feat(paseo-omp): opt-in correlated-user terminal ownership for unkeyed OMP runtimes #303
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| changes: | |
| name: Detect affected plugins | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| outputs: | |
| npm_matrix: ${{ steps.affected.outputs.npm_matrix }} | |
| npm_affected: ${{ steps.affected.outputs.npm_affected }} | |
| omp_affected: ${{ steps.affected.outputs.omp_affected }} | |
| shared_browser_affected: ${{ steps.affected.outputs.shared_browser_affected }} | |
| workflow_affected: ${{ steps.affected.outputs.workflow_affected }} | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Test affected plugin detection | |
| run: node --test .github/scripts/detect-affected.test.mjs | |
| - name: Detect affected plugins | |
| id: affected | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| DIFF_MODE: ${{ github.event_name == 'pull_request' && 'merge-base' || 'direct' }} | |
| run: node .github/scripts/detect-affected.mjs | |
| workflow-security: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.workflow_affected == 'true' }} | |
| name: GitHub Actions security | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run Zizmor | |
| uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 | |
| with: | |
| version: "1.30.1" | |
| advanced-security: false | |
| annotations: true | |
| npm-plugins: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.npm_affected == 'true' }} | |
| name: ${{ matrix.plugin }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJSON(needs.changes.outputs.npm_matrix) }} | |
| defaults: | |
| run: | |
| working-directory: ${{ matrix.plugin }} | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node | |
| uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: ${{ matrix.plugin }}/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci --include=dev | |
| - name: Check formatting and lint | |
| if: ${{ matrix.check }} | |
| run: npm run check | |
| - name: Lint | |
| if: ${{ matrix.lint }} | |
| run: npm run lint | |
| - name: Check formatting | |
| if: ${{ matrix.format_check }} | |
| run: npm run format:check | |
| - name: Typecheck | |
| if: ${{ matrix.typecheck }} | |
| run: npm run typecheck | |
| - name: Test | |
| if: ${{ matrix.test }} | |
| run: npm test | |
| - name: Unit tests | |
| if: ${{ matrix.test_unit }} | |
| run: npm run test:unit | |
| - name: Test coverage | |
| if: ${{ matrix.coverage }} | |
| run: npm run test:coverage | |
| - name: Verify package publication contents | |
| if: ${{ matrix.verify_package }} | |
| run: npm run verify:package | |
| omp-platform: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.omp_affected == 'true' }} | |
| name: paseo-omp (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| defaults: | |
| run: | |
| working-directory: paseo-omp | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node | |
| uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: paseo-omp/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci --include=dev | |
| - name: Check formatting and lint | |
| run: npm run check | |
| - name: Typecheck | |
| run: npm run typecheck | |
| - name: Test on macOS | |
| if: ${{ matrix.os == 'macos-latest' }} | |
| run: npm test | |
| - name: Test on Windows | |
| if: ${{ matrix.os == 'windows-latest' }} | |
| run: npm test -- --exclude tests/package-release.test.ts --exclude tests/server-bundle.test.ts | |
| - name: Test subprocess conformance | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| run: npm test -- tests/provider-conformance.test.ts | |
| - name: Test with coverage | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| run: npm run test:coverage | |
| - name: Archive and Git package installation smoke | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| run: npm run test:integration:install | |
| - name: Docker host-tool ownership integration | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| run: npm run test:integration:docker | |
| omp-real-e2e: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.omp_affected == 'true' }} | |
| name: paseo-omp real OMP ${{ matrix.version }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 12 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - version: "17.2.15" | |
| sha256: "fa884941f932f4f5d2046acba971790ae6aae18fd4806472b01f041de670368a" | |
| - version: "17.3.4" | |
| sha256: "3fce4b25628064b0cd7bfbc6245ecdada331750ed4b341aca6bd29ba4478aab5" | |
| - version: "18.0.11" | |
| sha256: "6054460b29e9bad5eba78336f291e1979c2fa0a5cd96fc2d92afd666cc681d26" | |
| - version: "18.1.10" | |
| sha256: "e91d5598ee47e1d4099fd8686dc9f61c9b755f2ea077d5f1774aba1072321f9e" | |
| - version: "18.1.15" | |
