feat: MU1 multi-user control plane (opt-in, SH_REQUIRE_AUTH=false by default) #413

Workflow file for this run

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	check:
	runs-on: ubuntu-latest
	timeout-minutes: 15
	services:
	redis:
	image: redis:7
	ports:
	- 6379:6379
	options: >-
	--health-cmd "redis-cli ping"
	--health-interval 10s
	--health-timeout 5s
	--health-retries 5
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	submodules: recursive

	- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
	with:
	node-version: '22'

	- uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
	with:
	version: 9

	- name: Cache pnpm store
	uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	with:
	path: ~/.local/share/pnpm/store/v3
	key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
	restore-keys: pnpm-

	- name: Cache pi-fork node_modules
	uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	with:
	path: pi-fork/node_modules
	key: pi-fork-${{ hashFiles('pi-fork/package-lock.json') }}
	restore-keys: pi-fork-

	- name: Build pi-fork (type declarations)
	run: cd pi-fork && npm ci && npm run build

	- name: Install workspace
	run: pnpm install --frozen-lockfile

	# Same recursive run as `make typecheck`, so the two cannot drift apart by editing a
	# list in one of them. See the Makefile target for why that matters (#191).
	- name: Typecheck
	run: pnpm -r typecheck

	- name: Test
	run: pnpm -r test

	# Runs the same `make lint` (pre-commit over all files) that contributors run locally, so
	# a config that silently executes zero hooks can no longer look identical to a green
	# build -- which is exactly how the broken `typescript` identify tag survived unnoticed.
	# Needs node/pnpm because the prettier hook drives the repo's own pinned Prettier, and
	# needs the pi-fork submodule because the workspace links into it.
	lint:
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	submodules: recursive

	- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
	with:
	node-version: '22'

	- uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
	with:
	version: 9

	- name: Cache pre-commit environments
	uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	with:
	path: ~/.cache/pre-commit
	key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
	restore-keys: pre-commit-

	- name: Install workspace
	run: pnpm install --frozen-lockfile

	- name: Install pre-commit
	run: pipx install pre-commit==4.3.0

	- name: Run hooks
	run: make lint

	# The deploy/ shell tests are cluster-free (kubectl/kind/docker are mocked on PATH), so
	# they need no node, no pnpm and no cluster -- hence their own fast job rather than a step
	# tacked onto `check`. Without this job nothing runs them: security-scans.yml only
	# shellchecks deploy/, and the live gate (RELAY_LIVE_SMOKE=1) cannot run in CI at all.
	deploy-scripts:
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- name: Run deploy shell tests
	run: make test-deploy

	- name: Verify sandbox inventory against the image
	run: \|
	jq --version
	IMAGE=ghcr.io/rossoctl/serverless-harness-sandbox:latest
	docker pull "$IMAGE" \|\| {
	echo "::warning title=Sandbox inventory drift check skipped::could not pull $IMAGE; inventory drift is UNVERIFIED"
	exit 0
	}
	bash deploy/knative/verify-sandbox-inventory.sh "$IMAGE"

	proto:
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1
	with:
	version: '1.71.0'
	github_token: ${{ github.token }}

	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: gen/go/go.mod

	- name: Lint proto
	run: buf lint

	- name: Regenerate stubs
	run: buf generate

	- name: Verify no codegen drift
	run: \|
	git add -A -- packages/k8s-sandbox/src/gen gen
	git diff --cached --exit-code -- packages/k8s-sandbox/src/gen gen \
	\|\| { echo "::error::Generated stubs are out of date or untracked. Run 'buf generate' and commit."; exit 1; }

	# A module left out of go.work falls back to standalone resolution and brings
	# back the stale-go.mod failure the workspace exists to prevent (#212).
	- name: Verify go.work covers every module
	run: \|
	covered="$(go work edit -json \| jq -r '.Use[].DiskPath')"
	rc=0
	while read -r mod; do
	dir="./$(dirname "$mod")"
	grep -qxF "$dir" <<<"$covered" \
	\|\| { echo "::error file=$mod::$mod is not listed in go.work -- add \"$dir\" to the use block."; rc=1; }
	done < <(git ls-files \| grep -E '(^\|/)go\.mod$')
	exit $rc

	- name: Build and test Go stubs
	run: cd gen/go && go build ./... && go test ./...

	- name: Build and test remote-worker
	working-directory: remote-worker
	run: \|
	test -z "$(gofmt -l .)" \|\| { echo "::error::gofmt needs running:"; gofmt -l .; exit 1; }
	go vet ./...
	go test -race ./...

	# Advisory only. In workspace mode a stale go.mod no longer breaks the build, so
	# this is hygiene rather than correctness -- and failing here would put Dependabot's
	# coupled bumps back in the red, which is the whole point of #212. Neither module is
	# consumed externally (gen/go is reached only through the local replace), so drift
	# can be tidied whenever convenient.
	- name: Check go.mod tidiness (advisory)
	run: \|
	for mod in gen/go remote-worker; do
	(cd "$mod" && go mod tidy -diff) \
	\|\| echo "::warning file=$mod/go.mod::$mod/go.mod is not tidy -- run 'cd $mod && go mod tidy'"
	done

Navigation Menu

Uh oh!

feat: MU1 multi-user control plane (opt-in, SH_REQUIRE_AUTH=false by default) #413

Workflow file

feat: MU1 multi-user control plane (opt-in, SH_REQUIRE_AUTH=false by default) #413

Uh oh!

Workflow file for this run