upstream: adopt the clean half of the 2026-09-03 T3 batch (65 commits) #634
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - pylon | |
| concurrency: | |
| group: ci-${{ github.event.pull_request.number || github.sha }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| check: | |
| name: Check | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| sparse-checkout: | | |
| /* | |
| !/.repos/ | |
| sparse-checkout-cone-mode: false | |
| - name: Reject repository-owned PR assets | |
| run: | | |
| files="$(git ls-files .github/pr-assets)" | |
| if test -n "$files"; then | |
| printf 'PR evidence must be uploaded to GitHub, not committed:\n%s\n' "$files" >&2 | |
| exit 1 | |
| fi | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@v1 | |
| with: | |
| node-version-file: package.json | |
| cache: true | |
| run-install: true | |
| - name: Ensure Electron runtime is installed | |
| run: vp run --filter @t3tools/desktop ensure:electron | |
| - name: Check | |
| run: vp check | |
| - name: Typecheck | |
| run: vpr typecheck | |
| - name: Build desktop pipeline | |
| run: vp run build:desktop | |
| - name: Verify preload bundle output | |
| run: | | |
| test -f apps/desktop/dist-electron/preload.cjs | |
| grep -nE "desktopBridge|getLocalEnvironmentBootstrap|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.cjs | |
| grep -n "__clerk_internal_electron_passkeys" apps/desktop/dist-electron/preload.cjs | |
| prime_background_platform: | |
| name: Prime Background Platform (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-24.04] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| sparse-checkout: | | |
| /* | |
| !/.repos/ | |
| sparse-checkout-cone-mode: false | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@v1 | |
| with: | |
| node-version-file: package.json | |
| cache: true | |
| run-install: true | |
| - name: Test Prime background subprocess on the host platform | |
| run: vp test run apps/server/src/textGeneration/PrimeAgentTextGeneration.platform.test.ts | |
| desktop_prime_packaged_smoke: | |
| name: Desktop Prime Packaged Smoke (${{ matrix.platform }}) | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 35 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: ubuntu-24.04 | |
| platform: linux | |
| - os: windows-2025 | |
| platform: win | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| sparse-checkout: | | |
| /* | |
| !/.repos/ | |
| sparse-checkout-cone-mode: false | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@v1 | |
| with: | |
| node-version-file: package.json | |
| cache: true | |
| run-install: true | |
| - name: Install ImageMagick | |
| if: matrix.platform == 'linux' | |
| shell: bash | |
| run: | | |
| if ! command -v magick >/dev/null 2>&1 && ! command -v convert >/dev/null 2>&1; then | |
| sudo apt-get update | |
| sudo apt-get install -y imagemagick | |
| fi | |
| if command -v magick >/dev/null 2>&1; then | |
| magick -version | |
| else | |
| convert -version | |
| fi | |
| - name: Ensure Electron runtime is installed | |
| run: vp run --filter @t3tools/desktop ensure:electron | |
| - name: Build unpacked app and run packaged Prime external-ESM smoke | |
| run: node scripts/build-desktop-artifact.ts --platform ${{ matrix.platform }} --arch x64 --smoke-only | |
| # Everything except `t3` (apps/server). `--fail-if-no-match` is Pylon's: | |
| # without it a filter that matches nothing only warns and exits 0, so a | |
| # renamed package would turn this job into a green no-op. | |
| # `--parallel` drops the package | |
| # dependency ordering that `vp run` applies by default: these `test` tasks | |
| # declare no `dependsOn` and resolve workspace deps from source, so ordering | |
| # only bought us idle runners between dependency layers. The concurrency | |
| # limit stays at the default 4 so peak load per runner is unchanged. | |
| test: | |
| name: Test | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| sparse-checkout: | | |
| /* | |
| !/.repos/ | |
| sparse-checkout-cone-mode: false | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@v1 | |
| with: | |
| node-version-file: package.json | |
| cache: true | |
| run-install: true | |
| - name: Ensure Electron runtime is installed | |
| run: vp run --filter @t3tools/desktop ensure:electron | |
| - name: Test | |
| run: vp run --fail-if-no-match --parallel --concurrency-limit 4 --filter '!t3' --filter '!@t3tools/monorepo' test | |
| # The root package is filtered out above because its own `test` script is | |
| # `vp run -r test`, which would recurse. That left its own suites - | |
