Fix portable static Linux release artifacts #203
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| docs: | |
| name: Documentation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| - name: Enable pinned pnpm | |
| run: corepack enable | |
| - name: Verify deterministic workspace inventory | |
| run: npm run verify:pnpm-workspace | |
| - name: Install workspace dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Validate documentation content | |
| run: pnpm docs:content | |
| - name: Typecheck documentation | |
| run: pnpm docs:typecheck | |
| - name: Lint documentation | |
| run: pnpm docs:lint | |
| - name: Build documentation | |
| run: pnpm docs:build | |
| - name: Build Cloudflare static deployment artifact | |
| run: pnpm docs:verify-deployment | |
| - name: Replay documented onboarding against this repository | |
| run: pnpm docs:verify-onboarding | |
| - name: Verify agent routes and prompt contracts | |
| run: | | |
| pnpm docs:verify-agent-journey | |
| pnpm docs:verify-agent-landing | |
| pnpm --filter @planr/docs verify:agent-markdown | |
| - name: Verify browser interactions and accessibility | |
| run: | | |
| pnpm docs:start > /tmp/planr-docs-server.log 2>&1 & | |
| docs_server_pid=$! | |
| trap 'kill "$docs_server_pid"' EXIT | |
| for attempt in $(seq 1 120); do | |
| if curl --fail --silent http://127.0.0.1:3000/llms.txt >/dev/null; then | |
| break | |
| fi | |
| if ! kill -0 "$docs_server_pid" 2>/dev/null; then | |
| sed -n '1,200p' /tmp/planr-docs-server.log | |
| exit 1 | |
| fi | |
| sleep 0.25 | |
| done | |
| curl --fail --silent http://127.0.0.1:3000/llms.txt >/dev/null | |
| CHROME_PATH="$(command -v google-chrome)" PLANR_DOCS_URL=http://127.0.0.1:3000 pnpm docs:verify-shell | |
| - name: Verify documented graph semantics against this repository | |
| run: pnpm docs:verify-concepts | |
| - name: Verify public reference coverage and drift | |
| run: pnpm docs:verify-reference | |
| - name: Verify contributor and operations contracts | |
| run: pnpm docs:verify-maintenance | |
| - name: Verify documentation release inventory and links | |
| run: pnpm docs:verify-release | |
| quality: | |
| name: Quality Gates | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install system tools | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y shellcheck | |
| - name: Install Rust components | |
| run: | | |
| rustup component add rustfmt clippy | |
| - name: Rust format | |
| run: cargo fmt --check | |
| - name: Rust lint | |
| run: cargo clippy --all-targets -- -D warnings | |
| - name: Rust tests | |
| run: cargo test | |
| - name: Deterministic local release-eval contract | |
| run: npm run verify:release-eval-gate | |
| - name: Deterministic release orchestration contract | |
| run: npm run verify:release-script | |
| - name: Shell lint | |
| run: shellcheck scripts/*.sh | |
| - name: Release dry-run | |
| run: | | |
| cargo build --release | |
| npm pack --dry-run | |
| node npm/bin/planr.js --version | |
| - name: Cargo audit | |
| run: | | |
| if ! command -v cargo-audit >/dev/null 2>&1; then | |
| cargo install cargo-audit --locked | |
| fi | |
| cargo audit --deny warnings | |
| linux-portability: | |
| name: Portable Linux ${{ matrix.target }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: linux-x86_64 | |
| rust_target: x86_64-unknown-linux-musl | |
| runner: ubuntu-24.04 | |
| - target: linux-arm64 | |
| rust_target: aarch64-unknown-linux-musl | |
| runner: ubuntu-24.04-arm | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Build portable Linux artifact | |
| env: | |
| PLANR_TARGET: ${{ matrix.target }} | |
| PLANR_CARGO_TARGET: ${{ matrix.rust_target }} | |
| run: scripts/build-linux-release.sh | |
| - name: Verify static linkage, lifecycle, checksums, and npm bytes | |
| env: | |
| PLANR_TARGET: ${{ matrix.target }} | |
| PLANR_CARGO_TARGET: ${{ matrix.rust_target }} | |
| run: scripts/verify-linux-release-artifact.sh | |
| - name: Save exact Linux release tarball | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: portable-${{ matrix.target }} | |
| path: dist/planr-${{ matrix.target }}.tar.gz | |
| compression-level: 0 | |
| linux-portability-checksums: | |
| name: Portable Linux aggregate checksums | |
| needs: linux-portability | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Download exact Linux release tarballs | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: portable-linux-* | |
| path: assets | |
| merge-multiple: true | |
| - name: Verify complete aggregate checksum set | |
| run: | | |
| test "$(find assets -maxdepth 1 -name 'planr-linux-*.tar.gz' -type f | wc -l)" -eq 2 | |
| cd assets | |
| sha256sum planr-linux-arm64.tar.gz planr-linux-x86_64.tar.gz > SHA256SUMS | |
| sha256sum -c SHA256SUMS | |
| - name: Save aggregate checksum evidence | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: portable-linux-sha256sums | |
| path: assets/SHA256SUMS |