Merge pull request #5608 from nodetool-ai/claude/macos-timeline-zoom-… #1130
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: User Journeys | |
| # Nightly + on demand (browser journeys) and on every push to main (the new | |
| # reliability-ring1 job) — the browser suite is deliberately NOT a | |
| # pull-request gate; the reliability-ring1 job IS a merge-to-main gate (see | |
| # below), which is why this workflow now also triggers on `push`. | |
| # | |
| # The journey suite drives whole flows through a real browser (build a graph and | |
| # run it, send a chat message, run a mini app, browse the library), so it is | |
| # slower and has more moving parts than the page-load smoke suite. Running it | |
| # nightly first lets it prove it is stable before it is allowed to block a | |
| # merge. | |
| # | |
| # Required from 2026-08-15 as a Ring 1 (merge-to-main) check — flip | |
| # continue-on-error to false then. Tracked in .github/workflows/README.md. | |
| on: | |
| schedule: | |
| # 03:30 UTC daily. | |
| - cron: "30 3 * * *" | |
| push: | |
| # Only to run the reliability-ring1 job (below) as a merge-to-main gate — | |
| # the legacy `journeys` job below skips on `push` and stays nightly/manual | |
| # until its own 2026-08-15 promotion. | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # On main, every commit's reliability-ring1 run must reach a conclusion of its | |
| # own: fly-deploy.yml gates the deploy on this workflow's result for that exact | |
| # head_sha, so a run cancelled by a follow-up merge reads as "Ring 1 failed" and | |
| # blocks the release. Same reasoning (and same expression) as docker.yml. | |
| # Elsewhere — PR branches, tags — superseded runs are still cancelled. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/') }} | |
| jobs: | |
| journeys: | |
| name: Drive the app the way a user does | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| # Nightly/manual only — `push` fires this workflow purely for | |
| # reliability-ring1 (below), which gates fly-deploy.yml on its own. Keeps | |
| # this job's cadence unchanged by that addition. | |
| if: github.event_name != 'push' | |
| # Report failures without failing the workflow run, so a flaky night does | |
| # not page anyone while the suite is still earning trust. Required from | |
| # 2026-08-15 — flip this to false then. Tracked in | |
| # .github/workflows/README.md. | |
| continue-on-error: true | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version-file: ".nvmrc" | |
| cache: "npm" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build workspace packages | |
| # The seeded backend (tests/globalSetup.ts) imports @nodetool-ai/* via | |
| # the `development` export condition, which resolves to each package's | |
| # compiled dist/. Build them first. | |
| run: npm run build:packages | |
| - name: Type-check journey suite | |
| working-directory: web | |
| run: npm run typecheck:journeys | |
| - name: Install Playwright Chromium browser | |
| # mesa-vulkan-drivers ships lavapipe (CPU Vulkan ICD) so headless | |
| # Chromium can acquire a WebGPU adapter on GPU-less runners. | |
| working-directory: web | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y mesa-vulkan-drivers | |
| npx playwright install --with-deps chromium | |
| - name: Run user-journey suite | |
| working-directory: web | |
| env: | |
| CI: "true" | |
| # Deterministic test-only master key committed in tests/globalSetup.ts. | |
| # Never use in production. | |
| SECRETS_MASTER_KEY: "U0NSRUVOU0hPVF9URVNUX0tFWV9ET19OT1RfVVNFISE=" | |
| run: npm run test:journeys | |
| - name: Upload journey report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: user-journeys-report | |
| path: | | |
| web/playwright-report/ | |
| web/test-results/ | |
| retention-days: 14 | |
| reliability-ring1: | |
| name: Reliability Ring 1 (full hermetic suite + differential + packaged) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| # Runs on every push to main, on schedule (alongside the nightly browser | |
| # suite), and on manual dispatch. Never `continue-on-error`: this job is | |
| # the Ring 1 gate docs/RELIABILITY_ARCHITECTURE.md §11 describes — a | |
| # failure here must fail this workflow run, because fly-deploy.yml's gate | |
| # job (below) reads this workflow's overall conclusion for the pushed | |
| # commit before deploying. | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version-file: ".nvmrc" | |
| cache: "npm" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build workspace packages | |
| run: npm run build:packages | |
| - name: Install system libraries for keytar | |
| # electron/scripts/prepare-backend.mjs's staging step (used by the | |
| # packaged-journey run below) shells out through the electron | |
| # workspace, which needs keytar's native build deps present. | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libsecret-1-dev | |
| # Full hermetic suite (every reliability/journeys/* journey) on kernel | |
| # (oracle, strict) + ws-server, cross-surface diffed (`--diff`), plus | |
| # one packaged-backend journey (§5 item 15's pattern: journey 1 against | |
| # the staged `server.mjs`) — `--packaged` stages the bundle first via | |
| # the same `npm run prepare-backend --workspace=electron` entry point | |
| # `backend:smoke` uses. | |
| - name: Run full reliability suite (kernel + ws-server + packaged) | |
| run: npm run reliability:ring1 -- --packaged |