feat(gateway): record prompt-free local outcomes #589
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| rust: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Enforce the Rust-only runtime boundary | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| forbidden=( | |
| wayfinder_router | |
| pyproject.toml | |
| uv.lock | |
| requirements.txt | |
| ) | |
| for artifact in "${forbidden[@]}"; do | |
| if [[ -e "$artifact" ]]; then | |
| echo "::error::obsolete Python runtime artifact returned: $artifact" | |
| exit 1 | |
| fi | |
| done | |
| if git grep -IlE 'python[0-9.]*[[:space:]]+-m[[:space:]]+(wayfinder_router|pytest)|pip[[:space:]]+install[[:space:]]+wayfinder-router' \ | |
| -- Dockerfile Makefile .github/workflows; then | |
| echo "::error::runtime, container, or CI still invokes the retired Python gateway" | |
| exit 1 | |
| fi | |
| - name: Install the Rust toolchain and required components | |
| run: rustup toolchain install stable --profile minimal --component rustfmt,clippy | |
| - name: Rust formatting | |
| run: cargo +stable fmt --manifest-path rust/Cargo.toml --all -- --check | |
| - name: Rust workspace tests | |
| run: cargo +stable test --manifest-path rust/Cargo.toml --workspace --all-features --locked | |
| - name: Build the default Router executable | |
| run: >- | |
| cargo +stable build --manifest-path rust/Cargo.toml --package wayfinder-cli | |
| --bin wayfinder-router --locked | |
| - name: Developer starter routing regression | |
| run: benchmarks/check-developer-starter.sh rust/target/debug/wayfinder-router | |
| - name: Held-out semantic distillation regression | |
| run: benchmarks/check-semantic-distillation.sh rust/target/debug/wayfinder-router | |
| - name: LLM setup guide contract | |
| run: benchmarks/check-llms-guide.sh rust/target/debug/wayfinder-router | |
| - name: Rust documentation tests | |
| run: cargo +stable test --manifest-path rust/Cargo.toml --doc --workspace --locked | |
| - name: Rust warning-denied Clippy | |
| run: >- | |
| cargo +stable clippy --manifest-path rust/Cargo.toml --workspace --all-targets | |
| --all-features --locked -- -D warnings | |
| docker: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build the gateway image | |
| run: docker build -t wayfinder-router:ci . | |
| - name: Smoke the immutable non-root runtime | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| config_dir="$RUNNER_TEMP/router-config" | |
| mkdir -p "$config_dir" | |
| key_hash="$(printf 'wf-ci' | sha256sum | cut -d ' ' -f 1)" | |
| cat > "$config_dir/wayfinder-router.toml" <<EOF | |
| [gateway.models.local] | |
| base_url = "http://127.0.0.1:11434/v1" | |
| model = "ci-local" | |
| [gateway.keys.ci] | |
| hash = "$key_hash" | |
| EOF | |
| docker volume create wayfinder-ci-state >/dev/null | |
| trap 'docker rm -f wayfinder-router-ci >/dev/null 2>&1 || true; docker volume rm wayfinder-ci-state >/dev/null 2>&1 || true' EXIT | |
| docker run --detach --name wayfinder-router-ci \ | |
| --read-only --tmpfs /tmp:rw,noexec,nosuid,size=16m \ | |
| --mount "type=bind,src=$config_dir,dst=/etc/wayfinder,readonly" \ | |
| --mount type=volume,src=wayfinder-ci-state,dst=/var/lib/wayfinder \ | |
| --publish 18088:8088 wayfinder-router:ci >/dev/null | |
| for attempt in {1..30}; do | |
| if curl --fail --silent http://127.0.0.1:18088/readyz >/dev/null; then | |
| break | |
| fi | |
| if (( attempt == 30 )); then | |
| docker logs wayfinder-router-ci | |
| exit 1 | |
| fi | |
| sleep 1 | |
| done | |
| test "$(docker inspect --format '{{.Config.User}}' wayfinder-router-ci)" = "10001:10001" | |
| test "$(docker exec wayfinder-router-ci id -u)" = "10001" | |
| test "$(docker inspect --format '{{.HostConfig.ReadonlyRootfs}}' wayfinder-router-ci)" = "true" | |
| docker inspect wayfinder-router-ci | jq -e \ | |
