tests.yml

# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
# Consolidated workflow (behaviour-preserving merge).
# Merged from: bench.yml, e2e.yml, integration.yml, stress-test.yml
name: Tests (E2E / Integration / Stress / Bench)

on:
  push:
    branches:
    - main
  pull_request: null
  workflow_dispatch: null
  schedule:
  # Daily 03:00 UTC — covers Mondays too. The Monday-only `0 3 * * 1`
  # cron from the pre-consolidation tests was a subset of the daily one
  # and was dropped to stop running this workflow twice on Mondays.
  - cron: 0 3 * * *

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: read-all

jobs:
  e2e-elixir:
    name: E2E — Elixir Scanner Pipeline
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1

      - name: Setup Erlang/Elixir
        uses: erlef/setup-beam@v1.24.1
        with:
          otp-version: '27.0'
          elixir-version: '1.17'

      - name: Restore Mix cache
        uses: actions/cache@v6.1.0
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-mix-${{ hashFiles('mix.lock') }}

      - name: Install dependencies
        run: mix deps.get

      - name: Run E2E test suite
        run: bash tests/e2e.sh

      - name: Escript packaging soundness
        # PR #278 documented that the rule definitions can be correct
        # but the *packaged escript* can silently drop entire rule
        # families. The in-process `mix test` catches rule-definition
        # regressions; this step catches packaging regressions by
        # building the escript fresh and running it against every
        # known-bad sample in test/soundness/manifest.json.
        run: bash test/soundness/run-escript-soundness.sh

  e2e-rust:
    name: E2E — Rust CLI Scan
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2.9.1

      - name: Build Rust CLI
        run: cargo build --release

      - name: E2E — Scan fixture repo
        run: |
          mkdir -p /tmp/test-repo/.github/workflows /tmp/test-repo/src
          echo 'name: CI' > /tmp/test-repo/.github/workflows/ci.yml
          echo 'on: push' >> /tmp/test-repo/.github/workflows/ci.yml
          echo 'jobs:' >> /tmp/test-repo/.github/workflows/ci.yml
          echo '  build:' >> /tmp/test-repo/.github/workflows/ci.yml
          echo '    runs-on: ubuntu-latest' >> /tmp/test-repo/.github/workflows/ci.yml
          echo '    steps:' >> /tmp/test-repo/.github/workflows/ci.yml
          echo '      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2' >> /tmp/test-repo/.github/workflows/ci.yml
          ./target/release/hyper scan /tmp/test-repo 2>&1 || true
          echo "PASS: Rust CLI scan completed"

  aspect-tests:
    name: Aspect — Rule Module Coverage
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1

      - name: Verify all documented rules have modules
        run: |
          PASS=0
          FAIL=0
          for rule in root_hygiene honest_completion workflow_audit cicd_rules code_safety migration_rules scorecard green_web git_state structural_drift; do
            if find lib/ -name "*${rule}*" 2>/dev/null | grep -q .; then
              echo "PASS: $rule"
              PASS=$((PASS + 1))
            else
              echo "FAIL: $rule (no module found)"
              FAIL=$((FAIL + 1))
            fi
          done
          echo "Results: $PASS pass, $FAIL fail"
          exit "$FAIL"

      - name: Verify no dangerous patterns
        run: |
          # Looks for proof-language escape hatches (Idris2 believe_me /
          # assert_total, Coq Admitted, Lean/Idris sorry, Haskell
          # unsafeCoerce) in the corresponding source files. Skip Elixir
          # and Rust (and especially lib/rules/, where these tokens
          # legitimately appear as detection patterns / catalogue
          # strings, not as actual escape hatches).
          # `grep -v '^\s*--'` strips Idris2 / Haskell line comments, which
          # legitimately mention these tokens as documentation
          # ("Zero believe_me." in src/abi/RuleEngine.idr is the canonical
          # example).
          DANGEROUS=$(find lib src \( -name '*.idr' -o -name '*.v' -o -name '*.lean' -o -name '*.hs' \) \
            -not -path 'lib/rules/*' \
            -exec grep -Hn 'believe_me\|assert_total\|\bsorry\b\|\bAdmitted\b\|unsafeCoerce' {} + 2>/dev/null \
            | grep -v ':[[:space:]]*--' || true)
          if [ -n "$DANGEROUS" ]; then
            echo "FAIL: Dangerous patterns found"
            echo "$DANGEROUS"
            exit 1
          fi
          echo "PASS: No dangerous patterns"

