Venice_Forge/.github/workflows/ci.yml at 81aa1e22521539306b84d1795d80a87aec9858c8 · spearchucker667/Venice_Forge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

permissions:
  contents: read

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
      - name: Use Node.js 22
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Audit dependencies (release gate)
        run: npm audit --audit-level=moderate
        # Moderate+ vulnerabilities fail the build for production and build-time dependencies.
        # High-only would be too permissive for a security-sensitive third-party client.
      - run: npm run lint:eslint
      - run: npm run typecheck
      - run: npm run test:coverage
      - run: npm run build
      - run: npm run verify:contracts
      - run: npm run verify:dist

  # Windows-sensitive-tests: targets the path-handling and Electron-specific
  # filesystem regressions the recent Windows path bug exposed. The main
  # Ubuntu job covers the full suite, but Windows path separators and
  # process.platform branches (`win32`) only exercise correctly on a
  # real Windows runner. We pin a minimal Windows subset here:
  #   - typecheck
  #   - the Electron main-process services tests
  #   - the verify-safety-guard + verify-markdown-links gates
  # We do NOT mark these as continue-on-error: failures block the PR.
  windows-sensitive-tests:
    runs-on: windows-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
      - name: Use Node.js 22
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Typecheck (renderer + electron)
        run: npm run typecheck
      - name: Run Electron main-process tests on Windows
        run: npx vitest run electron/services/configService.test.ts electron/services/mediaService.test.ts electron/services/chatStorage.test.ts electron/services/characterCardStorage.test.ts electron/services/rpChatStorage.test.ts
      - name: Run renderer tests on Windows (Electron-sensitive subset)
        run: npx vitest run src/components/gallery src/components/image src/utils/payloadBuilders.test.ts src/services/prompt-enhancer-service.test.ts
      - name: Verify safety guard
        run: npm run verify:safety-guard
      - name: Verify markdown links
        run: npm run verify:markdown-links
      - name: Audit dependencies (release gate)
        run: npm audit --audit-level=moderate
      - name: Verify workspace contracts
        run: npm run verify:contracts
      - name: Build
        run: npm run build
      - name: Verify build output
        run: npm run verify:dist

  # macOS-sensitive-tests: exercises macOS-specific filesystem, safeStorage,
  # and Electron main-process assumptions that do not surface on Ubuntu or
  # Windows runners. Mirrors the Windows-sensitive subset for consistency.
  macos-sensitive-tests:
    runs-on: macos-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
      - name: Use Node.js 22
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Typecheck (renderer + electron)
        run: npm run typecheck
      - name: Run Electron main-process tests on macOS
        run: npx vitest run electron/services/configService.test.ts electron/services/mediaService.test.ts electron/services/chatStorage.test.ts electron/services/characterCardStorage.test.ts electron/services/rpChatStorage.test.ts electron/services/secureStore.test.ts electron/services/bridgeServer.test.ts
      - name: Run renderer tests on macOS (Electron-sensitive subset)
        run: npx vitest run src/components/gallery src/components/image src/utils/payloadBuilders.test.ts src/services/prompt-enhancer-service.test.ts
      - name: Verify safety guard
        run: npm run verify:safety-guard
      - name: Verify markdown links
        run: npm run verify:markdown-links
      - name: Audit dependencies (release gate)
        run: npm audit --audit-level=moderate
      - name: Verify workspace contracts
        run: npm run verify:contracts
      - name: Build
        run: npm run build
      - name: Verify build output
        run: npm run verify:dist

  # Packaged Electron smoke test: launches the real built .app on macOS to
  # catch packaging / runtime bootstrap regressions that unit tests cannot.
  # This depends on the Ubuntu build-and-test job to avoid burning runner
  # minutes when the core suite is already broken.
  electron-smoke-macos:
    runs-on: macos-latest
    timeout-minutes: 45
    needs: build-and-test
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
      - name: Use Node.js 22
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Package macOS app
        run: npm run dist:mac:arm64
      - name: Run packaged Electron smoke test
        run: npx vitest run tests/smoke/electron-smoke.test.ts
        env:
          RUN_ELECTRON_SMOKE: 'true'

  # Packaged Electron smoke test on Windows
  electron-smoke-windows:
    runs-on: windows-latest
    timeout-minutes: 45
    needs: build-and-test
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
      - name: Use Node.js 22
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Package Windows portable app
        run: npm run dist:portable
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: "false"
      - name: Verify Windows portable artifact
        run: npm run verify:dist:portable
      - name: Run packaged Electron smoke test
        run: npx vitest run tests/smoke/electron-smoke.test.ts
        env:
          RUN_ELECTRON_SMOKE: 'true'