feat: run ompweb's own omp build over its own channel instead of RPC

.github/workflows/omp-runner.yml

@@ -0,0 +1,97 @@
+name: omp runner binaries
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths:
+      - "runner/**"
+      - ".github/workflows/omp-runner.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Typecheck and test
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: runner
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.4.4
+
+      - name: Fetch the pinned omp packages
+        run: bun scripts/use-omp-build.ts
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Typecheck
+        run: bunx tsc -p .
+
+      - name: Test
+        run: bun test
+
+  build:
+    name: Build (${{ matrix.target }})
+    # Bun cross-compiles every target from Linux, as omp's own release does.
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { target: linux-x64, os: linux, cpu: x64, binary: ompweb-omp-linux-x64 }
+          - { target: linux-arm64, os: linux, cpu: arm64, binary: ompweb-omp-linux-arm64 }
+          - { target: darwin-x64, os: darwin, cpu: x64, binary: ompweb-omp-darwin-x64 }
+          - { target: darwin-arm64, os: darwin, cpu: arm64, binary: ompweb-omp-darwin-arm64 }
+          - { target: windows-x64, os: win32, cpu: x64, binary: ompweb-omp-windows-x64.exe }
+    defaults:
+      run:
+        working-directory: runner
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.4.4
+
+      - name: Fetch the pinned omp packages
+        run: bun scripts/use-omp-build.ts
+
+      # The host's own addon package is not needed; the target's is what gets embedded.
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --os=${{ matrix.os }} --cpu=${{ matrix.cpu }}
+
+      - name: Build binary
+        run: bun scripts/build-binary.ts ${{ matrix.target }}
+
+      - name: Smoke test
+        if: matrix.target == 'linux-x64'
+        run: |
+          set -euo pipefail
+          runtime_dir="$(mktemp -d)"
+          HOME="$runtime_dir/home" XDG_DATA_HOME="$runtime_dir/xdg" release/${{ matrix.binary }} --version
+          HOME="$runtime_dir/home" XDG_DATA_HOME="$runtime_dir/xdg" release/${{ matrix.binary }} --smoke-test
+
+      - name: Upload binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ matrix.binary }}
+          path: runner/release/${{ matrix.binary }}
+          if-no-files-found: error

.github/workflows/prerelease.yml

@@ -40,6 +40,24 @@ jobs:
 
       - run: npm ci
       - run: npm run build
+      # The omp the runners compile against: the fork's newest integration build, not runner/omp-build.json's pin
+      # (not committed back). No such release or a runner that fails tsc against it fails the release.
+      - name: Find the newest omp integration build
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          sha=$(gh api repos/andrebrait/oh-my-pi/commits/integration-release --jq .sha)
+          tag=$(gh api --paginate 'repos/andrebrait/oh-my-pi/releases?per_page=100' --jq '.[].tag_name' \
+            | grep -E "^v[0-9]+\.[0-9]+\.[0-9]+-int\.[0-9]{12}\.g${sha:0:7}\$" | head -n 1 || true)
+          if [ -z "$tag" ]; then
+            echo "::error::andrebrait/oh-my-pi has no integration release for integration-release ($sha)"
+            exit 1
+          fi
+          echo "OMP_TAG=$tag" >> "$GITHUB_ENV"
+      # Without GH_TOKEN: bun install runs the omp packages' scripts.
+      - name: Pin the runner to it
+        run: npx bun runner/scripts/use-omp-build.ts "$OMP_TAG" && (cd runner && npx bun x tsc -p .)
       - name: Build the release binaries
         run: sh scripts/build-release-binaries.sh
       - run: npm run smoke -- --binary release/ompweb-linux-x64/ompweb
@@ -55,5 +73,5 @@ jobs:
           # A draft first, so a failed upload never leaves a published prerelease missing archives.
           gh release create "$tag" release/ompweb-*.tar.gz release/ompweb-*.zip \
             --repo "$GITHUB_REPOSITORY" --target "$SHA" --draft --prerelease --title "$title" \
-            --notes "Binaries built from $GITHUB_REPOSITORY@$SHA ($subject). Not a release: no npm package, no update notice."
+            --notes "Binaries built from $GITHUB_REPOSITORY@$SHA ($subject), omp: andrebrait/oh-my-pi $OMP_TAG. Not a release: no npm package, no update notice."
           gh release edit "$tag" --repo "$GITHUB_REPOSITORY" --draft=false

