chore(repo): remove agent and planning documents from the published repo #110
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| permissions: | |
| contents: read | |
| jobs: | |
| matrix-rust: | |
| name: Matrix Rust (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0 | |
| with: | |
| components: clippy, rustfmt | |
| - name: Install system dependencies (Linux) | |
| if: matrix.os == 'ubuntu-latest' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| libwebkit2gtk-4.1-dev \ | |
| libappindicator3-dev \ | |
| librsvg2-dev \ | |
| patchelf \ | |
| libssl-dev \ | |
| libsqlcipher-dev | |
| - name: Cache cargo registry & build | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| mesh/src-tauri/target | |
| key: ${{ runner.os }}-cargo-matrix-${{ hashFiles('mesh/src-tauri/Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-cargo-matrix- | |
| - name: Check Matrix backend | |
| working-directory: mesh/src-tauri | |
| run: cargo check --no-default-features --features matrix-backend --locked --jobs 1 | |
| - name: Lint Matrix backend and tests | |
| working-directory: mesh/src-tauri | |
| run: cargo clippy --no-default-features --features matrix-backend --all-targets --locked --jobs 1 -- -D warnings | |
| - name: Check Rust formatting | |
| working-directory: mesh/src-tauri | |
| run: cargo fmt --check | |
| - name: Check generated TypeScript IPC DTOs | |
| working-directory: mesh | |
| run: npm run check:ipc-types | |
| - name: Check behavior-level security boundaries | |
| working-directory: mesh | |
| run: npm run check:security-invariants:matrix | |
| - name: Test Matrix backend | |
| working-directory: mesh/src-tauri | |
| run: cargo test --no-default-features --features matrix-backend --locked --jobs 1 | |
| legacy-rust: | |
| name: Legacy LAN Rust | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0 | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| libwebkit2gtk-4.1-dev \ | |
| libappindicator3-dev \ | |
| librsvg2-dev \ | |
| patchelf \ | |
| libssl-dev \ | |
| libsqlcipher-dev | |
| - name: Cache cargo registry & legacy build | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| mesh/src-tauri/target | |
| key: ${{ runner.os }}-cargo-legacy-${{ hashFiles('mesh/src-tauri/Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-cargo-legacy- | |
| - name: Check legacy LAN backend | |
| working-directory: mesh/src-tauri | |
| run: cargo check --no-default-features --features legacy-p2p --locked --jobs 1 | |
| - name: Test legacy LAN backend | |
| working-directory: mesh/src-tauri | |
| run: cargo test --no-default-features --features legacy-p2p --locked --jobs 1 | |
| - name: Check legacy behavior-level security boundaries | |
| working-directory: mesh | |
| run: npm run check:security-invariants:legacy | |
| check-frontend: | |
| name: Frontend Build & Browser E2E | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| # The readiness validator binds sourceTreeHash to an exact historical | |
| # sourceCommit, so a synthetic depth-one PR merge is insufficient. | |
| fetch-depth: 0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: mesh/package-lock.json | |
| - name: Install dependencies | |
| working-directory: mesh | |
| run: npm ci | |
| - name: TypeScript check | |
| working-directory: mesh | |
| run: npx tsc --noEmit | |
| - name: Lint React compiler and Zustand selector contracts | |
| working-directory: mesh | |
| run: npm run lint | |
| - name: Check Tauri IPC command contract | |
| working-directory: mesh | |
| run: npm run check:ipc-contract | |
| - name: Check design token source of truth | |
| working-directory: mesh | |
| run: npm run check:design-tokens | |
| - name: Check icon source of truth | |
| working-directory: mesh | |
| run: npm run check:icons | |
| - name: Check reviewed public services | |
| working-directory: mesh | |
| run: npm run check:public-services | |
| - name: Check production readiness ledger | |
| working-directory: mesh | |
| run: | | |
| node --test scripts/check-readiness-ledger.test.mjs | |
| npm run check:readiness-ledger | |
| - name: Check fail-closed external acceptance contract | |
| working-directory: mesh | |
| run: | | |
| node --test scripts/check-external-acceptance.test.mjs | |
| node scripts/check-external-acceptance.mjs | |
| - name: Check public site source | |
| working-directory: mesh | |
| run: npm run check:public-site | |
| - name: Check beta product boundary | |
| working-directory: mesh | |
| run: npm run check:beta-contract | |
| - name: Check production operations boundary | |
| working-directory: mesh | |
| run: npm run check:operations-contract | |
| - name: Check third-party notices and licenses | |
| working-directory: mesh | |
| run: npm run check:third-party-notices | |
| - name: Check homeserver recovery scripts | |
| working-directory: mesh | |
| run: | | |
| shellcheck -x -e SC1007 infra/homeserver/*.sh infra/homeserver/tests/*.sh | |
| for test_script in infra/homeserver/tests/*.test.sh; do | |
| sh "$test_script" | |
| done | |
| python -m unittest discover -s infra/homeserver/tests -p 'test_*.py' -v | |
| cp infra/homeserver/.env.example infra/homeserver/.env | |
| trap 'rm -f infra/homeserver/.env' EXIT | |
| docker compose \ | |
| -f infra/homeserver/docker-compose.yml config --quiet | |
| - name: Run tests | |
| working-directory: mesh | |
| run: npm run test -- --maxWorkers=4 | |
| - name: Build frontend | |
| working-directory: mesh | |
| run: npm run build | |
| - name: Enforce frontend entry bundle budget | |
| working-directory: mesh | |
| run: npm run check:bundle-size | |
| - name: Install Playwright browser | |
| working-directory: mesh | |
| run: npm run e2e:install -- --with-deps | |
| - name: Run browser E2E tests and WCAG scans | |
| working-directory: mesh | |
| run: npm run e2e |