426 lines
15 KiB
YAML
426 lines
15 KiB
YAML
# Product merge gate: the `Product CI` job aggregates lint, typecheck, builds, unit,
|
|
# Postgres journeys, and Web E2E. Branch protection should require only that check.
|
|
# Deploy, OTA, and artifact uploads here are post-merge or soft-fail infra helpers.
|
|
name: ci
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint
|
|
runs-on: [self-hosted, evoo-ci, Linux]
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: pnpm/action-setup@v4
|
|
id: pnpm-setup
|
|
with:
|
|
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.job }}
|
|
- name: Isolate pnpm store and PATH
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
bin="${{ steps.pnpm-setup.outputs.bin_dest }}"
|
|
dest="${{ steps.pnpm-setup.outputs.dest }}"
|
|
if [[ -z "$bin" || -z "$dest" ]]; then
|
|
echo "pnpm setup did not report install paths" >&2
|
|
exit 1
|
|
fi
|
|
echo "PNPM_HOME=${dest}" >> "$GITHUB_ENV"
|
|
echo "${bin}" >> "$GITHUB_PATH"
|
|
echo "${dest}" >> "$GITHUB_PATH"
|
|
store="${RUNNER_TOOL_CACHE}/pnpm-store"
|
|
mkdir -p "$store"
|
|
echo "npm_config_store_dir=${store}" >> "$GITHUB_ENV"
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
- run: pnpm install --frozen-lockfile
|
|
- run: pnpm lint
|
|
|
|
check:
|
|
name: Typecheck
|
|
runs-on: [self-hosted, evoo-ci, Linux]
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: pnpm/action-setup@v4
|
|
id: pnpm-setup
|
|
with:
|
|
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.job }}
|
|
- name: Isolate pnpm store and PATH
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
bin="${{ steps.pnpm-setup.outputs.bin_dest }}"
|
|
dest="${{ steps.pnpm-setup.outputs.dest }}"
|
|
if [[ -z "$bin" || -z "$dest" ]]; then
|
|
echo "pnpm setup did not report install paths" >&2
|
|
exit 1
|
|
fi
|
|
echo "PNPM_HOME=${dest}" >> "$GITHUB_ENV"
|
|
echo "${bin}" >> "$GITHUB_PATH"
|
|
echo "${dest}" >> "$GITHUB_PATH"
|
|
store="${RUNNER_TOOL_CACHE}/pnpm-store"
|
|
mkdir -p "$store"
|
|
echo "npm_config_store_dir=${store}" >> "$GITHUB_ENV"
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
- run: pnpm install --frozen-lockfile
|
|
- run: pnpm db:generate
|
|
env:
|
|
DATABASE_URL: postgres://rakazo:rakazo@127.0.0.1:5433/rakazo
|
|
- run: pnpm check
|
|
|
|
build:
|
|
name: Production builds
|
|
runs-on: [self-hosted, evoo-ci, Linux]
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: pnpm/action-setup@v4
|
|
id: pnpm-setup
|
|
with:
|
|
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.job }}
|
|
- name: Isolate pnpm store and PATH
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
bin="${{ steps.pnpm-setup.outputs.bin_dest }}"
|
|
dest="${{ steps.pnpm-setup.outputs.dest }}"
|
|
if [[ -z "$bin" || -z "$dest" ]]; then
|
|
echo "pnpm setup did not report install paths" >&2
|
|
exit 1
|
|
fi
|
|
echo "PNPM_HOME=${dest}" >> "$GITHUB_ENV"
|
|
echo "${bin}" >> "$GITHUB_PATH"
|
|
echo "${dest}" >> "$GITHUB_PATH"
|
|
store="${RUNNER_TOOL_CACHE}/pnpm-store"
|
|
mkdir -p "$store"
|
|
echo "npm_config_store_dir=${store}" >> "$GITHUB_ENV"
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
- run: pnpm install --frozen-lockfile
|
|
- run: pnpm build
|
|
env:
|
|
DATABASE_URL: postgres://rakazo:rakazo@127.0.0.1:5433/rakazo
|
|
BETTER_AUTH_SECRET: ci-build-auth-secret-at-least-32-characters
|
|
ENCRYPTION_KEY: ci-build-encryption-key-at-least-32-characters
|
|
- name: Electron smoke
|
|
run: xvfb-run --auto-servernum pnpm --filter @rakazo/desktop exec playwright test --config e2e/playwright.config.ts
|
|
- name: Upload desktop setup screenshots
|
|
if: always()
|
|
continue-on-error: true
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: desktop-e2e-screenshots
|
|
path: apps/desktop/e2e/screenshots
|
|
if-no-files-found: ignore
|
|
retention-days: 7
|
|
|
|