| '.[0].Mounts[] | select(.Destination == "/etc/wayfinder") | .RW == false' >/dev/null | |
| docker inspect wayfinder-router-ci | jq -e \ | |
| '.[0].Mounts[] | select(.Destination == "/var/lib/wayfinder") | .RW == true' >/dev/null | |
| docker exec wayfinder-router-ci test -f /var/lib/wayfinder/wayfinder-audit.jsonl | |
| test "$(curl --silent --output /dev/null --write-out '%{http_code}' http://127.0.0.1:18088/v1/models)" = "401" | |
| test "$(curl --silent --output /dev/null --write-out '%{http_code}' \ | |
| --header 'Authorization: Bearer wf-ci' http://127.0.0.1:18088/v1/models)" = "200" | |
| client-contract: | |
| # The shared JS decision preview remains checked against the frozen migration | |
| # corpus. Rust owns the production routing decision. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| - name: Shared decision-preview contract | |
| run: node clients/shared/test/parity.mjs | |
| omarchy-plugin: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Read the reviewed standalone plugin commit | |
| id: omarchy-plugin-ref | |
| run: | | |
| commit="$(tr -d '[:space:]' < packaging/linux/omarchy-wayfinder-commit.txt)" | |
| [[ "$commit" =~ ^[0-9a-f]{40}$ ]] | |
| printf 'commit=%s\n' "$commit" >> "$GITHUB_OUTPUT" | |
| - name: Check out the standalone plugin release authority | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: asdecided/omarchy-wayfinder | |
| ref: ${{ steps.omarchy-plugin-ref.outputs.commit }} | |
| path: .omarchy-wayfinder-upstream | |
| persist-credentials: false | |
| - name: Verify the complete in-tree plugin mirror | |
| run: packaging/linux/check_omarchy_mirror.sh .omarchy-wayfinder-upstream | |
| - name: Test the mirror drift guard | |
| run: packaging/linux/test_omarchy_mirror.sh | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| - name: Validate the Omarchy manifest and package | |
| run: node integrations/omarchy-wayfinder/scripts/validate.mjs | |
| - name: Validate the Omarchy compatibility contract | |
| run: node integrations/omarchy-wayfinder/scripts/validate-compatibility.mjs | |
| - name: Test the prompt-free presentation model | |
| run: node integrations/omarchy-wayfinder/test/model.test.mjs | |
| - name: Test the pinned native Router installation | |
| run: bash integrations/omarchy-wayfinder/test/install.test.sh | |
| - name: Test atomic Router upgrade and rollback | |
| run: integrations/omarchy-wayfinder/test/router-lifecycle.test.sh | |
| - name: Test native Omarchy smoke harness | |
| run: integrations/omarchy-wayfinder/test/omarchy-native-smoke.test.sh | |
| - name: Check coding-agent smoke harnesses | |
| run: | | |
| bash -n \ | |
| integrations/omarchy-wayfinder/test/codex-smoke.sh \ | |
| integrations/omarchy-wayfinder/test/claude-code-smoke.sh \ | |
| integrations/omarchy-wayfinder/test/opencode-smoke.sh | |
| node --check integrations/omarchy-wayfinder/test/coding-agent-mock-provider.mjs | |
| - name: Check install and removal scripts | |
| run: >- | |
| bash -n integrations/omarchy-wayfinder/install.sh | |
| integrations/omarchy-wayfinder/uninstall.sh | |
| integrations/omarchy-wayfinder/scripts/router-lifecycle.sh | |
| integrations/omarchy-wayfinder/scripts/validate-omarchy-contract.sh | |
| integrations/omarchy-wayfinder/scripts/omarchy-native-smoke.sh | |
| integrations/omarchy-wayfinder/test/install.test.sh | |
| integrations/omarchy-wayfinder/test/router-lifecycle.test.sh | |
| integrations/omarchy-wayfinder/test/omarchy-native-smoke.test.sh | |
| linux-packaging: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Validate deterministic Linux packaging | |
| run: | | |
| bash -n packaging/linux/check_release_surfaces.sh packaging/linux/package_router.sh packaging/linux/test_package_router.sh tools/hosted-provider-live-smoke.sh | |
| packaging/linux/test_package_router.sh |