sdk.yml

# Acquires target-specific runtime artifacts, then fans build, test, codegen,
# and documentation checks out to the SDK language workflows.
name: "SDK build and test"

env:
  COPILOT_BAZEL_ANG_ENABLED: ${{ vars.COPILOT_BAZEL_ANG_ENABLED }}
  COPILOT_BAZEL_ANG_SCOPE: ${{ vars.COPILOT_BAZEL_ANG_SCOPE }}
  COPILOT_BAZEL_ANG_PR_SAMPLE_PERCENTAGE: ${{ vars.COPILOT_BAZEL_ANG_PR_SAMPLE_PERCENTAGE }}
  COPILOT_BAZEL_ANG_PR_SAMPLED_MODE: ${{ vars.COPILOT_BAZEL_ANG_PR_SAMPLED_MODE }}
  HUSKY: 0
  POWERSHELL_UPDATECHECK: Off

on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ (github.event_name == 'push' || github.event_name == 'pull_request') && github.ref != 'refs/heads/main' && github.run_attempt == 1 && github.ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  detect-sdk-changes:
    name: "Detect SDK-impacting changes"
    runs-on: ubuntu-slim
    outputs:
      has_sdk_changes: ${{ steps.full-coverage.outputs.has_sdk_changes || steps.classify.outputs.has_sdk_changes || steps.recover.outputs.has_sdk_changes }}
    steps:
      - name: Require full coverage outside pull requests
        id: full-coverage
        if: github.event_name != 'pull_request'
        run: echo "has_sdk_changes=true" >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@v7
        id: checkout
        if: github.event_name == 'pull_request'
        continue-on-error: true
        with:
          # Include the synthetic merge commit's base parent without fetching
          # repository history.
          fetch-depth: 2
          persist-credentials: false

      - name: Detect repository layout
        id: repository-layout
        if: steps.checkout.outcome == 'success'
        continue-on-error: true
        run: |
          trusted_revision="$(git rev-parse "$GITHUB_SHA^1")"
          echo "base-sha=$trusted_revision" >> "$GITHUB_OUTPUT"
          if git cat-file -e "${trusted_revision}:src/sdk/package.json" 2>/dev/null &&
             git cat-file -e "${trusted_revision}:script/sea-build.ts" 2>/dev/null; then
            echo "layout=runtime" >> "$GITHUB_OUTPUT"
          elif git cat-file -e "${trusted_revision}:package.json" 2>/dev/null &&
               git cat-file -e "${trusted_revision}:nodejs/package.json" 2>/dev/null; then
            echo "layout=standalone" >> "$GITHUB_OUTPUT"
          else
            echo "::warning::Unable to identify the SDK repository layout; requiring full coverage."
            exit 1
          fi

      - name: Find SDK-impacting paths
        id: filter
        if: steps.repository-layout.outcome == 'success'
        continue-on-error: true
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          base_sha: ${{ steps.repository-layout.outputs.base-sha }}
          sha: ${{ github.sha }}
          skip_initial_fetch: true
          fail_on_initial_diff_error: true
          quotepath: false
          files_yaml: |
            runtime:
              - .github/actions/**
              - .github/workflows/sdk*.yml
              - .github/workflows/sdk*.yaml
              - .github/workflows/shared-cli-build.yml
              - .github/workflows/publish.yml
              - .editorconfig
              - .gitattributes
              - .nvmrc
              - package.json
              - package-lock.json
              - pnpm-lock.yaml
              - sdk-protocol-version.json
              - assets/**
              - BUILD.bazel
              - src/**
              - generated/**
              - schema/**
              - files/**
              - third_party/**
              - patches/**
              - tools/bazel/**
              - .cargo/**
              - bazel/**
              - script/**
              - .bazelignore
              - .bazelrc
              - .bazelversion
              - Cargo.lock
              - Cargo.toml
              - MODULE.bazel
              - MODULE.bazel.lock
              - pnpm-workspace.yaml
              - rust-toolchain.toml
              - esbuild.ts
              - tsconfig*.json
            standalone:
              - .github/actions/**
              - .github/workflows/sdk*.yml
              - .github/workflows/sdk*.yaml
              - .github/workflows/shared-cli-build.yml
              - .github/workflows/publish.yml
              - .editorconfig
              - .gitattributes
              - .nvmrc
              - package.json
              - package-lock.json
              - pnpm-lock.yaml
              - sdk-protocol-version.json
              - assets/**
              - BUILD.bazel
              - nodejs/**
              - python/**
              - go/**
              - dotnet/**
              - java/**
              - rust/**
              - scripts/**
              - samples/**
              - test/**
              - docs/**
              - README.md
              - vitest.config.ts