test:
|
|
name: Unit tests
|
|
runs-on: [self-hosted, evoo-ci, Linux]
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: pnpm/action-setup@v4
|
|
id: pnpm-setup
|
|
with:
|
|
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.job }}
|
|
- name: Isolate pnpm store and PATH
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
bin="${{ steps.pnpm-setup.outputs.bin_dest }}"
|
|
dest="${{ steps.pnpm-setup.outputs.dest }}"
|
|
if [[ -z "$bin" || -z "$dest" ]]; then
|
|
echo "pnpm setup did not report install paths" >&2
|
|
exit 1
|
|
fi
|
|
echo "PNPM_HOME=${dest}" >> "$GITHUB_ENV"
|
|
echo "${bin}" >> "$GITHUB_PATH"
|
|
echo "${dest}" >> "$GITHUB_PATH"
|
|
store="${RUNNER_TOOL_CACHE}/pnpm-store"
|
|
mkdir -p "$store"
|
|
echo "npm_config_store_dir=${store}" >> "$GITHUB_ENV"
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
- run: pnpm install --frozen-lockfile
|
|
- run: pnpm db:generate
|
|
env:
|
|
DATABASE_URL: postgres://rakazo:rakazo@127.0.0.1:5433/rakazo
|
|
- run: pnpm test
|
|
|
|
test-integration:
|
|
name: Postgres journeys
|
|
runs-on: [self-hosted, evoo-ci, Linux]
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: pnpm/action-setup@v4
|
|
id: pnpm-setup
|
|
with:
|
|
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.job }}
|
|
- name: Isolate pnpm store and PATH
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
bin="${{ steps.pnpm-setup.outputs.bin_dest }}"
|
|
dest="${{ steps.pnpm-setup.outputs.dest }}"
|
|
if [[ -z "$bin" || -z "$dest" ]]; then
|
|
echo "pnpm setup did not report install paths" >&2
|
|
exit 1
|
|
fi
|
|
echo "PNPM_HOME=${dest}" >> "$GITHUB_ENV"
|
|
echo "${bin}" >> "$GITHUB_PATH"
|
|
echo "${dest}" >> "$GITHUB_PATH"
|
|
store="${RUNNER_TOOL_CACHE}/pnpm-store"
|
|
mkdir -p "$store"
|
|
echo "npm_config_store_dir=${store}" >> "$GITHUB_ENV"
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
- run: pnpm install --frozen-lockfile
|
|
- run: pnpm test:integration
|
|
|
|
test-e2e:
|
|
name: Web E2E
|
|
uses: ./.github/workflows/playwright.yml
|
|
with:
|
|
upload_artifacts: true
|
|
|
|
product-gate:
|
|
name: Product CI
|
|
if: always()
|
|
needs: [lint, check, build, test, test-integration, test-e2e]
|
|
runs-on: [self-hosted, evoo-ci, Linux]
|
|
steps:
|
|
- name: Verify product checks
|
|
env:
|
|
LINT: ${{ needs.lint.result }}
|
|
CHECK: ${{ needs.check.result }}
|
|
BUILD: ${{ needs.build.result }}
|
|
TEST: ${{ needs.test.result }}
|
|
TEST_INTEGRATION: ${{ needs.test-integration.result }}
|
|
TEST_E2E: ${{ needs.test-e2e.result }}
|
|
run: |
|
|
set -euo pipefail
|
|
failed=0
|
|
for name in LINT CHECK BUILD TEST TEST_INTEGRATION TEST_E2E; do
|
|
result="${!name}"
|
|
printf '%s=%s\n' "$name" "$result"
|
|
if [[ "$result" != "success" ]]; then
|
|
failed=1
|
|
fi
|
|
done
|
|
if [[ "$failed" -ne 0 ]]; then
|
|
echo "One or more product checks failed." >&2
|
|
exit 1
|
|
fi
|
|
echo "All product checks passed."
|
|
|
|
publish-mobile-update:
|
|
name: Publish compatible mobile update
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
|
continue-on-error: true
|
|
needs: [lint, check, build, test, test-integration, test-e2e]
|
|
runs-on: [self-hosted, evoo-ci, Linux]
|
|
timeout-minutes: 20
|
|
concurrency:
|
|
group: mobile-production-update
|
|
cancel-in-progress: false
|
|
steps:
|
|
- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Check whether the change is safe for OTA
|
|
id: ota
|
|
shell: bash
|
|
env:
|
|
BEFORE_SHA: ${{ github.event.before }}
|
|
run: |
|
|
set -euo pipefail
|
|
base="$BEFORE_SHA"
|
|
if [[ -z "$base" || "$base" =~ ^0+$ ]] || ! git cat-file -e "${base}^{commit}"; then
|
|
{
|
|
echo "### Mobile OTA skipped"
|
|
echo
|
|
echo "Could not resolve \`github.event.before\` for the full push range, so this job will not publish a partial-range update."
