feat: run ompweb's own omp build over its own channel instead of RPC

.github/workflows/omp-runner.yml

@@ -0,0 +1,97 @@
+name: omp runner binaries
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths:
+      - "runner/**"
+      - ".github/workflows/omp-runner.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Typecheck and test
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: runner
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.4.4
+
+      - name: Fetch the pinned omp packages
+        run: bun scripts/use-omp-build.ts
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Typecheck
+        run: bunx tsc -p .
+
+      - name: Test
+        run: bun test
+
+  build:
+    name: Build (${{ matrix.target }})
+    # Bun cross-compiles every target from Linux, as omp's own release does.
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { target: linux-x64, os: linux, cpu: x64, binary: ompweb-omp-linux-x64 }
+          - { target: linux-arm64, os: linux, cpu: arm64, binary: ompweb-omp-linux-arm64 }
+          - { target: darwin-x64, os: darwin, cpu: x64, binary: ompweb-omp-darwin-x64 }
+          - { target: darwin-arm64, os: darwin, cpu: arm64, binary: ompweb-omp-darwin-arm64 }
+          - { target: windows-x64, os: win32, cpu: x64, binary: ompweb-omp-windows-x64.exe }
+    defaults:
+      run:
+        working-directory: runner
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.4.4
+
+      - name: Fetch the pinned omp packages
+        run: bun scripts/use-omp-build.ts
+
+      # The host's own addon package is not needed; the target's is what gets embedded.
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --os=${{ matrix.os }} --cpu=${{ matrix.cpu }}
+
+      - name: Build binary
+        run: bun scripts/build-binary.ts ${{ matrix.target }}
+
+      - name: Smoke test
+        if: matrix.target == 'linux-x64'
+        run: |
+          set -euo pipefail
+          runtime_dir="$(mktemp -d)"
+          HOME="$runtime_dir/home" XDG_DATA_HOME="$runtime_dir/xdg" release/${{ matrix.binary }} --version
+          HOME="$runtime_dir/home" XDG_DATA_HOME="$runtime_dir/xdg" release/${{ matrix.binary }} --smoke-test
+
+      - name: Upload binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ matrix.binary }}
+          path: runner/release/${{ matrix.binary }}
+          if-no-files-found: error

.github/workflows/prerelease.yml

@@ -40,6 +40,24 @@ jobs:
 
       - run: npm ci
       - run: npm run build
+      # The omp the runners compile against: the fork's newest integration build, not runner/omp-build.json's pin
+      # (not committed back). No such release or a runner that fails tsc against it fails the release.
+      - name: Find the newest omp integration build
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          sha=$(gh api repos/ompweb-dev/oh-my-pi/commits/integration-release --jq .sha)
+          tag=$(gh api --paginate 'repos/ompweb-dev/oh-my-pi/releases?per_page=100' --jq '.[].tag_name' \
+            | grep -E "^v[0-9]+\.[0-9]+\.[0-9]+-int\.[0-9]{12}\.g${sha:0:7}\$" | head -n 1 || true)
+          if [ -z "$tag" ]; then
+            echo "::error::ompweb-dev/oh-my-pi has no integration release for integration-release ($sha)"
+            exit 1
+          fi
+          echo "OMP_TAG=$tag" >> "$GITHUB_ENV"
+      # Without GH_TOKEN: bun install runs the omp packages' scripts.
+      - name: Pin the runner to it
+        run: npx bun runner/scripts/use-omp-build.ts "$OMP_TAG" && (cd runner && npx bun x tsc -p .)
       - name: Build the release binaries
         run: sh scripts/build-release-binaries.sh
       - run: npm run smoke -- --binary release/ompweb-linux-x64/ompweb
@@ -55,5 +73,5 @@ jobs:
           # A draft first, so a failed upload never leaves a published prerelease missing archives.
           gh release create "$tag" release/ompweb-*.tar.gz release/ompweb-*.zip \
             --repo "$GITHUB_REPOSITORY" --target "$SHA" --draft --prerelease --title "$title" \
-            --notes "Binaries built from $GITHUB_REPOSITORY@$SHA ($subject). Not a release: no npm package, no update notice."
+            --notes "Binaries built from $GITHUB_REPOSITORY@$SHA ($subject), omp: ompweb-dev/oh-my-pi $OMP_TAG. Not a release: no npm package, no update notice."
           gh release edit "$tag" --repo "$GITHUB_REPOSITORY" --draft=false

