| 1 | # Tests every pull request into main, so main can always be deployed. The |
| 2 | # "Default branch" ruleset requires this workflow ("CI") to pass before a |
| 3 | # pull request merges; people may still push to main directly, agents |
| 4 | # may not. Deploy (deploy.yml) ships what lands on main. |
| 5 | # |
| 6 | # rust every crate's tests, natively |
| 7 | # typescript type checks and tests of the apps and TS services, the |
| 8 | # deploy and ops scripts, and the deploy manifest |
| 9 | # build the site, sudo and the docs build as they deploy |
| 10 | # |
| 11 | # On a push to main only `rust` runs, to keep main's caches current: a pull |
| 12 | # request's run restores from main's cache, never from another pull |
| 13 | # request's, so without it each pull request would start from nothing. |
| 14 | name: CI |
| 15 | |
| 16 | on: |
| 17 | pull_request: |
| 18 | branches: [main] |
| 19 | push: |
| 20 | branches: [main] |
| 21 | workflow_dispatch: |
| 22 | |
| 23 | # Its token only reads: it checks the code out and nothing more. |
| 24 | permissions: |
| 25 | contents: read |
| 26 | |
| 27 | concurrency: |
| 28 | group: ci-${{ github.ref }} |
| 29 | cancel-in-progress: true |
| 30 | |
| 31 | env: |
| 32 | CARGO_TERM_COLOR: never |
| 33 | WRANGLER_SEND_METRICS: "false" |
| 34 | |
| 35 | jobs: |
| 36 | rust: |
| 37 | name: Rust |
| 38 | runs-on: g1t-4core |
| 39 | timeout-minutes: 45 |
| 40 | steps: |
| 41 | - uses: actions/checkout@v5 |
| 42 | - name: Cache crates |
| 43 | uses: actions/cache@v4 |
| 44 | with: |
| 45 | path: ~/.cargo/registry/cache |
| 46 | key: cargo-crates-${{ runner.os }}-${{ hashFiles('Cargo.lock') }} |
| 47 | restore-keys: cargo-crates-${{ runner.os }}- |
| 48 | - name: Cache the test build |
| 49 | uses: actions/cache@v4 |
| 50 | with: |
| 51 | path: | |
| 52 | target/debug |
| 53 | !target/debug/incremental |
| 54 | key: cargo-test-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'services/runner/base.json') }} |
| 55 | restore-keys: cargo-test-${{ runner.os }}- |
| 56 | # The workspace's library crates, which Cargo compiles again on every |
| 57 | # checkout, come back from the repository's Actions cache when their |
| 58 | # inputs did not change (scripts/sccache.sh). Test harnesses and |
| 59 | # Workers' own crates are linked, and still compiled. |
| 60 | - name: sccache |
| 61 | run: bash scripts/sccache.sh install |
| 62 | - name: Tests |
| 63 | run: cargo test --workspace --locked --quiet |
| 64 | - name: sccache's hits and misses |
| 65 | if: ${{ always() }} |
| 66 | run: bash scripts/sccache.sh stats |
| 67 | |
| 68 | typescript: |
| 69 | name: TypeScript |
| 70 | if: ${{ github.event_name != 'push' }} |
| 71 | runs-on: ubuntu-latest |
| 72 | timeout-minutes: 30 |
| 73 | steps: |
| 74 | - uses: actions/checkout@v5 |
| 75 | # npm's downloads, kept between runs: an install reads them first |
| 76 | # and asks the registry only for what changed, so a dropped |
| 77 | # connection to it rarely stops the job. |
| 78 | - name: Cache npm's downloads |
| 79 | uses: actions/cache@v4 |
| 80 | with: |
| 81 | path: ~/.npm |
| 82 | key: npm-${{ runner.os }}-${{ hashFiles('package-lock.json') }} |
| 83 | restore-keys: npm-${{ runner.os }}- |
| 84 | - name: Install |
| 85 | run: npm ci --prefer-offline --no-audit --no-fund |
| 86 | - name: Type checks |
| 87 | run: npm run typecheck |
| 88 | - name: Tests |
| 89 | run: npm test --workspaces --if-present |
| 90 | - name: The deploy tool's tests |
| 91 | run: npm run test:deploy |
| 92 | - name: The conformance report's tests |
| 93 | run: npm run test:conformance |
| 94 | - name: The ops scripts' tests |
| 95 | run: npm run test:ops |
| 96 | - name: The manifest matches every wrangler.jsonc |
| 97 | run: node scripts/deploy.mjs manifest --check |
| 98 | |
| 99 | build: |
| 100 | name: Build |
| 101 | if: ${{ github.event_name != 'push' }} |
| 102 | runs-on: ubuntu-latest |
| 103 | timeout-minutes: 30 |
| 104 | steps: |
| 105 | - uses: actions/checkout@v5 |
| 106 | # npm's downloads, kept between runs: an install reads them first |
| 107 | # and asks the registry only for what changed, so a dropped |
| 108 | # connection to it rarely stops the job. |
| 109 | - name: Cache npm's downloads |
| 110 | uses: actions/cache@v4 |
| 111 | with: |
| 112 | path: ~/.npm |
| 113 | key: npm-${{ runner.os }}-${{ hashFiles('package-lock.json') }} |
| 114 | restore-keys: npm-${{ runner.os }}- |
| 115 | - name: Install |
| 116 | run: npm ci --prefer-offline --no-audit --no-fund |
| 117 | - name: The site, sudo and the docs |
| 118 | run: node scripts/deploy.mjs build --only web,sudo,docs |
| 119 | |
| 120 | desktop: |
| 121 | name: Desktop app |
| 122 | # The larger machine, as the Rust job: linking Tauri on the small one |
| 123 | # ran out of room and the linker died with a bus error. |
| 124 | runs-on: g1t-4core |
| 125 | timeout-minutes: 30 |
| 126 | steps: |
| 127 | - uses: actions/checkout@v5 |
| 128 | - name: What Tauri needs on Linux |
| 129 | # Tried three times: the mirror has answered with a mismatched package before. |
| 130 | run: | |
| 131 | ok=0 |
| 132 | for try in 1 2 3; do |
| 133 | if sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential libxdo-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev; then ok=1; break; fi |
| 134 | sudo apt-get clean; sleep 15 |
| 135 | done |
| 136 | [ "$ok" = 1 ] |
| 137 | - uses: actions/cache@v4 |
| 138 | with: |
| 139 | path: | |
| 140 | ~/.cargo/registry |
| 141 | apps/desktop/src-tauri/target |
| 142 | key: desktop-check-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }} |
| 143 | # Outside the workspace on purpose (Cargo.toml says why): checked and |
| 144 | # tested here, built into installers by desktop-release.yml. |
| 145 | - name: Check and test |
| 146 | run: cargo test --locked --manifest-path apps/desktop/src-tauri/Cargo.toml --quiet |
| 147 | - name: The release scripts' tests |
| 148 | run: node --test scripts/desktop-release.test.mjs scripts/mobile-release.test.mjs |