Skip to content

feat(app): opt-in debug logging mode and safer, richer diagnostic bundles #950

feat(app): opt-in debug logging mode and safer, richer diagnostic bundles

feat(app): opt-in debug logging mode and safer, richer diagnostic bundles #950

Workflow file for this run

name: Chaos
# Driven stress / chaos harness (design/STRESS_HARNESS.md s7).
#
# COST POLICY (maintainer budget): the chaos jobs run WINDOWS-ONLY on every PR
# and push to main (Windows is the primary target platform). The full 3-OS
# matrix [ubuntu, macos, windows] runs ONLY on `v*` tag pushes (release gates),
# where the extra macOS/Windows runner cost is worth the release-time coverage.
# The weekly 6-hour fuzz soak is NOT run in CI - it is a local/on-demand task
# (`just chaos-fuzz` / `just chaos-soak`); the bounded `fuzz-smoke` row still
# runs in the per-PR sweep. Unix-shaped rows (POSIX perms, case-sensitive FS)
# are exercised on the ubuntu leg of the tag-push 3-OS run and locally on Linux.
#
# Jobs:
# chaos-hermetic - every PR/push: windows-only; on a `v*` tag: 3-OS matrix.
# Runs every scenario whose requires() is satisfiable on a
# stock non-elevated runner; the rest SKIP cleanly.
# chaos-fake-drive - every PR/push: windows-only; on a `v*` tag: 3-OS matrix.
# The dedicated fault-injection gate (STRESS_HARNESS s7):
# runs ONLY the s3.7 Drive-side hazards + s4.2/s5 drive-side
# mutator faults against InMemoryRemoteStore
# (`run-all --fault-injection`).
# chaos-real-drive - `v*` TAG pushes ONLY: runs the REAL Google Drive contract
# suite (driven-drive/tests/google_e2e.rs) against a live
# GoogleDriveStore. The suite gates itself on three required
# secrets - DRIVEN_E2E_REFRESH_TOKEN, DRIVEN_E2E_DEST_FOLDER_ID
# and DRIVEN_OAUTH_CLIENT_SECRET (CLIENT_ID is optional) - and
# when ANY of them is absent it prints a "skipping real-Drive
# e2e" line and returns Ok (clean skip, never red). Real Google
# traffic on every push/PR is too costly, so it runs at release
# time only. See design/E2E_REAL.md.
#
# The long fuzz soak + soak-gated massive-input rows (million-files-nested,
# tiny-files-100k) run LOCALLY via the justfile (`just chaos-soak`,
# `just chaos-fuzz`), not in CI.
on:
push:
branches: [main]
tags: ["v*"]
pull_request:
branches: [main]
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
# Cancel only superseded PR runs. Never cancel a push to main (warms the shared
# rust-cache) or a `v*` tag push (the release-gate 3-OS run). Matches ci.yml /
# coverage.yml.
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
env:
CARGO_TERM_COLOR: always
RUST_BACKTRACE: 1
# The harness boots the headless core whose state layer uses sqlx
# compile-time-checked queries; CI has no live DB, so resolve against the
# committed .sqlx/ cache (same as ci.yml).
SQLX_OFFLINE: "true"
# No debuginfo in CI dev builds - MUST match ci.yml's value: both workflows
# share the per-OS "workspace" rust-cache key, and a differing debug level
# would fork every fingerprint and thrash that shared cache. (See ci.yml for
# the MSVC link-time rationale.)
CARGO_PROFILE_DEV_DEBUG: "0"
jobs:
chaos-hermetic:
name: chaos hermetic (${{ matrix.os }})
strategy:
fail-fast: false
matrix:
# WINDOWS-ONLY on a normal PR/push (the primary platform, cheapest
# coverage); the FULL 3-OS matrix only on a `v*` tag push, where Linux +
# macOS add the Unix-shaped rows for the release gate. The admin / VSS /
# real-Drive rows SKIP cleanly on every unelevated runner (never red).
os: ${{ startsWith(github.ref, 'refs/tags/') && fromJSON('["ubuntu-latest","macos-latest","windows-latest"]') || fromJSON('["windows-latest"]') }}
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v7
# No Defender exclusion step - real-time protection is already off on the
# windows-latest image, see the note in ci.yml rust-test.
- uses: dtolnay/rust-toolchain@stable
- name: Install Linux Tauri deps
if: runner.os == 'Linux'
run: |
sudo apt-get update
sudo apt-get install -y libwebkit2gtk-4.1-dev libxdo-dev libssl-dev \
libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev javascriptcoregtk-4.1
- uses: Swatinem/rust-cache@v2
with:
# Same dependency cache as ci.yml's rust-test (per-OS). chaos builds a
# subset of the workspace, so it reuses the rust-test-warmed cache.
shared-key: "workspace"
# Restore-only on PRs; only main (and not `v*` tags) writes the cache.
save-if: ${{ github.ref == 'refs/heads/main' }}
# run-all capability-gates every scenario: on a stock non-elevated runner
# the admin / real-Drive rows SKIP (recorded, never red); the rest run
# against the headless core + InMemoryRemoteStore.
# Exit code: 0 = all pass/skip, 1 = any fail (STRESS_HARNESS s9).
- name: chaos run-all (hermetic)
run: cargo run -p driven-chaos -- run-all --hermetic
chaos-fake-drive:
name: chaos fake-drive (${{ matrix.os }})
# The dedicated fault-injection gate (STRESS_HARNESS s7). Runs ONLY the
# s3.7 / s4.2 / s5 fault-injection subset against InMemoryRemoteStore;
# capability-gated rows SKIP cleanly, never red. Same cost policy as
# hermetic: windows-only normally, 3-OS on a `v*` tag.
strategy:
fail-fast: false
matrix:
os: ${{ startsWith(github.ref, 'refs/tags/') && fromJSON('["ubuntu-latest","macos-latest","windows-latest"]') || fromJSON('["windows-latest"]') }}
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v7
# No Defender exclusion step - real-time protection is already off on the
# windows-latest image, see the note in ci.yml rust-test.
- uses: dtolnay/rust-toolchain@stable
- name: Install Linux Tauri deps
if: runner.os == 'Linux'
run: |
sudo apt-get update
sudo apt-get install -y libwebkit2gtk-4.1-dev libxdo-dev libssl-dev \
libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev javascriptcoregtk-4.1
- uses: Swatinem/rust-cache@v2
with:
shared-key: "workspace"
save-if: ${{ github.ref == 'refs/heads/main' }}
- name: chaos run-all (fault-injection)
run: cargo run -p driven-chaos -- run-all --fault-injection
chaos-real-drive:
name: real-drive e2e (tag-only)
# REAL Google Drive contract suite (driven-drive/tests/google_e2e.rs). The
# previous step here ran the HERMETIC chaos harness despite the real-drive
# name + env (it never touched real Drive); this now runs the actual
# env-gated real-Drive suite so the OAuth/Drive REST surface gets regression
# coverage. Per the chaos COST POLICY above it runs ONLY on a `v*` tag push
# (real Google traffic on every push is too costly). google_e2e.rs gates
# itself on the DRIVEN_E2E_* env: when the creds are absent it prints a clear
# "skipping real-Drive e2e" line and returns Ok (never red), so a fork / a
# missing secret degrades to a clean skip, not a failure.
if: ${{ startsWith(github.ref, 'refs/tags/') }}
runs-on: ubuntu-latest
env:
DRIVEN_E2E_REFRESH_TOKEN: ${{ secrets.DRIVEN_E2E_REFRESH_TOKEN }}
DRIVEN_E2E_DEST_FOLDER_ID: ${{ secrets.DRIVEN_E2E_DEST_FOLDER_ID }}
# The OAuth client the refresh token was minted with. CLIENT_SECRET is
# REQUIRED by google_e2e.rs's gate; CLIENT_ID is optional (the suite falls
# back to the public installed-app client id when unset). Both must match
# the client that issued DRIVEN_E2E_REFRESH_TOKEN or the token exchange fails.
DRIVEN_OAUTH_CLIENT_SECRET: ${{ secrets.DRIVEN_OAUTH_CLIENT_SECRET }}
DRIVEN_OAUTH_CLIENT_ID: ${{ secrets.DRIVEN_OAUTH_CLIENT_ID }}
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- name: Install Linux build deps (libssl for the Drive HTTP client)
run: |
sudo apt-get update
sudo apt-get install -y libssl-dev
- uses: Swatinem/rust-cache@v2
with:
# Builds driven-drive's test target - a subset of the workspace - so it
# restores the same per-OS `workspace` cache. This job only runs on `v*`
# tags (save-if false there), so it is purely restore-only.
shared-key: "workspace"
save-if: ${{ github.ref == 'refs/heads/main' }}
# Real Drive round-trip against a throwaway UUID folder under the dest
# folder. Gate-skips cleanly (Ok, never red) when the creds are absent.
- name: real-drive e2e (google_e2e)
run: cargo test -p driven-drive --test google_e2e -- --nocapture