  build-images:
    name: Build Test Images
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4.2.0

      - name: Build hypatia image
        uses: docker/build-push-action@v7.3.0
        with:
          context: .
          file: deploy/Containerfile
          push: false
          load: true
          tags: hypatia:test
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Save images
        run: |
          docker save hypatia:test | gzip > images.tar.gz

      - name: Upload images
        uses: actions/upload-artifact@v7.0.1
        with:
          name: docker-images
          path: images.tar.gz
          retention-days: 1

  # ============================================================================
  # Integration Test Suite
  # ============================================================================

  integration-tests:
    name: Integration Tests
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: [build-images]
    services:
      arangodb:
        image: arangodb:3.11
        env:
          ARANGO_ROOT_PASSWORD: testpassword
          ARANGO_NO_AUTH: "0"
        ports:
          - 8529:8529
        # THREE separate faults made this probe unable to ever succeed. All
        # three were measured against the real arangodb:3.11 image, not inferred:
        #
        #   1. `curl` is NOT installed in the image      -> use wget (present)
        #   2. `localhost` resolves to ::1 there, but    -> use 127.0.0.1
        #      ArangoDB binds IPv4 only
        #   3. `/_api/version` requires authentication   -> use
        #      whenever ARANGO_ROOT_PASSWORD is set,        /_admin/server/availability
        #      so it returns 401 forever; and busybox
        #      wget has no --user/--password option at
        #      all, so the probe CANNOT be authenticated
        #
        # Measured, polling once a second for 25s from container start:
        #   /_api/version               -> exit 1 at EVERY timepoint (401)
        #   /_admin/server/availability -> exit 1 for 3s, then exit 0 onwards
        #
        # Fault 3 is why this looked intermittent. A probe that never passes
        # leaves the service permanently `starting`; whether the job survived
        # depended on a race in the runner's own poll (if it read
        # .State.Health.Status before Docker had recorded any health state it
        # saw an empty string and reported "healthy" — which is why one job
        # once logged "arangodb service is healthy" BEFORE the container had
        # even logged "Initializing root user"). Do not read that log line as
        # evidence the probe works.
        #
        # NB: keep comments OUTSIDE the `options: >-` folded scalar — inside it
        # `#` is literal text, gets folded into the docker args, and breaks
        # `docker create` with "invalid reference format".
        options: >-
          --health-cmd "wget -q --spider http://127.0.0.1:8529/_admin/server/availability || exit 1"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 10
          --health-start-period 40s

      dragonfly:
        image: docker.dragonflydb.io/dragonflydb/dragonfly:latest
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1

      - name: Download images
        uses: actions/download-artifact@v8.0.1
        with:
          name: docker-images

      - name: Load images
        run: |
          gunzip -c images.tar.gz | docker load

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2.9.1
        with:
          workspaces: ". -> target"
          cache-on-failure: true

      - name: Wait for ArangoDB
        run: |
          echo "Waiting for ArangoDB to be ready..."
          for i in {1..30}; do
            if curl -s http://localhost:8529/_api/version > /dev/null; then
              echo "ArangoDB is ready"
              break
            fi
            echo "Waiting... ($i/30)"
            sleep 2
          done

      - name: Initialize ArangoDB
        run: |
          # Create database and collections
          curl -X POST \
            -u "root:testpassword" \
            -H "Content-Type: application/json" \
            -d '{"name": "hypatia"}' \
            http://localhost:8529/_api/database