      - name: Select layout-specific result
        id: classify
        if: steps.filter.outcome == 'success'
        env:
          LAYOUT: ${{ steps.repository-layout.outputs.layout }}
          RUNTIME_CHANGED: ${{ steps.filter.outputs.runtime_any_modified }}
          STANDALONE_CHANGED: ${{ steps.filter.outputs.standalone_any_modified }}
        run: |
          if [[ "$LAYOUT" == "runtime" ]]; then
            has_sdk_changes="$RUNTIME_CHANGED"
          elif [[ "$LAYOUT" == "standalone" ]]; then
            has_sdk_changes="$STANDALONE_CHANGED"
          else
            exit 1
          fi
          echo "has_sdk_changes=$has_sdk_changes" >> "$GITHUB_OUTPUT"

      - name: Require full coverage after detection errors
        id: recover
        if: github.event_name == 'pull_request' && (steps.checkout.outcome != 'success' || steps.repository-layout.outcome != 'success' || steps.filter.outcome != 'success' || steps.classify.outcome != 'success')
        run: |
          echo "::warning::SDK change detection failed; requiring full coverage."
          echo "has_sdk_changes=true" >> "$GITHUB_OUTPUT"

  detect-layout:
    name: "Detect SDK layout"
    needs: detect-sdk-changes
    if: ${{ !cancelled() && (needs.detect-sdk-changes.result != 'success' || needs.detect-sdk-changes.outputs.has_sdk_changes == 'true') }}
    runs-on: ubuntu-26.04-2core-agent-runtime
    outputs:
      runtime-source: ${{ steps.detect.outputs.runtime-source }}
      sdk-home: ${{ steps.detect.outputs.sdk-home }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
          sparse-checkout: |
            /src/sdk/package.json
            /script/sea-build.ts
            /package.json
            /nodejs/package.json
          sparse-checkout-cone-mode: false
      - id: detect
        run: |
          if [[ -f src/sdk/package.json && -f script/sea-build.ts ]]; then
            echo "runtime-source=checkout" >> "$GITHUB_OUTPUT"
            echo "sdk-home=src/sdk" >> "$GITHUB_OUTPUT"
          elif [[ -f package.json && -f nodejs/package.json ]]; then
            echo "runtime-source=published" >> "$GITHUB_OUTPUT"
            echo "sdk-home=." >> "$GITHUB_OUTPUT"
          else
            echo "::error::Unable to identify the SDK repository layout."
            exit 1
          fi

  # TEMPORARY MERGE QUEUE REDUCTION: pull requests and main pushes retain the
  # full SDK matrix. Merge groups rerun only Linux x64 Node.js out-of-process
  # CAPI coverage. Remove the merge_group gates here and in sdk-platform.yml
  # and sdk-nodejs.yml to restore the full matrix.
  build-runtime-windows-x64-addons:
    name: "Build runtime addons (win32-x64)"
    needs: detect-layout
    if: github.event_name != 'merge_group' && needs.detect-layout.outputs.runtime-source == 'checkout'
    runs-on: ubuntu-latest-xl
    concurrency:
      group: windows-x64-addons-release-windows-e2e-no-icf-${{ github.sha }}
      queue: max
    permissions:
      contents: read
      id-token: write
      packages: read
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      # Resolve identity before cache restoration and Bazel configuration. The
      # composite setup below remains cache-miss-only because it also installs dependencies.
      - uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc

      - name: Capture verified addon source identity
        run: node --experimental-strip-types script/resolve-cli-build-identity.ts --github-env

      - name: Restore completed Windows x64 addons
        id: cache
        uses: actions/cache/restore@v6
        with:
          path: |
            windows-x64-addons-receipt.txt
            src/native/runtime/runtime.win32-x64-msvc.node
            src/native/runtime/runtime.win32-x64-msvc.node.metadata
            src/native/runtime/copilot-runtime.win32-x64-msvc.exe
            src/native/runtime/index.d.ts
            src/native/cli/cli-native.win32-x64-msvc.node
            src/native/cli/index.d.ts
          # v2 evicts addons created before producer build identity was required.
          key: windows-x64-addons-v2-release-windows-e2e-no-icf-${{ github.sha }}

