CI #3188
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Baseline CI — seeded once by socket-wheelhouse (template/presets/), then | |
| # repo-owned: edit freely. Runs check + test via the LOCAL composite actions | |
| # under .github/actions/fleet/ (cascade-updated), referenced by ./ path — no | |
| # cross-repo reusable workflow, no first-party `uses:@sha`. Add repo-specific | |
| # jobs anywhere under `jobs:`. | |
| name: 🧪 CI | |
| run-name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['*'] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # Fleet no-phone-home posture: the setup action exports every FLEET_ENV knob at | |
| # runtime from .github/actions/fleet/setup/fleet-env.json, which is THE one list | |
| # the shell-rc bridge, telemetry-env-is-disabled.mts and spawned agents all | |
| # derive from. Declaring them workflow-level as well is a second copy that | |
| # drifts from that list, which is what workflow-env-is-action-supplied flags. | |
| jobs: | |
| # First step of every job is the third-party actions/checkout (GitHub fetches | |
| # it independently) to populate the workspace so the LOCAL `./.github/actions/*` | |
| # composites resolve. setup-and-install then re-checks-out — full history | |
| # (fetch-depth 0) in the check job, since the commit-history checks it runs | |
| # (AI-attribution, release-boundary) read the default branch's history and | |
| # refuse a shallow clone rather than false-green; the test matrix stays at | |
| # the default depth (25 — covers CI's other git operations) and runs the | |
| # zizmor Actions audit (its own `strategy.job-total < 2` skip runs it in the | |
| # non-matrix check job, skips it in the test matrix). | |
| check: | |
| name: Check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| # First step cannot call the local ./.github/actions/fleet/checkout | |
| # composite - nothing is checked out yet for GitHub to resolve | |
| # `./.github/actions/*` from - so the workspace is bootstrapped with the | |
| # same inline git-fetch shape, non-persisting auth. | |
| - name: Bootstrap checkout | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| SERVER_URL: ${{ github.server_url }} | |
| REPOSITORY: ${{ github.repository }} | |
| TRIGGER_REF: ${{ github.sha }} | |
| FETCH_DEPTH: '1' | |
| run: | | |
| set -euo pipefail | |
| git init -q | |
| git config --local advice.detachedHead false | |
| git remote remove origin 2>/dev/null || true | |
| git remote add origin "${SERVER_URL}/${REPOSITORY}" | |
| FETCH_ARGS=(--no-tags --prune --depth "${FETCH_DEPTH}" origin "${TRIGGER_REF}") | |
| if [ -n "${GITHUB_TOKEN}" ]; then | |
| AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')" | |
| git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}" | |
| else | |
| git fetch "${FETCH_ARGS[@]}" | |
| fi | |
| git checkout -q --detach FETCH_HEAD | |
| - name: Set up and install | |
| uses: ./.github/actions/fleet/setup-and-install | |
| with: | |
| # Full history: the commit-history checks (AI-attribution, | |
| # release-boundary) read the default branch's history and refuse a | |
| # shallow clone rather than false-green. | |
| checkout-fetch-depth: '0' | |
| socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} | |
| # Reuse the PR App for a contents:read token scoped to wheelhouse. | |
| # Both credentials enable the private release fallback. Without the | |
| # key, hydration still pulls public GHCR anonymously. | |
| payload-token-client-id: ${{ vars.SOCKET_PR_CLIENT_ID }} | |
| payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }} | |
| - name: Run script | |
| uses: ./.github/actions/fleet/run-script | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| with: | |
| setup-script: pnpm run build | |
| main-script: pnpm run check --all | |
| test: | |
| name: Test (${{ matrix.os }}) | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 4 | |
| matrix: | |
| # JS/TS tests only need a fast Linux run; cross-platform behavior is | |
| # covered by unit tests, not the CI matrix. | |
| os: [ubuntu-latest] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 15 | |
| steps: | |
| # Depth: 1 is enough to run the full suite, but `pnpm test --ci` needs a | |