          # Create collections
          for collection in rules workflows runs adapters learning_data; do
            curl -X POST \
              -u "root:testpassword" \
              -H "Content-Type: application/json" \
              -d "{\"name\": \"$collection\"}" \
              http://localhost:8529/_db/hypatia/_api/collection
          done

      - name: Wait for Dragonfly
        run: |
          echo "Waiting for Dragonfly to be ready..."
          for i in {1..30}; do
            if redis-cli -h localhost -p 6379 ping > /dev/null 2>&1; then
              echo "Dragonfly is ready"
              break
            fi
            echo "Waiting... ($i/30)"
            sleep 2
          done

      - name: Run Rust integration tests
        run: |
          cargo test --workspace --features integration-tests -- --test-threads=1
        env:
          ARANGODB_URL: http://localhost:8529
          ARANGODB_DATABASE: hypatia
          ARANGODB_USER: root
          ARANGODB_PASSWORD: testpassword
          DRAGONFLY_URL: redis://localhost:6379
          TEST_GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
          RUST_LOG: debug

      # This job installs the RUST toolchain and then ran `mix test` — with no
      # BEAM anywhere on the runner. `mix` was simply not on PATH, so the step
      # died with exit 127 (command not found) and took `Integration Tests` red
      # with it. Same pins as the E2E job, so the two agree on the toolchain.
      - name: Setup Erlang/Elixir
        uses: erlef/setup-beam@v1.24.1
        with:
          otp-version: '27.0'
          elixir-version: '1.17'

      - name: Install Elixir dependencies
        run: mix deps.get

      - name: Run Elixir integration tests
        run: mix test --include integration
        env:
          ARANGODB_URL: http://localhost:8529
          ARANGODB_DATABASE: hypatia
          ARANGODB_USER: root
          ARANGODB_PASSWORD: testpassword
          DRAGONFLY_URL: redis://localhost:6379
          TEST_GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}

      - name: Run CLI integration tests
        working-directory: cli
        run: |
          cargo test --features integration-tests -- --test-threads=1
        env:
          ARANGODB_URL: http://localhost:8529
          ARANGODB_DATABASE: cicd_hyper_a
          ARANGODB_USER: root
          ARANGODB_PASSWORD: testpassword
          DRAGONFLY_URL: redis://localhost:6379

  # ============================================================================
  # REMOVED — "Haskell Integration Tests" (haskell-integration)
  #
  # The job ran `cabal build all` / `cabal test all` with
  # `defaults.run.working-directory: registry`, and cached on
  # `hashFiles('registry/hypatia.cabal')`.
  #
  # `registry/` does not exist. It was deliberately deleted in f2fe2df
  # (2026-03-06), whose own commit message reads:
  #     "Remove registry/ (30 files - Haskell, superseded by Elixir)"
  # The CI job was left behind and has failed EVERY run since: 11 failures
  # and 1 cancellation across the last 12 runs, never once green. The repo
  # now contains 0 .cabal files, no cabal.project, no stack.yaml, and a
  # single .hs file — test/soundness/fixtures/code_safety/unsafe_coerce.hs,
  # which is a scanner test fixture, not a Haskell project.
  #
  # Each run installed GHC 9.6 + cabal 3.10 and stood up an ArangoDB service
  # container before failing at the first `run:` step with
  #     No such file or directory ... /home/runner/work/hypatia/hypatia/registry
  # so removing it also stops burning those runner minutes.
  #
  # If Haskell returns to this repo, reinstate the job together with the
  # project, not before.
  # ============================================================================

  # ============================================================================
  # End-to-End Tests
  # ============================================================================

  e2e-tests:
    name: End-to-End Tests
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: [integration-tests]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1

      - name: Download images
        uses: actions/download-artifact@v8.0.1
        with:
          name: docker-images

