fix: preview explicit files outside workspace #773

Workflow file for this run

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	workflow_dispatch:

	# Cancel a superseded PR run (it is on a stale commit); never cancel a
	# push run — it is already producing the post-merge signal. The mount job
	# boots a real DSH + Chromium, so the savings matter there most.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	jobs:
	ci:
	runs-on: ubuntu-latest
	timeout-minutes: 20
	steps:
	- uses: actions/checkout@v7
	with:
	# Tests run git log against this repository and need the full history.
	fetch-depth: 0
	# pnpm version is pinned via packageManager in package.json; the action
	# reads it from there (specifying both makes action-setup fail on
	# purpose with ERR_PNPM_BAD_PM_VERSION).
	- uses: pnpm/action-setup@v6
	- uses: actions/setup-node@v7
	with:
	node-version: 22
	cache: pnpm
	# The plugin's git revert/cherry-pick spawn git without setting an
	# identity (deliberate, see tests/smoke.spec.ts) and rely on ambient
	# config; the runner has none by default.
	- name: Configure git identity for tests
	run: \|
	git config --global user.name "dsh-better-sidebar-ci"
	git config --global user.email "ci@dsh.invalid"
	- name: Install dependencies
	run: pnpm install --frozen-lockfile
	- name: Typecheck
	run: pnpm typecheck
	- name: Lint
	run: pnpm lint
	- name: Test
	run: pnpm test
	- name: Build
	run: pnpm build
	# The consumer-facing declaration surface guard: a browser-only plugin
	# (no @types/node, skipLibCheck: false) must type-check against the
	# shipped lib/types. Runs AFTER build (it reads the built output).
	- name: Check consumer type surface
	run: pnpm check:consumer-types

	# Windows parity lane for the pure-logic suite. The codebase carries real
	# win32 branches (shell parsing, WSL path projection, the PowerShell
	# installer) that mock-injection tests alone cannot validate — this lane
	# runs the same typecheck / test / build / consumer-type-surface steps on
	# a real Windows runtime. The plugin-mount lane (real DSH + Playwright
	# Chromium) stays ubuntu-only and is deliberately NOT mirrored here.
	ci-windows:
	runs-on: windows-latest
	timeout-minutes: 30
	defaults:
	run:
	# The runner ships Git Bash: multi-line steps and
	# scripts/check-consumer-types.sh work verbatim.
	shell: bash
	steps:
	- uses: actions/checkout@v7
	with:
	# Tests run git log against this repository and need the full history.
	fetch-depth: 0
	# pnpm version is pinned via packageManager in package.json; the action
	# reads it from there (specifying both makes action-setup fail on
	# purpose with ERR_PNPM_BAD_PM_VERSION).
	- uses: pnpm/action-setup@v6
	- uses: actions/setup-node@v7
	with:
	node-version: 22
	cache: pnpm
	# Same rationale as the ci job: smoke tests spawn git without an
	# identity and rely on ambient config, which the runner lacks.
	- name: Configure git identity for tests
	run: \|
	git config --global user.name "dsh-better-sidebar-ci"
	git config --global user.email "ci@dsh.invalid"
	- name: Install dependencies
	run: pnpm install --frozen-lockfile
	- name: Typecheck
	run: pnpm typecheck
	- name: Lint
	run: pnpm lint
	- name: Test
	run: pnpm test
	- name: Build
	run: pnpm build
	- name: Check consumer type surface
	run: pnpm check:consumer-types

	# Pack the plugin as an npm tarball, mount it into a REAL DSH instance
	# through the official `dsh plugin --profile web add` channel, and render
	# the DSH web UI headlessly (Playwright Chromium) to prove the plugin
	# mounts without crashing the shell. Drives `pnpm test:mount`, which boots
	# a keyless `dsh web` against a scratch profile and sweeps every built-in
	# sidebar tab. No API key needed — the whole lane is deterministic.
	plugin-mount:
	runs-on: ubuntu-latest
	timeout-minutes: 30
	# CI runs must never report to the production telemetry endpoint baked
	# into the DSH composition (same guard DSH's own CI uses).
	env:
	DSH_TELEMETRY_DISABLED: '1'
	steps:
	- uses: actions/checkout@v7

	# pnpm version is pinned via packageManager in package.json; the action
	# reads it from there (specifying both makes action-setup fail on
	# purpose with ERR_PNPM_BAD_PM_VERSION).
	- uses: pnpm/action-setup@v6

	- uses: actions/setup-node@v7
	with:
	node-version: 22
	cache: pnpm

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	# Pin the DSH CLI the lane mounts into; the profile's bundle stack
	# (dsh-base / dsh-web-app) resolves from this installation. Keep in
	# step with the plugin's @deepseek-ai/* peer range when bumping.
	# DSH 0.1.2-rc.1 is published under the `next` dist-tag; the lanes
	# speak the slash-only RPC dialect (tests/e2e/host-protocol.ts).
	- name: Install dsh CLI (pinned)
	run: npm install -g @deepseek-ai/dsh@0.1.2-rc.1

	# lib/ is gitignored; the tarball is produced from this build.
	- name: Build and pack the npm tarball
	run: pnpm build && pnpm pack

	- name: Install Playwright Chromium
	run: pnpm exec playwright install --with-deps chromium

	- name: Mount + headless-render smoke
	run: pnpm test:mount

	# Aggregate double-mount regression: a fixture aggregate bundle mounts
	# dsh-better-sidebar under its own entry id BEFORE the plugin's bundle
	# row; the plugin must back off (no duplicate /sidebar/api, boot OK).
	# Uses the pinned DSH CLI installed above.
	- name: Aggregate double-mount regression
	env:
	DSH_CMD: dsh
	run: pnpm test:mount:aggregate

	- name: Upload Playwright report on failure
	if: failure()
	uses: actions/upload-artifact@v4
	with:
	name: playwright-report
	path: \|
	playwright-report/
	test-results/
	if-no-files-found: ignore

Navigation Menu

Uh oh!

fix: preview explicit files outside workspace #773

Workflow file

fix: preview explicit files outside workspace #773

Uh oh!

Workflow file for this run