Vendor the Ladybug binding MIT license with upstream provenance #782
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - integration/** | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| plan: | |
| name: Plan affected verification | |
| runs-on: ubuntu-latest | |
| outputs: | |
| plan: ${{ steps.plan.outputs.plan }} | |
| mode: ${{ steps.plan.outputs.mode }} | |
| rust: ${{ steps.plan.outputs.rust }} | |
| rust_crash: ${{ steps.plan.outputs.rust_crash }} | |
| rust_runtime: ${{ steps.plan.outputs.rust_runtime }} | |
| typescript: ${{ steps.plan.outputs.typescript }} | |
| vitest: ${{ steps.plan.outputs.vitest }} | |
| python: ${{ steps.plan.outputs.python }} | |
| receipts: ${{ steps.plan.outputs.receipts }} | |
| prd: ${{ steps.plan.outputs.prd }} | |
| packaging: ${{ steps.plan.outputs.packaging }} | |
| steps: | |
| - name: Check out source and base history | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up pinned Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .node-version | |
| - name: Verify Node toolchain | |
| run: node scripts/check-node-version.mjs | |
| - name: Derive affected-module plan | |
| id: plan | |
| run: | | |
| mode="$(node scripts/ci/select-mode.mjs)" | |
| node scripts/ci/plan-affected.mjs \ | |
| --base "${{ github.event.pull_request.base.sha || github.event.before }}" \ | |
| --head "${{ github.event.pull_request.head.sha || github.sha }}" \ | |
| --mode "$mode" | |
| quick: | |
| name: Quick deterministic checks | |
| needs: plan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up Node dependencies with evidence | |
| uses: ./.github/actions/setup-node-dependencies | |
| - name: Verify Node toolchain | |
| run: node scripts/check-node-version.mjs | |
| - name: Fast portfolio, formatting, and generated-file checks | |
| run: node scripts/ci/run-chapter.mjs quick | |
| env: | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| lbug-prebuilt: | |
| name: Prebuilt Ladybug native library | |
| needs: [plan, quick] | |
| if: ${{ needs.quick.result == 'success' && (needs.plan.outputs.rust == 'true' || needs.plan.outputs.rust_runtime == 'true' || needs.plan.outputs.rust_crash == 'true') }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up isolated Rust compilation | |
| id: rust-setup | |
| uses: ./.github/actions/setup-rust-compilation | |
| with: | |
| lane: lbug-prebuilt | |
| - name: Restore trusted prebuilt Ladybug bundle | |
| id: lbug-cache | |
| uses: actions/cache/restore@v5 | |
| with: | |
| path: ${{ runner.temp }}/lbug-prebuilt | |
| key: lbug-prebuilt-${{ runner.os }}-${{ runner.arch }}-${{ steps.rust-setup.outputs.rustc-release }}-v1-${{ hashFiles('Cargo.lock') }} | |
| - name: Build Ladybug from the pinned bundled source | |
| if: ${{ steps.lbug-cache.outputs.cache-hit != 'true' }} | |
| run: | | |
| node scripts/ci/run-timed.mjs "Ladybug source build" cargo build -p lbug --timings | |
| mkdir -p "$RUNNER_TEMP/cargo-timings-lbug-prebuilt" | |
| cp "$RUNNER_TEMP/cargo-target/cargo-timings/cargo-timing.html" \ | |
| "$RUNNER_TEMP/cargo-timings-lbug-prebuilt/lbug-prebuilt.html" 2>/dev/null || true | |
| node scripts/ci/lbug-artifact.mjs create \ | |
| --repository "$GITHUB_WORKSPACE" \ | |
| --target-dir "$RUNNER_TEMP/cargo-target" \ | |
| --artifact-dir "$RUNNER_TEMP/lbug-prebuilt" \ | |
| --source-commit "$GITHUB_SHA" \ | |
| --platform "${{ runner.os }}-${{ runner.arch }}" \ | |
| --rustc-release "${{ steps.rust-setup.outputs.rustc-release }}" | |
| env: | |
| CARGO_TARGET_DIR: ${{ runner.temp }}/cargo-target | |
| CARGO_INCREMENTAL: "0" | |
| CARGO_PROFILE_DEV_DEBUG: line-tables-only | |
| RELAYER_CARGO_TIMINGS_DIR: ${{ runner.temp }}/cargo-timings-lbug-prebuilt | |
| RELAYER_SCCACHE_ENABLED: ${{ steps.rust-setup.outputs.sccache-enabled }} | |