      - name: Load images
        run: gunzip -c images.tar.gz | docker load

      - name: Start full stack
        working-directory: deploy
        run: |
          docker compose up -d arangodb dragonfly

          # Wait for databases
          sleep 30

          # Initialize database
          docker compose exec -T arangodb arangosh --server.password="$ARANGO_ROOT_PASSWORD" <<-EOF
            db._createDatabase('hypatia');
            db._useDatabase('hypatia');
            db._create('rules');
            db._create('workflows');
            db._create('runs');
          EOF

          # Start services
          docker compose up -d hypatia

          # Wait for services to be ready
          sleep 30

      - name: Run E2E test suite
        run: |
          # Test hypatia health
          curl -sf http://localhost:8080/health || (echo "Health check failed" && exit 1)
          echo "E2E tests passed"

      - name: Collect logs on failure
        if: failure()
        working-directory: deploy
        run: |
          docker compose logs > compose-logs.txt
          docker ps -a

      - name: Upload logs on failure
        if: failure()
        uses: actions/upload-artifact@v7.0.1
        with:
          name: e2e-failure-logs
          path: deploy/compose-logs.txt
          retention-days: 7

      - name: Stop stack
        if: always()
        working-directory: deploy
        run: docker compose down -v

  # ============================================================================
  # Coverage Report
  # ============================================================================

  coverage-report:
    name: Integration Coverage
    runs-on: ubuntu-latest
    timeout-minutes: 60
    needs: [integration-tests]
    services:
      arangodb:
        image: arangodb:3.11
        env:
          ARANGO_ROOT_PASSWORD: testpassword
        ports:
          - 8529:8529
        # THREE separate faults made this probe unable to ever succeed. All
        # three were measured against the real arangodb:3.11 image, not inferred:
        #
        #   1. `curl` is NOT installed in the image      -> use wget (present)
        #   2. `localhost` resolves to ::1 there, but    -> use 127.0.0.1
        #      ArangoDB binds IPv4 only
        #   3. `/_api/version` requires authentication   -> use
        #      whenever ARANGO_ROOT_PASSWORD is set,        /_admin/server/availability
        #      so it returns 401 forever; and busybox
        #      wget has no --user/--password option at
        #      all, so the probe CANNOT be authenticated
        #
        # Measured, polling once a second for 25s from container start:
        #   /_api/version               -> exit 1 at EVERY timepoint (401)
        #   /_admin/server/availability -> exit 1 for 3s, then exit 0 onwards
        #
        # Fault 3 is why this looked intermittent. A probe that never passes
        # leaves the service permanently `starting`; whether the job survived
        # depended on a race in the runner's own poll (if it read
        # .State.Health.Status before Docker had recorded any health state it
        # saw an empty string and reported "healthy" — which is why one job
        # once logged "arangodb service is healthy" BEFORE the container had
        # even logged "Initializing root user"). Do not read that log line as
        # evidence the probe works.
        #
        # NB: keep comments OUTSIDE the `options: >-` folded scalar — inside it
        # `#` is literal text, gets folded into the docker args, and breaks
        # `docker create` with "invalid reference format".
        options: >-
          --health-cmd "wget -q --spider http://127.0.0.1:8529/_admin/server/availability || exit 1"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 10
          --health-start-period 40s

      dragonfly:
        image: docker.dragonflydb.io/dragonflydb/dragonfly:latest
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          components: llvm-tools-preview

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@v2.85.3
        with:
          tool: cargo-llvm-cov

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2.9.1
        with:
          workspaces: ". -> target"

      - name: Wait for services
        run: |
          for i in {1..30}; do
            if curl -s http://localhost:8529/_api/version > /dev/null; then break; fi
            sleep 2
          done

      - name: Initialize database
        run: |
          curl -X POST -u "root:testpassword" \
            -H "Content-Type: application/json" \
            -d '{"name": "hypatia"}' \
            http://localhost:8529/_api/database || true

