ci: isolate release dependency caches #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| commit-lint: | |
| name: commit messages | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Lint commit messages | |
| env: | |
| BEFORE_SHA: ${{ github.event.before }} | |
| CURRENT_SHA: ${{ github.sha }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| if [ "$EVENT_NAME" = "pull_request" ]; then | |
| range="$PR_BASE_SHA..$PR_HEAD_SHA" | |
| elif [ "$BEFORE_SHA" != "0000000000000000000000000000000000000000" ] && git cat-file -e "$BEFORE_SHA" 2>/dev/null; then | |
| range="$BEFORE_SHA..$CURRENT_SHA" | |
| else | |
| range="HEAD~1..HEAD" | |
| fi | |
| tools/git/commit-lint.sh "$range" | |
| research: | |
| name: research records | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Validate research records | |
| run: | | |
| pip install --quiet --requirement tools/research/requirements.txt | |
| tools/research/validate.sh | |
| rust: | |
| name: conformance harness | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: "24.20.0" | |
| cache: npm | |
| cache-dependency-path: | | |
| adapters/canva/app/package-lock.json | |
| adapters/figma/plugin/package-lock.json | |
| tools/svelte-oracle/package-lock.json | |
| tools/automerge-oracle/package-lock.json | |
| - name: Install the pinned Rust toolchain | |
| run: | | |
| rustup toolchain install 1.98.0 --profile minimal --component rustfmt --component clippy | |
| rustup default 1.98.0 | |
| - name: Install Linux native dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev | |
| - name: Complete automated research and conformance loop | |
| run: cargo xtask all | |
| - name: Build Linux developer packages | |
| run: | | |
| cargo xtask wasm-package | |
| cargo xtask mcp-package | |
| cargo xtask cli-package | |
| cargo xtask ffi-package | |
| - name: Upload Linux developer packages | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: developer-packages-linux-x86_64 | |
| if-no-files-found: error | |
| path: | | |
| target/dist/nuif-wasm-*.tar.gz | |
| target/dist/nuif-wasm-*.binding.json | |
| target/dist/nuif-mcp-*.tar.gz | |
| target/dist/nuif-mcp-*.manifest.json | |
| target/dist/nuif-cli-*.tar.gz | |
| target/dist/nuif-cli-*.manifest.json | |
| target/dist/nuif-ffi-*.tar.gz | |
| target/dist/nuif-ffi-*.manifest.json | |
| - name: Build external conformance kit | |
| run: cargo xtask conformance-kit | |
| - name: Upload external conformance kit | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: conformance-kit | |
| if-no-files-found: error | |
| path: | | |
| target/dist/nuif-conformance-kit-*.tar.gz | |
| target/dist/nuif-conformance-kit-*.zip | |
| target/dist/nuif-conformance-kit-*.manifest.json | |
| - name: Upload Gate B trial report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: gate-b-report | |
| path: target/gate-b-report.json | |
| - name: Upload adapter coverage audit | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: adapter-coverage-report | |
| path: target/adapter-coverage-report.json | |
| - name: Upload research readiness audit | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: research-readiness-report | |
| path: target/research-readiness-report.json | |
| - name: Upload direct dependency audit | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: dependency-audit-report | |
| path: target/dependency-audit-report.json | |
| - name: Upload diagnostic registry audit | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: diagnostic-registry-report | |
| path: target/diagnostic-registry-report.json | |
| - name: Upload workflow metadata audit | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: workflow-audit-report | |
| path: target/workflow-audit-report.json | |
| - name: Upload hostile-input measurements | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: hostile-input-report | |
| path: target/hostile-input-report.json | |
| - name: Upload automatic reduction evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: reduction-profile | |
| if-no-files-found: error | |
| path: | | |
| target/reduction-profile-report.json | |
| target/reduction-profile-fixture | |
| - name: Upload editor hostile-interaction evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: editor-hostile-input-report | |
| path: target/editor-hostile-input-report.json | |
| - name: Upload profile-zero performance measurements | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: performance-profile-report | |
| if-no-files-found: error | |
| path: | | |
| target/performance-profile-report.json | |
| target/criterion-smoke-report.json | |
| - name: Upload codec decision measurements | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: codec-benchmark-report | |
| path: target/codec-benchmark-report.json | |
| - name: Upload browser WebAssembly developer package | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: nuif-wasm-web | |
| if-no-files-found: error | |
| path: | | |
| target/nuif-wasm-web | |
| target/wasm-conformance-report.json | |
| - name: Upload experimental C ABI evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: nuif-ffi-header-report | |
| if-no-files-found: error | |
| path: | | |
| target/ffi-header-report.json | |
| target/ffi-symbol-report.json | |