| RUSTC_WRAPPER: ${{ github.workspace }}/scripts/ci/sccache-wrapper.sh | |
| SCCACHE_CLIENT_SIDE: "1" | |
| SCCACHE_GHA_ENABLED: "true" | |
| SCCACHE_GHA_RW_MODE: READ_WRITE | |
| SCCACHE_GHA_VERSION: ${{ steps.rust-setup.outputs.cache-version }} | |
| SCCACHE_IGNORE_SERVER_IO_ERROR: "1" | |
| - name: Upload prebuilt Ladybug library | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: lbug-prebuilt-${{ github.sha }}-${{ runner.os }}-${{ runner.arch }} | |
| path: ${{ runner.temp }}/lbug-prebuilt | |
| overwrite: true | |
| if-no-files-found: error | |
| retention-days: 1 | |
| - name: Save trusted prebuilt Ladybug bundle | |
| if: ${{ github.event_name == 'push' && success() && steps.lbug-cache.outputs.cache-hit != 'true' }} | |
| uses: actions/cache/save@v5 | |
| with: | |
| path: ${{ runner.temp }}/lbug-prebuilt | |
| key: ${{ steps.lbug-cache.outputs.cache-primary-key }} | |
| - name: Report Ladybug build compiler cache | |
| if: ${{ always() }} | |
| continue-on-error: true | |
| uses: ./.github/actions/report-rust-compilation | |
| with: | |
| lane: lbug-prebuilt | |
| sccache-enabled: ${{ steps.rust-setup.outputs.sccache-enabled }} | |
| rust-clippy: | |
| name: Rust Clippy | |
| needs: [plan, quick, lbug-prebuilt] | |
| if: ${{ always() && needs.plan.result == 'success' && needs.quick.result == 'success' && needs.plan.outputs.rust == 'true' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up pinned Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .node-version | |
| - name: Set up isolated Rust compilation | |
| id: rust-setup | |
| uses: ./.github/actions/setup-rust-compilation | |
| with: | |
| lane: rust-clippy | |
| - name: Download prebuilt Ladybug library | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 | |
| with: | |
| name: lbug-prebuilt-${{ github.sha }}-${{ runner.os }}-${{ runner.arch }} | |
| path: ${{ runner.temp }}/lbug-prebuilt-download | |
| continue-on-error: true | |
| - name: Verify and install prebuilt Ladybug library | |
| id: lbug-install | |
| continue-on-error: true | |
| run: | | |
| node scripts/ci/lbug-artifact.mjs verify \ | |
| --repository "$GITHUB_WORKSPACE" \ | |
| --artifact-dir "$RUNNER_TEMP/lbug-prebuilt-download" \ | |
| --platform "${{ runner.os }}-${{ runner.arch }}" \ | |
| --rustc-release "${{ steps.rust-setup.outputs.rustc-release }}" \ | |
| --github-env "$GITHUB_ENV" | |
| - name: Record prebuilt Ladybug outcome | |
| if: ${{ always() }} | |
| run: | | |
| echo "- Prebuilt Ladybug library: ${{ steps.lbug-install.outcome }}" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Run Rust Clippy | |
| run: node scripts/ci/run-chapter.mjs rust-clippy | |
| env: | |
| CARGO_TARGET_DIR: ${{ runner.temp }}/cargo-target | |
| RELAYER_CARGO_TIMINGS_DIR: ${{ runner.temp }}/cargo-timings-rust-clippy | |
| CARGO_INCREMENTAL: "0" | |
| CARGO_PROFILE_DEV_DEBUG: line-tables-only | |
| CARGO_PROFILE_TEST_DEBUG: line-tables-only | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| RELAYER_SCCACHE_ENABLED: ${{ steps.rust-setup.outputs.sccache-enabled }} | |
| RUSTC_WRAPPER: ${{ github.workspace }}/scripts/ci/sccache-wrapper.sh | |
| SCCACHE_CLIENT_SIDE: "1" | |
| SCCACHE_GHA_ENABLED: "true" | |
| SCCACHE_GHA_RW_MODE: READ_WRITE | |
| SCCACHE_GHA_VERSION: ${{ steps.rust-setup.outputs.cache-version }} | |
| SCCACHE_IGNORE_SERVER_IO_ERROR: "1" | |
| - name: Report Rust Clippy compiler cache | |
| if: ${{ always() }} | |
| continue-on-error: true | |
| uses: ./.github/actions/report-rust-compilation | |
| with: | |
| lane: rust-clippy | |
| sccache-enabled: ${{ steps.rust-setup.outputs.sccache-enabled }} | |
| - name: Save trusted Rust dependency downloads | |
| if: ${{ github.event_name == 'push' && success() && steps.rust-setup.outputs.dependency-cache-hit != 'true' }} | |
| continue-on-error: true | |
