fix: require proven session bindings for tmux writes (#124) #475
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| types: [opened, edited, synchronize, reopened] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| pr-policy: | |
| name: PR policy | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| if: github.event_name == 'pull_request' | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js | |
| if: github.event_name == 'pull_request' | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 | |
| with: | |
| node-version: 22.22.2 | |
| cache: npm | |
| - name: Install dependencies | |
| if: github.event_name == 'pull_request' | |
| run: npm ci | |
| - name: Validate pull request title | |
| if: github.event_name == 'pull_request' | |
| env: | |
| PR_TITLE: ${{ github.event.pull_request.title }} | |
| run: printf '%s\n' "$PR_TITLE" | npx --no-install commitlint | |
| verify: | |
| name: Verify Node ${{ matrix.node-major }} | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - node-version: 22.22.2 | |
| node-major: 22 | |
| - node-version: 24.15.0 | |
| node-major: 24 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Install tmux | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install --yes tmux | |
| tmux -V | |
| - name: Set up Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: npm | |
| - name: Set up Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Verify dependency signatures | |
| run: npm audit signatures | |
| - name: Verify | |
| run: npm run verify | |
| - name: Write verify receipt | |
| run: | | |
| mkdir -p .ci-receipts | |
| node scripts/cua/write-release-receipt.mjs verify .ci-receipts/verify-node${{ matrix.node-major }}.json ubuntu-22.04 | |
| - name: Upload verify receipt | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: verify-receipt-node-${{ matrix.node-version }} | |
| path: .ci-receipts | |
| if-no-files-found: error | |
| include-hidden-files: true | |
| retention-days: 14 | |
| bundle: | |
| name: Canonical server bundle | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js 22 | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 | |
| with: | |
| node-version: 22.22.2 | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build canonical server bundle | |
| run: npm run server:bundle | |
| - name: Write bundle receipt | |
| run: | | |
| mkdir -p .ci-receipts | |
| node scripts/cua/write-release-receipt.mjs bundle .ci-receipts/bundle-node22.json ubuntu-22.04 release/server | |
| rm -rf release/server | |
| - name: Upload bundle receipt | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: bundle-receipt-node-22 | |
| path: .ci-receipts | |
| if-no-files-found: error | |
| include-hidden-files: true | |
| retention-days: 14 | |
| fleet-release: | |
| name: Fleet release evidence | |
| # Release-grade browser/desktop QA requires a warm dedicated host; CI runners | |
| # starve the fixture startup budgets with high variance. This workflow-dispatch | |
| # evidence is manual and recommended; publication is not gated on it. | |
| if: github.event_name == 'workflow_dispatch' | |
| needs: [verify, bundle] | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Install isolated graphical CI dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install --yes tmux xvfb gnome-shell gnome-screenshot dbus-x11 at-spi2-core python3 python3-pip | |
| - name: Install pinned Python browser driver | |
| run: | | |
| python3 -m pip install --disable-pip-version-check --no-cache-dir 'playwright==1.49.1' | |
| python3 -c 'from playwright.sync_api import sync_playwright; print(sync_playwright.__module__)' | |
| - name: Set up Node.js 24 | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 | |
| with: | |
| node-version: 24.15.0 | |
| cache: npm | |
| - name: Set up Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Download CI parity receipts | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 | |
| with: | |
| pattern: '*-receipt-node-*' | |
| path: .cua-release-evidence/ci | |
| merge-multiple: true | |
| - name: Fleet browser and full release QA | |
| env: | |
| CUA_EVIDENCE_DIR: ${{ github.workspace }}/.cua-release-evidence | |
| run: npm run cua:release | |
| - name: Upload fleet release evidence | |
| if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: fleet-release-evidence-node-24 | |
| path: .cua-release-evidence | |
| if-no-files-found: error | |
| include-hidden-files: true | |
| retention-days: 14 |