| target/ffi-variable-font-report.json | |
| target/ffi-variable-font-sanitized-report.json | |
| - name: Upload MCP cross-surface evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: mcp-conformance-report | |
| if-no-files-found: error | |
| path: target/mcp-conformance-report.json | |
| - name: Upload portable resource profile evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: portable-resource-profile-reports | |
| if-no-files-found: error | |
| path: | | |
| target/package-resources-report.json | |
| target/package-resources-fixture.nuif | |
| target/package-resources-foreign.nuif | |
| target/package-foreign-oracle-report.json | |
| target/image-resources-report.json | |
| target/font-resources-report.json | |
| target/variable-font-metadata-report.json | |
| target/variable-font-shaping-report.json | |
| target/variable-font-metrics-report.json | |
| target/variable-font-global-metrics-report.json | |
| target/variable-font-security-report.json | |
| target/variable-font-package-report.json | |
| target/variable-font-corpus-report.json | |
| target/variable-font-gvar-generated-report.json | |
| target/variable-font-runtime-report.json | |
| target/variable-font-surface-report.json | |
| - name: Upload live browser capture evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: live-browser-capture-report | |
| if-no-files-found: error | |
| path: | | |
| target/live-browser-capture-report.json | |
| target/layout-inference-report.json | |
| - name: Upload reconstruction evaluation contract | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: reconstruction-evaluation-report | |
| if-no-files-found: error | |
| path: target/reconstruction-evaluation-report.json | |
| - name: Upload reconstruction corpus integrity contract | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: reconstruction-corpus-audit-report | |
| if-no-files-found: error | |
| path: target/reconstruction-corpus-audit-report.json | |
| - name: Upload reconstruction provider manifest contract | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: reconstruction-provider-manifest-report | |
| if-no-files-found: error | |
| path: target/reconstruction-provider-manifest-report.json | |
| - name: Upload layout differential report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: layout-differential-report | |
| path: target/layout-differential-report.json | |
| - name: Upload text pinning report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: text-pinning-report | |
| path: target/text-pinning-report.json | |
| - name: Upload render profile report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: render-profile-report | |
| path: target/render-profile-report.json | |
| - name: Upload editor authoring report and snapshot | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: editor-authoring-report | |
| path: | | |
| target/editor-authoring-report.json | |
| target/editor-authoring-snapshot | |
| - name: Upload native editor semantic and visual trial | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: editor-gui-trial | |
| path: target/editor-gui-trial | |
| - name: Upload user-scoped editor install trial | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: editor-install-trial | |
| path: target/editor-install-trial.json | |
| - name: Upload HTML and CSS synchronization evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: html-css-sync-report | |
| path: | | |
| target/html-sync-report.json | |
| target/html-sync-output.html | |
| target/html-sync-v0-report.json | |
| target/html-sync-v0-output.html | |
| target/html-sync-v0-editor-report.json | |
| target/html-sync-v0-editor-output.html | |
| - name: Upload SVG synchronization evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: svg-sync-report | |
| path: | | |
| target/svg-sync-report.json | |
| target/svg-sync-output.svg | |
| target/svg-sync-edited.nuif | |
| target/svg-sync-cli-report.json | |
| target/svg-sync-cli-output.svg | |
| - name: Upload DTCG synchronization evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: dtcg-sync-report | |
| path: | | |
| target/dtcg-sync-report.json | |
| target/dtcg-sync-output.tokens.json | |
| target/dtcg-sync-edited.nuif | |
| target/dtcg-sync-cli-report.json | |
| target/dtcg-sync-cli-output.tokens.json | |
| - name: Upload Penpot synchronization evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: penpot-sync-report | |
| path: | | |
| target/penpot-sync-report.json | |
| target/penpot-sync-output.penpot | |
| target/penpot-sync-edited.nuif | |
| target/penpot-sync-cli-report.json | |
| target/penpot-sync-cli-output.penpot | |
| - name: Upload React JSX synchronization evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: react-jsx-sync-report | |
| path: | | |
| target/react-sync-report.json | |
| target/react-sync-output.jsx | |
| target/react-sync-edited.nuif.json | |
| target/react-sync-cli-report.json | |
| target/react-sync-cli-output.jsx | |
| - name: Upload Svelte synchronization and compiler evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: svelte-static-sync-report | |
| if-no-files-found: error | |
| path: | | |
| target/svelte-sync-report.json | |
| target/svelte-sync-output.svelte | |
| target/svelte-sync-edited.nuif.json | |