| uses: actions/cache/save@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| key: ${{ steps.rust-setup.outputs.dependency-cache-key }} | |
| rust-tests: | |
| name: Fresh Rust tests | |
| needs: [plan, quick, lbug-prebuilt] | |
| if: ${{ always() && needs.plan.result == 'success' && needs.quick.result == 'success' && needs.plan.outputs.rust == 'true' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up pinned Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .node-version | |
| - name: Set up isolated Rust compilation | |
| id: rust-setup | |
| uses: ./.github/actions/setup-rust-compilation | |
| with: | |
| lane: rust-tests | |
| - name: Download prebuilt Ladybug library | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 | |
| with: | |
| name: lbug-prebuilt-${{ github.sha }}-${{ runner.os }}-${{ runner.arch }} | |
| path: ${{ runner.temp }}/lbug-prebuilt-download | |
| continue-on-error: true | |
| - name: Verify and install prebuilt Ladybug library | |
| id: lbug-install | |
| continue-on-error: true | |
| run: | | |
| node scripts/ci/lbug-artifact.mjs verify \ | |
| --repository "$GITHUB_WORKSPACE" \ | |
| --artifact-dir "$RUNNER_TEMP/lbug-prebuilt-download" \ | |
| --platform "${{ runner.os }}-${{ runner.arch }}" \ | |
| --rustc-release "${{ steps.rust-setup.outputs.rustc-release }}" \ | |
| --github-env "$GITHUB_ENV" | |
| - name: Record prebuilt Ladybug outcome | |
| if: ${{ always() }} | |
| run: | | |
| echo "- Prebuilt Ladybug library: ${{ steps.lbug-install.outcome }}" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Run fresh Rust tests | |
| run: node scripts/ci/run-chapter.mjs rust-tests | |
| env: | |
| CARGO_INCREMENTAL: "0" | |
| CARGO_TARGET_DIR: ${{ runner.temp }}/cargo-target | |
| RELAYER_CARGO_TIMINGS_DIR: ${{ runner.temp }}/cargo-timings-rust-tests | |
| CARGO_PROFILE_DEV_DEBUG: line-tables-only | |
| CARGO_PROFILE_TEST_DEBUG: line-tables-only | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| RELAYER_SCCACHE_ENABLED: ${{ steps.rust-setup.outputs.sccache-enabled }} | |
| RUSTC_WRAPPER: ${{ github.workspace }}/scripts/ci/sccache-wrapper.sh | |
| SCCACHE_CLIENT_SIDE: "1" | |
| SCCACHE_GHA_ENABLED: "true" | |
| SCCACHE_GHA_RW_MODE: READ_WRITE | |
| SCCACHE_GHA_VERSION: ${{ steps.rust-setup.outputs.cache-version }} | |
| SCCACHE_IGNORE_SERVER_IO_ERROR: "1" | |
| - name: Report Rust test compiler cache | |
| if: ${{ always() }} | |
| continue-on-error: true | |
| uses: ./.github/actions/report-rust-compilation | |
| with: | |
| lane: rust-tests | |
| sccache-enabled: ${{ steps.rust-setup.outputs.sccache-enabled }} | |
| rust-crash: | |
| name: Fresh crash reconciliation tests | |
| needs: [plan, quick, lbug-prebuilt] | |
| if: ${{ always() && needs.plan.result == 'success' && needs.quick.result == 'success' && needs.plan.outputs.rust_crash == 'true' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up pinned Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .node-version | |
| - name: Set up isolated Rust compilation | |
| id: rust-setup | |
| uses: ./.github/actions/setup-rust-compilation | |
| with: | |
| lane: rust-crash | |
| - name: Download prebuilt Ladybug library | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 | |
| with: | |
| name: lbug-prebuilt-${{ github.sha }}-${{ runner.os }}-${{ runner.arch }} | |
| path: ${{ runner.temp }}/lbug-prebuilt-download | |
| continue-on-error: true | |
| - name: Verify and install prebuilt Ladybug library | |
| id: lbug-install | |
| continue-on-error: true | |
| run: | | |
| node scripts/ci/lbug-artifact.mjs verify \ | |
| --repository "$GITHUB_WORKSPACE" \ | |
| --artifact-dir "$RUNNER_TEMP/lbug-prebuilt-download" \ | |
| --platform "${{ runner.os }}-${{ runner.arch }}" \ | |
| --rustc-release "${{ steps.rust-setup.outputs.rustc-release }}" \ | |
| --github-env "$GITHUB_ENV" | |
