Skip to content

chore(deps-dev): bump browserslist from 4.28.2 to 4.28.8 in /crates/web/ui in the npm_and_yarn group across 1 directory #5680

chore(deps-dev): bump browserslist from 4.28.2 to 4.28.8 in /crates/web/ui in the npm_and_yarn group across 1 directory

chore(deps-dev): bump browserslist from 4.28.2 to 4.28.8 in /crates/web/ui in the npm_and_yarn group across 1 directory #5680

Workflow file for this run

name: CI
on:
push:
branches: [main]
pull_request:
workflow_dispatch:
schedule:
- cron: "0 4 * * *"
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions: {}
env:
CARGO_TERM_COLOR: always
# Must match rust-toolchain.toml (single source of truth for the nightly pin).
NIGHTLY_TOOLCHAIN: nightly-2026-06-20
jobs:
local-validation:
name: ${{ matrix.label }}
if: ${{ github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' }}
runs-on: ubuntu-latest
permissions:
contents: read
statuses: read
strategy:
fail-fast: false
matrix:
include:
- label: fmt
context: local/fmt
- label: biome
context: local/biome
- label: i18n
context: local/i18n
- label: zizmor
context: local/zizmor
- label: clippy
context: local/lint
- label: test
context: local/test
- label: macos-app
context: local/macos-app
- label: ios-app
context: local/ios-app
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Verify local status context
env:
GH_TOKEN: ${{ github.token }}
REPO: ${{ github.repository }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
REQUIRED_CONTEXT: ${{ matrix.context }}
run: python3 scripts/check-local-status.py
changelog-guard:
name: Changelog Guard
if: ${{ github.event_name == 'pull_request' }}
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
fetch-depth: 0
- name: Block manual CHANGELOG.md edits
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: bash ./scripts/check-changelog-guard.sh "$BASE_SHA" "$HEAD_SHA"
zizmor:
name: Workflow Security
if: ${{ github.event_name != 'pull_request' }}
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: zizmorcore/zizmor-action@135698455da5c3b3e55f73f4419e481ab68cdd95 # v0.4.1
with:
advanced-security: false
online-audits: false
biome:
name: Biome
if: ${{ github.event_name != 'pull_request' }}
needs: zizmor
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: 24
cache: npm
cache-dependency-path: crates/web/ui/package-lock.json
- run: npm ci --ignore-scripts --prefix crates/web/ui
- run: ./crates/web/ui/node_modules/.bin/biome ci crates/web/ui/src/ crates/web/ui/e2e/
- run: ./scripts/i18n-check.sh
fmt:
name: Format
if: ${{ github.event_name != 'pull_request' }}
needs: zizmor
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Check Rust file size limit
run: ./scripts/check-file-size.sh
- name: Check website install script sync
run: ./scripts/check-website-install-sync.sh
- name: Check install script package names match release workflow
run: ./scripts/check-install-package-names.sh
- name: Check install docs avoid stale asset URLs
run: ./scripts/check-install-docs.sh
- uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
with:
toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
components: rustfmt
- run: cargo fmt --all -- --check
rust-clippy:
name: Rust CI (Clippy)
if: ${{ github.event_name != 'pull_request' }}
needs: [fmt, biome]
# Temporarily use GitHub-hosted runners while self-hosted runners are offline.
# Restore to [self-hosted, Linux, X64] when they are connected again.
runs-on: ubuntu-latest
permissions:
contents: read
container:
image: nvidia/cuda:12.4.1-devel-ubuntu22.04
env:
LD_LIBRARY_PATH: /usr/local/cuda/compat:/usr/local/nvidia/lib:/usr/local/nvidia/lib64
steps:
- name: Install git for proper clone (CUDA image has none)
run: apt-get update -qq && apt-get install -y -qq --no-install-recommends git ca-certificates >/dev/null
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Mark workspace safe for gix (container uid mismatch)
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
- name: Clean up corrupted cargo config
run: rm -f ~/.cargo/config.toml
- name: Install build dependencies
run: bash ./scripts/install-linux-build-deps.sh
- uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
with:
toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
components: clippy
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: "22"
- name: Install QMD CLI
run: |
npm install --prefix "$RUNNER_TEMP/qmd-cli" @tobilu/qmd
echo "$RUNNER_TEMP/qmd-cli/node_modules/.bin" >> "$GITHUB_PATH"
export PATH="$RUNNER_TEMP/qmd-cli/node_modules/.bin:$PATH"
qmd --version
- name: Initialize git repo in llama-cpp source to satisfy cmake
run: |
cargo fetch --locked
LLAMA_SRC=$(find ~/.cargo/registry/src -name "llama-cpp-sys-2-*" -type d 2>/dev/null | head -1)
if [ -n "$LLAMA_SRC" ] && [ ! -d "$LLAMA_SRC/.git" ]; then
cd "$LLAMA_SRC"
git init
git config user.email "ci@example.com"
git config user.name "CI"
git add -A
git commit -m "init" --allow-empty
git tag v0.0.0
fi
- name: Install npm dependencies
working-directory: crates/web/ui
run: npm ci --ignore-scripts
- name: Build web assets
run: |
./scripts/download-tailwindcss-cli.sh tailwindcss-linux-x64
TAILWINDCSS=./tailwindcss-linux-x64 ./scripts/build-web-assets.sh
- run: cargo clippy -Z unstable-options --workspace --all-features --all-targets --timings -- -D warnings
- name: Upload cargo timing reports
if: always()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: cargo-timings-rust-ci-${{ github.run_id }}-${{ github.run_attempt }}
path: target/cargo-timings/
if-no-files-found: ignore
rust-test:
name: Rust CI (Test)
if: ${{ github.event_name != 'pull_request' }}
needs: [fmt, biome]