      - uses: ./.github/actions/setup-node
        if: steps.cache.outputs.cache-hit != 'true'
        timeout-minutes: 60
      - uses: ./.github/actions/setup-bazel
        if: steps.cache.outputs.cache-hit != 'true'
        with:
          datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
          datadog-site: ${{ vars.DATADOG_SITE || vars.DD_SITE }}

      - name: Set up private source authentication
        if: steps.cache.outputs.cache-hit != 'true' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
        uses: ./.github/actions/setup-private-source-auth
        with:
          client-id: ${{ vars.RUNTIME_ACCESSOR_APP_CLIENT_ID }}
          private-key: ${{ secrets.RUNTIME_ACCESSOR_APP_PRIVATE_KEY }}

      - name: Cache xwin downloads
        if: steps.cache.outputs.cache-hit != 'true'
        uses: actions/cache@v6
        continue-on-error: true
        with:
          path: ${{ runner.temp }}/bazel-xwin-cache/dl
          key: bazel-xwin-v2-vs17.14.37628.2-sdk10.0.26100-crt14.44.17.14-x86_64

      - name: Point the Bazel repository rule at the xwin cache
        if: steps.cache.outputs.cache-hit != 'true'
        env:
          XWIN_CACHE_DIR: ${{ runner.temp }}/bazel-xwin-cache
        run: echo "common --repo_env=COPILOT_BAZEL_XWIN_CACHE_DIR=${XWIN_CACHE_DIR}" >> local.bazelrc

      - name: Cross-build Windows x64 addons
        if: steps.cache.outputs.cache-hit != 'true'
        env:
          # The CI-owned Bazel override is intentionally trusted; without this
          # identity the producer stamps an empty source while consumers verify the SHA.
          COPILOT_NAPI_ADDONS_BUILD_IDENTITY: ${{ github.sha }}
          CLI_GIT_COMMIT: ${{ github.sha }}
          CLI_PACKAGE_NAME: "@github/copilot"
          CLI_TARGET: win32-x64
          COPILOT_RUNTIME_E2E_TEST_HOOKS: "1"
        run: |
          export CLI_VERSION="0.0.1-${GITHUB_SHA::7}"
          node --experimental-strip-types script/build-addons-bazel.ts \
            --profile release \
            --platform win32 \
            --arch x64 \
            --bazel-config=windows-e2e-no-icf

      - name: Verify Windows x64 addons
        env:
          CLI_PACKAGE_NAME: "@github/copilot"
        run: |
          export CLI_VERSION="0.0.1-${GITHUB_SHA::7}"
          node --experimental-strip-types script/assert-runtime-build-metadata.ts \
            src/native/runtime win32-x64-msvc
          test -s src/native/runtime/runtime.win32-x64-msvc.node.metadata
          for artifact in \
            src/native/runtime/runtime.win32-x64-msvc.node \
            src/native/runtime/copilot-runtime.win32-x64-msvc.exe \
            src/native/cli/cli-native.win32-x64-msvc.node; do
            test -s "$artifact"
            file "$artifact" | grep -q "PE32+"
          done

      - name: Record completed Windows x64 addons
        if: steps.cache.outputs.cache-hit != 'true'
        run: printf 'profile=release\nbazel-config=windows-e2e-no-icf\nsha=%s\n' "$GITHUB_SHA" > windows-x64-addons-receipt.txt

      - name: Save completed Windows x64 addons
        if: steps.cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v6
        with:
          path: |
            windows-x64-addons-receipt.txt
            src/native/runtime/runtime.win32-x64-msvc.node
            src/native/runtime/runtime.win32-x64-msvc.node.metadata
            src/native/runtime/copilot-runtime.win32-x64-msvc.exe
            src/native/runtime/index.d.ts
            src/native/cli/cli-native.win32-x64-msvc.node
            src/native/cli/index.d.ts
          key: ${{ steps.cache.outputs.cache-primary-key }}