| - name: Record prebuilt Ladybug outcome | |
| if: ${{ always() }} | |
| run: | | |
| echo "- Prebuilt Ladybug library: ${{ steps.lbug-install.outcome }}" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Run fresh crash reconciliation tests | |
| run: node scripts/ci/run-chapter.mjs rust-crash | |
| env: | |
| CARGO_INCREMENTAL: "0" | |
| CARGO_TARGET_DIR: ${{ runner.temp }}/cargo-target | |
| CARGO_PROFILE_DEV_DEBUG: line-tables-only | |
| CARGO_PROFILE_TEST_DEBUG: line-tables-only | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| RELAYER_SCCACHE_ENABLED: ${{ steps.rust-setup.outputs.sccache-enabled }} | |
| RUSTC_WRAPPER: ${{ github.workspace }}/scripts/ci/sccache-wrapper.sh | |
| SCCACHE_CLIENT_SIDE: "1" | |
| SCCACHE_GHA_ENABLED: "true" | |
| SCCACHE_GHA_RW_MODE: READ_WRITE | |
| SCCACHE_GHA_VERSION: ${{ steps.rust-setup.outputs.cache-version }} | |
| SCCACHE_IGNORE_SERVER_IO_ERROR: "1" | |
| - name: Report crash-test compiler cache | |
| if: ${{ always() }} | |
| continue-on-error: true | |
| uses: ./.github/actions/report-rust-compilation | |
| with: | |
| lane: rust-crash | |
| sccache-enabled: ${{ steps.rust-setup.outputs.sccache-enabled }} | |
| rust-runtime: | |
| name: Rust runtime build | |
| needs: [plan, quick, lbug-prebuilt] | |
| if: ${{ always() && needs.plan.result == 'success' && needs.quick.result == 'success' && needs.plan.outputs.rust_runtime == 'true' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up pinned Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .node-version | |
| - name: Set up isolated Rust compilation | |
| id: rust-setup | |
| uses: ./.github/actions/setup-rust-compilation | |
| with: | |
| lane: rust-runtime | |
| # The runtime lane's unique outputs are uncachable binary links; its | |
| # shareable units are identical to the default-test lane's. When the | |
| # Rust chapter runs, the writer lanes seed those objects and the | |
| # runtime lane reads without writing to avoid duplicate-write | |
| # collisions. On runtime-only plans no writer lane exists, so the | |
| # runtime lane writes to keep the namespace from going cold. | |
| sccache-mode: ${{ needs.plan.outputs.rust == 'true' && 'READ_ONLY' || 'READ_WRITE' }} | |
| - name: Download prebuilt Ladybug library | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 | |
| with: | |
| name: lbug-prebuilt-${{ github.sha }}-${{ runner.os }}-${{ runner.arch }} | |
| path: ${{ runner.temp }}/lbug-prebuilt-download | |
| continue-on-error: true | |
| - name: Verify and install prebuilt Ladybug library | |
| id: lbug-install | |
| continue-on-error: true | |
| run: | | |
| node scripts/ci/lbug-artifact.mjs verify \ | |
| --repository "$GITHUB_WORKSPACE" \ | |
| --artifact-dir "$RUNNER_TEMP/lbug-prebuilt-download" \ | |
| --platform "${{ runner.os }}-${{ runner.arch }}" \ | |
| --rustc-release "${{ steps.rust-setup.outputs.rustc-release }}" \ | |
| --github-env "$GITHUB_ENV" | |
| - name: Record prebuilt Ladybug outcome | |
| if: ${{ always() }} | |
| run: | | |
| echo "- Prebuilt Ladybug library: ${{ steps.lbug-install.outcome }}" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Run selected Rust runtime build | |
| run: node scripts/ci/run-chapter.mjs rust-runtime | |
| env: | |
| CARGO_INCREMENTAL: "0" | |
| CARGO_TARGET_DIR: ${{ runner.temp }}/cargo-target | |
| RELAYER_CARGO_TIMINGS_DIR: ${{ runner.temp }}/cargo-timings-rust-runtime | |
| CARGO_PROFILE_DEV_DEBUG: line-tables-only | |
| CARGO_PROFILE_TEST_DEBUG: line-tables-only | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| RELAYER_SCCACHE_ENABLED: ${{ steps.rust-setup.outputs.sccache-enabled }} | |
| RUSTC_WRAPPER: ${{ github.workspace }}/scripts/ci/sccache-wrapper.sh | |
| SCCACHE_CLIENT_SIDE: "1" | |
| SCCACHE_GHA_ENABLED: "true" | |