.github/workflows/publish.yml

@@ -33,10 +33,28 @@ jobs:
       - run: npm ci
       - run: npm test
       - run: npm run build
-      - run: npm run smoke
-
+      # The omp the runners compile against: the fork's newest integration build, not runner/omp-build.json's pin
+      # (not committed back). No such release or a runner that fails tsc against it fails the release.
+      - name: Find the newest omp integration build
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          sha=$(gh api repos/andrebrait/oh-my-pi/commits/integration-release --jq .sha)
+          tag=$(gh api --paginate 'repos/andrebrait/oh-my-pi/releases?per_page=100' --jq '.[].tag_name' \
+            | grep -E "^v[0-9]+\.[0-9]+\.[0-9]+-int\.[0-9]{12}\.g${sha:0:7}\$" | head -n 1 || true)
+          if [ -z "$tag" ]; then
+            echo "::error::andrebrait/oh-my-pi has no integration release for integration-release ($sha)"
+            exit 1
+          fi
+          echo "OMP_TAG=$tag" >> "$GITHUB_ENV"
+      # Without GH_TOKEN: bun install runs the omp packages' scripts.
+      - name: Pin the runner to it
+        run: npx bun runner/scripts/use-omp-build.ts "$OMP_TAG" && (cd runner && npx bun x tsc -p .)
+      # Builds the omp runners too, which the source smoke spawns from runner/release/.
       - name: Build the release binaries
         run: sh scripts/build-release-binaries.sh
+      - run: npm run smoke
       - run: npm run smoke -- --binary release/ompweb-linux-x64/ompweb
 
       - name: Create draft GitHub Release
@@ -46,6 +64,7 @@ jobs:
         run: |
           if ! gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             node bin/generate-release-notes.js --tag "$TAG" --output release-notes.md
+            printf '\nomp: andrebrait/oh-my-pi %s\n' "$OMP_TAG" >> release-notes.md
             gh release create "$TAG" --repo "$GITHUB_REPOSITORY" --verify-tag --title "$TAG" --notes-file release-notes.md --draft
           fi
 
@@ -55,6 +74,26 @@ jobs:
           TAG: ${{ github.ref_name }}
         run: gh release upload "$TAG" release/ompweb-*.tar.gz release/ompweb-*.zip --repo "$GITHUB_REPOSITORY" --clobber
 
+      # npm installs get the runner the esbuild way: one prebuilt package per platform, which npm installs only on
+      # the matching os/cpu, pinned to this exact version. No install script, no Bun or compile on the user's machine.
+      - name: Publish the omp runner packages and pin them
+        run: |
+          VERSION="$(node -p 'require("./package.json").version')"
+          for target in linux-x64 linux-arm64 darwin-x64 darwin-arm64 windows-x64; do
+            os="${target%-*}"; cpu="${target#*-}"; exe=""
+            if [ "$os" = windows ]; then os=win32; exe=.exe; fi
+            name="@kahme247/ompweb-omp-$target"
+            dir="runner-packages/$target"
+            mkdir -p "$dir"
+            cp "runner/release/ompweb-omp-$target$exe" "$dir/ompweb-omp$exe"
+            cp LICENSE "$dir/"
+            node -e 'const [name, version, os, cpu, bin] = process.argv.slice(1); process.stdout.write(JSON.stringify({ name, version, description: "The omp runner ompweb spawns, for one platform", license: "MIT", repository: { type: "git", url: "git+https://github.com/kahme247/ompweb.git" }, os: [os], cpu: [cpu], files: [bin, "LICENSE"] }, null, 2))' "$name" "$VERSION" "$os" "$cpu" "ompweb-omp$exe" > "$dir/package.json"
+            if ! npm view "$name@$VERSION" version --registry https://registry.npmjs.org/ >/dev/null 2>&1; then
+              (cd "$dir" && npm publish --provenance --access public)
+            fi
+            npm pkg set "optionalDependencies.$name=$VERSION"
+          done
+
       - name: Publish to npm
         run: |
           PACKAGE_NAME="$(node -p 'require("./package.json").name')"