      - uses: actions/upload-artifact@v7
        with:
          name: sdk-bazel-cross-addons-win32-x64-release
          path: |
            src/native/runtime/runtime.win32-x64-msvc.node
            src/native/runtime/runtime.win32-x64-msvc.node.metadata
            src/native/runtime/copilot-runtime.win32-x64-msvc.exe
            src/native/runtime/index.d.ts
            src/native/cli/cli-native.win32-x64-msvc.node
            src/native/cli/index.d.ts
          if-no-files-found: error
          retention-days: 1

  build-runtime-linux-x64:
    name: "Build runtime (linux-x64)"
    needs: detect-layout
    permissions:
      actions: read
      contents: read
      id-token: write
      packages: read
    uses: ./.github/workflows/sdk-runtime-artifact.yml
    with:
      runtime-source: ${{ needs.detect-layout.outputs.runtime-source }}
      sdk-home: ${{ needs.detect-layout.outputs.sdk-home }}
      os: ubuntu-26.04-16core-agent-runtime
      target: linux-x64
      artifact: Linux-X64-gnu
      bazel-config: e2e-no-lto
      shared-cli-build-compatible: true
    secrets: inherit

  build-runtime-linuxmusl-x64:
    name: "Build runtime (linuxmusl-x64)"
    needs: detect-layout
    if: github.event_name != 'merge_group'
    permissions:
      actions: read
      contents: read
      id-token: write
      packages: read
    uses: ./.github/workflows/sdk-runtime-artifact.yml
    with:
      runtime-source: ${{ needs.detect-layout.outputs.runtime-source }}
      sdk-home: ${{ needs.detect-layout.outputs.sdk-home }}
      os: ubuntu-26.04-16core-agent-runtime
      target: linuxmusl-x64
      artifact: Linux-X64-musl
      bazel-config: e2e-no-lto
    secrets: inherit

  build-runtime-linuxmusl-arm64:
    name: "Build runtime (linuxmusl-arm64)"
    needs: detect-layout
    if: github.event_name != 'merge_group'
    permissions:
      actions: read
      contents: read
      id-token: write
      packages: read
    uses: ./.github/workflows/sdk-runtime-artifact.yml
    with:
      runtime-source: ${{ needs.detect-layout.outputs.runtime-source }}
      sdk-home: ${{ needs.detect-layout.outputs.sdk-home }}
      os: ubuntu-26.04-16core-agent-runtime
      target: linuxmusl-arm64
      artifact: Linux-ARM64-musl
      bazel-config: e2e-no-lto
    secrets: inherit

  build-runtime-darwin-arm64:
    name: "Build runtime (darwin-arm64)"
    needs: detect-layout
    if: github.event_name != 'merge_group'
    permissions:
      actions: read
      contents: read
      id-token: write
      packages: read
    uses: ./.github/workflows/sdk-runtime-artifact.yml
    with:
      runtime-source: ${{ needs.detect-layout.outputs.runtime-source }}
      sdk-home: ${{ needs.detect-layout.outputs.sdk-home }}
      os: macos-26-xlarge-agent-runtime
      target: darwin-arm64
      artifact: macOS-ARM64
      bazel-config: e2e-no-lto
      use-bazel-addons-on-darwin: true
      shared-cli-build-compatible: true
    secrets: inherit

  build-runtime-win32-x64:
    name: "Build runtime (win32-x64)"
    needs: [detect-layout, build-runtime-windows-x64-addons]
    if: always() && github.event_name != 'merge_group' && needs.detect-layout.result == 'success' && (needs.detect-layout.outputs.runtime-source == 'published' || needs.build-runtime-windows-x64-addons.result == 'success')
    permissions:
      actions: read
      contents: read
      id-token: write
      packages: read
    uses: ./.github/workflows/sdk-runtime-artifact.yml
    with:
      runtime-source: ${{ needs.detect-layout.outputs.runtime-source }}
      sdk-home: ${{ needs.detect-layout.outputs.sdk-home }}
      os: windows-2025-16core-agent-runtime
      target: win32-x64
      artifact: Windows-X64
      bazel-config: windows-e2e-no-icf
      shared-cli-build-compatible: true
      prebuilt-addons-artifact: ${{ needs.detect-layout.outputs.runtime-source == 'checkout' && 'sdk-bazel-cross-addons-win32-x64-release' || '' }}
    secrets: inherit