| SCCACHE_GHA_RW_MODE: ${{ needs.plan.outputs.rust == 'true' && 'READ_ONLY' || 'READ_WRITE' }} | |
| SCCACHE_GHA_VERSION: ${{ steps.rust-setup.outputs.cache-version }} | |
| SCCACHE_IGNORE_SERVER_IO_ERROR: "1" | |
| - name: Report runtime-build compiler cache | |
| if: ${{ always() }} | |
| continue-on-error: true | |
| uses: ./.github/actions/report-rust-compilation | |
| with: | |
| lane: rust-runtime | |
| sccache-enabled: ${{ steps.rust-setup.outputs.sccache-enabled }} | |
| - name: Seal selected Rust runtime | |
| run: | | |
| node scripts/ci/runtime-artifact.mjs create \ | |
| --repository "$GITHUB_WORKSPACE" \ | |
| --target-dir "$RUNNER_TEMP/cargo-target/debug" \ | |
| --artifact-dir "$RUNNER_TEMP/relayer-rust-runtime" \ | |
| --source-commit "$GITHUB_SHA" \ | |
| --platform "${{ runner.os }}-${{ runner.arch }}" \ | |
| --rustc-release "${{ steps.rust-setup.outputs.rustc-release }}" \ | |
| --cargo-profile "debug-line-tables-only" \ | |
| --plan-json "$CI_PLAN_JSON" | |
| env: | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| - name: Upload selected Rust runtime | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: rust-runtime-${{ github.sha }}-${{ runner.os }}-${{ runner.arch }} | |
| path: ${{ runner.temp }}/relayer-rust-runtime | |
| # Artifacts are immutable per run; overwrite lets "re-run all jobs" | |
| # replace the first attempt's bytes instead of failing the upload. | |
| overwrite: true | |
| if-no-files-found: error | |
| retention-days: 1 | |
| - name: Save trusted Rust dependency downloads for runtime-only changes | |
| if: ${{ github.event_name == 'push' && success() && needs.plan.outputs.rust != 'true' && steps.rust-setup.outputs.dependency-cache-hit != 'true' }} | |
| continue-on-error: true | |
| uses: actions/cache/save@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| key: ${{ steps.rust-setup.outputs.dependency-cache-key }} | |
| rust: | |
| name: Rust checks and fresh tests | |
| needs: [plan, quick, rust-clippy, rust-tests, rust-crash, rust-runtime] | |
| if: ${{ always() && needs.plan.result == 'success' && needs.quick.result == 'success' && needs.plan.outputs.rust == 'true' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up pinned Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .node-version | |
| - name: Assert every selected Rust lane passed | |
| run: node scripts/ci/assert-required-jobs.mjs | |
| env: | |
| CI_AGGREGATE: rust | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| CI_NEEDS_JSON: ${{ toJSON(needs) }} | |
| typescript: | |
| name: TypeScript builds | |
| needs: [plan, quick] | |
| if: ${{ needs.quick.result == 'success' && needs.plan.outputs.typescript == 'true' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up Node dependencies with evidence | |
| uses: ./.github/actions/setup-node-dependencies | |
| - name: Build selected TypeScript workspaces | |
| run: node scripts/ci/run-chapter.mjs typescript | |
| env: | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| vitest: | |
| name: Fresh deterministic Vitest portfolio | |
| needs: [plan, quick, rust-runtime] | |
| if: ${{ always() && needs.quick.result == 'success' && needs.plan.outputs.vitest == 'true' && ((needs.plan.outputs.rust_runtime == 'true' && needs['rust-runtime'].result == 'success') || needs.plan.outputs.rust_runtime != 'true') }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Node dependencies with evidence | |
| uses: ./.github/actions/setup-node-dependencies | |
| - name: Identify Rust artifact inputs | |
| id: rust-toolchain | |
| run: | | |
| rustc --version --verbose | |
| echo "release=$(rustc --version --verbose | sed -n 's/^release: //p')" >> "$GITHUB_OUTPUT" | |
| - name: Download selected Rust runtime | |
| if: ${{ needs.plan.outputs.rust_runtime == 'true' }} | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 | |