| # scripts/ and the oxlint plugin - running nowhere, which is how a failing | |
| # build-desktop-artifact test went unnoticed. Run them directly instead. | |
| - name: Test repository scripts and lint rules | |
| run: vp test run scripts oxlint-plugin-t3code | |
| # apps/server sets `fileParallelism: false`, so its 278 files run strictly | |
| # one at a time. Sharding spreads them over separate runners instead of | |
| # separate workers, so no two server test files ever share a machine and the | |
| # isolation that flag buys is preserved exactly. | |
| test_server: | |
| name: Test Server ${{ matrix.shard }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [1, 2, 3] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| sparse-checkout: | | |
| /* | |
| !/.repos/ | |
| sparse-checkout-cone-mode: false | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@v1 | |
| with: | |
| node-version-file: package.json | |
| cache: true | |
| run-install: true | |
| # No Electron setup here: `t3` (apps/server) has no Electron dependency | |
| # and none of its tests touch the runtime. Only the non-server `test` | |
| # job, which covers @t3tools/desktop, needs the download. | |
| - name: Test | |
| env: | |
| T3CODE_TRANSFER_BUDGET_REPORT_PATH: ${{ runner.temp }}/t3code-transfer-budget.md | |
| T3CODE_TRANSFER_BUDGET_RESULT_PATH: ${{ runner.temp }}/thread-transfer-result.json | |
| run: vp run --fail-if-no-match --filter t3 test --shard ${{ matrix.shard }}/${{ strategy.job-total }} | |
| # src/server.test.ts writes the budget report, so exactly one shard | |
| # produces these files. Gating on their presence keeps a single | |
| # `thread-transfer-results` artifact per run, which is the name | |
| # thread-transfer-report.yml resolves. | |
| - name: Detect transfer budget report | |
| id: transfer_budget | |
| if: always() | |
| run: | | |
| if test -f "${{ runner.temp }}/thread-transfer-result.json"; then | |
| echo "present=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "present=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Publish transfer budget report | |
| if: always() && steps.transfer_budget.outputs.present == 'true' | |
| run: | | |
| if test -f "${{ runner.temp }}/t3code-transfer-budget.md"; then | |
| tee -a "$GITHUB_STEP_SUMMARY" < "${{ runner.temp }}/t3code-transfer-budget.md" | |
| else | |
| echo "Transfer budget report was not produced." >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| # Non-fatal on purpose. This is a few KB of JSON whose only consumer is | |
| # thread-transfer-report.yml, which turns it into a PR comment. Account | |
| # artifact storage is a shared, org-wide resource that something else can | |
| # exhaust, and when it is exhausted every upload fails — so leaving this | |
| # step fatal lets an unrelated storage condition fail a run whose tests | |
| # passed, which is what happened to #9. Losing the transfer comment is the | |
| # correct way to degrade; blocking code review is not. Upstream's presence | |
| # gate handles a different failure — the two shards that legitimately | |
| # produce nothing — so Pylon keeps both. | |
| - name: Upload thread transfer result | |
| if: always() && steps.transfer_budget.outputs.present == 'true' | |
| continue-on-error: true | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: thread-transfer-results | |
| path: ${{ runner.temp }}/thread-transfer-result.json | |
| if-no-files-found: ignore | |
| retention-days: 30 | |
| # Split out of Check and Test: both paid ~7-9s to install a Rust toolchain | |
| # for checks that take under 3s, on the critical path of every PR. | |
| rust: | |
| name: Rust | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| sparse-checkout: | | |
| /* | |
| !/.repos/ | |
| sparse-checkout-cone-mode: false | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt | |
| - name: Check resource monitor formatting | |
| run: cargo fmt --manifest-path native/resource-monitor/Cargo.toml -- --check | |
| - name: Test resource monitor | |
| run: cargo test --locked --manifest-path native/resource-monitor/Cargo.toml | |
| release_smoke: | |
| name: Release Smoke | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| sparse-checkout: | | |
| /* | |
| !/.repos/ | |
| sparse-checkout-cone-mode: false | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@v1 | |
| with: | |
| node-version-file: package.json | |
| cache: true | |
| run-install: | | |
| args: | |
| - --filter=@t3tools/scripts... | |
| - name: Exercise release-only workflow steps | |
| run: node scripts/release-smoke.ts |