Huanqi Cao
007001677d
The Windows CI was a single job running the full ci-windows inventory
(check:ci:windows), while Linux splits into 5 lanes (static/lint/coverage/
snapshot/artifacts) per the parallel-gates RFC. The single-job shape was a
transitional artifact from when Windows CI was added as a non-required
observation lane; its rationale ('keep gate parallelism modest so coverage
is not starved') conflated run-gates intra-job concurrency
(DSH_GATE_CONCURRENCY) with GitHub job fan-out — orthogonal concerns.
Split Windows into 4 lanes mirroring Linux (snapshot absent: its goldens
are Linux-recorded and self-skip on Windows). Each lane is a separate
GitHub job so a Windows regression is attributable to one lane, not
buried in one job's log. Concurrency is NOT throttled versus Linux: the
lane is non-blocking (continue-on-error), and the observational stance
is to actively expose Windows-arm issues rather than hide them behind
reduced parallelism.
- scripts/run-gates.ts: add ci-windows:static/lint/coverage/artifacts
modes; ci-windows (full inventory) is retained as the local one-process
entry, symmetric with Linux's ci-primary.
- .github/workflows/ci.yml: windows job becomes a matrix over the 4 lanes.
- package.json: check:ci:windows:{static,lint,coverage,artifacts} scripts.
- AGENTS.md + windows-support RFC: document the per-lane, non-blocking,
unthrottled stance.
Verified: scripts/caohuanqi-private/run-ci.py --windows (full
check:ci:windows) — all gates green except the known hooks-claude
bridge.spec waitFor timeout (pre-existing Windows subprocess-timing
flake, unrelated).
291 lines
9.7 KiB
YAML
291 lines
9.7 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main, master]
|
|
pull_request:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
PRIMARY_NODE_VERSION: '24'
|
|
|
|
jobs:
|
|
node-24:
|
|
runs-on: ubuntu-latest
|
|
name: node 24 / ${{ matrix.lane }}
|
|
env:
|
|
DSH_GATE_CONCURRENCY: ${{ matrix.gate_concurrency }}
|
|
DSH_PUBLINT_CONCURRENCY: ${{ matrix.publint_concurrency }}
|
|
DSH_COVERAGE_MAX_WORKERS: ${{ matrix.coverage_max_workers }}
|
|
DSH_ESLINT_CACHE: ${{ matrix.eslint_cache }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- lane: static
|
|
command: pnpm run check:ci:static
|
|
gate_concurrency: '4'
|
|
publint_concurrency: '8'
|
|
coverage_max_workers: ''
|
|
eslint_cache: ''
|
|
- lane: lint
|
|
command: pnpm run check:ci:lint
|
|
gate_concurrency: '1'
|
|
publint_concurrency: '8'
|
|
coverage_max_workers: ''
|
|
eslint_cache: '1'
|
|
- lane: coverage
|
|
command: pnpm run check:ci:coverage
|
|
gate_concurrency: '1'
|
|
publint_concurrency: '8'
|
|
coverage_max_workers: '4'
|
|
eslint_cache: ''
|
|
- lane: snapshot
|
|
command: pnpm run check:ci:snapshot
|
|
gate_concurrency: '1'
|
|
publint_concurrency: '8'
|
|
coverage_max_workers: ''
|
|
eslint_cache: ''
|
|
- lane: artifacts
|
|
command: pnpm run check:ci:artifacts
|
|
gate_concurrency: '3'
|
|
publint_concurrency: '8'
|
|
coverage_max_workers: ''
|
|
eslint_cache: ''
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ env.PRIMARY_NODE_VERSION }}
|
|
|
|
- name: Enable corepack (pnpm)
|
|
run: corepack enable
|
|
|
|
- name: Resolve pnpm store path
|
|
id: pnpm-store
|
|
run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
|
|
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: ${{ steps.pnpm-store.outputs.path }}
|
|
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-
|
|
|
|
- name: Install (immutable)
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
# The snapshot lane REPLAYS the sandbox example's recorded scenarios,
|
|
# re-executing their bash calls under a real runner. ubuntu-latest has
|
|
# no bubblewrap preinstalled and no built Landlock launcher, so without
|
|
# this the confined executions fail closed (SANDBOX_UNAVAILABLE). Same
|
|
# install as sandbox.yml's bwrap leg (incl. the Ubuntu 24.04 AppArmor
|
|
# userns knob).
|
|
- name: Install bubblewrap (unrestrict userns)
|
|
if: matrix.lane == 'snapshot'
|
|
run: |
|
|
sudo apt-get update -q
|
|
sudo apt-get install -yq bubblewrap
|
|
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 \
|
|
|| echo "apparmor userns knob absent — the functional probe decides"
|
|
|
|
- uses: actions/cache@v4
|
|
if: matrix.lane == 'lint'
|
|
with:
|
|
path: .cache/eslint
|
|
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-eslint-${{ hashFiles('pnpm-lock.yaml', 'eslint.config.mjs', 'tsconfig.json', 'packages/*/*/tsconfig.json', 'examples/*/tsconfig.json') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-eslint-
|
|
|
|
- name: Run gates
|
|
run: ${{ matrix.command }}
|
|
|
|
node-compat:
|
|
runs-on: ubuntu-latest
|
|
name: node ${{ matrix.node }}
|
|
env:
|
|
DSH_GATE_CONCURRENCY: '2'
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
node: ['22.19', 24, 26]
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ matrix.node }}
|
|
|
|
- name: Enable corepack (pnpm)
|
|
run: corepack enable
|
|
|
|
- name: Resolve pnpm store path
|
|
id: pnpm-store
|
|
run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
|
|
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: ${{ steps.pnpm-store.outputs.path }}
|
|
key: ${{ runner.os }}-node-${{ matrix.node }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-node-${{ matrix.node }}-pnpm-
|
|
|
|
- name: Install (immutable)
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Run compatibility gates
|
|
run: pnpm run check:node-compat
|
|
|
|
python-sdk:
|
|
runs-on: ubuntu-latest
|
|
name: python 3.10 / keyless SDK
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- uses: actions/setup-python@v6
|
|
with:
|
|
python-version: '3.10'