| with: | |
| name: rust-runtime-${{ github.sha }}-${{ runner.os }}-${{ runner.arch }} | |
| path: ${{ runner.temp }}/relayer-rust-runtime | |
| - name: Verify and install selected Rust runtime | |
| if: ${{ needs.plan.outputs.rust_runtime == 'true' }} | |
| run: | | |
| node scripts/ci/runtime-artifact.mjs verify \ | |
| --repository "$GITHUB_WORKSPACE" \ | |
| --artifact-dir "$RUNNER_TEMP/relayer-rust-runtime" \ | |
| --install-dir "$GITHUB_WORKSPACE/target/debug" \ | |
| --source-commit "$GITHUB_SHA" \ | |
| --platform "${{ runner.os }}-${{ runner.arch }}" \ | |
| --rustc-release "${{ steps.rust-toolchain.outputs.release }}" \ | |
| --cargo-profile "debug-line-tables-only" | |
| - name: Build non-Rust Vitest prerequisites | |
| run: node scripts/ci/run-chapter.mjs vitest-prerequisites | |
| env: | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| - name: Run fresh Vitest and secret-boundary tests | |
| run: node scripts/ci/run-chapter.mjs vitest | |
| env: | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| python: | |
| name: Fresh Python client tests | |
| needs: [plan, quick] | |
| if: ${{ needs.quick.result == 'success' && needs.plan.outputs.python == 'true' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up pinned Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .node-version | |
| - name: Run fresh Python tests | |
| run: node scripts/ci/run-chapter.mjs python | |
| env: | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| receipts: | |
| name: Receipt integrity | |
| needs: [plan, quick] | |
| if: ${{ needs.quick.result == 'success' && needs.plan.outputs.receipts == 'true' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up Node dependencies with evidence | |
| uses: ./.github/actions/setup-node-dependencies | |
| - name: Check receipt integrity | |
| run: node scripts/ci/run-chapter.mjs receipts | |
| env: | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| prd: | |
| name: PRD readability | |
| needs: [plan, quick] | |
| if: ${{ needs.quick.result == 'success' && needs.plan.outputs.prd == 'true' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up pinned Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .node-version | |
| - name: Check PRD readability | |
| run: node scripts/ci/run-chapter.mjs prd | |
| env: | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| packaging: | |
| name: Prime runtime package (${{ matrix.target }}) | |
| needs: [plan, quick] | |
| if: ${{ needs.quick.result == 'success' && needs.plan.outputs.packaging == 'true' }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # Apple Silicon is the only target smoke-packaged per PR. Intel macOS | |
| # and Windows x64 are still built at release time by | |
| # desktop-signed-preview.yml; re-add them here if they need per-PR | |
| # coverage again. | |
| - target: macos-arm64 | |
| runner: macos-15 | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up Node dependencies with evidence | |
| uses: ./.github/actions/setup-node-dependencies | |
| - name: Verify Node toolchain | |
| run: node scripts/check-node-version.mjs | |
| - name: Identify Rust cache inputs | |
| id: rust-toolchain | |
| run: | | |
| rustc --version --verbose | |
| echo "release=$(rustc --version --verbose | sed -n 's/^release: //p')" >> "$GITHUB_OUTPUT" | |
| echo "host=$(rustc --version --verbose | sed -n 's/^host: //p')" >> "$GITHUB_OUTPUT" | |
| - name: Start Rust cache timing | |
| id: rust-cache-timing | |
| run: echo "started=$(date +%s)" >> "$GITHUB_OUTPUT" | |
| - name: Restore packaging Rust compilation acceleration | |
| id: rust-cache | |
| uses: actions/cache/restore@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| target | |
| key: rust-packaging-${{ matrix.target }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.rust-toolchain.outputs.release }}-${{ steps.rust-toolchain.outputs.host }}-debug-default-v1-${{ hashFiles('Cargo.lock') }} | |
