Skip to content
CI-CD

fix(act): unsubscribe from notify before stopping the settle loop #1658

Sign in to view logs

fix(act): unsubscribe from notify before stopping the settle loop

fix(act): unsubscribe from notify before stopping the settle loop #1658

Workflow file for this run

.github/workflows/ci-cd.yml at a91fe75
name: CI-CD
permissions:
contents: write
pull-requests: write
issues: write
on:
pull_request:
paths:
- 'libs/**'
push:
branches: [master]
paths:
- 'libs/**'
workflow_dispatch:
env:
SKIP_SIMPLE_GIT_HOOKS: 1
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
jobs:
# One paths-filter pass produces three signals:
# - `src-changed`: any `libs/*/src/**` touched → run unit tests.
# Pure docs/CHANGELOG/PERFORMANCE updates inside a lib don't trip this.
# - `perf-changed`: a perf-critical hot path or a benchmark file changed
# → run benches on top of unit tests. Most PRs and most master pushes
# skip this. A perf-affecting change that doesn't touch the filter's
# paths goes uncaught; refresh `perf-baseline.json` when that bites.
# - `libs`: which lib directories changed at all → CD matrix entries.
# semantic-release still has the final say (a `docs:` commit produces
# no release), so this is just an upper bound on which jobs to spin up.
changes:
runs-on: ubuntu-latest
outputs:
src-changed: ${{ steps.src.outputs.src }}
perf-changed: ${{ steps.perf.outputs.perf }}
libs: ${{ steps.libs.outputs.changes }}
steps:
- uses: actions/checkout@v7
- uses: dorny/paths-filter@v4
id: src
with:
filters: |
src:
- 'libs/*/src/**'
- uses: dorny/paths-filter@v4
id: perf
with:
# Hot paths are enforced by directory convention, not an
# explicit file list:
# - `libs/*/src/internal/**` — non-public pipeline code
# (drain, correlate, settle, close, event-sourcing,
# lru-map, etc.). The right home for perf-sensitive
# helpers that aren't public API.
# - `libs/*/src/adapters/**` — Store/Cache/Logger impls.
# The in-memory adapters are exercised by every bench.
# - `libs/*/{bench,scripts}/**` — bench files and the
# bench-runner scripts themselves.
# - `libs/*/perf-baseline.json` — baseline refreshes.
# Code that doesn't fit a convention either lives in
# `internal/` (the right place for perf-sensitive helpers)
# or accepts that it won't be auto-bench-validated. The
# convention is the contract; expand it by moving files
# into one of these dirs, not by amending the workflow.
filters: |
perf:
- 'libs/*/src/internal/**'
- 'libs/*/src/adapters/**'
- 'libs/*/bench/**'
- 'libs/*/scripts/**'
- 'libs/*/perf-baseline.json'
- uses: dorny/paths-filter@v4
id: libs
with:
filters: |
act-patch: ['libs/act-patch/**']
act: ['libs/act/**']
act-http: ['libs/act-http/**']
act-pg: ['libs/act-pg/**']
act-sqlite: ['libs/act-sqlite/**']
act-pino: ['libs/act-pino/**']
act-otel: ['libs/act-otel/**']
act-notify: ['libs/act-notify/**']
act-ops: ['libs/act-ops/**']
act-crypto: ['libs/act-crypto/**']
act-diagram: ['libs/act-diagram/**']
act-tck: ['libs/act-tck/**']
# RFC gate (#1061). Enforces the `rfcs/` process mechanically: if a PR grows
# the public-surface stability snapshot (new export / builder method / port
# method / lifecycle event) without adding or linking an `rfcs/NNNN-*.md`, it
# fails. Pure renames/removals and non-surface diffs pass — the charter and
# the snapshot diff itself already cover those. Runs on PRs only; needs full
# history to diff against the base branch. Dependency-free (git + node), so no
# install/build step. See scripts/check-rfc-gate.mjs and rfcs/README.md.
rfc-gate:
if: github.event_name == 'pull_request'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
with:
fetch-depth: 0
- name: enforce RFC gate for public-surface additions
env:
BASE_REF: origin/${{ github.base_ref }}
GH_TOKEN: ${{ github.token }}
PR_NUMBER: ${{ github.event.pull_request.number }}
EVENT_BODY: ${{ github.event.pull_request.body }}
# Fetch the body live so an exempt marker (or RFC link) added to the
# PR description after opening takes effect on a plain job rerun —
# the event payload is frozen at trigger time and would miss it.
# Falls back to the payload if the API call fails.
run: |
LIVE_BODY="$(gh api "repos/${{ github.repository }}/pulls/${PR_NUMBER}" --jq '.body // ""' || true)"
PR_BODY="${LIVE_BODY:-$EVENT_BODY}" node scripts/check-rfc-gate.mjs
ci:
needs: changes
if: needs.changes.outputs.src-changed == 'true'
runs-on: ubuntu-latest
services:
postgres:
image: postgres:18-alpine
env:
POSTGRES_PASSWORD: postgres
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
ports:
- 5431:5432
steps:
- uses: actions/checkout@v7
- uses: pnpm/action-setup@v6
with:
run_install: false
- uses: actions/setup-node@v7
with:
node-version: 22.23.2
cache: "pnpm"
- run: pnpm install
# Fail fast if a package added/removed/renamed a subpath `export`
# without regenerating the workspace `paths` map (ticket #1059).
# `pnpm paths:sync` rewrites tsconfig.workspace.json from the
# `exports` fields; this check enforces they stay in lockstep.
- run: pnpm paths:check
- run: pnpm typecheck
# `pnpm typecheck` no longer builds first (it resolves cross-package
# imports to `src` via tsconfig.workspace.json), so build explicitly to
# keep declaration-emit / tsup coverage on PRs.
- run: pnpm build
- run: pnpm test
# Browser-safety gate. A published subpath that client code imports
# (`@rotorsoft/act-http/sse`) must not statically reach a Node API:
# #1423 added `import { log } from "@rotorsoft/act"` to the server half
# of that barrel, which put the framework — and the AsyncLocalStorage it
# builds at module scope — into every browser bundle touching it. Nothing
# here builds a browser bundle, so it sat for ten days. Walks `dist/`, so
# it runs after build.
- run: pnpm check:browser-safe
# Section-presence check for libs/*/README.md — ticket #751.
# Fails the build if any lib README is missing one of the required
# canonical sections (Title + tagline, Why, Installation, Quick start,
# Related, Documentation, License). Deprecated packages opt out via
# the `canonical-check: deprecated` HTML-comment marker.
- run: pnpm check:readmes
# `act` CLI smoke test — non-interactive `-q` query against both
# example apps. Catches regressions in the parser, builder, or
# formatter that would silently break the doc surface. NO_COLOR
# neutralises picocolors so greps can match the plain detail view.
- name: act-cli smoke (calculator)
env:
NO_COLOR: "1"
FORCE_COLOR: "0"
run: |
set -o pipefail
pnpm act packages/calculator -q Incremented | tee act-cli-calculator.log
grep -q "^Incremented$" act-cli-calculator.log
grep -q "status:" act-cli-calculator.log
- name: act-cli smoke (wolfdesk)
env:
NO_COLOR: "1"
FORCE_COLOR: "0"
run: |
set -o pipefail
pnpm act packages/wolfdesk -q TicketOpened | tee act-cli-wolfdesk.log
grep -q "^TicketOpened$" act-cli-wolfdesk.log
grep -q "status:" act-cli-wolfdesk.log
# Render the v8 coverage summary as a markdown table in the PR/run
# summary. `json-summary` reporter is enabled in vite.config.ts.
- name: Coverage summary
if: always()
run: |
node -e '
const fs = require("fs");
const f = "coverage/coverage-summary.json";
if (!fs.existsSync(f)) { console.log("No coverage summary found"); process.exit(0); }
const t = JSON.parse(fs.readFileSync(f, "utf8")).total;
const row = (label, m) => `| ${label} | ${m.pct.toFixed(2)}% | ${m.covered}/${m.total} |`;
const md = [
"## Coverage",
"",
"| Metric | % | Covered / Total |",
"|---|---:|---:|",
row("Statements", t.statements),
row("Branches", t.branches),
row("Functions", t.functions),
row("Lines", t.lines),
"",
].join("\n");
fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, md + "\n");
'
