Public release: 2026-05-19

Author: marmutapp

.github/workflows/ci.yml

@@ -0,0 +1,107 @@
+# Continuous-integration gates — run on every PR + every push to
+# main. Catches frontend type errors, Go vet/test regressions, and
+# the "I forgot to run `make web-build` before committing" class of
+# bug that silently shipped pre-v1.6.0.
+#
+# Tagged-release builds are handled by npm-release.yml; this file is
+# the pre-merge / pre-tag safety net.
+
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  # ----------------------------------------------------------------
+  # React frontend gates: install, typecheck, build. Also asserts the
+  # committed embedded dist matches what a fresh build produces — if
+  # `web/src/` was edited without rerunning `make web-build`, this
+  # job fails with a clear actionable message. Without this gate the
+  # embedded bundle silently drifted from the React source.
+  # ----------------------------------------------------------------
+  frontend:
+    name: frontend
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: web/package-lock.json
+
+      - name: npm ci
+        run: |
+          cd web
+          npm ci
+
+      - name: typecheck
+        run: |
+          cd web
+          npm run typecheck
+
+      - name: build
+        run: |
+          cd web
+          npm run build
+
+      - name: dist consistency check
+        # Mirrors `make web-build`'s second half: regenerates the
+        # embedded dir from web/dist and asserts it matches what's
+        # committed. If it doesn't, the dev edited web/src/ but
+        # forgot to commit the rebuilt bundle — a stale embed would
+        # ship on the next release.
+        run: |
+          set -euo pipefail
+          rm -rf internal/intelligence/dashboard/webapp/dist
+          mkdir -p internal/intelligence/dashboard/webapp/dist
+          cp -R web/dist/. internal/intelligence/dashboard/webapp/dist/
+          if ! git diff --quiet --exit-code internal/intelligence/dashboard/webapp/dist; then
+            echo "::error::Committed webapp/dist drifted from web/dist. Run \`make web-build\` and commit the result."
+            git diff --stat internal/intelligence/dashboard/webapp/dist | head -40
+            exit 1
+          fi
+          echo "embedded dist matches fresh build ✓"
+
+  # ----------------------------------------------------------------
+  # Go gates — vet, test, build. Pure-Go so no special toolchain
+  # beyond setup-go. Frontend build is independent (this job doesn't
+  # need a fresh dist to compile; the committed embed satisfies the
+  # //go:embed directive at compile time, even if it's stale for the
+  # purposes of the runtime UI).
+  # ----------------------------------------------------------------
+  go:
+    name: go
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+          cache: true
+
+      - name: vet
+        run: go vet ./...
+
+      - name: test
+        # -race catches the watcher / proxy concurrency bugs that
+        # otherwise slip past until live use.
+        run: go test -race ./...
+
+      - name: build
+        # `make build` skipped here — that target requires Node for
+        # web-build, which the frontend job already verified. This
+        # step exercises the Go compile path against the committed
+        # embedded dist.
+        run: |
+          mkdir -p bin
+          go build -trimpath -o bin/observer ./cmd/observer
+          GOOS=windows GOARCH=amd64 go build -trimpath -o bin/antigravity-bridge.exe ./cmd/antigravity-bridge
+          ls -l bin/