cloudhal/.github/workflows/ci.yml at main · cloudhal-dev/cloudhal · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
name: CI

on:
  push:
    branches: [main]
  pull_request:

# Least privilege for the GITHUB_TOKEN: every job only reads the repository. Caches
# (setup-node, rust-cache, cache-cargo-install) use the Actions cache service, not this token;
# nothing here comments, uploads releases or writes checks.
permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  TYPIFY_VERSION: 0.8.0

jobs:
  ts:
    name: TypeScript (lint · typecheck · test)
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node: [24, 26]
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      # Size ratchet (docs/engineering/code-structure.md): no new oversized files or functions.
      - run: pnpm size:check
      - run: node scripts/font-fallbacks.ts --check
      - run: node scripts/mcp-tools-doc.ts --check
      # RFC-0039 invariant 7: the committed demo archive's content (its manifest), not its gzip bytes.
      - run: node scripts/demo-archive.ts --check
      - run: pnpm turbo run typecheck
      # Each vitest starts a worker per core; more than two packages at once oversubscribes the
      # 4-vCPU runner and slow tests (auth, D1, workerd) hit their timeouts.
      - run: pnpm turbo run test --concurrency=2
      - name: Publishable packages build (and publishConfig is current)
        if: matrix.node == 24
        run: |
          node scripts/build-packages.ts --check
          pnpm build:packages

  rust:
    name: Rust (test · clippy · fmt)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      # Rust tests validate fixtures against the bundled schemas, so bundle first.
      - run: pnpm --filter @cloudhal/core-contracts bundle
      - run: cargo fmt --all --check
      - run: cargo clippy --workspace --all-targets --locked -- -D warnings
      - run: cargo test --workspace --locked

  contract-drift:
    name: Contract drift (schema → TS + Rust)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/cache-cargo-install-action@v3
        with:
          tool: cargo-typify@${{ env.TYPIFY_VERSION }}
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm --filter @cloudhal/core-contracts gen
      - run: pnpm --filter @cloudhal/release-verify gen:ts
      - name: Generated code must match the committed code
        run: |
          git diff --exit-code -- packages/core-contracts/src/generated packages/release-verify/src/generated crates/cloudhal-schema/src/generated \
            || { echo "::error::Generated types are out of date. Run 'pnpm gen' and commit."; exit 1; }

  release-verify-v0-9-0:
    # RFC-0046 §11a: @cloudhal/release-verify against the real, immutable v0.9.0 assets, tarball
    # included. Ordinary test runs skip this test (no network); only this job downloads them.
    name: Release verifier on the real v0.9.0 bundle
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Download the v0.9.0 release assets
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release download v0.9.0 --repo cloudhal-dev/cloudhal --dir "$RUNNER_TEMP/v0.9.0"
      - name: Verify them (statement, manifest, every tarball entry)
        working-directory: packages/release-verify
        env:
          CLOUDHAL_RELEASE_ASSETS: ${{ runner.temp }}/v0.9.0
        run: pnpm exec vitest run test/real-tarball.test.ts