Merge pull request #255 from polymorph-components/cm705/gate-removal #317
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| DENO_VERSION: "2.9.5" | |
| WASM_TOOLS_VERSION: "1.247.0" | |
| JUST_VERSION: "1.54.0" | |
| jobs: | |
| core: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Dev parity is linux-arm64; ubuntu-24.04 (x64) is deliberately part | |
| # of the matrix — CI is the project's first non-arm validation. | |
| runner: [ubuntu-24.04, ubuntu-24.04-arm] | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: true # third_party/component-model: testgen + conformance corpus | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-unknown-unknown,wasm32-wasip2 | |
| - uses: Swatinem/rust-cache@v2 | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }},just@${{ env.JUST_VERSION }} | |
| - uses: denoland/setup-deno@v2 | |
| with: | |
| deno-version: ${{ env.DENO_VERSION }} | |
| # The job body lives in the `gha` just module (one workflow job = one | |
| # `gha::` recipe, so `just ci` is exactly CI); step-level rationale | |
| # lives on the root-justfile recipes it composes. Suite order and | |
| # arch-conditional lanes (jsc-pinned is x64-only) are all encoded | |
| # there. | |
| # | |
| # The env below is the only thing the version guard's `pr` mode needs | |
| # (its first step): it reads the PR's LIVE labels and diffs against the | |
| # base. All three are empty on push runs, where the guard skips itself — | |
| # deliberately, since there is no PR to have labels. Note that label | |
| # edits do NOT re-trigger this workflow (no `types:` addition above, on | |
| # purpose): the PR pass is an early warning, release.yml's `cut` mode is | |
| # the enforcement point, and a re-run picks up corrected labels. | |
| - run: just gha::core | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| GH_TOKEN: ${{ github.token }} | |
| browser: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 45 | |
| # Post-merge only (operator decision, issue #22 follow-up): the | |
| # conformance corpus is engine-shaped, and per-PR/per-push engine | |
| # coverage now comes from the pinned shell lanes in the `core` job | |
| # above (sm-pinned, jsc-pinned) at fixed, sha256-verified pins. The | |
| # browser lanes verify something the shell lanes can't — the embedding | |
| # (real DOM/Worker/fetch globals) plus the SHIPPED-CHANNEL config | |
| # (e.g. Firefox's JSPI pref, which this lane sets explicitly — unlike | |
| # the jsshell, which has JSPI on by default; see | |
| # harness/shell/expectations/sm-pinned.ts) — so they stay as the gate | |
| # for the post-merge prerelease (`release`, below), which is the compat | |
| # matrix for now (revisit when real releases exist). | |
| if: github.event_name == 'push' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: true | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-unknown-unknown,wasm32-wasip2 | |
| - uses: Swatinem/rust-cache@v2 | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }},just@${{ env.JUST_VERSION }} | |
| - uses: denoland/setup-deno@v2 | |
| with: | |
| deno-version: ${{ env.DENO_VERSION }} | |
| - name: cache playwright browsers | |
| uses: actions/cache@v4 | |
| with: | |
| # run-lane.ts pins playwright@1.62.1 and a REPO-LOCAL browser cache | |
| # (PLAYWRIGHT_BROWSERS_PATH=$PWD/.browser-cache) — cache that path, | |
| # not ~/.cache/ms-playwright (rehearsal finding). The recipe's | |
| # install step below restores into it. | |
| path: .browser-cache | |
| key: playwright-1.62.1-${{ runner.os }}-${{ runner.arch }} | |
| # shim + corpus + browser install (--with-deps) + the chromium/firefox | |
| # required lanes + the best-effort webkit lane, per the recipes. | |
| - run: just gha::browser | |
| # Every GREEN main ref update ships a GitHub PRERELEASE: tag | |
| # pre-<shorthash>, shim artifacts + SHA256SUMS, and nothing on a registry | |
| # — JSR and npm carry cut releases only (#223). Gated on this same run's | |
| # core matrix + browser job, so "green" is the release criterion by | |
| # construction, and the prerelease doubles as the proof a cut later | |
| # requires ("a pre-<shorthash> release exists for this commit"). Notes: | |
| # (a) the concurrency group above cancels superseded runs, so rapid | |
| # consecutive pushes release only the surviving tip — a cancelled run was | |
| # never green; (b) continue-on-error steps (the webkit lane) do not block | |
| # a release, by the same policy that keeps them non-blocking in CI. | |
| release: | |
| needs: [core, browser] | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| # The prerelease path only ever uses `contents: write` (create a GitHub | |
| # release, upload assets) — no registry is published from a prerelease, | |
| # so id-token (JSR OIDC) and actions (the npm dispatch) are dead weight | |
| # here. They are granted anyway BECAUSE THEY MUST BE: a reusable-workflow | |
| # call fails at STARTUP unless the caller grants everything the called | |
| # workflow's `permissions` block requests, if-skipped steps included | |
| # (observed on #223: "requesting 'actions: write, id-token: write', but | |
| # is only allowed 'none'"), and release.yml requests all three for its | |
| # cut mode. The unused tokens are inert: the steps that would spend them | |
| # are `if: inputs.release`, which a workflow_call run cannot set. | |
| permissions: | |
| contents: write | |
| id-token: write # unused here; required by release.yml's request (cut mode) | |
| actions: write # ditto | |
| uses: ./.github/workflows/release.yml |