Bump the pi-mono group in /spike-host-alpine with 3 updates #59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ["**"] | |
| pull_request: | |
| workflow_dispatch: | |
| # Cancel superseded runs on the same ref to save CI minutes. | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| wrapper-lint-test: | |
| name: node-wrapper · lint + hermetic tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: node-wrapper | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: node-wrapper/package-lock.json | |
| - name: Install (locked) | |
| run: npm ci | |
| - name: Lint | |
| run: npm run lint | |
| - name: Format check | |
| run: npm run format | |
| - name: Hermetic tests (no API key — integration self-skips) | |
| run: npm test | |
| env: | |
| WRAPPER_LOG_LEVEL: silent | |
| wrapper-audit: | |
| name: node-wrapper · dependency audit | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: node-wrapper | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: node-wrapper/package-lock.json | |
| # npm ci already fails if package.json and the lockfile disagree, so this | |
| # doubles as a lockfile-in-sync check. | |
| - run: npm ci | |
| # Not a bare `npm audit --audit-level=high`: pi-coding-agent ships an | |
| # npm-shrinkwrap.json that pins vulnerable transitives out of reach of | |
| # consumer overrides. The gate allowlists exactly those, with a written | |
| # reachability argument each, and still fails on anything new or critical. | |
| # See scripts/audit-gate.mjs and SECURITY.md. | |
| - name: Audit production deps (allowlisted gate) | |
| run: npm run audit | |
| wrapper-docker: | |
| name: node-wrapper · Alpine/musl image | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Build image | |
| run: docker build -t pi-filling-node-wrapper ./node-wrapper | |
| - name: Run suite inside Alpine/musl (no key) | |
| run: docker run --rm pi-filling-node-wrapper | |
| spike-api-contract: | |
| name: spike-host-alpine · API contract + hermetic driver | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: spike-host-alpine | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: spike-host-alpine/package-lock.json | |
| - name: Install (locked) | |
| run: npm ci | |
| # This directory had no CI coverage at all, so a dependency bump that | |
| # removed an export the drivers use reported green while breaking every | |
| # driver at import time (a 0.84.x bump moves `getModel` out of pi-ai's | |
| # main entry). driver-extras and driver-e2e need a real API key and can't | |
| # run here, so assert their import contract instead. | |
| - name: API contract (no key needed) | |
| run: npm run check-api | |
| # driver.mjs is hermetic by design — a mock streamFn, no real LLM call — | |
| # so the Q1/Q2/Q3 spike assertions can run on every push. | |
| - name: Hermetic spike driver (Q1/Q2/Q3) | |
| run: npm run spike | |
| android-build: | |
| name: android · unit tests + assembleDebug | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: android | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # JDK 17 specifically: Kotlin 2.0.21 refuses to run on Java 25 with an | |
| # opaque "* What went wrong: 25.0.4", and jvmToolchain(17) does not help | |
| # because it is the daemon JVM that has to be old enough. See | |
| # android/README.md. | |
| - uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: "17" | |
| cache: gradle | |
| # The scaffold had never been compiled before this job existed, so a | |
| # broken Kotlin change could land unnoticed — the same blind spot that let | |
| # a breaking dependency bump report green for spike-host-alpine. | |
| # Unit tests run before the APK: android/ had no tests at all until the | |
| # defect scan showed both high findings were in Kotlin while the wrapper, | |
| # which has 25 tests, held none. These cover the wrapper-death path. | |
| - name: Unit tests (JVM, no emulator) | |
| run: ./gradlew testDebugUnitTest --no-daemon | |
| - name: Build debug APK | |
| run: ./gradlew assembleDebug --no-daemon | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: app-debug-apk | |
| path: android/app/build/outputs/apk/debug/*.apk | |
| if-no-files-found: error | |
| retention-days: 14 | |
| shell-lint: | |
| name: proot-bootstrap · shellcheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Syntax check | |
| run: bash -n android/proot-bootstrap/build-proot.sh | |
| - name: ShellCheck | |
| run: shellcheck -S warning android/proot-bootstrap/build-proot.sh || true |