Compat #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Compat | |
| # dshbase-style compatibility verification (monthly + on demand): | |
| # 1. bare-import: install the packed tarball into an empty project (native | |
| # builds allowlisted) and import its entry - catches devDependencies | |
| # mistaken for dependencies and native-build gate regressions. | |
| # 2. profile: install the tarball into a scratch DSH_HOME profile next to | |
| # dsh-base + dsh-headless, assert the bundle row mounts (dump-config), and | |
| # run one keyless headless task. MISSING_CREDENTIAL proves the plugin tree | |
| # loaded; a hang (pending service) hits the 120s timeout and fails, which | |
| # is exactly how a missing injected service surfaces. | |
| # 3. uninstall: the profile install must be fully reversible. | |
| # Platform guard: every assertion here is platform-neutral. Platform-specific | |
| # behavior (Windows/macOS-only rows) is never asserted on this Linux runner. | |
| on: | |
| schedule: | |
| - cron: '0 4 1 * *' | |
| workflow_dispatch: | |
| jobs: | |
| bare-import: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 11.7.0 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| cache-dependency-path: pnpm-lock.yaml | |
| - name: Install | |
| run: pnpm install --frozen-lockfile | |
| - name: Build and pack | |
| run: | | |
| pnpm run build | |
| pnpm pack --pack-destination "$RUNNER_TEMP" | |
| - name: Bare install + import smoke | |
| run: | | |
| set -euo pipefail | |
| TARBALL="$(ls "$RUNNER_TEMP"/dsh-doublecheck-*.tgz | head -n1)" | |
| mkdir -p "$RUNNER_TEMP/bare" && cd "$RUNNER_TEMP/bare" | |
| pnpm init >/dev/null | |
| cat > pnpm-workspace.yaml <<'YAML' | |
| packages: | |
| - . | |
| nodeLinker: hoisted | |
| autoInstallPeers: true | |
| allowBuilds: | |
| '@deepseek-ai/dsh-subprocess-local': true | |
| koffi: true | |
| node-pty: true | |
| protobufjs: true | |
| '@google/genai': true | |
| YAML | |
| pnpm add "$TARBALL" >/dev/null | |
| node --input-type=module -e "import('dsh-doublecheck').then(()=>process.exit(0)).catch(e=>{console.error(e);process.exit(1)})" | |
| profile: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 11.7.0 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| cache-dependency-path: pnpm-lock.yaml | |
| - name: Install | |
| run: pnpm install --frozen-lockfile | |
| - name: Build and pack | |
| run: | | |
| pnpm run build | |
| pnpm pack --pack-destination "$RUNNER_TEMP" | |
| - name: Install dsh CLI | |
| run: npm install -g @deepseek-ai/dsh@0.1.0-rc.6 | |
| - name: Install into a scratch profile (builds allowlisted) | |
| run: | | |
| set -euo pipefail | |
| TARBALL="$(ls "$RUNNER_TEMP"/dsh-doublecheck-*.tgz | head -n1)" | |
| export DSH_HOME="$RUNNER_TEMP/dsh-home" | |
| mkdir -p "$DSH_HOME/profiles/compat" | |
| cat > "$DSH_HOME/profiles/compat/pnpm-workspace.yaml" <<'YAML' | |
| packages: | |
| - . | |
| nodeLinker: hoisted | |
| autoInstallPeers: false | |
| allowBuilds: | |
| '@deepseek-ai/dsh-subprocess-local': true | |
| koffi: true | |
| node-pty: true | |
| protobufjs: true | |
| '@google/genai': true | |
| YAML | |
| dsh plugin --profile compat add '@deepseek-ai/dsh-base@0.1.0-rc.6' '@deepseek-ai/dsh-headless@0.1.0-rc.6' "$TARBALL" | |
| - name: Row-mount assertion | |
| run: | | |
| set -euo pipefail | |
| export DSH_HOME="$RUNNER_TEMP/dsh-home" | |
| dsh --profile compat --dump-config > dump.txt | |
| grep -q "dsh-doublecheck" dump.txt | |
| - name: Keyless headless smoke | |
| run: | | |
| set -euo pipefail | |
| export DSH_HOME="$RUNNER_TEMP/dsh-home" | |
| set +e | |
| timeout 120 dsh --profile compat "Reply with exactly: ok" > smoke.log 2>&1 | |
| code="$?" | |
| set -e | |
| if grep -q 'MISSING_CREDENTIAL' smoke.log; then | |
| echo 'PASS: plugin tree loaded (keyless)' | |
| elif [ "$code" -eq 0 ] && grep -qiE '(^|[^a-z])ok([^a-z]|$)' smoke.log; then | |
| echo 'PASS: plugin tree loaded (with key)' | |
| else | |
| echo 'FAIL: headless smoke did not prove tree load' | |
| cat smoke.log | |
| exit 1 | |
| fi | |
| - name: Uninstall | |
| run: | | |
| set -euo pipefail | |
| export DSH_HOME="$RUNNER_TEMP/dsh-home" | |
| dsh plugin --profile compat remove dsh-doublecheck |