mirror of
https://gh-proxy.org/https://github.com/klinsmaya/multica.git
synced 2026-11-10 02:16:45 +08:00
8d2da6b8db
* MUL-6479 feat(dev): make a local environment a named object with one verb per lifecycle step Local development had six entry points, thirty-four make targets and no way to see or delete what they created. `make up` / `status` / `list` / `down` / `destroy` / `gc` / `env-exec` replace that with one set of verbs, shared by humans and agents, with `C=api,web,daemon,desktop` selecting components. Three defects made the old flow untrustworthy rather than merely verbose. 1. The database the tooling created was not the one the application reached. `ensure-postgres.sh` creates through `docker exec`; when a native PostgreSQL owns 5432 the container never binds the host port, so the create lands in a server the backend never talks to. It printed "✓ PostgreSQL ready" and the next step died with `SQLSTATE 3D000`. On the machine this was written on the two servers had already diverged: 94 same-named databases, 69 more in the container with no counterpart. `up` now creates through DATABASE_URL and treats a successful `migrate up` — which pings that same string — as the only proof; failure diagnoses the port owner instead of reporting a missing database. 2. Identity was computed, not allocated. Ports, database names and CLI profiles all came from `cksum($PWD) % 1000`, and a collision was silent: the loser fails to bind while the winner keeps answering 200. Allocation now happens under a lock, probing from the same path hash so a checkout keeps its familiar numbers, and requires the slot to be both unregistered and free of a live listener. The manifest in ~/.multica/dev/envs/<name>/ is what every later command reads. 3. Creating an environment left no record of how to destroy it, so there was no destroy — only archaeology. `down` stops processes and keeps the data; `destroy` consumes the manifest: processes, database, profile, slot. `list` makes leaks visible and `gc` collects environments whose checkout is gone or whose TTL passed. /health now reports pid, commit and started_at. A 200 alone proves something is listening, which is exactly what let a failed restart keep serving the previous build; `up` compares started_at against its own launch and refuses an answer that predates it. Two constraints are enforced rather than documented: the daemon is started from a built server/bin/multica, never `go run` (the daemon re-execs its own path for every task, and `go run` deletes that binary when the launcher exits), and `C=daemon` under a .multica/daemon_task_context.json marker stops with that explanation up front instead of spending a login on a refusal. scripts/dev-env.test.sh covers the registry verbs against a throwaway MULTICA_DEV_HOME with no services running, and pins the regression that made `down` exit 1 after reporting success: on bash 3.2 a command substitution whose function ends in a failing command aborts the script under `set -e`, and "no process is listening" is that function's normal answer. `make dev` is unchanged and still runs in the foreground. Co-authored-by: multica-agent <[email protected]> * fix(dev): close local environment lifecycle gaps Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Lambda <[email protected]> Co-authored-by: multica-agent <[email protected]>
800 lines
37 KiB
YAML
800 lines
37 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
# Decides whether the heavy frontend validation jobs, the backend Go jobs
|
|
# and sqlc verification have anything to do.
|
|
# The frontend jobs validate the web/desktop apps, the shared packages,
|
|
# the install graph, and the selfhost / reserved-slugs scripts it runs;
|
|
# a pure backend-only or docs-only PR touches none of those and gains
|
|
# nothing from a full web build. Symmetrically, the backend jobs compile
|
|
# and test server/, so a frontend-only or docs-only PR gains nothing from
|
|
# a `go test -race` run. The outputs are consumed by the focused jobs
|
|
# below.
|
|
changes:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
outputs:
|
|
frontend: ${{ steps.decide.outputs.frontend }}
|
|
backend: ${{ steps.decide.outputs.backend }}
|
|
sqlc: ${{ steps.decide.outputs.sqlc }}
|
|
images: ${{ steps.filter.outputs.images }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Filter paths
|
|
id: filter
|
|
uses: dorny/paths-filter@v3
|
|
with:
|
|
# apps/docs is excluded from the frontend turbo run, but knip does
|
|
# analyze it, so a docs-only change still needs this job.
|
|
# apps/mobile has its own mobile-verify workflow. Everything else
|
|
# the frontend job touches is listed here; bias toward
|
|
# over-matching since a missed path silently skips validation.
|
|
filters: |
|
|
frontend:
|
|
- 'apps/web/**'
|
|
- 'apps/desktop/**'
|
|
- 'apps/docs/**'
|
|
- 'packages/**'
|
|
- 'package.json'
|
|
- '.npmrc'
|
|
- 'pnpm-lock.yaml'
|
|
- 'pnpm-workspace.yaml'
|
|
- 'turbo.json'
|
|
- 'knip.jsonc'
|
|
- '.github/workflows/ci.yml'
|
|
- 'scripts/generate-reserved-slugs.mjs'
|
|
- 'server/internal/handler/reserved_slugs.json'
|
|
- 'scripts/check-ui-wildcard-exports.mjs'
|
|
- 'scripts/check-ui-wildcard-exports.test.sh'
|
|
- 'scripts/selfhost-config.test.sh'
|
|
- 'scripts/drop-database.sh'
|
|
- 'scripts/remove-worktree.sh'
|
|
- 'scripts/worktree-db.test.sh'
|
|
- 'scripts/dev-env.sh'
|
|
- 'scripts/dev-env.test.sh'
|
|
- 'scripts/selfhost-wait.sh'
|
|
# selfhost-config.test.sh asserts on the installers' side of
|
|
# the port contract, so a change to either must run it.
|
|
- 'scripts/install.sh'
|
|
- 'scripts/install.ps1'
|
|
- 'scripts/check.sh'
|
|
- 'scripts/dev.sh'
|
|
- 'scripts/local-env.sh'
|
|
- '.env.example'
|
|
- 'docker-compose.selfhost.yml'
|
|
- 'docker-compose.selfhost.build.yml'
|
|
- 'Makefile'
|
|
# Everything the backend jobs (backend-tests,
|
|
# go-vulnerability-scan, windows-execenv) read, which is NOT the
|
|
# same thing as server/**: four Go tests reach out of the module
|
|
# to pin a contract against a file the other side owns, across
|
|
# three cross-module file dependencies. Each of those files has
|
|
# to be listed here or the PR that breaks the contract is exactly
|
|
# the PR that skips the test. Same bias as the frontend filter:
|
|
# over-match rather than silently skip validation.
|
|
backend:
|
|
- 'server/**'
|
|
- 'deploy/helm/**'
|
|
# pkg/agent/worktree_capability_contract_test.go reads this file
|
|
# and compares LOCAL_WORKTREE_CAPABILITY against the daemon's
|
|
# protocol constant. A typo on either side disables worktree
|
|
# mode for everyone with no error anywhere, so a change to the
|
|
# frontend half must run the backend suite.
|
|
- 'packages/core/runtimes/cli-version.ts'
|
|
# internal/daemon/agent_command_names_test.go reads both of
|
|
# these as test inputs; the guard script is additionally the
|
|
# entry point scripts/test-go.sh runs, and the names file is
|
|
# the data that guard consumes.
|
|
- 'scripts/agent-cli-command-names.txt'
|
|
- 'scripts/go-test-with-agent-cli-guard.sh'
|
|
- 'scripts/helm-config.test.sh'
|
|
- 'scripts/entrypoint.test.sh'
|
|
- 'docker/entrypoint.sh'
|
|
- 'scripts/test-go.sh'
|
|
- 'scripts/test-go.test.sh'