  sdk-linux-x64:
    name: "Linux x64"
    needs: [detect-layout, build-runtime-linux-x64]
    uses: ./.github/workflows/sdk-platform.yml
    with:
      platform: linux-x64
      sdk-home: ${{ needs.detect-layout.outputs.sdk-home }}
    secrets: inherit

  sdk-linuxmusl-x64:
    name: "Linux musl x64"
    needs: [detect-layout, build-runtime-linuxmusl-x64]
    if: github.event_name != 'merge_group'
    uses: ./.github/workflows/sdk-platform.yml
    with:
      platform: linuxmusl-x64
      sdk-home: ${{ needs.detect-layout.outputs.sdk-home }}
    secrets: inherit

  sdk-linuxmusl-arm64:
    name: "Linux musl ARM64 (Java)"
    needs: [detect-layout, build-runtime-linuxmusl-arm64]
    if: github.event_name != 'merge_group'
    uses: ./.github/workflows/sdk-java.yml
    with:
      platform: linuxmusl-arm64
      sdk-home: ${{ needs.detect-layout.outputs.sdk-home }}
    secrets: inherit

  sdk-darwin-arm64:
    name: "macOS ARM64"
    needs: [detect-layout, build-runtime-darwin-arm64]
    if: github.event_name != 'merge_group'
    uses: ./.github/workflows/sdk-platform.yml
    with:
      platform: darwin-arm64
      sdk-home: ${{ needs.detect-layout.outputs.sdk-home }}
    secrets: inherit

  sdk-win32-x64:
    name: "Windows x64"
    needs: [detect-layout, build-runtime-win32-x64]
    # Published mode skips the checkout-only addon ancestor.
    if: ${{ !cancelled() && github.event_name != 'merge_group' && needs.detect-layout.result == 'success' && needs.build-runtime-win32-x64.result == 'success' }}
    uses: ./.github/workflows/sdk-platform.yml
    with:
      platform: win32-x64
      sdk-home: ${{ needs.detect-layout.outputs.sdk-home }}
    secrets: inherit

  # Only Linux CAPI gates this rollup; the full SDK aggregate still reports all coverage.
  sdk-typescript:
    name: sdk-typescript
    if: always()
    needs: [detect-sdk-changes, sdk-linux-x64]
    runs-on: ubuntu-slim
    steps:
      - name: Check Linux CAPI Node.js SDK result
        env:
          DETECT_RESULT: ${{ needs.detect-sdk-changes.result }}
          EVENT_NAME: ${{ github.event_name }}
          HAS_SDK_CHANGES: ${{ needs.detect-sdk-changes.outputs.has_sdk_changes }}
          RESULTS: ${{ toJSON(needs) }}
        run: |
          linux_result=$(jq -r '.["sdk-linux-x64"].result' <<< "$RESULTS")
          if [[ "$EVENT_NAME" == "pull_request" && "$DETECT_RESULT" == "success" && "$HAS_SDK_CHANGES" == "false" ]]; then
            if [[ "$linux_result" != "skipped" ]]; then
              echo "::error::Non-SDK pull request did not skip sdk-linux-x64: $linux_result"
              exit 1
            fi
            echo "No SDK-impacting changes; Linux CAPI Node.js SDK job skipped"
            exit 0
          fi

          result=$(jq -r '.["sdk-linux-x64"].outputs["nodejs-capi-result"]' <<< "$RESULTS")
          if [[ "$result" != "success" ]]; then
            echo "::error::Linux CAPI Node.js SDK job: expected success, got $result"
            exit 1
          fi