.github/workflows/verify-pr.yml

@@ -43,8 +43,12 @@ jobs:
           node-version-file: .nvmrc
           cache: npm
 
+      # The runner's own deps too: lib/hosts/omp-socket.test.mjs checks the host against runner/src/channel.ts.
       - name: Install dependencies
-        run: npm ci
+        run: |
+          npm ci
+          npx bun runner/scripts/use-omp-build.ts
+          npx bun install --cwd runner --frozen-lockfile
 
       - name: TypeScript typecheck
         run: npm run typecheck
@@ -58,6 +62,9 @@ jobs:
       - name: Verify production build
         run: npm run build
 
+      - name: Build the omp runner
+        run: npx bun runner/scripts/build-binary.ts
+
       - name: Smoke test
         run: npm run smoke
 
@@ -68,25 +75,30 @@ jobs:
         run: |
           if [ "$RUNNER_OS" = Windows ]; then
             npx bun scripts/build-binary.ts --target bun-windows-x64-baseline
-            npm run smoke -- --binary release/ompweb-windows-x64/ompweb.exe
+            bin=release/ompweb-windows-x64/ompweb.exe
           else
             npx bun scripts/build-binary.ts --target bun-linux-x64-baseline
-            npm run smoke -- --binary release/ompweb-linux-x64/ompweb
+            bin=release/ompweb-linux-x64/ompweb
           fi
+          npm run smoke -- --binary "$bin"
+          # What the host updater checks on a new release before it switches (lib/hosts/update-worker.ts): the marker
+          # it finds the command by, then the command itself against the bundled ompweb-omp.
+          grep -qa ompweb-preflight-scratch- "$bin"
+          timeout 120 "$bin" preflight
 
       - name: Packed install smoke test
         shell: bash
         run: |
           npm pack --ignore-scripts
           npm install -g --prefix "$RUNNER_TEMP/ompweb-prefix" ./kahme247-ompweb-*.tgz
-          npm run smoke -- --package "$(npm root -g --prefix "$RUNNER_TEMP/ompweb-prefix")/@kahme247/ompweb"
+          npm run smoke -- --omp "$(ls runner/release/ompweb-omp-*)" --package "$(npm root -g --prefix "$RUNNER_TEMP/ompweb-prefix")/@kahme247/ompweb"
 
       # Bun's postinstall does not run here: the launcher must fall back to @oven/bun-<os>-<arch> (spec R1).
       - name: Packed install smoke test (install scripts disabled)
         shell: bash
         run: |
           npm install -g --ignore-scripts --prefix "$RUNNER_TEMP/ompweb-prefix-no-scripts" ./kahme247-ompweb-*.tgz
-          npm run smoke -- --package "$(npm root -g --prefix "$RUNNER_TEMP/ompweb-prefix-no-scripts")/@kahme247/ompweb"
+          npm run smoke -- --omp "$(ls runner/release/ompweb-omp-*)" --package "$(npm root -g --prefix "$RUNNER_TEMP/ompweb-prefix-no-scripts")/@kahme247/ompweb"
 
       - name: Parse Windows PowerShell scripts (Windows only)
         if: runner.os == 'Windows'