| restore-keys: | | |
| rust-packaging-${{ matrix.target }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.rust-toolchain.outputs.release }}-${{ steps.rust-toolchain.outputs.host }}-debug-default-v1- | |
| - name: Record packaging Rust cache status | |
| env: | |
| CACHE_HIT: ${{ steps.rust-cache.outputs.cache-hit }} | |
| STARTED: ${{ steps.rust-cache-timing.outputs.started }} | |
| run: | | |
| elapsed=$(($(date +%s) - STARTED)) | |
| echo "### Packaging Rust compilation cache" >> "$GITHUB_STEP_SUMMARY" | |
| echo "- Exact hit: ${CACHE_HIT:-false}" >> "$GITHUB_STEP_SUMMARY" | |
| echo "- Restore: ${elapsed}s" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Seed the locked Cargo dependency closure | |
| run: node scripts/ci/run-timed.mjs "Packaging Cargo fetch" cargo fetch --locked --target aarch64-apple-darwin | |
| - name: Build and inspect the actual target ASAR | |
| run: node scripts/ci/run-timed.mjs "Apple Silicon packaging" npm run desktop:pack | |
| env: | |
| RELAYER_DESKTOP_TARGET: ${{ matrix.target }} | |
| - name: Save trusted packaging Rust compilation acceleration | |
| if: ${{ github.event_name == 'push' && success() && steps.rust-cache.outputs.cache-hit != 'true' }} | |
| uses: actions/cache/save@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| target | |
| key: ${{ steps.rust-cache.outputs.cache-primary-key }} | |
| check: | |
| name: check | |
| if: always() | |
| needs: | |
| [plan, quick, rust, typescript, vitest, python, receipts, prd, packaging] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| - name: Set up pinned Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .node-version | |
| - name: Assert every selected required chapter passed | |
| run: node scripts/ci/assert-required-jobs.mjs | |
| env: | |
| CI_PLAN_JSON: ${{ needs.plan.outputs.plan }} | |
| CI_NEEDS_JSON: ${{ toJSON(needs) }} | |
| ladybug-windows-qualification: | |
| # Parked while Windows is not a release target. The pinned-source setup below | |
| # is preserved verbatim so re-enabling is a one-line change. This job has never | |
| # published a receipt; see docs/evidence/issue-261-ladybug-qualification.md. | |
| if: ${{ false }} | |
| name: Ladybug packaged qualification (windows-x64) (blocked) | |
| runs-on: windows-2025 | |
| timeout-minutes: 60 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .node-version | |
| cache: npm | |
| - run: node scripts/check-node-version.mjs | |
| - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1 | |
| with: | |
| arch: amd64 | |
| - run: npm ci | |
| - name: Seed the locked Cargo dependency closure | |
| shell: pwsh | |
| run: cargo fetch --locked --target x86_64-pc-windows-msvc | |
| - name: Fetch and prepare pinned Ladybug and static OpenSSL sources | |
| shell: pwsh | |
| run: | | |
| npm run ladybug:source -- fetch --cache "$env:RUNNER_TEMP/ladybug-cache" | |
| npm run ladybug:source -- prepare --cache "$env:RUNNER_TEMP/ladybug-cache" --output "$env:RUNNER_TEMP/ladybug-prepared" --target x86_64-pc-windows-msvc | |
| - name: Build, inspect, and exercise packaged Ladybug | |
| shell: pwsh | |
| env: | |
| RELAYER_DESKTOP_TARGET: windows-x64 | |
| SOURCE_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }} | |
| run: node scripts/capture-ladybug-packaged-lifecycle.mjs --source-output "$env:RUNNER_TEMP/ladybug-prepared" --source-commit "$env:SOURCE_COMMIT" --receipt-output "$env:RUNNER_TEMP/ladybug-windows-receipt.json" | |
| - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: ladybug-windows-qualification-${{ github.event.pull_request.head.sha || github.sha }} | |
| path: ${{ runner.temp }}/ladybug-windows-receipt.json | |
| if-no-files-found: error | |
| retention-days: 30 |