  check-freshness:
    name: "Check schema and SDK freshness"
    needs: detect-layout
    runs-on: ubuntu-26.04-2core-agent-runtime
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
          fetch-depth: ${{ github.event_name == 'pull_request' && 2 || 1 }}
      - name: Fetch generation comparison baseline
        if: needs.detect-layout.outputs.runtime-source == 'checkout' && (github.event_name == 'merge_group' || github.event_name == 'push')
        env:
          BASELINE_SHA: ${{ github.event.merge_group.base_sha || github.event.before }}
          CHECKOUT_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          if [[ "$GITHUB_EVENT_NAME" == "push" && "$BASELINE_SHA" =~ ^0+$ ]]; then
            echo "New branch push has no generation baseline; checking all projections."
            exit 0
          fi
          if [[ ! "$BASELINE_SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
            echo "::error::Missing or invalid SDK generation baseline SHA."
            exit 1
          fi
          if git cat-file -e "$BASELINE_SHA^{commit}" 2>/dev/null; then
            exit 0
          fi
          auth_header="$(printf 'x-access-token:%s' "$CHECKOUT_TOKEN" | base64 | tr -d '\n')"
          GIT_CONFIG_COUNT=1 \
          GIT_CONFIG_KEY_0=http.https://github.com/.extraheader \
          GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $auth_header" \
            git fetch --no-tags --depth=1 origin "$BASELINE_SHA"
      - if: needs.detect-layout.outputs.runtime-source == 'checkout'
        uses: ./.github/actions/setup-node
        with:
          install-deps: "false"
      - if: needs.detect-layout.outputs.runtime-source == 'checkout'
        uses: ./.github/actions/setup-bazel
        with:
          datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
          datadog-site: ${{ vars.DATADOG_SITE || vars.DD_SITE }}
      - uses: actions/setup-go@v6
        with:
          go-version: "1.24"
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.94.0"
          components: rustfmt
      - if: needs.detect-layout.outputs.runtime-source == 'published'
        uses: actions/setup-node@v6
        with:
          node-version: 22
      - run: npm ci
        working-directory: ${{ needs.detect-layout.outputs.sdk-home }}/nodejs
      - run: npm ci
        working-directory: ${{ needs.detect-layout.outputs.sdk-home }}/scripts/codegen
      - if: needs.detect-layout.outputs.runtime-source == 'published'
        run: npm ci
        working-directory: ${{ needs.detect-layout.outputs.sdk-home }}/java/scripts/codegen
      - env:
          SDK_HOME: ${{ needs.detect-layout.outputs.sdk-home }}
        run: node --test "$SDK_HOME"/scripts/ci/*.test.mjs
      - env:
          SDK_HOME: ${{ needs.detect-layout.outputs.sdk-home }}
        run: npm --prefix "$SDK_HOME/nodejs" exec -- tsx --test "$SDK_HOME/scripts/ci/prepare-published-runtime.test.ts"
      - if: needs.detect-layout.outputs.runtime-source == 'checkout'
        env:
          SDK_HOME: ${{ needs.detect-layout.outputs.sdk-home }}
        run: node "$SDK_HOME/scripts/ci/check-generated.mjs"
      - if: needs.detect-layout.outputs.runtime-source == 'published'
        run: npm run generate
        working-directory: ${{ needs.detect-layout.outputs.sdk-home }}/scripts/codegen
      - if: needs.detect-layout.outputs.runtime-source == 'published'
        run: npm run generate
        working-directory: ${{ needs.detect-layout.outputs.sdk-home }}/java/scripts/codegen
      - if: needs.detect-layout.outputs.runtime-source == 'published'
        env:
          SDK_HOME: ${{ needs.detect-layout.outputs.sdk-home }}
        run: npm --prefix "$SDK_HOME/nodejs" run update:protocol-version
      - if: needs.detect-layout.outputs.runtime-source == 'published'
        env:
          SDK_HOME: ${{ needs.detect-layout.outputs.sdk-home }}
        run: |
          paths=("$SDK_HOME/nodejs/src/generated" "$SDK_HOME/dotnet/src/Generated" "$SDK_HOME/python/copilot/generated" "$SDK_HOME/go" "$SDK_HOME/java/sdk/src/generated" "$SDK_HOME/rust/src/generated")
          paths+=("$SDK_HOME/nodejs/src/sdkProtocolVersion.ts" "$SDK_HOME/python/copilot/_sdk_protocol_version.py" "$SDK_HOME/dotnet/src/SdkProtocolVersion.cs" "$SDK_HOME/rust/src/sdk_protocol_version.rs" "$SDK_HOME/java/sdk/src/main/java/com/github/copilot/SdkProtocolVersion.java")
          changes=$(git status --porcelain -- "${paths[@]}")
          if [[ -n "$changes" ]]; then
            echo "::error::Generated SDK clients are out of date. From the SDK repository root, run: npm run generate"
            echo "Commit all resulting generated changes, including added/deleted files, then push the updated branch. Do not hand-edit generated files."
            echo "$changes"
            git diff --stat -- "${paths[@]}"
            git diff -- "${paths[@]}"
            exit 1
          fi