# Temporarily use GitHub-hosted runners while self-hosted runners are offline.
# Restore to [self-hosted, Linux, X64] when they are connected again.
runs-on: ubuntu-latest
permissions:
contents: read
container:
image: nvidia/cuda:12.4.1-devel-ubuntu22.04
env:
LD_LIBRARY_PATH: /usr/local/cuda/compat:/usr/local/nvidia/lib:/usr/local/nvidia/lib64
steps:
- name: Install git for proper clone (CUDA image has none)
run: apt-get update -qq && apt-get install -y -qq --no-install-recommends git ca-certificates >/dev/null
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Mark workspace safe for gix (container uid mismatch)
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
- name: Clean up corrupted cargo config
run: rm -f ~/.cargo/config.toml
- name: Install build dependencies
run: bash ./scripts/install-linux-build-deps.sh
- uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
with:
toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: "22"
- name: Install QMD CLI
run: |
npm install --prefix "$RUNNER_TEMP/qmd-cli" @tobilu/qmd
echo "$RUNNER_TEMP/qmd-cli/node_modules/.bin" >> "$GITHUB_PATH"
export PATH="$RUNNER_TEMP/qmd-cli/node_modules/.bin:$PATH"
qmd --version
- name: Initialize git repo in llama-cpp source to satisfy cmake
run: |
cargo fetch --locked
LLAMA_SRC=$(find ~/.cargo/registry/src -name "llama-cpp-sys-2-*" -type d 2>/dev/null | head -1)
if [ -n "$LLAMA_SRC" ] && [ ! -d "$LLAMA_SRC/.git" ]; then
cd "$LLAMA_SRC"
git init
git config user.email "ci@example.com"
git config user.name "CI"
git add -A
git commit -m "init" --allow-empty
git tag v0.0.0
fi
- name: Install npm dependencies
working-directory: crates/web/ui
run: npm ci --ignore-scripts
- name: Build web assets
run: |
./scripts/download-tailwindcss-cli.sh tailwindcss-linux-x64
TAILWINDCSS=./tailwindcss-linux-x64 ./scripts/build-web-assets.sh
- uses: taiki-e/install-action@f176c07a0a40cbfdd08ee9aa8bf1655701d11e69 # v2.67.25
with:
tool: cargo-nextest
- run: cargo nextest run --all-features --profile ci
- name: Upload test results
if: always()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: test-results-${{ github.run_id }}-${{ github.run_attempt }}
path: target/nextest/ci/junit.xml
if-no-files-found: ignore
sandbox-runtime-e2e:
name: Sandbox Runtime E2E
if: ${{ github.event_name != 'pull_request' }}
needs: [fmt, biome]
runs-on: ubuntu-latest
permissions:
contents: read
env:
MOLTIS_SANDBOX_RUNTIME_E2E: "1"
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Install runtime dependencies
run: |
sudo apt-get update \
-o Acquire::Retries=5 \
-o Acquire::http::Timeout=30 \
-o Acquire::https::Timeout=30 \
-o APT::Update::Error-Mode=any
sudo apt-get install -y podman uidmap slirp4netns fuse-overlayfs
- name: Verify runtimes
run: |
docker --version
docker info
podman --version
podman info
- uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
with:
toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
- uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
with:
shared-key: sandbox-runtime-e2e-v1
cache-all-crates: true
- name: Exercise Docker and Podman OCI file transfers
run: cargo test -p moltis-tools runtime_oci_file_transfers -- --nocapture
coverage:
name: Code Coverage
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Free disk space
run: |
sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/boost
sudo apt-get clean
df -h /
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Install build dependencies
run: |
sudo apt-get update \
-o Acquire::Retries=5 \
-o Acquire::http::Timeout=30 \
-o Acquire::https::Timeout=30 \
-o APT::Update::Error-Mode=any
sudo apt-get install -y cmake build-essential clang libclang-dev pkg-config
- uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
with:
toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
components: llvm-tools-preview
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: "22"