      - name: Generate integration coverage
        run: |
          cargo llvm-cov --workspace --features integration-tests \
            --lcov --output-path integration-lcov.info \
            -- --test-threads=1
        env:
          ARANGODB_URL: http://localhost:8529
          ARANGODB_DATABASE: hypatia
          ARANGODB_USER: root
          ARANGODB_PASSWORD: testpassword
          DRAGONFLY_URL: redis://localhost:6379

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7.0.0
        with:
          files: integration-lcov.info
          flags: integration
          fail_ci_if_error: false

  # ============================================================================
  # Integration Status
  # ============================================================================

  integration-status:
    name: Integration Status
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs:
      - build-images
      - integration-tests
      - e2e-tests
      - coverage-report
    if: always()
    steps:
      - name: Check integration status
        run: |
          echo "## Integration Test Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          declare -A jobs=(
            ["build-images"]="${{ needs.build-images.result }}"
            ["integration-tests"]="${{ needs.integration-tests.result }}"
            ["e2e-tests"]="${{ needs.e2e-tests.result }}"
            ["coverage-report"]="${{ needs.coverage-report.result }}"
          )

          failed=false
          for job in "${!jobs[@]}"; do
            result="${jobs[$job]}"
            if [[ "$result" == "success" ]]; then
              echo "- :white_check_mark: $job: $result" >> $GITHUB_STEP_SUMMARY
            elif [[ "$result" == "failure" ]]; then
              echo "- :x: $job: $result" >> $GITHUB_STEP_SUMMARY
              failed=true
            else
              echo "- :warning: $job: $result" >> $GITHUB_STEP_SUMMARY
            fi
          done

          if [[ "$failed" == "true" ]]; then
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "**Some integration tests failed. Please review the results.**" >> $GITHUB_STEP_SUMMARY
            exit 1
          fi

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**All integration tests passed successfully!**" >> $GITHUB_STEP_SUMMARY

  stress-test:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v7.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Install stress testing tools
        run: |
          sudo apt-get update
          sudo apt-get install -y stress-ng

      - name: Build release
        run: cargo build --release --all-features

      # `./target/release/*` globs BUILD DIRECTORIES (build/, deps/, examples/,
      # incremental/) and .d files — not just binaries. The previous steps ran
      # `timeout 1s ./target/release/build` 100 times, printed "Permission
      # denied" 100 times, and still reported SUCCESS, because a bare `wait`
      # returns 0 no matter what the background jobs did. Resolve the real bin
      # targets from cargo metadata so this cannot rot when a binary is added
      # or renamed, and assert each one exists before relying on it.
      - name: Resolve release binaries
        run: |
          set -euo pipefail
          BINS="$(cargo metadata --no-deps --format-version 1 \
            | jq -r '.packages[].targets[] | select(.kind[] == "bin") | .name' \
            | sort -u | tr '\n' ' ')"
          [ -n "${BINS// /}" ] || { echo "::error::no bin targets resolved from cargo metadata"; exit 1; }
          echo "resolved binaries: $BINS"
          for b in $BINS; do
            [ -x "target/release/$b" ] \
              || { echo "::error::target/release/$b missing or not executable"; exit 1; }
          done
          echo "STRESS_BINS=$BINS" >> "$GITHUB_ENV"

      - name: Concurrent launch stress test
        run: |
          set -euo pipefail
          pids=(); names=()
          for b in $STRESS_BINS; do
            for _ in $(seq 1 25); do
              "./target/release/$b" --help >/dev/null 2>&1 &
              pids+=("$!"); names+=("$b")
            done
          done
          failed=0
          for i in "${!pids[@]}"; do
            if ! wait "${pids[$i]}"; then
              echo "::error::${names[$i]} exited non-zero under concurrent launch"
              failed=$((failed + 1))
            fi
          done
          echo "launched ${#pids[@]} concurrent processes; failures: $failed"
          [ "$failed" -eq 0 ]