  sdk:
    name: "SDK"
    if: always()
    needs:
      - detect-sdk-changes
      - build-runtime-windows-x64-addons
      - build-runtime-linux-x64
      - build-runtime-linuxmusl-x64
      - build-runtime-linuxmusl-arm64
      - build-runtime-darwin-arm64
      - build-runtime-win32-x64
      - detect-layout
      - sdk-linux-x64
      - sdk-linuxmusl-x64
      - sdk-linuxmusl-arm64
      - sdk-darwin-arm64
      - sdk-win32-x64
      - check-freshness
    runs-on: ubuntu-slim
    steps:
      - name: Check SDK results
        env:
          DETECT_RESULT: ${{ needs.detect-sdk-changes.result }}
          EVENT_NAME: ${{ github.event_name }}
          HAS_SDK_CHANGES: ${{ needs.detect-sdk-changes.outputs.has_sdk_changes }}
          RESULTS: ${{ toJSON(needs) }}
          RUNTIME_SOURCE: ${{ needs.detect-layout.outputs.runtime-source }}
        run: |
          if [[ "$EVENT_NAME" == "pull_request" && "$DETECT_RESULT" == "success" && "$HAS_SDK_CHANGES" == "false" ]]; then
            unexpected=$(jq -r '
              to_entries[]
              | select(.key != "detect-sdk-changes" and .value.result != "skipped")
              | "\(.key): \(.value.result)"
            ' <<< "$RESULTS")
            if [[ -n "$unexpected" ]]; then
              echo "::error::Non-SDK pull request did not skip all SDK jobs:"
              echo "$unexpected"
              exit 1
            fi
            echo "No SDK-impacting changes; SDK build and test matrix skipped"
            exit 0
          fi

          # TEMPORARY MERGE QUEUE REDUCTION: keep this branch aligned with the
          # gated jobs above until the full merge-group matrix is restored.
          if [[ "$EVENT_NAME" == "merge_group" ]]; then
            required_jobs=(
              detect-layout
              build-runtime-linux-x64
              sdk-linux-x64
              check-freshness
            )
            skipped_jobs=(
              build-runtime-windows-x64-addons
              build-runtime-linuxmusl-x64
              build-runtime-linuxmusl-arm64
              build-runtime-darwin-arm64
              build-runtime-win32-x64
              sdk-linuxmusl-x64
              sdk-linuxmusl-arm64
              sdk-darwin-arm64
              sdk-win32-x64
            )
            for job in "${required_jobs[@]}"; do
              if [[ "$(jq -r --arg job "$job" '.[$job].result' <<< "$RESULTS")" != "success" ]]; then
                echo "::error::Required merge-group SDK job did not succeed: $job"
                echo "$RESULTS"
                exit 1
              fi
            done
            for job in "${skipped_jobs[@]}"; do
              if [[ "$(jq -r --arg job "$job" '.[$job].result' <<< "$RESULTS")" != "skipped" ]]; then
                echo "::error::Merge-group-only SDK reduction did not skip: $job"
                echo "$RESULTS"
                exit 1
              fi
            done
            echo "Linux x64 Node.js SDK compatibility and generated clients passed"
            exit 0
          fi

          if [[ "$RUNTIME_SOURCE" == "published" ]]; then
            addon_result=$(jq -r '."build-runtime-windows-x64-addons".result' <<< "$RESULTS")
            if [[ "$addon_result" != "skipped" ]]; then
              echo "::error::Published-layout Windows addon producer was not skipped: $addon_result"
              exit 1
            fi
          fi

          failures=$(jq -r --arg runtime_source "$RUNTIME_SOURCE" '
            to_entries[]
            | select(.value.result != "success")
            | select(.key != "detect-sdk-changes")
            | select(
                $runtime_source != "published"
                or .key != "build-runtime-windows-x64-addons"
                or .value.result != "skipped"
              )
            | "\(.key): \(.value.result)"
          ' <<< "$RESULTS")
          if [[ -n "$failures" ]]; then
            echo "::error::SDK jobs did not all succeed:"
            echo "$failures"
            exit 1
          fi