| sha256: "747518a41fbb32ac47491b4677a7a921d0d9e5977ae006c358d6836813149adc" | |
| - version: "18.1.22" | |
| sha256: "9ccddf1091e01e08fea1f8e1208f8901cc90d5d098b16581672eeab03f118b81" | |
| - version: "18.2.0" | |
| sha256: "41b67a43f18a7cd33cc0dd772a4fa042cd20ab6c57e6bd451ff6dbe55a7978d8" | |
| defaults: | |
| run: | |
| working-directory: paseo-omp | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node | |
| uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: paseo-omp/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Install pinned OMP | |
| env: | |
| OMP_SHA256: ${{ matrix.sha256 }} | |
| OMP_URL: https://github.com/can1357/oh-my-pi/releases/download/v${{ matrix.version }}/omp-linux-x64 | |
| run: | | |
| install -d "$RUNNER_TEMP/omp-bin" | |
| curl --fail --location --retry 3 --max-time 300 "$OMP_URL" --output "$RUNNER_TEMP/omp-bin/omp" | |
| echo "$OMP_SHA256 $RUNNER_TEMP/omp-bin/omp" | sha256sum --check --strict | |
| chmod 0755 "$RUNNER_TEMP/omp-bin/omp" | |
| echo "$RUNNER_TEMP/omp-bin" >> "$GITHUB_PATH" | |
| test "$("$RUNNER_TEMP/omp-bin/omp" --version)" = "omp/${{ matrix.version }}" | |
| - name: Run real OMP provider scenarios | |
| env: | |
| PASEO_OMP_REAL_E2E: "1" | |
| PASEO_OMP_VERSION: ${{ matrix.version }} | |
| run: npm test -- tests/provider.real.e2e.test.ts | |
| shared-browser: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.shared_browser_affected == 'true' }} | |
| name: paseo-shared-browser | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| defaults: | |
| run: | |
| working-directory: paseo-shared-browser | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node | |
| uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: paseo-shared-browser/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci --include=dev | |
| - name: Typecheck | |
| run: npm run typecheck | |
| - name: Lint | |
| run: npm run lint | |
| - name: Check formatting | |
| run: npm run format:check | |
| - name: Unit tests | |
| run: npm run test:unit | |
| wsl-host-tools: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.omp_affected == 'true' }} | |
| name: paseo-omp WSL host ownership | |
| runs-on: windows-latest | |
| timeout-minutes: 20 | |
| defaults: | |
| run: | |
| working-directory: paseo-omp | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Windows Node | |
| uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: paseo-omp/package-lock.json | |
| - name: Install Windows dependencies | |
| run: npm ci | |
| - name: Provision WSL distribution | |
| uses: Vampire/setup-wsl@d1da7f2c0322a5ee4f24975344f67fc0f5baf364 # v7 | |
| with: | |
| distribution: Ubuntu-24.04 | |
| set-as-default: "true" | |
| - name: Require an available WSL distribution | |
| shell: pwsh | |
| working-directory: . | |
| run: | | |
| $distros = @(wsl.exe --list --quiet | ForEach-Object { $_ -replace "`0", "" } | Where-Object { $_.Trim() }) | |
| if ($LASTEXITCODE -ne 0 -or $distros.Count -eq 0) { | |
| throw "The Windows runner does not provide an executable WSL distribution" | |
| } | |
| wsl.exe --exec sh -lc "uname -a" | |
| - name: Install Node in WSL | |
| shell: pwsh | |
| working-directory: . | |
| run: wsl.exe --exec sh -lc 'curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt-get install -y nodejs' | |
| - name: Allow WSL to reach the Windows Node fixture | |
| shell: pwsh | |
| working-directory: . | |
| run: | | |
| $node = (Get-Command node).Source | |
| New-NetFirewallRule -DisplayName "Paseo OMP WSL CI" -Direction Inbound -Action Allow -Program $node | |
| - name: WSL host-tool ownership integration | |
| env: | |
| PASEO_OMP_REQUIRE_WSL: "1" | |
| run: npm run test:integration:wsl | |
| - name: Remove WSL fixture firewall rule | |
| if: ${{ always() }} | |
| shell: pwsh | |
| working-directory: . | |
| run: Remove-NetFirewallRule -DisplayName "Paseo OMP WSL CI" -ErrorAction SilentlyContinue | |
| # Keep this job name stable: branch rulesets require "CI sentinel". | |
| sentinel: | |
| name: CI sentinel | |
| if: ${{ always() }} | |
| needs: | |
| - changes | |
| - workflow-security | |
| - npm-plugins | |
| - omp-platform | |
| - omp-real-e2e | |
| - shared-browser | |
| - wsl-host-tools | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Require successful affected-plugin jobs | |
| env: | |
| NEEDS_CONTEXT: ${{ toJSON(needs) }} | |
| run: | | |
| failures="$(jq -r 'to_entries[] | select(.value.result != "success" and .value.result != "skipped") | "\(.key): \(.value.result)"' <<<"$NEEDS_CONTEXT")" | |
| if [[ -n "$failures" ]]; then | |
| printf 'Required jobs did not succeed:\n%s\n' "$failures" >&2 | |
| exit 1 | |
| fi | |
| echo "All affected plugin jobs succeeded." |