| # merge base to diff against, and a one-commit clone has none. Deepen on | |
| # a pull request only; every other event runs `--all`, which needs no | |
| # history at all and keeps the cheap depth-1 fetch. | |
| # First step cannot call the local ./.github/actions/fleet/checkout | |
| # composite - nothing is checked out yet for GitHub to resolve | |
| # `./.github/actions/*` from - so the workspace is bootstrapped with the | |
| # same inline git-fetch shape, non-persisting auth. | |
| - name: Bootstrap checkout | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| SERVER_URL: ${{ github.server_url }} | |
| REPOSITORY: ${{ github.repository }} | |
| TRIGGER_REF: ${{ github.sha }} | |
| FETCH_DEPTH: ${{ github.event_name == 'pull_request' && 50 || 1 }} | |
| run: | | |
| set -euo pipefail | |
| git init -q | |
| git config --local advice.detachedHead false | |
| git remote remove origin 2>/dev/null || true | |
| git remote add origin "${SERVER_URL}/${REPOSITORY}" | |
| FETCH_ARGS=(--no-tags --prune --depth "${FETCH_DEPTH}" origin "${TRIGGER_REF}") | |
| if [ -n "${GITHUB_TOKEN}" ]; then | |
| AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')" | |
| git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}" | |
| else | |
| git fetch "${FETCH_ARGS[@]}" | |
| fi | |
| git checkout -q --detach FETCH_HEAD | |
| # The base branch as a remote-tracking ref, so resolveCiBaseRef can find | |
| # it. A failure here is NOT fatal: with no base ref the scope decision | |
| # escalates to the full suite, which is the safe answer. | |
| - name: Fetch the base branch for the diff | |
| if: github.event_name == 'pull_request' | |
| shell: bash | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| run: | | |
| set -euo pipefail | |
| git fetch --no-tags --depth 50 origin \ | |
| "+refs/heads/${BASE_REF}:refs/remotes/origin/${BASE_REF}" || true | |
| - name: Set up and install | |
| uses: ./.github/actions/fleet/setup-and-install | |
| with: | |
| socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} | |
| # Reuse the PR App for a contents:read token scoped to wheelhouse. | |
| # Both credentials enable the private release fallback. Without the | |
| # key, hydration still pulls public GHCR anonymously. | |
| payload-token-client-id: ${{ vars.SOCKET_PR_CLIENT_ID }} | |
| payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }} | |
| - name: Run script | |
| uses: ./.github/actions/fleet/run-script | |
| env: | |
| # Authenticate build-time GitHub API reads (release listings, | |
| # prebuilt-artifact downloads). Unauthenticated calls share the | |
| # hosted runner's IP-scoped rate limit and 403 under load. | |
| GH_TOKEN: ${{ github.token }} | |
| with: | |
| setup-script: pnpm run build | |
| # The diff-aware suite escalates when it cannot resolve a safe scope. | |
| # Coverage shards verify the complete suite on each pushed commit. | |
| main-script: pnpm run test --ci | |
| cover-shards: | |
| if: github.event_name != 'pull_request' | |
| outputs: | |
| shard-count: ${{ strategy.job-total }} | |
| name: Coverage collection (${{ matrix.shard }}/${{ strategy.job-total }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [1, 2, 3, 4] | |
| steps: | |
| # First step cannot call the local ./.github/actions/fleet/checkout | |
| # composite - nothing is checked out yet for GitHub to resolve | |
| # `./.github/actions/*` from - so the workspace is bootstrapped with the | |
| # same inline git-fetch shape, non-persisting auth. | |
| - name: Bootstrap checkout | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| SERVER_URL: ${{ github.server_url }} | |
| REPOSITORY: ${{ github.repository }} | |
| TRIGGER_REF: ${{ github.sha }} | |
| FETCH_DEPTH: '1' | |
| run: | | |
| set -euo pipefail | |
| git init -q | |
| git config --local advice.detachedHead false | |
| git remote remove origin 2>/dev/null || true | |
| git remote add origin "${SERVER_URL}/${REPOSITORY}" | |
| FETCH_ARGS=(--no-tags --prune --depth "${FETCH_DEPTH}" origin "${TRIGGER_REF}") | |
| if [ -n "${GITHUB_TOKEN}" ]; then | |
| AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')" | |
| git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}" | |
| else | |
| git fetch "${FETCH_ARGS[@]}" | |
| fi | |
| git checkout -q --detach FETCH_HEAD | |