.github/workflows/publish.yml

@@ -31,13 +31,34 @@ jobs:
 
       - run: npm install --global npm@^11.5.1
       - run: npm ci
+      # The omp the runners compile against: the fork's newest integration build, not runner/omp-build.json's pin
+      # (not committed back). No such release or a runner that fails tsc against it fails the release. Pinned before
+      # the tests: they import the runner (lib/hosts/omp-socket.test.mjs), and must run against the omp that ships.
+      - name: Find the newest omp integration build
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          sha=$(gh api repos/ompweb-dev/oh-my-pi/commits/integration-release --jq .sha)
+          tag=$(gh api --paginate 'repos/ompweb-dev/oh-my-pi/releases?per_page=100' --jq '.[].tag_name' \
+            | grep -E "^v[0-9]+\.[0-9]+\.[0-9]+-int\.[0-9]{12}\.g${sha:0:7}\$" | head -n 1 || true)
+          if [ -z "$tag" ]; then
+            echo "::error::ompweb-dev/oh-my-pi has no integration release for integration-release ($sha)"
+            exit 1
+          fi
+          echo "OMP_TAG=$tag" >> "$GITHUB_ENV"
+      # Without GH_TOKEN: bun install runs the omp packages' scripts.
+      - name: Pin the runner to it
+        run: npx bun runner/scripts/use-omp-build.ts "$OMP_TAG" && (cd runner && npx bun x tsc -p .)
       - run: npm test
       - run: npm run build
-      - run: npm run smoke
-
+      # Builds the omp runners too, which the source smoke spawns from runner/release/. The archives leave them out:
+      # every install fetches its runner from this release (lib/omp/runner-fetch.ts), attached below.
       - name: Build the release binaries
-        run: sh scripts/build-release-binaries.sh
-      - run: npm run smoke -- --binary release/ompweb-linux-x64/ompweb
+        run: sh scripts/build-release-binaries.sh --no-runner
+      - run: npm run smoke
+      # --omp: the draft release cannot serve the runner to the binary yet.
+      - run: npm run smoke -- --binary release/ompweb-linux-x64/ompweb --omp runner/release/ompweb-omp-linux-x64
 
       - name: Create draft GitHub Release
         env:
@@ -46,14 +67,28 @@ jobs:
         run: |
           if ! gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             node bin/generate-release-notes.js --tag "$TAG" --output release-notes.md
+            printf '\nomp: ompweb-dev/oh-my-pi %s\n' "$OMP_TAG" >> release-notes.md
             gh release create "$TAG" --repo "$GITHUB_REPOSITORY" --verify-tag --title "$TAG" --notes-file release-notes.md --draft
           fi
 
-      - name: Attach the binaries to the draft release
+      # The runners, by the names and checksum listing lib/omp/runner-fetch.ts fetches (OMP_RUNNER_ASSET,
+      # OMP_RUNNER_CHECKSUMS), for binary and npm installs alike.
+      - name: Attach the binaries and the omp runners to the draft release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          runners=(ompweb-omp-linux-x64 ompweb-omp-linux-arm64 ompweb-omp-darwin-x64 ompweb-omp-darwin-arm64 ompweb-omp-windows-x64.exe)
+          (cd runner/release && sha256sum "${runners[@]}" > ompweb-omp.sha256)
+          gh release upload "$TAG" release/ompweb-*.tar.gz release/ompweb-*.zip "${runners[@]/#/runner/release/}" runner/release/ompweb-omp.sha256 --repo "$GITHUB_REPOSITORY" --clobber
+
+      # Before npm: an npm install fetches its runner from this release, which a draft does not serve.
+      - name: Publish GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
-        run: gh release upload "$TAG" release/ompweb-*.tar.gz release/ompweb-*.zip --repo "$GITHUB_REPOSITORY" --clobber
+        run: gh release edit "$TAG" --repo "$GITHUB_REPOSITORY" --draft=false
 