package-manager-cache: false
- name: Install QMD CLI
run: |
npm install --prefix "$RUNNER_TEMP/qmd-cli" @tobilu/qmd
echo "$RUNNER_TEMP/qmd-cli/node_modules/.bin" >> "$GITHUB_PATH"
export PATH="$RUNNER_TEMP/qmd-cli/node_modules/.bin:$PATH"
qmd --version
- uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
with:
shared-key: coverage-v1
cache-all-crates: true
- name: Initialize git repo in llama-cpp source to satisfy cmake
run: |
cargo fetch --locked
LLAMA_SRC=$(find ~/.cargo/registry/src -name "llama-cpp-sys-2-*" -type d 2>/dev/null | head -1)
if [ -n "$LLAMA_SRC" ] && [ ! -d "$LLAMA_SRC/.git" ]; then
cd "$LLAMA_SRC"
git init
git config user.email "ci@example.com"
git config user.name "CI"
git add -A
git commit -m "init" --allow-empty
git tag v0.0.0
fi
- uses: taiki-e/install-action@f176c07a0a40cbfdd08ee9aa8bf1655701d11e69 # v2.67.25
with:
tool: cargo-llvm-cov
- name: Install npm dependencies
working-directory: crates/web/ui
run: npm ci --ignore-scripts
- name: Build web assets
run: |
./scripts/download-tailwindcss-cli.sh tailwindcss-linux-x64
TAILWINDCSS=./tailwindcss-linux-x64 ./scripts/build-web-assets.sh
- name: Generate coverage
run: cargo llvm-cov --workspace --exclude moltis-tools --exclude moltis-swift-bridge --lcov --output-path lcov.info
- name: Upload to Codecov
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
with:
files: lcov.info
token: ${{ secrets.CODECOV_TOKEN }}
fail_ci_if_error: true
use_pypi: true
e2e:
name: E2E Tests
if: ${{ github.event_name != 'pull_request' }}
needs: [fmt, biome]
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
with:
toolchain: stable
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: "22"
cache: npm
cache-dependency-path: crates/web/ui/package-lock.json
- uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
with:
shared-key: e2e-v1
cache-all-crates: true
- name: Install npm dependencies
working-directory: crates/web/ui
run: npm ci
- name: Build web assets
run: |
./scripts/download-tailwindcss-cli.sh tailwindcss-linux-x64
TAILWINDCSS=./tailwindcss-linux-x64 ./scripts/build-web-assets.sh
- name: Build moltis binary
timeout-minutes: 20
run: cargo build --bin moltis
- name: Reclaim Rust build disk for E2E
run: bash ./scripts/cleanup-e2e-build-artifacts.sh
- name: Cache Playwright browsers
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
path: ~/.cache/ms-playwright
key: playwright-${{ runner.os }}-${{ hashFiles('crates/web/ui/package-lock.json') }}
- name: Install Playwright browsers
timeout-minutes: 2
working-directory: crates/web/ui
run: npx playwright install chromium
- name: Run E2E tests
working-directory: crates/web/ui
env:
CI: "true"
MOLTIS_BINARY: ${{ github.workspace }}/target/e2e-bin/moltis
run: ./e2e/run-ci.sh
- name: Upload test results
if: ${{ !cancelled() }}
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: e2e-test-results-${{ github.run_id }}-${{ github.run_attempt }}
path: |
crates/web/ui/playwright-report/
crates/web/ui/test-results/
target/e2e-runtime*/gateway.log
if-no-files-found: ignore
retention-days: 14
- name: Clean E2E runtime directories
if: ${{ always() }}
run: sudo rm -rf target/e2e-runtime*
macos-app:
name: macOS App
if: ${{ github.event_name != 'pull_request' }}
needs: [fmt, biome]
runs-on: macos-latest
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
with:
toolchain: stable
targets: aarch64-apple-darwin
- uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
with:
shared-key: macos-app-v1
cache-all-crates: true
- name: Install Swift build dependencies
run: brew install xcodegen cbindgen swiftlint
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: "22"
package-manager-cache: false
- name: Install npm dependencies
working-directory: crates/web/ui
run: npm ci --ignore-scripts
- name: Build web assets
run: |
./scripts/download-tailwindcss-cli.sh tailwindcss-macos-arm64
