name: Cross-platform vectors

# V3.5 §CI parity gate. Both runners load test-vectors/*.json and verify their
# native implementation produces byte-identical output to the recorded vectors.
# Any divergence — KDF labels, AAD encoding, wire format — fails CI immediately
# so cross-platform messaging breakage cannot land on main.

on:
  push:
    branches: [main]
    paths:
      - 'test-vectors/**'
      - 'packages/shade-core/tests/cross-platform-vectors.test.ts'
      - 'packages/shade-core/src/**'
      - 'packages/shade-crypto-web/src/**'
      - 'packages/shade-proto/src/**'
      - 'android/**'
      - 'scripts/generate-vectors.ts'
      - '.gitea/workflows/cross-vectors.yml'
  pull_request:
    branches: [main]
    paths:
      - 'test-vectors/**'
      - 'packages/shade-core/tests/cross-platform-vectors.test.ts'
      - 'packages/shade-core/src/**'
      - 'packages/shade-crypto-web/src/**'
      - 'packages/shade-proto/src/**'
      - 'android/**'
      - 'scripts/generate-vectors.ts'
      - '.gitea/workflows/cross-vectors.yml'

jobs:
  ts-vectors:
    name: TypeScript vectors (bun)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Bun
        run: curl -fsSL https://bun.sh/install | bash

      - name: Install dependencies
        run: ~/.bun/bin/bun install --frozen-lockfile

      - name: Run TS vector tests
        run: ~/.bun/bin/bun run test:vectors

      - name: Verify vectors are up-to-date
        # Regenerate vectors and fail if they would change. Forces vector
        # commits to come from `bun run vectors:gen`, never hand-edited.
        run: |
          ~/.bun/bin/bun run vectors:gen
          if ! git diff --quiet test-vectors/; then
            echo "::error::test-vectors/ is out of date. Run 'bun run vectors:gen' and commit."
            git diff test-vectors/
            exit 1
          fi

  kotlin-vectors:
    name: Kotlin vectors (gradle)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ hashFiles('android/**/*.gradle.kts', 'android/gradle/wrapper/gradle-wrapper.properties') }}
          restore-keys: gradle-

      - name: Run Kotlin vector tests
        working-directory: android
        run: ./gradlew :shade-android:test --no-daemon --info

      - name: Upload Gradle test report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: kotlin-test-report
          path: android/shade-android/build/reports/tests/test/
          if-no-files-found: ignore