|
|
# makefile-build.test.sh asserts how `make build` names its
|
|
# output binaries, so a change to either side must run it.
|
|
- 'scripts/makefile-build.test.sh'
|
|
- 'Makefile'
|
|
- '.github/workflows/ci.yml'
|
|
sqlc:
|
|
- 'server/pkg/db/queries/**'
|
|
- 'server/pkg/db/generated/**'
|
|
- 'server/migrations/**'
|
|
- 'server/sqlc.yaml'
|
|
- 'Makefile'
|
|
- '.github/workflows/ci.yml'
|
|
# Gates the image-budget job so the full-history checkout it
|
|
# needs is only paid for on PRs that actually touch a bitmap.
|
|
images:
|
|
- '**/*.png'
|
|
- '**/*.jpg'
|
|
- '**/*.jpeg'
|
|
- '**/*.gif'
|
|
- '**/*.bmp'
|
|
- '**/*.tif'
|
|
- '**/*.tiff'
|
|
- '**/*.webp'
|
|
- '**/*.avif'
|
|
- 'scripts/check-image-budget.mjs'
|
|
|
|
- name: Decide
|
|
id: decide
|
|
# Always run everything on push to main (full validation); on
|
|
# pull_request, run only the areas whose paths changed.
|
|
# The gated jobs themselves always run and report success — their
|
|
# steps are gated on these outputs rather than the job being skipped
|
|
# — so the required "frontend" / "backend" status checks are
|
|
# satisfied with a genuine green instead of being left pending on
|
|
# filtered PRs. It also keeps the aggregate gates strict: a job that
|
|
# goes missing for any OTHER reason (a failed `changes`, a cancelled
|
|
# run) still reports non-success and fails the gate.
|
|
env:
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
FRONTEND_CHANGED: ${{ steps.filter.outputs.frontend }}
|
|
BACKEND_CHANGED: ${{ steps.filter.outputs.backend }}
|
|
SQLC_CHANGED: ${{ steps.filter.outputs.sqlc }}
|
|
run: |
|
|
if [ "$EVENT_NAME" != "pull_request" ] || [ "$FRONTEND_CHANGED" = "true" ]; then
|
|
echo "frontend=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "frontend=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
if [ "$EVENT_NAME" != "pull_request" ] || [ "$BACKEND_CHANGED" = "true" ]; then
|
|
echo "backend=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "backend=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
if [ "$EVENT_NAME" != "pull_request" ] || [ "$SQLC_CHANGED" = "true" ]; then
|
|
echo "sqlc=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "sqlc=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
sqlc-check:
|
|
needs: changes
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
if: ${{ needs.changes.outputs.sqlc == 'true' }}
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Setup Go
|
|
if: ${{ needs.changes.outputs.sqlc == 'true' }}
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.26.x"
|
|
check-latest: true
|
|
cache-dependency-path: server/go.sum
|
|
|
|
- name: Verify generated SQL is up to date
|
|
if: ${{ needs.changes.outputs.sqlc == 'true' }}
|
|
run: |
|
|
make sqlc
|
|
git diff --exit-code -- server/pkg/db/generated
|
|
untracked="$(git ls-files --others --exclude-standard -- server/pkg/db/generated)"
|
|
if [ -n "$untracked" ]; then
|
|
printf 'Untracked generated SQL files:\n%s\n' "$untracked"
|
|
exit 1
|
|
fi
|
|
|
|
# The frontend validation is split across four runners on purpose. A prior
|
|
# split isolated build/typecheck/lint from the test suites; on a full test
|
|
# cache miss, however, web/core/desktop/views still competed for the four
|
|
# vCPUs on the test runner and stretched the job to ~8 minutes. Giving views
|
|
# its own runner only reduced that to 7m23s because the suite itself remained
|
|
# the long pole, so two Vitest shards now split it across two runners while
|
|
# the remaining suites continue in parallel on another. The extra setup
|
|
# increases total runner-minutes but reduces wall-clock feedback time.
|
|
frontend-build:
|
|
needs: changes
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
# Pin turbo's filesystem cache somewhere actions/cache can address.
|
|
TURBO_CACHE_DIR: .turbo/cache
|
|
steps:
|
|
- name: Checkout
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Setup pnpm
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Setup Node.js
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
run: pnpm install
|
|
|
|
# `node-version: 22` above floats across patch releases, and turbo's
|
|
# global hash does not include the interpreter at all (`engines` is null
|
|
# in its dry-run cache inputs). Without the resolved version in the key,
|
|
# a runner silently moving to another 22.x would restore a cache built by
|
|
# the old interpreter and report green without executing anything.
|
|
- name: Resolve runtime for cache key
|
|
id: runtime
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
run: echo "node=$(node --version)" >> "$GITHUB_OUTPUT"
|
|
|
|
# Cache entries are immutable, so the key carries the commit SHA to make
|
|
# every run publish a fresh one and `restore-keys` falls back to the most
|
|
# recent prefix match. Each frontend worker runs a disjoint task set, so
|
|
# it gets its own prefix rather than racing to save one key.
|
|
# GitHub scopes caches by branch: a PR reads main's entries (so unchanged
|
|
# tasks hit on the first push) and writes its own (so re-pushes hit too).
|
|
- name: Restore turbo cache
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: .turbo/cache
|
|
key: turbo-build-${{ runner.os }}-${{ runner.arch }}-${{ steps.runtime.outputs.node }}-${{ github.sha }}
|
|
restore-keys: |
|
|
turbo-build-${{ runner.os }}-${{ runner.arch }}-${{ steps.runtime.outputs.node }}-
|
|
|
|
- name: Test self-host env derivation
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
run: bash scripts/selfhost-config.test.sh
|
|
|
|
- name: Test worktree database cleanup
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
run: bash scripts/worktree-db.test.sh
|
|
|
|
- name: Test development environment registry
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
run: bash scripts/dev-env.test.sh
|
|
|
|
- name: Verify reserved-slugs.ts is up to date
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
# Re-runs the generator and fails on any drift from the
|
|
# checked-in TypeScript output. The Go side embeds the JSON
|
|
# source directly, so a passing diff here proves both sides
|
|
# share one source of truth.
|
|
run: |
|
|
pnpm generate:reserved-slugs
|
|
git diff --exit-code -- packages/core/paths/reserved-slugs.ts
|
|
|
|
- name: Build, type check, and lint
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
# Mobile lives in a parallel mobile-verify workflow (path-filtered
|
|
# to apps/mobile/** + packages/core/**) so it doesn't add
|
|
# ~50s of expo-lint + tsc to every web/desktop PR. Keep this
|
|
# filter in sync with the root package.json scripts, which also
|
|
# exclude @multica/mobile.
|
|
run: pnpm exec turbo build typecheck lint --filter='!@multica/docs' --filter='!@multica/mobile'
