LocalApp/.github/workflows/ci.yml at main · Patodo/LocalApp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

env:
  NODE_VERSION: "24"
  PNPM_VERSION: "10.34.6"

jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: packages/localapp/native/linux
          shared-key: native-linux-x64

      - name: Install workspace and OpenSpec
        run: |
          pnpm install --frozen-lockfile
          npm install --global @fission-ai/openspec@1.6.0

      - name: Validate generated platform contract
        run: pnpm check:capabilities

      - name: Prepare isolated development executor
        run: bash scripts/setup-ci-sandbox.sh

      - name: Build TypeScript applications
        run: |
          pnpm -C packages/server-core build
          pnpm -C packages/web build
          pnpm -C packages/server build
          pnpm -C packages/localapp build

      - name: Test platform packages
        run: |
          pnpm -C packages/server-core test
          pnpm -C packages/web test
          pnpm -C packages/server test
          pnpm -C packages/localapp test
          pnpm -C packages/localapp test:native
          pnpm -C init-repo test
          pnpm test:platform-regression

      - name: Validate release infrastructure
        run: |
          pnpm test:windows-release-script
          pnpm test:release-manifest
          pnpm test:release-workflow
          node --test scripts/check-npm-release.node-test.mjs
          pnpm test:public-source

      - name: Validate OpenSpec
        run: openspec validate --all --strict

      - name: Verify builds leave tracked sources unchanged
        run: git diff --exit-code

      - name: Pack the Docker product
        run: pnpm package:localapp

      - name: Build public Docker image from the npm package
        run: docker build --tag localapp-ci:${{ github.sha }} .

      - name: Smoke test packaged Server in Docker
        run: bash scripts/docker-release-smoke.sh localapp-ci:${{ github.sha }}

  public-source:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu
      - name: Install workspace and OpenSpec
        run: |
          pnpm install --frozen-lockfile
          npm install --global @fission-ai/openspec@1.6.0
      - name: Prepare isolated development executor
        run: bash scripts/setup-ci-sandbox.sh
      - name: Export and verify public source snapshot
        run: pnpm export:public-source --commit "${GITHUB_SHA}" --output "${RUNNER_TEMP}/localapp-public" --verify

  secrets:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}