       - name: Publish to npm
         run: |
@@ -65,12 +100,6 @@ jobs:
             npm publish --provenance --access public
           fi
 
-      - name: Publish GitHub Release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ github.ref_name }}
-        run: gh release edit "$TAG" --repo "$GITHUB_REPOSITORY" --draft=false
-
   notify-discord:
     needs: publish
     runs-on: ubuntu-latest

.github/workflows/verify-pr.yml

@@ -43,8 +43,12 @@ jobs:
           node-version-file: .nvmrc
           cache: npm
 
+      # The runner's own deps too: lib/hosts/omp-socket.test.mjs checks the host against runner/src/channel.ts.
       - name: Install dependencies
-        run: npm ci
+        run: |
+          npm ci
+          npx bun runner/scripts/use-omp-build.ts
+          npx bun install --cwd runner --frozen-lockfile
 
       - name: TypeScript typecheck
         run: npm run typecheck
@@ -58,6 +62,9 @@ jobs:
       - name: Verify production build
         run: npm run build
 
+      - name: Build the omp runner
+        run: npx bun runner/scripts/build-binary.ts
+
       - name: Smoke test
         run: npm run smoke
 
@@ -68,25 +75,34 @@ jobs:
         run: |
           if [ "$RUNNER_OS" = Windows ]; then
             npx bun scripts/build-binary.ts --target bun-windows-x64-baseline
-            npm run smoke -- --binary release/ompweb-windows-x64/ompweb.exe
+            bin=release/ompweb-windows-x64/ompweb.exe
+            archive=release/ompweb-windows-x64.zip
           else
             npx bun scripts/build-binary.ts --target bun-linux-x64-baseline
-            npm run smoke -- --binary release/ompweb-linux-x64/ompweb
+            bin=release/ompweb-linux-x64/ompweb
+            archive=release/ompweb-linux-x64.tar.gz
           fi
+          # The archive a host downloads must pass the updater's own size limits and checks.
+          npx bun scripts/check-host-release-archive.ts "$archive"
+          npm run smoke -- --binary "$bin"
+          # What the host updater checks on a new release before it switches (lib/hosts/update-worker.ts): the marker
+          # it finds the command by, then the command itself against the bundled ompweb-omp.
+          grep -qa ompweb-preflight-scratch- "$bin"
+          timeout 120 "$bin" preflight
 
       - name: Packed install smoke test
         shell: bash
         run: |
           npm pack --ignore-scripts
           npm install -g --prefix "$RUNNER_TEMP/ompweb-prefix" ./kahme247-ompweb-*.tgz
-          npm run smoke -- --package "$(npm root -g --prefix "$RUNNER_TEMP/ompweb-prefix")/@kahme247/ompweb"
+          npm run smoke -- --omp "$(ls runner/release/ompweb-omp-*)" --package "$(npm root -g --prefix "$RUNNER_TEMP/ompweb-prefix")/@kahme247/ompweb"
 
       # Bun's postinstall does not run here: the launcher must fall back to @oven/bun-<os>-<arch> (spec R1).
       - name: Packed install smoke test (install scripts disabled)
         shell: bash
         run: |
           npm install -g --ignore-scripts --prefix "$RUNNER_TEMP/ompweb-prefix-no-scripts" ./kahme247-ompweb-*.tgz
-          npm run smoke -- --package "$(npm root -g --prefix "$RUNNER_TEMP/ompweb-prefix-no-scripts")/@kahme247/ompweb"
+          npm run smoke -- --omp "$(ls runner/release/ompweb-omp-*)" --package "$(npm root -g --prefix "$RUNNER_TEMP/ompweb-prefix-no-scripts")/@kahme247/ompweb"
 
       - name: Parse Windows PowerShell scripts (Windows only)
         if: runner.os == 'Windows'