|
|
|
|
# Blocking from the start: it reports nothing today, and it covers the
|
|
# one regression knip structurally cannot see. packages/ui exports four
|
|
# wildcards, which knip expands into entry-point globs over every file
|
|
# in those directories — so a newly stranded component there always
|
|
# reads as "used". See the script header for the options ruled out.
|
|
- name: Check packages/ui wildcard exports
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
run: |
|
|
bash scripts/check-ui-wildcard-exports.test.sh
|
|
node scripts/check-ui-wildcard-exports.mjs
|
|
|
|
# WARN PHASE — reports, never blocks. `shamefully-hoist=true` in .npmrc
|
|
# hides both halves of the drift this catches: an undeclared import still
|
|
# resolves, and an obsolete declaration still installs. Neither shows up
|
|
# in build, typecheck, or lint.
|
|
#
|
|
# `continue-on-error` alone, with no `|| true`: the real exit code has to
|
|
# reach Actions for the step to show as a warning rather than a silent
|
|
# pass, and it is what makes the promotion below a one-line change.
|
|
#
|
|
# TO PROMOTE TO BLOCKING: once this step has run clean for a full cycle
|
|
# on main, drop `continue-on-error`. The findings it reports today are
|
|
# pre-existing dead code left out of the cleanup that introduced it
|
|
# (MUL-6353) — clear those first, or the flip turns them into a red main.
|
|
- name: Check for dead code and phantom dependencies (knip)
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
continue-on-error: true
|
|
run: pnpm knip
|
|
|
|
frontend-test:
|
|
needs: changes
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
TURBO_CACHE_DIR: .turbo/cache
|
|
steps:
|
|
- name: Checkout
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Setup pnpm
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Setup Node.js
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
run: pnpm install
|
|
|
|
- name: Resolve runtime for cache key
|
|
id: runtime
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
run: echo "node=$(node --version)" >> "$GITHUB_OUTPUT"
|
|
|
|
# See frontend-build for the key strategy. These entries are tiny (~60KB
|
|
# measured): `test` declares no outputs, so turbo caches exit codes and
|
|
# logs rather than artifacts -- yet a hit still skips the whole suite,
|
|
# which is the single most expensive task in the graph.
|
|
- name: Restore turbo cache
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: .turbo/cache
|
|
key: turbo-test-${{ runner.os }}-${{ runner.arch }}-${{ steps.runtime.outputs.node }}-${{ github.sha }}
|
|
restore-keys: |
|
|
turbo-test-${{ runner.os }}-${{ runner.arch }}-${{ steps.runtime.outputs.node }}-
|
|
|
|
- name: Test web, core, and desktop
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
# Same filter rationale as frontend-build. Type errors are not this
|
|
# job's responsibility -- frontend-build owns the `typecheck` task.
|
|
# `test` reaches dependency sources through the hash-only
|
|
# `^cache-inputs` edge (see turbo.json), so no `tsc` runs here.
|
|
run: pnpm exec turbo test --filter='!@multica/docs' --filter='!@multica/mobile' --filter='!@multica/views'
|
|
|
|
# Split views across two runners. GitHub reports the matrix job's combined
|
|
# result, so the aggregate gate can continue depending on this one job ID.
|
|
frontend-views-test:
|
|
name: frontend-views-test (${{ matrix.index }}/${{ matrix.total }})
|
|
needs: changes
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- index: 1
|
|
total: 2
|
|
- index: 2
|
|
total: 2
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
TURBO_CACHE_DIR: .turbo/cache
|
|
steps:
|
|
- name: Checkout
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Setup pnpm
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Setup Node.js
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
run: pnpm install
|
|
|
|
- name: Resolve runtime for cache key
|
|
id: runtime
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
run: echo "node=$(node --version)" >> "$GITHUB_OUTPUT"
|
|
|
|
# Each shard has its own prefix so concurrent jobs never race to save the
|
|
# same immutable cache key. Turbo also includes the passthrough `--shard`
|
|
# argument in the task hash, while dependency sources still flow through
|
|
# turbo.json's hash-only `^cache-inputs` edge.
|
|
- name: Restore turbo cache
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: .turbo/cache
|
|
key: turbo-views-test-${{ matrix.index }}-of-${{ matrix.total }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.runtime.outputs.node }}-${{ github.sha }}
|
|
restore-keys: |
|
|
turbo-views-test-${{ matrix.index }}-of-${{ matrix.total }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.runtime.outputs.node }}-
|
|
|
|
- name: Test views shard ${{ matrix.index }}/${{ matrix.total }}
|
|
if: ${{ needs.changes.outputs.frontend == 'true' }}
|
|
run: pnpm exec turbo test --filter='@multica/views' -- --shard=${{ matrix.index }}/${{ matrix.total }}
