fix: support isolated CI paper rendering #21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| commit-lint: | |
| name: commit messages | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Lint commit messages | |
| env: | |
| BEFORE_SHA: ${{ github.event.before }} | |
| CURRENT_SHA: ${{ github.sha }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| if [ "$EVENT_NAME" = "pull_request" ]; then | |
| range="$PR_BASE_SHA..$PR_HEAD_SHA" | |
| elif [ "$BEFORE_SHA" != "0000000000000000000000000000000000000000" ] && git cat-file -e "$BEFORE_SHA" 2>/dev/null; then | |
| range="$BEFORE_SHA..$CURRENT_SHA" | |
| else | |
| range="HEAD~1..HEAD" | |
| fi | |
| tools/git/commit-lint.sh "$range" | |
| research: | |
| name: research records | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Validate research records | |
| run: | | |
| pip install --quiet --requirement tools/research/requirements.txt | |
| tools/research/validate.sh | |
| rust: | |
| name: conformance harness | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install the pinned Rust toolchain | |
| run: | | |
| rustup toolchain install 1.98.0 --profile minimal --component rustfmt --component clippy | |
| rustup default 1.98.0 | |
| - name: Install Linux native dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev | |
| - name: Complete automated research and conformance loop | |
| run: cargo xtask all | |
| - name: Upload Gate B trial report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: gate-b-report | |
| path: target/gate-b-report.json | |
| - name: Upload adapter coverage audit | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: adapter-coverage-report | |
| path: target/adapter-coverage-report.json | |
| - name: Upload direct dependency audit | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: dependency-audit-report | |
| path: target/dependency-audit-report.json | |
| - name: Upload hostile-input measurements | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: hostile-input-report | |
| path: target/hostile-input-report.json | |
| - name: Upload editor hostile-interaction evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: editor-hostile-input-report | |
| path: target/editor-hostile-input-report.json | |
| - name: Upload profile-zero performance measurements | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: performance-profile-report | |
| path: target/performance-profile-report.json | |
| - name: Upload layout differential report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: layout-differential-report | |
| path: target/layout-differential-report.json | |
| - name: Upload text pinning report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: text-pinning-report | |
| path: target/text-pinning-report.json | |
| - name: Upload render profile report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: render-profile-report | |
| path: target/render-profile-report.json | |
| - name: Upload editor authoring report and snapshot | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: editor-authoring-report | |
| path: | | |
| target/editor-authoring-report.json | |
| target/editor-authoring-snapshot | |
| - name: Upload native editor semantic and visual trial | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: editor-gui-trial | |
| path: target/editor-gui-trial | |
| - name: Upload user-scoped editor install trial | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: editor-install-trial | |
| path: target/editor-install-trial.json | |
| - name: Upload HTML and CSS synchronization evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: html-css-sync-report | |
| path: | | |
| target/html-sync-report.json | |
| target/html-sync-output.html | |
| target/html-sync-v0-report.json | |
| target/html-sync-v0-output.html | |
| target/html-sync-v0-editor-report.json | |
| target/html-sync-v0-editor-output.html | |
| - name: Upload SVG synchronization evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: svg-sync-report | |
| path: | | |
| target/svg-sync-report.json | |
| target/svg-sync-output.svg | |
| target/svg-sync-edited.nuif | |
| target/svg-sync-cli-report.json | |
| target/svg-sync-cli-output.svg | |
| - name: Upload DTCG synchronization evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: dtcg-sync-report | |
| path: | | |
| target/dtcg-sync-report.json | |
| target/dtcg-sync-output.tokens.json | |
| target/dtcg-sync-edited.nuif | |
| target/dtcg-sync-cli-report.json | |
| target/dtcg-sync-cli-output.tokens.json | |
| - name: Upload Penpot synchronization evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: penpot-sync-report | |
| path: | | |
| target/penpot-sync-report.json | |
| target/penpot-sync-output.penpot | |
| target/penpot-sync-edited.nuif | |
| target/penpot-sync-cli-report.json | |
| target/penpot-sync-cli-output.penpot | |
| - name: Upload independent implementation evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: gate-g-independent-profile | |
| path: | | |
| target/gate-g-report.json | |
| target/gate-g-independent | |
| - name: Upload collaboration convergence evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: collaboration-register-profile | |
| path: target/collaboration-report.json | |
| - name: Upload verification artifact index | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: verification-manifest | |
| path: target/verification-manifest.json | |
| native-editor: | |
| name: native-editor (${{ matrix.platform }}) | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 45 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - platform: linux-x86_64 | |
| runner: ubuntu-latest | |
| - platform: windows-x86_64 | |
| runner: windows-latest | |
| - platform: macos | |
| runner: macos-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install the pinned Rust toolchain | |
| shell: bash | |
| run: | | |
| rustup toolchain install 1.98.0 --profile minimal --component clippy | |
| rustup default 1.98.0 | |
| - name: Install Linux native dependencies | |
| if: runner.os == 'Linux' | |
| run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev | |
| - name: Check native editor targets | |
| run: cargo check -p nuif-editor --all-targets --all-features --locked | |
| - name: Test native editor and automation | |
| run: cargo test -p nuif-editor --all-targets --all-features --locked | |
| - name: Run semantic and visual editor trial | |
| run: cargo xtask editor-gui-trial | |
| - name: Exercise user-scoped source installation | |
| run: cargo xtask editor-install-trial | |
| - name: Build and verify native package | |
| run: cargo xtask editor-package | |
| - name: Validate macOS bundle metadata | |
| if: runner.os == 'macOS' | |
| run: plutil -lint target/dist/nuif-editor-*/NUIF\ Editor.app/Contents/Info.plist | |
| - name: Upload native package and editor evidence | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: native-editor-${{ matrix.platform }} | |
| if-no-files-found: error | |
| path: | | |
| target/dist/editor-package-manifest.json | |
| target/dist/*.tar.gz | |
| target/dist/*.zip | |
| target/editor-gui-trial/report.json | |
| target/editor-gui-trial/editor-shell.png | |
| target/editor-gui-trial/editor-file-menu.png | |
| target/editor-gui-trial/semantics.json | |
| target/editor-install-trial.json | |
| msrv: | |
| name: minimum Rust version | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install the minimum Rust toolchain | |
| run: | | |
| rustup toolchain install 1.96.0 --profile minimal | |
| rustup default 1.96.0 | |
| - name: Install Linux native dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev | |
| - name: Check at rust-version | |
| run: cargo check --workspace --all-targets --locked | |
| workflow-security: | |
| name: workflow security | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Audit GitHub Actions workflows | |
| uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 | |
| with: | |
| advanced-security: false | |
| annotations: true | |
| persona: pedantic | |
| version: 1.29.0 | |
| deny: | |
| name: dependency policy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 | |
| with: | |
| command: check |