brains-plugins/.github/workflows/tests.yml at main · ssvlabs/brains-plugins · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: tests

on:
  pull_request:
  push:
    branches: [main]

jobs:
  plugin-contract:
    name: cross-client plugin contract
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.8"
      # The contract asks a real Claude Code to validate the manifest, and fails closed when the
      # CLI is missing under CI — so it has to be installed here or the job cannot pass.
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - run: npm install -g @anthropic-ai/claude-code@2.1.220
      - run: bun run tests/plugin-contract/run.ts

  inbox-v2:
    name: inbox-v2 contract test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.8"
      - run: bun run tests/inbox-v2/run.ts

  tool-error:
    name: tool-error contract test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.8"
      - run: bun run tests/tool-error/run.ts

  generated-artifact-guard:
    name: generated-artifact + delivery guard
    runs-on: ubuntu-latest
    # Only meaningful on a PR: it compares HEAD against the base branch. A push
    # to main has nothing to compare against and would be a no-op.
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v4
        with:
          # The guard diffs against the PR base, so the default shallow clone
          # (which has no base history) would make every comparison a no-op.
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      # base_ref goes through `env:` and every use is quoted. Interpolating
      # `${{ github.base_ref }}` straight into `run:` splices the branch name into
      # the shell before it runs, so a branch named e.g. `release/$USER` — or
      # anything carrying shell metacharacters — changes which ref gets fetched
      # and compared. The guard would then judge the wrong base and still say OK.
      - run: git fetch --no-tags origin "$BASE_REF"
        env:
          BASE_REF: ${{ github.base_ref }}
      - run: bash scripts/generated-artifact-guard.sh "origin/$BASE_REF"
        env:
          BASE_REF: ${{ github.base_ref }}