fix(console-oauth): send the derived code=true authorize parameter #427
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: [push, pull_request] | |
| jobs: | |
| # --- P9a-4: the SAME macOS build as release.yml's `build-platform`, minus the tag pin, on EVERY | |
| # push -- so a broken darwin build fails here, before a `v*` tag ever exists to discover it at | |
| # publish time. Runs the smoke's EXECUTE path (real `--version` spawn of the just-built binary) | |
| # rather than the SKIP path the two ubuntu `pack-smoke*` jobs below take on this same publishable | |
| # package (M1: `os`/`cpu` mismatch there is expected and permanent, never a reason to fail). This | |
| # job never publishes anything -- `release-gates.test.ts` pins that alongside every other job here. | |
| build-platform: | |
| runs-on: macos-15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: "assert a REAL macOS arm64 runner (P9a-4) -- never trust the `macos-15` label alone" | |
| run: | | |
| set -euo pipefail | |
| UNAME_S="$(uname -s)" | |
| UNAME_M="$(uname -m)" | |
| if [ "$UNAME_S" != "Darwin" ] || [ "$UNAME_M" != "arm64" ]; then | |
| echo "build-platform: expected Darwin/arm64, got $UNAME_S/$UNAME_M -- refusing to build the darwin-arm64 binary here" >&2 | |
| exit 1 | |
| fi | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: pnpm/action-setup@v4 | |
| with: { version: 10 } | |
| - run: pnpm install | |
| - run: bun run scripts/build-runtime.ts --platform-package | |
| - run: ./packages/platform/darwin-arm64/bin/winter --version | |
| - run: bun run scripts/smoke-installed.ts --runtime=bun # the EXECUTE path (P9a-5): os/cpu match here | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: pnpm/action-setup@v4 | |
| with: { version: 10 } | |
| - run: pnpm install | |
| - run: bun run build:packages # P7a fix wave r2 (item 2, re-review N2): EXPLICIT, and FIRST. | |
| # Since the compiled emit, every publishable package points | |
| # its `types` condition at `./dist/*.d.ts`, and two steps | |
| # below resolve through it: `bun test` (compile-fixtures) and | |
| # the consumer-fixture `tsc` (which maps `@sdk-under-test` | |
| # onto the sdk SOURCE, replacing the repo-wide `paths`, so | |
| # every OTHER workspace specifier goes via node_modules). | |
| # Both used to depend on some earlier test having built as a | |
| # SIDE EFFECT -- which is how the merge's focused run failed | |
| # once and passed on re-run. `scripts/release-gates.test.ts` | |
| # pins this step's position. | |
| - run: bun test # all unit tests (codec, runtime, wrapper, trace, version) | |
| - run: bun run typecheck # whole-repo tsc --noEmit incl. test files (sdk, runtime, | |
| # conformance/src, scripts) — Task 5 rider; `bun test` only | |
| # type-strips, so this is the repo's one real tsc gate | |
| - run: bun run conformance:fetch # ephemeral pinned-tarball fetch + checksum verify (Task 2) | |
| - run: bun run conformance:snapshot -- --check # declaration drift gate (Task 3) | |
| - run: bunx tsc --noEmit -p packages/conformance/tsconfig.winter.json # consumer fixture (winter) | |
| - run: bunx tsc --noEmit -p packages/conformance/tsconfig.winter-dist.json # P7a pre-publish item 3: the SAME fixture against the BUILT declarations -- what an installed consumer actually resolves | |
| - run: bun run provider:catalog -- --check # P6 (WS-13 §13): the catalog regenerates byte-identically | |
| # from its two committed layers — a hand-edit of | |
| # generated/catalog.json fails HERE | |
| - run: bun run provider:sync -- --offline # P6 Lane X: NO NETWORK. Re-validates the committed upstream | |
| # layer standalone and cross-checks it against the overlay. | |
| # The NETWORK form (`bun run provider:sync`, and its | |
| # `--check` sibling) is deliberately ABSENT from CI: it | |
| # clones a pinned upstream release, which is a maintainer | |
| # action, not a per-push gate. | |
| # `scripts/verify-provider-live.ts` (the opt-in LIVE provider | |
| # gate) is likewise deliberately absent — it needs real | |
| # credentials and spends real money; scripts/ci-gates.test.ts pins | |
| # that this file never names it. | |
| - run: bun run differential # first differential vs golden (Task 8) | |
| - run: bun run verify:compiled # compiled-transport gate (Task 5, WS-02 §7.4): compiles a | |
| # linux binary via the direct --out path (not the darwin | |
| # platform package) and re-runs the equivalence suite against it | |
| - run: bun run verify:workflow # P5 Task 8 (rider 8/21): the WORKFLOW half of the same | |
| # compiled-binary proof. `verify:compiled` re-runs the | |
| # equivalence suite against the binary; this one drives a REAL | |
| # workflow end to end through the binary's own | |
| # `__workflow-worker` argv dispatch, which no other gate | |
| # exercises -- a dispatch that only exists in the COMPILED | |
| # entry graph, so a dev-leg run cannot stand in for it. | |
| # `sandbox: false` on a host without /usr/bin/sandbox-exec | |
| # (this runner) is the script's own documented linux mode: | |
| # the SUBJECT there is the argv dispatch and the bridge, and | |
| # `launch()` still refuses outright in production when the | |