| target/svelte-sync-cli-report.json | |
| target/svelte-sync-cli-output.svelte | |
| target/svelte-compiler-oracle-report.json | |
| - name: Upload Figma mapping and compiled-shell evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: figma-adapter-evidence | |
| if-no-files-found: error | |
| path: | | |
| target/figma-snapshot-report.json | |
| target/figma-plugin-shell-report.json | |
| target/figma-plugin-fixture-snapshot.json | |
| target/figma-plugin-fixture.nuif.json | |
| target/figma-plugin-fixture-report.json | |
| target/figma-plugin-plan-validation.json | |
| target/nuif-figma-plugin-review-shell | |
| - name: Upload Canva mapping and compiled-shell evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: canva-adapter-evidence | |
| if-no-files-found: error | |
| path: | | |
| target/canva-current-page-report.json | |
| target/canva-app-shell-report.json | |
| target/canva-app-fixture.nuif.json | |
| target/canva-app-fixture-page.json | |
| target/canva-app-fixture-imported.nuif.json | |
| target/canva-app-fixture-report.json | |
| target/canva-app-plan.json | |
| target/canva-app-plan-report.json | |
| target/canva-app-plan-validation.json | |
| target/canva-app-benchmark-report.json | |
| target/nuif-canva-review-app | |
| - name: Upload behavior portability evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: behavior-portability | |
| if-no-files-found: error | |
| path: | | |
| target/behavior-portability-fixture.json | |
| target/behavior-portability-static-report.json | |
| target/behavior-portability-report.json | |
| target/behavior-package-fixture.nuif | |
| target/behavior-package-expected.json | |
| target/behavior-package-static-report.json | |
| target/behavior-package-report.json | |
| target/behavior-package-cli-report.json | |
| - name: Upload independent implementation evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: gate-g-independent-profile | |
| path: | | |
| target/gate-g-report.json | |
| target/gate-g-independent | |
| - name: Upload collaboration convergence evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: collaboration-profiles | |
| if-no-files-found: error | |
| path: | | |
| target/collaboration-report.json | |
| target/collaboration-structure-report.json | |
| target/collaboration-tree-foreign-report.json | |
| target/collaboration-creation-report.json | |
| target/collaboration-nested-creation-report.json | |
| target/collaboration-nested-creation-v1-report.json | |
| target/collaboration-mixed-report.json | |
| target/collaboration-gc-report.json | |
| target/collaboration-gc-prefix-report.json | |
| target/collaboration-automerge-input.json | |
| target/collaboration-automerge-report.json | |
| - name: Upload verification artifact index | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: verification-manifest | |
| path: target/verification-manifest.json | |
| resource-profiles: | |
| name: resource profiles (${{ matrix.platform }}) | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - platform: linux-x86_64 | |
| runner: ubuntu-24.04 | |
| - platform: windows-x86_64 | |
| runner: windows-2025 | |
| - platform: macos-aarch64 | |
| runner: macos-15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install the pinned Rust toolchain | |
| shell: bash | |
| run: | | |
| rustup toolchain install 1.98.0 --profile minimal | |
| rustup default 1.98.0 | |
| - name: Install Linux native dependencies | |
| if: runner.os == 'Linux' | |
| run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev | |
| - name: Validate package, image, and font profiles | |
| run: | | |
| cargo xtask gate-i-package | |
| cargo xtask gate-i-image | |
| cargo xtask gate-i-font | |
| cargo xtask gate-i-font-metadata | |
| cargo xtask gate-i-font-shaping | |
| cargo xtask gate-i-font-metrics | |
| cargo xtask gate-i-font-global-metrics | |
| cargo xtask gate-i-font-security | |
| cargo xtask gate-i-font-package | |
| cargo xtask gate-i-font-corpus | |
| cargo xtask gate-i-font-gvar-generated | |
| cargo xtask gate-i-font-runtime | |
| - name: Upload platform resource evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: portable-resource-profiles-${{ matrix.platform }} | |
| if-no-files-found: error | |
| path: | | |
| target/package-resources-report.json | |
| target/image-resources-report.json | |
| target/font-resources-report.json | |
| target/variable-font-metadata-report.json | |
| target/variable-font-shaping-report.json | |
| target/variable-font-metrics-report.json | |
| target/variable-font-global-metrics-report.json | |
| target/variable-font-security-report.json | |
| target/variable-font-package-report.json | |
| target/variable-font-corpus-report.json | |
| target/variable-font-gvar-generated-report.json | |
| target/variable-font-runtime-report.json | |
| resource-profile-matrix: | |
| name: resource profile host agreement | |
| needs: resource-profiles | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install the pinned Rust toolchain | |
| run: | | |
| rustup toolchain install 1.98.0 --profile minimal | |
| rustup default 1.98.0 | |
| - name: Download Linux resource evidence | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: portable-resource-profiles-linux-x86_64 | |
| path: target/resource-host-matrix/linux-x86_64 | |
