ci.yml

name: CI

# Fast checks on every push and pull request. Deliberately does NOT download
# speech models (up to 2.5 GB) or run Electron — see selftest.js for what is
# covered without them.

on:
  push:
    branches: [main, master, dev]
  pull_request:
  workflow_dispatch:

# Read-only. Nothing here publishes anything, and this is the repo releases are
# cut from — release.yml is the only workflow that needs more than this.
permissions:
  contents: read

jobs:
  lint:
    name: Lint and type-check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: ESLint
        run: npm run lint

      # tsc --checkJs over the files that opt in with `// @ts-check`. The set
      # grows as modules are annotated; see jsconfig.json.
      - name: Type-check
        run: npm run typecheck

  test:
    name: Self test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Run self test
        run: npm run selftest

      - name: Verify the icon generator still produces a valid PNG
        run: |
          node scripts/make-icon.js
          node -e "const b=require('fs').readFileSync('build/icon.png'); if (b.slice(0,8).toString('hex') !== '89504e470d0a1a0a') { throw new Error('not a PNG'); } console.log('icon ok', b.readUInt32BE(16) + 'x' + b.readUInt32BE(20));"

  package:
    name: Packaging smoke test
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm

      - run: npm ci

      # The libvosk runtime is bundled into the build, so it must be fetched
      # before electron-builder runs. Models are NOT fetched — the app
      # downloads those itself on first run.
      - name: Fetch Vosk runtime
        run: npm run setup -- --runtime-only

      - name: Generate icon
        run: npm run icon

      # --dir produces an unpacked build: fast, and enough to catch a broken
      # electron-builder config without waiting on installer compression.
      - name: Build (unpacked)
        run: npm run pack

      - name: Check libvosk was bundled into resources
        shell: bash
        run: |
          set -e
          found=$(find dist -name "libvosk.dll" | head -1)
          if [ -z "$found" ]; then
            echo "::error::libvosk.dll is missing from the packaged output"
            exit 1
          fi
          echo "bundled: $found"

      # The Whisper, Moonshine and Parakeet engines all run on ONNX Runtime. Its
      # binding loads onnxruntime.dll as an ordinary shared-library dependency, so
      # both files have to be unpacked from the asar and sitting next to each
      # other — a miss here fails when a user picks one of those models, not at
      # build time.
      - name: Check ONNX Runtime was unpacked next to its binding
        shell: bash
        run: |
          set -e
          binding=$(find dist -name "onnxruntime_binding.node" | head -1)
          if [ -z "$binding" ]; then
            echo "::error::onnxruntime_binding.node is missing from the packaged output"
            exit 1
          fi
          if [ ! -f "$(dirname "$binding")/onnxruntime.dll" ]; then
            echo "::error::onnxruntime.dll is not beside the binding at $(dirname "$binding")"
            exit 1
          fi
          echo "bundled: $binding"

          # Only the platform being built should ship. Catching this keeps ~200 MB
          # of other platforms' libraries out of the installer.
          for other in darwin linux; do
            if find dist -path "*napi-v6/$other/*" -name "*onnxruntime*" | grep -q .; then
              echo "::error::$other ONNX Runtime binaries leaked into a Windows build"
              exit 1
            fi
          done
          if find dist -name "DirectML.dll" | grep -q .; then
            echo "::error::DirectML.dll was bundled; ChatterLayer only uses the CPU provider"
            exit 1
          fi
          echo "no foreign or GPU ONNX binaries bundled"