| - name: Set up and install | |
| uses: ./.github/actions/fleet/setup-and-install | |
| with: | |
| socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} | |
| payload-token-client-id: ${{ vars.SOCKET_PR_CLIENT_ID }} | |
| payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }} | |
| - name: Run coverage | |
| id: coverage_collection | |
| uses: ./.github/actions/fleet/run-script | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| COVERAGE_SHARD: ${{ matrix.shard }} | |
| COVERAGE_SHARD_COUNT: ${{ strategy.job-total }} | |
| with: | |
| setup-script: pnpm run build | |
| main-script: pnpm run cover:shard --shard="$COVERAGE_SHARD/$COVERAGE_SHARD_COUNT" | |
| - name: Upload coverage collection | |
| uses: ./.github/actions/fleet/upload-artifact | |
| with: | |
| name: coverage-shard-${{ matrix.shard }} | |
| path: .cache/fleet/coverage-shards/${{ matrix.shard }} | |
| - name: Preserve coverage failure output | |
| if: ${{ failure() && steps.coverage_collection.outcome == 'failure' }} | |
| uses: ./.github/actions/fleet/upload-artifact | |
| with: | |
| name: coverage-shard-${{ matrix.shard }}-failure | |
| path: | | |
| .cache/fleet/fleet-cover | |
| .cache/fleet/coverage-shards/${{ matrix.shard }} | |
| if-no-files-found: ignore | |
| cover: | |
| name: Cover | |
| needs: [cover-shards] | |
| if: ${{ !cancelled() && github.event_name != 'pull_request' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Require successful coverage collection | |
| shell: bash | |
| env: | |
| COLLECTION_RESULT: ${{ needs.cover-shards.result }} | |
| run: | | |
| if [ "$COLLECTION_RESULT" != success ]; then | |
| echo "Coverage collection failed. Fix the failed collection jobs before aggregation." | |
| exit 1 | |
| fi | |
| - name: Bootstrap checkout | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| SERVER_URL: ${{ github.server_url }} | |
| REPOSITORY: ${{ github.repository }} | |
| TRIGGER_REF: ${{ github.sha }} | |
| FETCH_DEPTH: '1' | |
| run: | | |
| set -euo pipefail | |
| git init -q | |
| git config --local advice.detachedHead false | |
| git remote remove origin 2>/dev/null || true | |
| git remote add origin "${SERVER_URL}/${REPOSITORY}" | |
| FETCH_ARGS=(--no-tags --prune --depth "${FETCH_DEPTH}" origin "${TRIGGER_REF}") | |
| if [ -n "${GITHUB_TOKEN}" ]; then | |
| AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')" | |
| git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}" | |
| else | |
| git fetch "${FETCH_ARGS[@]}" | |
| fi | |
| git checkout -q --detach FETCH_HEAD | |
| - name: Set up and install | |
| uses: ./.github/actions/fleet/setup-and-install | |
| with: | |
| socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} | |
| payload-token-client-id: ${{ vars.SOCKET_PR_CLIENT_ID }} | |
| payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }} | |
| - name: Download coverage shard 1 | |
| uses: ./.github/actions/fleet/download-artifact | |
| with: | |
| name: coverage-shard-1 | |
| path: .cache/fleet/coverage-shards/1 | |
| - name: Download coverage shard 2 | |
| uses: ./.github/actions/fleet/download-artifact | |
| with: | |
| name: coverage-shard-2 | |
| path: .cache/fleet/coverage-shards/2 | |
| - name: Download coverage shard 3 | |
| uses: ./.github/actions/fleet/download-artifact | |
| with: | |
| name: coverage-shard-3 | |
| path: .cache/fleet/coverage-shards/3 | |
| - name: Download coverage shard 4 | |
| uses: ./.github/actions/fleet/download-artifact | |
| with: | |
| name: coverage-shard-4 | |
| path: .cache/fleet/coverage-shards/4 | |
| - name: Run coverage | |
| id: coverage_aggregate | |
| uses: ./.github/actions/fleet/run-script | |
| env: | |
| COVERAGE_SHARD_COUNT: ${{ needs.cover-shards.outputs.shard-count }} | |
| GH_TOKEN: ${{ github.token }} | |
| with: | |
| main-script: pnpm run cover:aggregate --shards="$COVERAGE_SHARD_COUNT" | |
| setup-script: pnpm run build | |
| - name: Preserve coverage failure output | |
| if: ${{ failure() && steps.coverage_aggregate.outcome == 'failure' }} | |
| uses: ./.github/actions/fleet/upload-artifact | |
| with: | |
| name: coverage-failure-output | |
| path: | | |
| .cache/fleet/fleet-cover | |
| .cache/fleet/coverage | |
| if-no-files-found: ignore |