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
echo "publish=false" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
|
|
mapfile -t files < <(
|
|
git diff --name-only "$base" "$GITHUB_SHA" -- \
|
|
.github/workflows/ci.yml \
|
|
apps/mobile \
|
|
package.json \
|
|
packages/chat-ui \
|
|
packages/contracts \
|
|
packages/core \
|
|
pnpm-lock.yaml
|
|
)
|
|
|
|
publish=false
|
|
blocked=false
|
|
for file in "${files[@]}"; do
|
|
case "$file" in
|
|
*.test.ts|*.test.tsx|*.d.ts)
|
|
continue
|
|
;;
|
|
esac
|
|
|
|
eligible=false
|
|
case "$file" in
|
|
apps/mobile/app/*|apps/mobile/components/*|apps/mobile/lib/*)
|
|
case "$file" in
|
|
*.ts|*.tsx) eligible=true ;;
|
|
esac
|
|
;;
|
|
packages/chat-ui/src/*)
|
|
case "$file" in
|
|
*.ts|*.tsx|*.css) eligible=true ;;
|
|
esac
|
|
;;
|
|
packages/contracts/src/*|packages/core/src/*)
|
|
case "$file" in
|
|
*.ts|*.tsx) eligible=true ;;
|
|
esac
|
|
;;
|
|
esac
|
|
|
|
if [[ "$eligible" == true ]]; then
|
|
publish=true
|
|
else
|
|
blocked=true
|
|
fi
|
|
done
|
|
|
|
if [[ "$blocked" == true ]]; then
|
|
publish=false
|
|
{
|
|
echo "### Mobile OTA skipped"
|
|
echo
|
|
echo "This revision changes native-sensitive mobile configuration, dependencies, modules, assets, or workflow files. Create new iOS and Android builds instead of publishing it to an older native runtime."
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
elif [[ "$publish" == true ]]; then
|
|
{
|
|
echo "### Mobile OTA eligible"
|
|
echo
|
|
echo "The revision only changes JavaScript, TypeScript, or bundled CSS used by the mobile client."
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
else
|
|
{
|
|
echo "### No mobile OTA needed"
|
|
echo
|
|
echo "This revision does not change the shipped mobile bundle."
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
fi
|
|
echo "publish=$publish" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Check Expo automation token
|
|
id: expo_token
|
|
if: steps.ota.outputs.publish == 'true'
|
|
env:
|
|
EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
|
|
run: |
|
|
if [[ -z "$EXPO_TOKEN" ]]; then
|
|
{
|
|
echo "### Mobile OTA skipped"
|
|
echo
|
|
echo "No \`EXPO_TOKEN\` repository secret is configured, so CI will not publish a production update. Add a token with access to the inbox-zero/rakazo Expo project when OTA from main is desired."
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
echo "ready=false" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
echo "ready=true" >> "$GITHUB_OUTPUT"
|
|
|
|
- uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
|
|
if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
|
|
id: pnpm-setup
|
|
with:
|
|
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.job }}
|
|
- name: Isolate pnpm store and PATH
|
|
if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
bin="${{ steps.pnpm-setup.outputs.bin_dest }}"
|
|
dest="${{ steps.pnpm-setup.outputs.dest }}"
|
|
if [[ -z "$bin" || -z "$dest" ]]; then
|
|
echo "pnpm setup did not report install paths" >&2
|
|
exit 1
|
|
fi
|
|
echo "PNPM_HOME=${dest}" >> "$GITHUB_ENV"
|
|
echo "${bin}" >> "$GITHUB_PATH"
|
|
echo "${dest}" >> "$GITHUB_PATH"
|
|
store="${RUNNER_TOOL_CACHE}/pnpm-store"
|
|
mkdir -p "$store"
|
|
echo "npm_config_store_dir=${store}" >> "$GITHUB_ENV"
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
|
|
if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
- name: Set up Expo
|
|
if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
|
|
uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # v9
|
|
with:
|
|
eas-version: latest
|
|
packager: pnpm
|
|
token: ${{ secrets.EXPO_TOKEN }}
|
|
- name: Install dependencies
|
|
if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Verify mobile project
|
|
if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
|
|
run: pnpm --filter @rakazo/mobile check
|
|
- name: Publish production update
|
|
if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
|
|
working-directory: apps/mobile
|
|
run: |
|
|
set -euo pipefail
|
|
head="$(git ls-remote origin refs/heads/main | awk '{print $1}')"
|
|
if [[ -z "$head" ]]; then
|
|
echo "Could not resolve the current main head before publishing." >&2
|
|
exit 1
|
|
fi
|
|
if [[ "$GITHUB_SHA" != "$head" ]]; then
|
|
{
|
|
echo "### Mobile OTA skipped"
|
|
echo
|
|
echo "This run is for \`$GITHUB_SHA\`, but \`main\` is now \`$head\`. Skipping so an older revision cannot overwrite a newer production update."
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
eas update --platform all --channel production --environment production --message "$GITHUB_SHA" --non-interactive
|
|
|