Gstack

# Copy to .env and fill in values
# bun auto-loads .env — no dotenv needed

# Required for LLM-as-judge evals (bun run test:eval)
ANTHROPIC_API_KEY=sk-ant-your-key-here


self-hosted-runner:
  labels:
    - ubicloud-standard-2
    - ubicloud-standard-8


# Force LF on text files we parse with `\n`-anchored regexes (frontmatter,
# YAML, markdown structure tests). Without this, Windows checkouts with
# core.autocrlf=true convert these to CRLF and break tests that match
# /^---\n...\n---/ against SKILL.md.tmpl frontmatter, etc.
*.md         text eol=lf
*.tmpl       text eol=lf
*.yml        text eol=lf
*.yaml       text eol=lf
*.json       text eol=lf
*.toml       text eol=lf

# Bash scripts must always use LF — CRLF in bash scripts produces bizarre
# "Bad interpreter" / "command not found" errors on Linux runners.
*.sh         text eol=lf
*.bash       text eol=lf

# Extensionless executables (top-level setup script + bin/gstack-* helpers).
# These are bash scripts checked into git without a `.sh` suffix. Without
# explicit eol=lf, Windows checkout with core.autocrlf=true converts them
# to CRLF and breaks both `\n`-anchored regex tests (test/setup-codesign.test.ts)
# and shebang resolution if the script is ever executed on Linux.
setup        text eol=lf
bin/*        text eol=lf
**/scripts/* text eol=lf

# TypeScript/JavaScript: LF for portability across the bun toolchain.
*.ts         text eol=lf
*.tsx        text eol=lf
*.js         text eol=lf
*.mjs        text eol=lf
*.cjs        text eol=lf

# Binary files — never touch.
*.png        binary
*.jpg        binary
*.jpeg       binary
*.gif        binary
*.ico        binary
*.pdf        binary


name: Build CI Image
on:
  # Rebuild weekly (Monday 6am UTC) to pick up CLI updates
  schedule:
    - cron: '0 6 * * 1'
  # Rebuild on Dockerfile or lockfile changes
  push:
    branches: [main]
    paths:
      - '.github/docker/Dockerfile.ci'
      - 'package.json'
      - 'bun.lock'
  # Manual trigger
  workflow_dispatch:

jobs:
  build:
    runs-on: ubicloud-standard-8
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      # Copy lockfile + package.json into Docker build context
      - run: cp package.json bun.lock .github/docker/

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/build-push-action@v6
        with:
          context: .github/docker
          file: .github/docker/Dockerfile.ci
          push: true
          tags: |
            ghcr.io/${{ github.repository }}/ci:latest
            ghcr.io/${{ github.repository }}/ci:${{ github.sha }}


name: Periodic Evals
on:
  schedule:
    - cron: '0 6 * * 1'  # Monday 6 AM UTC
  workflow_dispatch:

concurrency:
  group: evals-periodic
  cancel-in-progress: true

env:
  IMAGE: ghcr.io/${{ github.repository }}/ci
  EVALS_TIER: periodic
  EVALS_ALL: 1  # Ignore diff — run all periodic tests

jobs:
  build-image:
    runs-on: ubicloud-standard-8
    permissions:
      contents: read
      packages: write
    outputs:
      image-tag: ${{ steps.meta.outputs.tag }}
    steps:
      - uses: actions/checkout@v4

      - id: meta
        run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'package.json', 'bun.lock') }}" >> "$GITHUB_OUTPUT"

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Check if image exists
        id: check
        run: |
          if docker manifest inspect ${{ steps.meta.outputs.tag }} > /dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - if: steps.check.outputs.exists == 'false'
        run: cp package.json bun.lock .github/docker/

      - if: steps.check.outp