Merge pull request #290 from the-open-engine/zeroshot/spinning-aegis-96 #367
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| - dev | |
| push: | |
| branches: | |
| - main | |
| - dev | |
| merge_group: | |
| branches: | |
| - main | |
| - dev | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| enforce-main-pr-source: | |
| if: github.event_name == 'pull_request' && github.base_ref == 'main' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check PR source branch | |
| run: | | |
| if [[ "${{ github.head_ref }}" != "dev" ]]; then | |
| echo "::error::PRs to main MUST come from the dev branch." | |
| echo "" | |
| echo "Blocked PR from '${{ github.head_ref }}' to main." | |
| echo "" | |
| echo "Correct workflow:" | |
| echo " 1. Merge feature work into dev." | |
| echo " 2. Open the release PR from dev to main." | |
| exit 1 | |
| fi | |
| echo "PR from dev to main is allowed." | |
| check: | |
| name: check | |
| needs: [enforce-main-pr-source] | |
| if: always() && (needs.enforce-main-pr-source.result == 'success' || needs.enforce-main-pr-source.result == 'skipped') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Provision pinned Ruff proof artifact | |
| run: | | |
| python -m pip install --disable-pip-version-check ruff==0.6.9 | |
| test "$(ruff --version)" = "ruff 0.6.9" | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: x86_64-unknown-linux-musl | |
| - name: Setup Linux musl toolchain | |
| run: sudo apt-get update && sudo apt-get install -y musl-tools | |
| - name: Install | |
| run: npm ci | |
| - name: Install authoritative mypy | |
| run: python -m pip install --disable-pip-version-check mypy==2.3.0 | |
| - name: Install authoritative Pyright | |
| run: npm install --prefix "${RUNNER_TEMP}/opcore-pyright" --no-package-lock --ignore-scripts pyright@1.1.411 | |
| - name: Check | |
| run: npm run ci | |
| - name: Prove authoritative mypy after-state execution | |
| run: npm run python:mypy-authority-proof | |
| env: | |
| OPCORE_REAL_MYPY: ${{ env.pythonLocation }}/bin/mypy | |
| - name: Prove authoritative Pyright after-state execution | |
| run: npm run python:pyright-authority-proof | |
| env: | |
| OPCORE_REAL_PYRIGHT: ${{ runner.temp }}/opcore-pyright/node_modules/.bin/pyright | |
| native-artifact: | |
| name: native-artifact (${{ matrix.target }}) | |
| needs: check | |
| if: | | |
| always() && | |
| needs.check.result == 'success' && | |
| ( | |
| github.ref == 'refs/heads/main' || | |
| (github.event_name == 'pull_request' && github.base_ref == 'main') || | |
| (github.event_name == 'merge_group' && ( | |
| github.event.merge_group.base_ref == 'main' || | |
| github.event.merge_group.base_ref == 'refs/heads/main' || | |
| startsWith(github.ref, 'refs/heads/gh-readonly-queue/main/') | |
| )) | |
| ) | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: linux-x64 | |
| runner: ubuntu-latest | |
| rust_target: x86_64-unknown-linux-musl | |
| - target: darwin-x64 | |
| runner: macos-15-large | |
| rust_target: x86_64-apple-darwin | |
| - target: darwin-arm64 | |
| runner: macos-15-xlarge | |
| rust_target: aarch64-apple-darwin | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.rust_target }} | |
| - name: Setup Linux musl toolchain | |
| if: matrix.target == 'linux-x64' | |
| run: sudo apt-get update && sudo apt-get install -y musl-tools | |
| - name: Install | |
| run: npm ci | |
| - name: Build native graph artifact | |
| run: node scripts/build-graph-core-artifact.mjs --target ${{ matrix.target }} | |
| - name: Release dry-run | |
| run: npm run release:dry-run | |
| - name: Archive graph artifacts | |
| run: tar -C packages/opcore-graph-core-${{ matrix.target }} -czf "${RUNNER_TEMP}/opcore-graph-core-${{ matrix.target }}.tgz" . | |
| - name: Upload graph artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: opcore-graph-core-${{ matrix.target }} | |
| path: ${{ runner.temp }}/opcore-graph-core-${{ matrix.target }}.tgz | |
| aggregate: | |
| name: aggregate | |
| needs: [check, native-artifact] | |
| if: | | |
| always() && | |
| needs.check.result == 'success' && | |
| needs.native-artifact.result == 'success' && | |
| ( | |
| github.ref == 'refs/heads/main' || | |
| (github.event_name == 'pull_request' && github.base_ref == 'main') || | |
| (github.event_name == 'merge_group' && ( | |
| github.event.merge_group.base_ref == 'main' || | |
| github.event.merge_group.base_ref == 'refs/heads/main' || | |
| startsWith(github.ref, 'refs/heads/gh-readonly-queue/main/') | |
| )) | |
| ) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install | |
| run: npm ci | |
| - name: Download darwin arm64 artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: opcore-graph-core-darwin-arm64 | |
| path: ${{ runner.temp }}/opcore-graph-core-darwin-arm64 | |
| - name: Download darwin x64 artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: opcore-graph-core-darwin-x64 | |
| path: ${{ runner.temp }}/opcore-graph-core-darwin-x64 | |
| - name: Download linux x64 artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: opcore-graph-core-linux-x64 | |
| path: ${{ runner.temp }}/opcore-graph-core-linux-x64 | |
| - name: Extract native graph artifacts | |
| run: | | |
| rm -rf packages/opcore-graph-core-darwin-arm64 packages/opcore-graph-core-darwin-x64 packages/opcore-graph-core-linux-x64 | |
| mkdir -p packages/opcore-graph-core-darwin-arm64 packages/opcore-graph-core-darwin-x64 packages/opcore-graph-core-linux-x64 | |
| tar -xzf "${RUNNER_TEMP}/opcore-graph-core-darwin-arm64/opcore-graph-core-darwin-arm64.tgz" -C packages/opcore-graph-core-darwin-arm64 | |
| tar -xzf "${RUNNER_TEMP}/opcore-graph-core-darwin-x64/opcore-graph-core-darwin-x64.tgz" -C packages/opcore-graph-core-darwin-x64 | |
| tar -xzf "${RUNNER_TEMP}/opcore-graph-core-linux-x64/opcore-graph-core-linux-x64.tgz" -C packages/opcore-graph-core-linux-x64 | |
| - name: Build JS artifacts | |
| run: node node_modules/typescript/bin/tsc -b --pretty false && node scripts/write-cli-descriptor.mjs && node scripts/write-asp-provider-manifest.mjs | |
| - name: Release dry-run | |
| run: npm run release:dry-run | |
| env: | |
| OPCORE_REQUIRE_ALL_NATIVE_PACKAGES: "1" | |
| - name: Pack, release, and cutover checks | |
| run: npm run pack:check && npm run release-receipt:check && npm run cutover:check | |
| env: | |
| OPCORE_REQUIRE_ALL_NATIVE_PACKAGES: "1" | |
| OPCORE_CUTOVER_REUSE_CURRENT_TOOL_GUARDRAILS: "1" |