TAILWINDCSS=./tailwindcss-macos-arm64 ./scripts/build-web-assets.sh
- name: Build Swift bridge and generate Xcode project
env:
MOLTIS_SWIFT_BRIDGE_PROFILE: swift-ci
MOLTIS_SWIFT_BRIDGE_TARGETS: aarch64-apple-darwin
MOLTIS_SWIFT_BRIDGE_SKIP_WASM_BUILD: "1"
MOLTIS_SWIFT_BRIDGE_SKIP_WASM_PRECOMPILE: "1"
run: |
./scripts/build-swift-bridge.sh
./scripts/generate-swift-project.sh
- name: Lint Swift
run: ./scripts/lint-swift.sh
- name: Build macOS app
run: |
xcodebuild \
-project apps/macos/Moltis.xcodeproj \
-scheme Moltis \
-configuration Release \
-destination "platform=macOS" \
-derivedDataPath apps/macos/.derivedData-ci \
ARCHS=arm64 \
ONLY_ACTIVE_ARCH=YES \
build
ios-app:
name: iOS App
if: ${{ github.event_name != 'pull_request' }}
needs: [fmt, biome]
runs-on: macos-latest
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
with:
toolchain: stable
- uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
with:
shared-key: ios-app-v1
cache-all-crates: true
- name: Install xcodegen
run: brew install xcodegen
- name: Export GraphQL schema and generate project
run: |
cargo run -p moltis-schema-export -- apps/ios/GraphQL/Schema/schema.graphqls
./scripts/generate-ios-project.sh
./scripts/generate-ios-graphql.sh
./scripts/generate-ios-project.sh
- name: Build iOS app
run: |
xcodebuild \
-project apps/ios/Moltis.xcodeproj \
-scheme Moltis \
-configuration Debug \
-destination "generic/platform=iOS" \
CODE_SIGNING_ALLOWED=NO \
build
rust-full-targets:
name: Rust Full Targets (scheduled)
if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
continue-on-error: true
needs: [fmt, biome]
# Temporarily use GitHub-hosted runners while self-hosted runners are offline.
# Restore to [self-hosted, Linux, X64] when they are connected again.
runs-on: ubuntu-latest
permissions:
contents: read
container:
image: nvidia/cuda:12.4.1-devel-ubuntu22.04
env:
LD_LIBRARY_PATH: /usr/local/cuda/compat:/usr/local/nvidia/lib:/usr/local/nvidia/lib64
steps:
- name: Install git for proper clone (CUDA image has none)
run: apt-get update -qq && apt-get install -y -qq --no-install-recommends git ca-certificates >/dev/null
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Mark workspace safe for gix (container uid mismatch)
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
- name: Clean up corrupted cargo config
run: rm -f ~/.cargo/config.toml
- name: Install build dependencies
run: bash ./scripts/install-linux-build-deps.sh
- uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
with:
toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
components: clippy
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: "22"
package-manager-cache: false
- name: Install QMD CLI
run: |
npm install --prefix "$RUNNER_TEMP/qmd-cli" @tobilu/qmd
echo "$RUNNER_TEMP/qmd-cli/node_modules/.bin" >> "$GITHUB_PATH"
export PATH="$RUNNER_TEMP/qmd-cli/node_modules/.bin:$PATH"
qmd --version
- name: Initialize git repo in llama-cpp source to satisfy cmake
run: |
cargo fetch --locked
LLAMA_SRC=$(find ~/.cargo/registry/src -name "llama-cpp-sys-2-*" -type d 2>/dev/null | head -1)
if [ -n "$LLAMA_SRC" ] && [ ! -d "$LLAMA_SRC/.git" ]; then
cd "$LLAMA_SRC"
git init
git config user.email "ci@example.com"
git config user.name "CI"
git add -A
git commit -m "init" --allow-empty
git tag v0.0.0
fi
- name: Install npm dependencies
working-directory: crates/web/ui
run: npm ci --ignore-scripts
- name: Build web assets
run: |
./scripts/download-tailwindcss-cli.sh tailwindcss-linux-x64
TAILWINDCSS=./tailwindcss-linux-x64 ./scripts/build-web-assets.sh
- run: cargo clippy -Z unstable-options --workspace --all-features --all-targets --timings -- -D warnings
- name: Upload cargo timing reports
if: always()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: cargo-timings-rust-full-targets-${{ github.run_id }}-${{ github.run_attempt }}
path: target/cargo-timings/
if-no-files-found: ignore