# Perf regression guard. Compares a fresh bench run against the
# checked-in baseline; fails if any scenario's p50 exceeds 1.5× baseline.
# To refresh: `pnpm -F @rotorsoft/act bench:update` in a PR labeled
# `perf-baseline-update` with rationale in PERFORMANCE.md.
#
# Benches run only when a perf-critical file changed (see the `perf`
# filter above). Most PRs and most master pushes skip the bench
# steps entirely. If a perf-sensitive change lands without touching
# the filter's paths, it will not be auto-detected — keep the file
# list in sync as new hot paths emerge.
- run: pnpm -F @rotorsoft/act bench:run
if: needs.changes.outputs.perf-changed == 'true'
- run: pnpm -F @rotorsoft/act bench:check
if: needs.changes.outputs.perf-changed == 'true'
# Per-adapter perf gate on REAL adapters (act-1031). Unlike the core
# gate above (InMemory), these run against the docker Postgres on
# 5431 and a real on-disk SQLite — the only place adapter-level
# regressions (a lost index, a reintroduced N+1, a snapshot-floor
# read that scans the whole stream) actually surface.
#
# Budgets: p50 ≤ 2.0× baseline for act-pg (wide noise band on a real
# DB), p50 ≤ 1.5× for act-sqlite (embedded, tighter). Both skip the
# ratio check when the baseline p50 is below a 1.0 ms absolute floor
# (sub-ms ops are noise-dominated). See each package's perf-check.ts.
#
# BLOCKING (#1094): a budget breach fails the PR. Baselines were
# generated on this CI runner via the perf-baseline.yml workflow, so they
# match the hardware the gate runs on — the laptop-vs-runner mismatch that
# report-only guarded against is gone, and the 2.0×/1.5× tolerances + the
# 1.0 ms floor absorb run-to-run variance. If a scenario proves noisy,
# refresh the baseline (re-run perf-baseline.yml) or widen its budget —
# don't silence the gate. The pg connection needs no extra env:
# PostgresStore defaults (host/db/user/password = postgres) match the
# docker service.
- name: act-pg perf gate
if: needs.changes.outputs.perf-changed == 'true'
run: |
set -o pipefail
pnpm -F @rotorsoft/act-pg bench:run
pnpm -F @rotorsoft/act-pg bench:check 2>&1 | tee bench-pg.log
- name: act-sqlite perf gate
if: needs.changes.outputs.perf-changed == 'true'
run: |
set -o pipefail
pnpm -F @rotorsoft/act-sqlite bench:run
pnpm -F @rotorsoft/act-sqlite bench:check 2>&1 | tee bench-sqlite.log
- name: Append adapter perf results to step summary
if: |
always() &&
needs.changes.outputs.perf-changed == 'true'
run: |
{
echo "## Adapter perf gate"
echo ""
echo "Real-adapter p50 regression budgets — act-pg 2.0×, act-sqlite"
echo "1.5×, both with a 1.0 ms absolute floor. A breach fails the PR."
echo ""
echo "### act-pg"
echo '```'
sed -E $'s/\x1b\\[[0-9;]*m//g' bench-pg.log 2>/dev/null || echo "(no act-pg output)"
echo '```'
echo "### act-sqlite"
echo '```'
sed -E $'s/\x1b\\[[0-9;]*m//g' bench-sqlite.log 2>/dev/null || echo "(no act-sqlite output)"
echo '```'
} >> "$GITHUB_STEP_SUMMARY"
# Coveralls upload is best-effort. Outages have blocked merges on
# master before — we'd rather lose a coverage badge than lose a
# release. `continue-on-error: true` lets the rest of the pipeline
# advance regardless of coveralls availability.
- uses: coverallsapp/github-action@v2
continue-on-error: true
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
# Scenario benchmarks run in their own job rather than inline in `ci`
# (#1551). They were the single longest step on the critical path — longer
# than the whole test suite — and share nothing with the rest of `ci`, so
# running them alongside it rather than after cuts the wall time by their
# full duration. They keep gating releases: `cd` waits on this job.
#
# The scenario benches exercise the real Postgres adapter (per the
# benchmarking rule in CLAUDE.md), so this job needs the same service `ci`
# has.
bench:
needs: changes
if: needs.changes.outputs.perf-changed == 'true'
runs-on: ubuntu-latest
services:
postgres:
image: postgres:18-alpine
env:
POSTGRES_PASSWORD: postgres
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
ports:
- 5431:5432
steps:
- uses: actions/checkout@v7
- uses: pnpm/action-setup@v6
with:
run_install: false
- uses: actions/setup-node@v7
with:
node-version: 22.23.2
cache: "pnpm"
- run: pnpm install
# Scenario benchmarks (Shape C). Each one has a built-in
# regression assertion, so a real perf regression breaks the
# build. The captured stdout ends up in the workflow's step
# summary so reviewers see the numbers without scrolling logs.
- name: bench:scenarios
env:
# vitest/node emit ANSI color codes even when stdout is piped,
# which renders as `␛[32m'…'␛[39m` garbage inside the markdown
# code block we append to the step summary. NO_COLOR disables
# color emission at the Node level.
NO_COLOR: "1"
FORCE_COLOR: "0"
run: |
set -o pipefail
pnpm bench:scenarios 2>&1 | tee bench-scenarios.log
- name: Append scenario bench results to step summary
if: always()
run: |
{
echo "## Scenario benchmark results"
echo ""
echo '```'
# Extract the console.table blocks from the captured run.
# Scenario benches print `=== <header> ===` then the table;
# the closing `└` line is the bottom corner of the table.
# Single-process vitest keeps output prefix-free, so the
# match is purely structural. `sed` strips any stray ANSI
# escapes that slipped past NO_COLOR (belt and suspenders).
if grep -qE '=== .+ ===' bench-scenarios.log 2>/dev/null; then
awk '
/=== .+ ===/ { printing=1 }
printing { print }
/└/ && printing { printing=0; print "" }
' bench-scenarios.log \
| sed -E $'s/\x1b\\[[0-9;]*m//g'
else
tail -n 80 bench-scenarios.log
fi
echo '```'
} >> "$GITHUB_STEP_SUMMARY"
cd:
# Run on master when at least one lib directory changed, regardless of
# whether CI ran. `ci` skips on pure docs/CHANGELOG updates inside libs
# — semantic-release-monorepo decides on its own whether a release is
# warranted, so a skipped CI still gets us a clean no-op CD when the
# commit type isn't releasable. `always()` is required because `needs:`
# by default treats a skipped upstream as a block.
if: |
always() &&
github.ref == 'refs/heads/master' &&
needs.changes.outputs.libs != '[]' &&
(needs.ci.result == 'success' || needs.ci.result == 'skipped') &&
(needs.bench.result == 'success' || needs.bench.result == 'skipped')
needs: [changes, ci, bench]
runs-on: ubuntu-latest
# Job-level permissions REPLACE the workflow-level block, so the existing
# grants are restated here alongside the new one. `id-token: write` lets
# npm mint a Sigstore provenance attestation on publish (issue #1142) —
# the OIDC token proves the package was built by this workflow run.
permissions:
contents: write
pull-requests: write
issues: write
id-token: write
strategy:
max-parallel: 1 # prevents concurrent pull/push conflicts on main branch
fail-fast: false
matrix:
lib: ${{ fromJson(needs.changes.outputs.libs) }}
steps:
- uses: actions/checkout@v7
with:
fetch-depth: 0
- uses: pnpm/action-setup@v6
with:
run_install: false
- uses: actions/setup-node@v7
with:
node-version: 22.23.2
cache: "pnpm"
registry-url: "https://registry.npmjs.org"
- run: pnpm install
# Build everything from source. We used to ship a `libs/*/dist`
# artifact from CI and download it here, but `actions/upload-artifact`
# strips the longest common ancestor (`libs/`), so the dist files
# landed at `<root>/<lib>/dist` instead of `<root>/libs/<lib>/dist`
# — and `pnpm publish` shipped 11 versions across 7 libs with no
# `dist/` at all (LICENSE + README + package.json only). Rebuilding
# here costs ~30s per matrix job and removes the whole class of
# bug. `pnpm -r build` respects topological order.
- run: pnpm build
- name: configure git
run: |
git config user.name "rotorsoft"
git config user.email "rotorsoft@outlook.com"
- name: pull latest master
run: git pull origin master --rebase
# Publishes with npm TRUSTED PUBLISHING — no long-lived token. pnpm
# exchanges the job's OIDC identity (the `id-token: write` permission
# above) for a short-lived npm token scoped to the package being
# published, which npm grants only to the repo + workflow filename
# registered as that package's Trusted Publisher on npmjs.com. A
# publish from anywhere else has no identity to trade.
#
# `NPM_TOKEN` / `NODE_AUTH_TOKEN` were removed with the migration
# (npm_migration.md). Note pnpm attempts the OIDC exchange whether or
# not a static token is present, so their absence is not what enables
# this — the Trusted Publisher registration is. Adding a token back
# would only reinstate a credential that can leak.
- name: release ${{ matrix.lib }}
working-directory: libs/${{ matrix.lib }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Provenance attestation (issue #1142). Trusted publishing turns
# this on by default; kept explicit so the intent survives a change
# of publish path, and because `pnpm publish` delegates to the npm
# CLI, which reads NPM_CONFIG_* from the environment.
NPM_CONFIG_PROVENANCE: true
run: npx semantic-release