| 1 | # Tests every pull request into main, so main can always be deployed. The |
| 2 | # "Default branch" ruleset requires this workflow ("CI") to pass before a |
| 3 | # pull request merges; people may still push to main directly, agents |
| 4 | # may not. Deploy (deploy.yml) ships what lands on main. |
| 5 | # |
| 6 | # rust every crate's tests, natively |
| 7 | # typescript type checks and tests of the apps and TS services, the |
| 8 | # deploy and ops scripts, and the deploy manifest |
| 9 | # build the site, sudo and the docs build as they deploy |
| 10 | name: CI |
| 11 | |
| 12 | on: |
| 13 | pull_request: |
| 14 | branches: [main] |
| 15 | workflow_dispatch: |
| 16 | |
| 17 | # Its token only reads: it checks the code out and nothing more. |
| 18 | permissions: |
| 19 | contents: read |
| 20 | |
| 21 | concurrency: |
| 22 | group: ci-${{ github.ref }} |
| 23 | cancel-in-progress: true |
| 24 | |
| 25 | env: |
| 26 | CARGO_TERM_COLOR: never |
| 27 | WRANGLER_SEND_METRICS: "false" |
| 28 | |
| 29 | jobs: |
| 30 | rust: |
| 31 | name: Rust |
| 32 | runs-on: g1t-4core |
| 33 | timeout-minutes: 45 |
| 34 | steps: |
| 35 | - uses: actions/checkout@v5 |
| 36 | - name: Cache crates |
| 37 | uses: actions/cache@v4 |
| 38 | with: |
| 39 | path: ~/.cargo/registry/cache |
| 40 | key: cargo-crates-${{ runner.os }}-${{ hashFiles('Cargo.lock') }} |
| 41 | restore-keys: cargo-crates-${{ runner.os }}- |
| 42 | - name: Cache the test build |
| 43 | uses: actions/cache@v4 |
| 44 | with: |
| 45 | path: | |
| 46 | target/debug |
| 47 | !target/debug/incremental |
| 48 | key: cargo-test-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'services/runner/base.json') }} |
| 49 | restore-keys: cargo-test-${{ runner.os }}- |
| 50 | - name: Tests |
| 51 | run: cargo test --workspace --locked --quiet |
| 52 | |
| 53 | typescript: |
| 54 | name: TypeScript |
| 55 | runs-on: ubuntu-latest |
| 56 | timeout-minutes: 30 |
| 57 | steps: |
| 58 | - uses: actions/checkout@v5 |
| 59 | - name: Install |
| 60 | run: npm ci --no-audit --no-fund |
| 61 | - name: Type checks |
| 62 | run: npm run typecheck |
| 63 | - name: Tests |
| 64 | run: npm test --workspaces --if-present |
| 65 | - name: The deploy tool's tests |
| 66 | run: npm run test:deploy |
| 67 | - name: The ops scripts' tests |
| 68 | run: npm run test:ops |
| 69 | - name: The manifest matches every wrangler.jsonc |
| 70 | run: node scripts/deploy.mjs manifest --check |
| 71 | |
| 72 | build: |
| 73 | name: Build |
| 74 | runs-on: ubuntu-latest |
| 75 | timeout-minutes: 30 |
| 76 | steps: |
| 77 | - uses: actions/checkout@v5 |
| 78 | - name: Install |
| 79 | run: npm ci --no-audit --no-fund |
| 80 | - name: The site, sudo and the docs |
| 81 | run: node scripts/deploy.mjs build --only web,sudo,docs |