pulse/.github/workflows/unified-agent-native.yml

name: Unified Agent Native Verification

on:
  push:
    branches: [main]
    paths:
      - '.github/workflows/unified-agent-native.yml'
      - 'cmd/pulse-agent/**'
      - 'internal/agenttls/**'
      - 'internal/agentupdate/**'
      - 'internal/dockeragent/**'
      - 'internal/hostagent/**'
      - 'internal/kubernetesagent/**'
      - 'internal/remoteconfig/**'
      - 'pkg/agents/**'
      - 'frontend-modern/src/utils/agentInstallCommand.ts'
      - 'frontend-modern/src/utils/__tests__/agentInstallCommand.windows.test.ts'
      - 'scripts/install.sh'
      - 'scripts/install.ps1'
      - 'scripts/installtests/**'
      - 'go.mod'
      - 'go.sum'
  pull_request:
    branches: [main]
    paths:
      - '.github/workflows/unified-agent-native.yml'
      - 'cmd/pulse-agent/**'
      - 'internal/agenttls/**'
      - 'internal/agentupdate/**'
      - 'internal/dockeragent/**'
      - 'internal/hostagent/**'
      - 'internal/kubernetesagent/**'
      - 'internal/remoteconfig/**'
      - 'pkg/agents/**'
      - 'frontend-modern/src/utils/agentInstallCommand.ts'
      - 'frontend-modern/src/utils/__tests__/agentInstallCommand.windows.test.ts'
      - 'scripts/install.sh'
      - 'scripts/install.ps1'
      - 'scripts/installtests/**'
      - 'go.mod'
      - 'go.sum'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  native-agent:
    name: ${{ matrix.name }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Linux x64
            runner: ubuntu-24.04
            unix: true
          - name: Linux ARM64
            runner: ubuntu-24.04-arm
            unix: true
          - name: macOS ARM64
            runner: macos-15
            unix: true
          - name: macOS Intel
            runner: macos-15-intel
            unix: true
          - name: Windows x64
            runner: windows-2025
            unix: false
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Test native agent runtime
        run: >-
          go test
          ./cmd/pulse-agent
          ./internal/agenttls
          ./internal/agentupdate
          ./internal/dockeragent
          ./internal/hostagent
          ./internal/kubernetesagent
          ./internal/remoteconfig

      - name: Test native Unix installer contracts
        if: matrix.unix
        run: go test ./scripts/installtests

      - name: Test native Windows installer contracts
        if: ${{ !matrix.unix }}
        run: go test ./scripts/installtests -run '^Test(InstallPS1|WindowsAgentLifecycle)'

      - name: Set up Node.js for Windows command proof
        if: ${{ !matrix.unix }}
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: 'npm'
          cache-dependency-path: 'frontend-modern/package-lock.json'

      - name: Install frontend test dependencies
        if: ${{ !matrix.unix }}
        working-directory: frontend-modern
        run: npm ci

      - name: Execute generated command with Windows PowerShell 5.1
        if: ${{ !matrix.unix }}
        working-directory: frontend-modern
        run: npm test -- --run src/utils/__tests__/agentInstallCommand.windows.test.ts

      - name: Build and execute native Unix agent
        if: matrix.unix
        shell: bash
        run: |
          set -euo pipefail
          go build -o pulse-agent-native ./cmd/pulse-agent
          ./pulse-agent-native --version
          ./pulse-agent-native --self-test

      - name: Build and execute native Windows agent
        if: ${{ !matrix.unix }}
        shell: pwsh
        run: |
          go build -o pulse-agent-native.exe ./cmd/pulse-agent
          .\pulse-agent-native.exe --version
          $selfTestStateDir = Join-Path $env:RUNNER_TEMP 'pulse-agent-self-test'
          $selfTestLogFile = Join-Path $selfTestStateDir 'pulse-agent.log'
          New-Item -ItemType Directory -Path $selfTestStateDir -Force | Out-Null
          .\pulse-agent-native.exe --self-test --state-dir $selfTestStateDir --log-file $selfTestLogFile
          $errors = $null
          [System.Management.Automation.Language.Parser]::ParseFile(
            (Resolve-Path 'scripts/install.ps1'),
            [ref]$null,
            [ref]$errors
          ) > $null
          if ($errors.Count) {
            $errors | ForEach-Object { Write-Error $_.ToString() }
            exit 1
          }

      - name: Exercise native Windows service lifecycle
        if: ${{ !matrix.unix }}
        shell: pwsh
        timeout-minutes: 10
        run: |
          if (Get-Service -Name 'PulseAgent' -ErrorAction SilentlyContinue) {
            throw 'PulseAgent is already installed; refusing to clear lifecycle state.'
          }
          $lifecycleStateDir = Join-Path $env:ProgramData 'Pulse'
          if (Test-Path $lifecycleStateDir) {
            Write-Host "Removing test-only Pulse state before clean lifecycle proof: $lifecycleStateDir"
            Remove-Item -Path $lifecycleStateDir -Recurse -Force
          }
          go build -buildvcs=false -trimpath -ldflags="-s -w -X main.Version=6.0.5-ci.1" -o pulse-agent-windows-ci-1.exe ./cmd/pulse-agent
          go build -buildvcs=false -trimpath -ldflags="-s -w -X main.Version=6.0.5-ci.2" -o pulse-agent-windows-ci-2.exe ./cmd/pulse-agent
          go build -buildvcs=false -trimpath -o windows-lifecycle-server.exe ./scripts/installtests/windowslifecycleserver
          & ./scripts/installtests/windows_agent_lifecycle.ps1 `
            -Phase Full `
            -ServerBinary ./windows-lifecycle-server.exe `
            -AgentV1 ./pulse-agent-windows-ci-1.exe `
            -AgentV2 ./pulse-agent-windows-ci-2.exe `
            -InstallerPath ./scripts/install.ps1 `
            -ConfirmLifecycleMutation

  freebsd-build-contract:
    name: FreeBSD cross-build contract
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Compile and validate FreeBSD binaries
        shell: bash
        run: |
          set -euo pipefail
          for arch in amd64 arm64; do
            GOOS=freebsd GOARCH="$arch" CGO_ENABLED=0 \
              go build -o "pulse-agent-freebsd-${arch}" ./cmd/pulse-agent
            magic="$(od -An -tx1 -N4 "pulse-agent-freebsd-${arch}" | tr -d ' \n')"
            test "$magic" = "7f454c46"
          done
          GOOS=freebsd GOARCH=amd64 go test -c -o agentupdate-freebsd.test ./internal/agentupdate