| - name: Download Windows resource evidence | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: portable-resource-profiles-windows-x86_64 | |
| path: target/resource-host-matrix/windows-x86_64 | |
| - name: Download macOS resource evidence | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: portable-resource-profiles-macos-aarch64 | |
| path: target/resource-host-matrix/macos-aarch64 | |
| - name: Require portable resource agreement | |
| env: | |
| SOURCE_REVISION: ${{ github.sha }} | |
| run: cargo xtask gate-i-resource-host-matrix "$SOURCE_REVISION" target/resource-host-matrix | |
| - name: Upload cross-host resource evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: portable-resource-profile-host-matrix | |
| if-no-files-found: error | |
| path: target/resource-host-matrix-report.json | |
| accessibility: | |
| name: web host browser oracles | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: "24.20.0" | |
| cache: npm | |
| cache-dependency-path: tools/accessibility-oracle/package-lock.json | |
| - name: Install the pinned Rust toolchain | |
| run: | | |
| rustup toolchain install 1.98.0 --profile minimal | |
| rustup default 1.98.0 | |
| - name: Compare portable semantics and behavior across three engines | |
| run: cargo xtask gate-web-hosts | |
| - name: Upload web host mapping evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: accessibility-mapping-report | |
| if-no-files-found: error | |
| path: | | |
| target/accessibility-mapping-static-report.json | |
| target/accessibility-mapping-report.json | |
| target/accessibility-mapping-fixture.html | |
| target/accessibility-mapping-expected.json | |
| target/web-behavior-static-report.json | |
| target/web-behavior-report.json | |
| target/web-behavior-fixture.html | |
| target/web-behavior-expected.json | |
| native-editor: | |
| name: native-editor (${{ matrix.platform }}) | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 45 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - platform: linux-x86_64 | |
| runner: ubuntu-24.04 | |
| - platform: windows-x86_64 | |
| runner: windows-2025 | |
| - platform: macos | |
| runner: macos-15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install the pinned Rust toolchain | |
| shell: bash | |
| run: | | |
| rustup toolchain install 1.98.0 --profile minimal --component clippy | |
| rustup default 1.98.0 | |
| - name: Install Linux native dependencies | |
| if: runner.os == 'Linux' | |
| run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev | |
| - name: Check native editor targets | |
| run: cargo check -p nuif-editor --all-targets --all-features --locked | |
| - name: Test native editor and automation | |
| run: cargo test -p nuif-editor --all-targets --all-features --locked | |
| - name: Run semantic and visual editor trial | |
| run: cargo xtask editor-gui-trial | |
| - name: Exercise user-scoped source installation | |
| run: cargo xtask editor-install-trial | |
| - name: Build and verify native package | |
| run: cargo xtask editor-package | |
| - name: Validate macOS bundle metadata | |
| if: runner.os == 'macOS' | |
| run: plutil -lint target/dist/nuif-editor-*/NUIF\ Editor.app/Contents/Info.plist | |
| - name: Upload native package and editor evidence | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: native-editor-${{ matrix.platform }} | |
| if-no-files-found: error | |
| path: | | |
| target/dist/editor-package-manifest.json | |
| target/dist/*.tar.gz | |
| target/dist/*.zip | |
| target/editor-gui-trial/report.json | |
| target/editor-gui-trial/editor-shell.png | |
| target/editor-gui-trial/editor-file-menu.png | |
| target/editor-gui-trial/semantics.json | |
| target/editor-install-trial.json | |
| fuzz-smoke: | |
| name: bounded sanitizer fuzzing | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install the pinned fuzz toolchain | |
| run: rustup toolchain install nightly-2026-08-28 --profile minimal --component rust-src | |
| - name: Install the pinned fuzz driver | |
| run: cargo +nightly-2026-08-28 install cargo-fuzz --version 0.13.2 --locked | |
| - name: Run every bounded fuzz contract | |
| env: | |
| NUIF_FUZZ_RUNS: "512" | |
| run: cargo +nightly-2026-08-28 xtask fuzz-smoke | |
| - name: Upload fuzz campaign report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: fuzz-smoke-report | |
| if-no-files-found: error | |
| path: target/fuzz-smoke-report.json | |
| msrv: | |
| name: minimum Rust version | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install the minimum Rust toolchain | |
| run: | | |
| rustup toolchain install 1.96.0 --profile minimal | |
| rustup default 1.96.0 | |
| - name: Install Linux native dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev | |
| - name: Check at rust-version | |
| run: cargo check --workspace --all-targets --locked | |
| workflow-security: | |
| name: workflow security | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Audit GitHub Actions workflows | |
| uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 | |
| with: | |
| advanced-security: false | |
| annotations: true | |
| persona: pedantic | |
| version: 1.29.0 | |
| deny: | |
| name: dependency policy | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 | |
| with: | |
| command: check |