|
|
cache: pip
|
|
|
|
- name: Install uv
|
|
run: python -m pip install uv==0.11.23
|
|
|
|
- name: Run complete keyless Python suite
|
|
run: uv run --python 3.10 --group test --project python/sdk pytest
|
|
|
|
# Blocking Windows build lane: keep the already-green native build protected
|
|
# while the broader observational gate job below exposes the remaining
|
|
# portability work without blocking mainline merges.
|
|
windows-build:
|
|
runs-on: windows-2025
|
|
name: windows / build
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ env.PRIMARY_NODE_VERSION }}
|
|
|
|
- name: Enable corepack (pnpm)
|
|
run: corepack enable
|
|
|
|
- name: Install (immutable)
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build (tsc -b + tsdown)
|
|
run: pnpm run build
|
|
|
|
# Observational Windows mirror of the Linux gate lanes. Snapshot stays
|
|
# Linux-only while its replay goldens remain platform-specific. Splitting the
|
|
# lanes makes failures attributable without changing their non-gating role.
|
|
windows-gates:
|
|
runs-on: windows-2025
|
|
name: windows node 24 / ${{ matrix.lane }}
|
|
env:
|
|
DSH_GATE_CONCURRENCY: ${{ matrix.gate_concurrency }}
|
|
DSH_PUBLINT_CONCURRENCY: ${{ matrix.publint_concurrency }}
|
|
DSH_COVERAGE_MAX_WORKERS: ${{ matrix.coverage_max_workers }}
|
|
DSH_ESLINT_CACHE: ${{ matrix.eslint_cache }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- lane: static
|
|
command: pnpm run check:ci:static
|
|
gate_concurrency: '4'
|
|
publint_concurrency: '8'
|
|
coverage_max_workers: ''
|
|
eslint_cache: ''
|
|
- lane: lint
|
|
command: pnpm run check:ci:lint
|
|
gate_concurrency: '1'
|
|
publint_concurrency: '8'
|
|
coverage_max_workers: ''
|
|
eslint_cache: '1'
|
|
- lane: coverage
|
|
command: pnpm run check:ci:coverage
|
|
gate_concurrency: '1'
|
|
publint_concurrency: '8'
|
|
coverage_max_workers: '4'
|
|
eslint_cache: ''
|
|
- lane: artifacts
|
|
command: pnpm run check:ci:artifacts
|
|
gate_concurrency: '3'
|
|
publint_concurrency: '8'
|
|
coverage_max_workers: ''
|
|
eslint_cache: ''
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Enable Developer Mode (symlink support)
|
|
shell: powershell
|
|
run: >-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
|
|
/t REG_DWORD /f /v "AllowDevelopmentWithoutDevLicense" /d "1"
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ env.PRIMARY_NODE_VERSION }}
|
|
|
|
- name: Enable corepack (pnpm)
|
|
shell: powershell
|
|
run: corepack enable
|
|
|
|
- name: Resolve pnpm store path
|
|
id: pnpm-store
|
|
shell: powershell
|
|
run: '"path=$(pnpm store path --silent)" >> $env:GITHUB_OUTPUT'
|
|
|
|
- uses: actions/cache@v4
|
|
if: matrix.lane == 'lint'
|
|
with:
|
|
path: ${{ steps.pnpm-store.outputs.path }}
|
|
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-
|
|
|
|
- name: Install (immutable)
|
|
shell: powershell
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: .cache/eslint
|
|
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-eslint-${{ hashFiles('pnpm-lock.yaml', 'eslint.config.mjs', 'tsconfig.json', 'packages/*/*/tsconfig.json', 'examples/*/tsconfig.json') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-eslint-
|
|
|
|
- name: Run gates
|
|
shell: powershell
|
|
run: ${{ matrix.command }}
|
|
|
|
# Single stable required check for branch protection: require "all checks
|
|
# passed" instead of enumerating matrix legs whose names change as lanes and
|
|
# node versions evolve. Every blocking job in THIS workflow must be listed in
|
|
# `needs`; explicitly observational jobs such as windows-gates stay out
|
|
# (`needs` cannot reach across workflow files; e2e.yml stays its own check).
|
|
# `if: always()` is load-bearing: without it a failed dependency
|
|
# would SKIP this job, and GitHub counts a skipped required check as passing
|
|
# — so this job always runs and fails on any non-success result, including
|
|
# 'cancelled' and 'skipped'.
|
|
all-checks-passed:
|
|
name: all checks passed
|
|
runs-on: ubuntu-latest
|
|
needs: [node-24, node-compat, python-sdk, windows-build]
|
|
if: always()
|
|
steps:
|
|
- name: Fail if any needed job did not succeed
|
|
if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')
|
|
run: |
|
|
echo "::error::Needed job results: ${{ join(needs.*.result, ', ') }}"
|
|
exit 1
|
|
- name: All checks passed
|
|
run: echo "All needed jobs succeeded (${{ join(needs.*.result, ', ') }})"
|