      - name: Memory-constrained execution
        run: |
          set -euo pipefail
          # The cap goes on the BINARY, never on cargo/rustc. The previous
          # `ulimit -v 512000; cargo test --release` failed on 6 of 6 runs:
          # 500MB of virtual address space cannot host rustc's LLD linker,
          # which aborts with
          #     std::system_error ... Resource temporarily unavailable
          #     collect2: fatal error: ld terminated with signal 6 [Aborted]
          # The very same build scripts (zerocopy, crossbeam-utils, num-traits)
          # compiled fine in the preceding step, which set no ulimit — that
          # in-log A/B is what identified the cause.
          for b in $STRESS_BINS; do
            if ( ulimit -v 1048576; "./target/release/$b" --help >/dev/null 2>&1 ); then
              echo "  ok: $b runs under a 1GiB virtual-memory cap"
            else
              echo "::error::$b failed under a 1GiB virtual-memory cap"
              exit 1
            fi
          done

      # REMOVED — "Long-running scenario test": it ran
      #   valgrind --leak-check=full --error-exitcode=1 ./target/release/* || true
      # which globbed a directory (so valgrind never profiled a binary) and
      # ended in `|| true` (so it could not fail even when it did). It reported
      # success without testing anything. Deleted rather than left in place.
      # To reinstate as a real gate: name a specific binary and drop `|| true`.

      - name: Test suite under CPU and I/O stress
        run: |
          set -euo pipefail
          stress-ng --cpu 4 --io 2 --timeout 60s &
          STRESS_PID=$!
          trap 'kill "$STRESS_PID" 2>/dev/null || true' EXIT
          cargo test --release

  bench:
    name: criterion + baseline gate
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2.9.1
        with:
          workspaces: ". -> target"
          cache-on-failure: true
          key: bench

      - name: Run criterion benches (quick mode)
        run: |
          set -euo pipefail
          # Quick mode: warm-up 1s, measurement 2s, sample 10 — cuts
          # total runtime to ~2 min while still giving a tight enough
          # estimate to catch >20% regressions.
          cargo bench --bench hypatia_bench -- \
              --warm-up-time 1 --measurement-time 2 --sample-size 10 \
              --output-format bencher \
              | tee bench-output.txt
          echo "---"
          grep '^test.*bench:' bench-output.txt || true

      - name: Compare against committed baseline
        id: compare
        if: ${{ github.event.inputs.mode != 'regenerate-baseline' }}
        run: |
          set -euo pipefail
          cargo build --release --manifest-path scripts/bench-tools/Cargo.toml
          ./scripts/bench-tools/target/release/check-bench-regression \
              bench-output.txt \
              .machine_readable/benchmarks/baselines.json \
              | tee -a "$GITHUB_STEP_SUMMARY"

      - name: Regenerate baseline (manual dispatch only)
        if: ${{ github.event.inputs.mode == 'regenerate-baseline' }}
        run: |
          set -euo pipefail
          cargo build --release --manifest-path scripts/bench-tools/Cargo.toml
          ./scripts/bench-tools/target/release/update-bench-baselines \
              bench-output.txt \
              .machine_readable/benchmarks/baselines.json
          echo "## Regenerated baseline" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "The refreshed \`baselines.json\` is attached as an" >> "$GITHUB_STEP_SUMMARY"
          echo "artefact. Review the diff and commit manually — the" >> "$GITHUB_STEP_SUMMARY"
          echo "workflow does not push changes on its own." >> "$GITHUB_STEP_SUMMARY"

      - name: Upload baseline candidate (regenerate mode)
        if: ${{ github.event.inputs.mode == 'regenerate-baseline' }}
        uses: actions/upload-artifact@v7.0.1
        with:
          name: baselines-candidate
          path: .machine_readable/benchmarks/baselines.json
          retention-days: 30

      - name: Upload raw bench output
        if: always()
        uses: actions/upload-artifact@v7.0.1
        with:
          name: bench-output
          path: bench-output.txt
          retention-days: 30