|
|
|
|
# Aggregate gate. `frontend` is the status-check name the repository's
|
|
# branch rules refer to, so it has to survive the split above: this job
|
|
# keeps reporting under that name and simply fails when any worker fails.
|
|
# It also inherits the old contract that the check goes green (rather than
|
|
# staying pending) on PRs the path filter excluded — all workers succeed
|
|
# trivially in that case because every step is gated off.
|
|
frontend:
|
|
needs: [frontend-build, frontend-test, frontend-views-test]
|
|
# `!cancelled()` rather than `always()`: a run superseded by a newer push
|
|
# is cancelled by the concurrency group above, and there is no reason to
|
|
# spend a runner reporting a verdict nobody will read.
|
|
if: ${{ !cancelled() }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check frontend job results
|
|
env:
|
|
BUILD_RESULT: ${{ needs.frontend-build.result }}
|
|
TEST_RESULT: ${{ needs.frontend-test.result }}
|
|
VIEWS_TEST_RESULT: ${{ needs.frontend-views-test.result }}
|
|
run: |
|
|
echo "frontend-build: $BUILD_RESULT"
|
|
echo "frontend-test: $TEST_RESULT"
|
|
echo "frontend-views-test: $VIEWS_TEST_RESULT"
|
|
if [ "$BUILD_RESULT" != "success" ] || [ "$TEST_RESULT" != "success" ] || [ "$VIEWS_TEST_RESULT" != "success" ]; then
|
|
echo "::error::frontend validation failed"
|
|
exit 1
|
|
fi
|
|
|
|
backend-tests:
|
|
needs: changes
|
|
runs-on: ubuntu-latest
|
|
# `services` cannot be conditional, so the Postgres and Redis containers
|
|
# still start on a filtered PR. That is ~1 minute of runner time against
|
|
# the several minutes the gated steps below cost; job-level `if` would
|
|
# save it but report `skipped` to the aggregate gate, which then has to
|
|
# accept `skipped` as success and stops catching jobs that go missing for
|
|
# reasons other than the path filter.
|
|
services:
|
|
postgres:
|
|
image: pgvector/pgvector:pg17
|
|
env:
|
|
POSTGRES_DB: multica
|
|
POSTGRES_USER: multica
|
|
POSTGRES_PASSWORD: multica
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U multica -d multica"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 20
|
|
redis:
|
|
image: redis:7-alpine
|
|
ports:
|
|
- 6379:6379
|
|
options: >-
|
|
--health-cmd "redis-cli ping"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 10
|
|
env:
|
|
DATABASE_URL: postgres://multica:multica@localhost:5432/multica?sslmode=disable
|
|
# Wires up the RedisLocalSkill*_test.go suite. Distinct from REDIS_URL
|
|
# (which would flip the server binary itself onto the Redis-backed
|
|
# realtime relay + request stores); the tests talk to this Redis
|
|
# directly so they run alongside the Postgres-backed suite.
|
|
REDIS_TEST_URL: redis://localhost:6379/1
|
|
steps:
|
|
- name: Checkout
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Setup Go
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
# Deliberately independent from the minimum patch in server/go.mod:
|
|
# CI follows the newest 1.26 patch available to setup-go.
|
|
go-version: "1.26.x"
|
|
check-latest: true
|
|
cache-dependency-path: server/go.sum
|
|
|
|
- name: Setup Helm
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
uses: azure/setup-helm@v4
|
|
|
|
- name: Test Helm chart
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
run: bash scripts/helm-config.test.sh
|
|
|
|
- name: Test backend entrypoint signals
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
run: bash scripts/entrypoint.test.sh
|
|
|
|
- name: Test build output naming
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
run: bash scripts/makefile-build.test.sh
|
|
|
|
- name: Build
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
run: cd server && go build ./...
|
|
|
|
- name: Run migrations
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
run: cd server && go run ./cmd/migrate up
|
|
|
|
- name: Verify Go test wrapper
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
run: bash scripts/test-go.test.sh
|
|
|
|
- name: Test
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
run: bash scripts/test-go.sh --race
|
|
|
|
# Keep the live vulnerability database from hiding build and test results.
|
|
# The aggregate backend job below still treats both jobs as one merge gate.
|
|
go-vulnerability-scan:
|
|
needs: changes
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Setup Go
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
# Deliberately independent from the minimum patch in server/go.mod:
|
|
# CI follows the newest 1.26 patch available to setup-go.
|
|
go-version: "1.26.x"
|
|
check-latest: true
|
|
cache-dependency-path: server/go.sum
|
|
|
|
- name: Scan Go vulnerabilities
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
working-directory: server
|
|
run: go tool govulncheck ./...
