Add daemon self-update: check GitHub releases, verify checksum, swap … #172
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Actions are pinned to commit SHAs, with the tag they were at in the comment | |
| # beside them. A tag is mutable: whoever controls an action's repository can move | |
| # `v7` to different code, and that code runs here with this repository checked | |
| # out. The comment keeps them readable and updatable; the SHA is what makes them | |
| # the code someone actually looked at. | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Manual trigger, because a push that silently creates no run leaves nobody a | |
| # way to ask. It has happened on this repository — four consecutive pushes to | |
| # `main` registered as push events and produced no CI run at all — and without | |
| # this the only recourse is another commit hoping the trigger fires. | |
| workflow_dispatch: | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: latest | |
| # --frozen-lockfile so CI fails on an out-of-date bun.lock rather than | |
| # silently resolving different versions than a contributor is running. | |
| - run: bun install --frozen-lockfile | |
| # Covers daemon, protocol, relay and the app: the relay's Workers globals | |
| # conflict with Node's, and the app needs React Native's own config, so | |
| # each is a separate pass rather than one project. | |
| - run: npm run typecheck | |
| # Type-aware rules only: floating promises, promises passed where a sync | |
| # callback was expected, dead code. Almost no style rules, so a failure | |
| # here is a bug rather than a formatting opinion. Warnings do not fail the | |
| # build — the React dependency-array ones need the app running to judge. | |
| - run: npm run lint | |
| # Exercises the ACP pipeline end to end via providers/echo.json, which | |
| # needs no API key and no network. | |
| - run: npm test | |
| # The daemon ships a Windows binary, and until this job existed nothing ever | |
| # ran a line of it on Windows. | |
| # | |
| # That is not theoretical. Executable detection was `existsSync(join(dir, | |
| # command))` with no extension, which on Windows matched the *bash* script npm | |
| # installs beside `agent.cmd` — so every npm-installed agent was reported | |
| # present and then failed at spawn, while `cursor-agent.exe` was reported | |
| # missing because nothing on disk is named `cursor-agent`. Both directions | |
| # wrong, on a platform with a published binary, invisible to four green jobs. | |
| # | |
| # Scoped to daemon and protocol: those are what the Windows binary contains. | |
| # The app is built on a Mac and shipped as an IPA, so running its tests here | |
| # would buy nothing and pay 2x for it. | |
| windows: | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: latest | |
| - run: bun install --frozen-lockfile | |
| # The real thing, not the PEW2_FAKE_PLATFORM simulation the Linux job | |
| # runs: real PATHEXT, a real `npx.cmd` shim from the runner's own Node, | |
| # and a real spawn that would refuse a .cmd with EINVAL. | |
| - run: bun test ./packages/daemon/src ./packages/protocol/src | |
| # Proves the CLI actually starts as a Windows process — a crash on startup | |
| # would otherwise reach users as a binary that exits instantly with no | |
| # output. | |
| - run: bun run packages/daemon/src/cli/index.ts --version | |
| # And that the bundled manifests load and resolve here. Not `doctor`, | |
| # which exits non-zero by design on a machine with no pairing and no | |
| # daemon — true of every CI runner, so it would fail for the one reason | |
| # that is not a bug. | |
| - run: bun run packages/daemon/src/cli/index.ts providers validate | |
| # ios/ and android/ are gitignored (CNG), so no native code is checked in and a | |
| # native break is invisible to typecheck. This job regenerates Android from | |
| # app.json and compiles it: the only check that proves the plugin set still | |
| # merges (two plugins claiming one permission string is a silent overwrite), | |
| # that every native module autolinks, and that the manifest builds. | |
| android: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: latest | |
| # 17 because that is what the build was verified against locally; pinned | |
| # rather than inherited so a runner image bump cannot change the JDK under | |
| # the build without anyone choosing it. | |
| - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4 | |
| with: | |
| distribution: temurin | |
| java-version: "17" | |
| - uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4 | |
| - run: bun install --frozen-lockfile | |
| - run: npx expo prebuild --platform android --no-install | |
| working-directory: packages/app | |
| # assembleDebug, not release: there are no signing keys in CI, and the | |
| # compile is what catches breakage. Several minutes cold — mostly the NDK | |
| # builds reanimated and the app pull in; setup-gradle above caches them. | |
| - run: ./gradlew assembleDebug --console=plain | |
| working-directory: packages/app/android |