| # sandbox is required and unavailable. | |
| pack-smoke: | |
| # P7a Lane C, Step 3 (WS-02 §9 item 3): proves a consumer can actually INSTALL and IMPORT what | |
| # release-pack.ts packs -- runs on every push (unlike release.yml, which fires only on a `v*` tag | |
| # or workflow_dispatch and actually publishes; this job never does, so there is no reason to gate | |
| # it behind a release trigger). This job is the BLOCKING half -- the Bun leg, WS-02 §5's own | |
| # Bun-first requirement. The Node 18 leg lives in the separate `pack-smoke-node18` job below, | |
| # BLOCKING since the compiled emit landed (R-7a-16 reversed) -- see that job's own header for why the split exists. | |
| # | |
| # review r1 (Important-4): both this job and `pack-smoke-node18` call the ONE shared | |
| # `scripts/smoke-installed.ts` rather than duplicating the pack/install/import steps inline. It | |
| # packs fresh (running the tarball scan), does ONE `npm install --offline` of every tarball into | |
| # a throwaway project outside the repo (`npm` alone correctly cross-resolves each package's | |
| # inter-dependency against the other tarballs on the same command line -- `bun install` does not, | |
| # confirmed empirically while first building this job), then imports EVERY publishable package's | |
| # bare entry AND every declared `exports` subpath -- derived at run time from each package's own | |
| # manifest, so a new subpath can never be silently left unchecked (this is the exact gap that let | |
| # review r1's two Critical findings ship undetected: the pre-fix version of this job checked only | |
| # 2 of 5 packages' entry points). | |
| # | |
| # `scripts/verify-published-install.ts` (the opt-in cross-repo acceptance step, gated on | |
| # WINTER_PACKAGES_TOKEN) is deliberately absent from every job in this file: it needs a real | |
| # GitHub Packages read token this workflow never holds, and it installs from the REAL registry | |
| # rather than a local tarball, which only makes sense after an actual publish has happened. It is | |
| # a local operator step, never a CI step; release-gates.test.ts pins that the variable name never | |
| # appears anywhere in .github/workflows/. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: pnpm/action-setup@v4 | |
| with: { version: 10 } | |
| - run: pnpm install | |
| - run: bun run scripts/smoke-installed.ts --runtime=bun # WS-02 §5's Bun-first requirement -- BLOCKING | |
| pack-smoke-node18: | |
| # R-7a-16 REVERSED (P7a fix wave, item 1): BLOCKING. `continue-on-error` is gone. | |
| # | |
| # The finding this job was carrying is FIXED. Every publishable package now ships a compiled | |
| # emit -- `bun build --target=node --format=esm --packages=external` per export entry, plus | |
| # `tsc --emitDeclarationOnly` declarations whose relative specifiers are rewritten to `.js` -- | |
| # and every manifest's `default` condition points at it, with a `bun` condition that keeps this | |
| # repo's own resolution on the SOURCE. `scripts/smoke-installed.ts` packs, installs into a | |
| # throwaway project outside the repo, and imports every declared entry point under Node 18. | |
| # | |
| # The Node leg asserts only what a package DECLARES: `engines.node` means "a Node consumer may | |
| # import this", and `@yanlinglabs/winter-provider-conformance` declares `engines.bun` alone | |
| # because it stands up loopback servers with `Bun.serve` -- a deliberate design decision | |
| # `tsconfig.sdk-fence.json` records in prose, which a compiled emit cannot and should not change. | |
| # A package declaring NEITHER engine is required under both, so a new one cannot opt out by | |
| # omission. See `runtimesFor` in that script. | |
| # | |
| # `bun run build:packages` is NOT a step here: `smoke-installed.ts` calls `releasePack()`, which | |
| # builds first by construction -- a tarball whose `default` condition names a file nobody emitted | |
| # is exactly the failure this job exists to catch, and the tarball scan cannot see a MISSING file. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: pnpm/action-setup@v4 | |
| with: { version: 10 } | |
| - uses: actions/setup-node@v4 | |
| with: { node-version: 18 } | |
| - run: pnpm install | |
| - name: "pack-smoke-node18 (BLOCKING since the compiled emit landed — R-7a-16 reversed)" | |
| run: bun run scripts/smoke-installed.ts --runtime=node | |
| official-fixture-compile: | |
| # Task 11 (WS-03 §14 dual-compile, official half): a SEPARATE job (not a step on `build`) so its | |
| # ephemeral ~200MB official-package install (native optionalDependency included — accepted here, | |
| # not skipped) runs in parallel with `build` rather than adding to its critical path. Mirrors | |
| # `build`'s own setup (checkout/bun/pnpm) since compile-official-fixture.ts shells out to `bunx | |
| # tsc`, which needs this repo's pinned typescript from the workspace install, not an ad-hoc fetch. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: pnpm/action-setup@v4 | |
| with: { version: 10 } | |
| - run: pnpm install | |
| - run: bun run scripts/compile-official-fixture.ts |