|
|
|
|
# Preserve the existing required-check name while allowing tests, generated
|
|
# SQL verification, and the vulnerability scan to run independently.
|
|
backend:
|
|
needs: [backend-tests, sqlc-check, go-vulnerability-scan]
|
|
if: ${{ !cancelled() }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check backend job results
|
|
env:
|
|
TEST_RESULT: ${{ needs.backend-tests.result }}
|
|
SQLC_RESULT: ${{ needs.sqlc-check.result }}
|
|
VULNERABILITY_RESULT: ${{ needs.go-vulnerability-scan.result }}
|
|
run: |
|
|
echo "backend-tests: $TEST_RESULT"
|
|
echo "sqlc-check: $SQLC_RESULT"
|
|
echo "go-vulnerability-scan: $VULNERABILITY_RESULT"
|
|
if [ "$TEST_RESULT" != "success" ] || [ "$SQLC_RESULT" != "success" ] || [ "$VULNERABILITY_RESULT" != "success" ]; then
|
|
echo "::error::backend validation failed"
|
|
exit 1
|
|
fi
|
|
|
|
windows-execenv:
|
|
# The environment-preparation deadline owns a process tree, not just a Go
|
|
# process. This Windows runtime test verifies Job Object cancellation kills
|
|
# a delayed descendant before an immediate retry can reuse the same root.
|
|
# Every step here is a Go test under server/, so it rides the same path
|
|
# filter as the backend jobs; steps are gated rather than the job so the
|
|
# check still reports green on a filtered PR.
|
|
needs: changes
|
|
runs-on: windows-latest
|
|
steps:
|
|
- name: Checkout
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Setup Go
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
# Deliberately independent from the minimum patch in server/go.mod:
|
|
# CI follows the newest 1.26 patch available to setup-go.
|
|
go-version: "1.26.x"
|
|
check-latest: true
|
|
cache-dependency-path: server/go.sum
|
|
|
|
- name: Test Windows execution-environment isolation
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
working-directory: server
|
|
# Keep this job scoped to the runtime regression it exists to prove.
|
|
# The package's legacy OpenClaw HOME tests are not Windows-safe and are
|
|
# outside this PR; the normal backend job still runs the full package.
|
|
run: go test ./internal/daemon/execenv -run '^TestPrepareIsolated_WindowsKillsDescendantBeforeRetry$' -count=1 -timeout=5m
|
|
|
|
- name: Test Windows agent launcher argv/stdin handling
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
working-directory: server
|
|
# Agent prompts must never reach a Windows launcher through argv: the
|
|
# official cursor-agent.ps1 and pi.ps1 launch native children with
|
|
# `$args`, and PowerShell re-serialises them onto the child command
|
|
# line. Under
|
|
# Legacy native argument passing (powershell.exe 5.1, pwsh <= 7.2) a
|
|
# prompt holding embedded quotes is re-tokenised and fragments like
|
|
# `-X` become flags (#5649). Only a real PowerShell host proves this,
|
|
# so it cannot live in the ubuntu backend job. Scoped to the launcher
|
|
# tests, which are windows-tagged and therefore run nowhere else today;
|
|
# the backend job still runs the full package on Linux.
|
|
# -v so a silent skip (no PowerShell host resolved, or a -run pattern
|
|
# that stops matching) is visible in the log instead of passing as "ok".
|
|
run: go test ./pkg/agent -v -run '^(TestCursorExecutePromptSurvivesPowerShellShim|TestPiExecutePromptSurvivesPowerShellShim|TestPlatformCursorInvocation|TestPlatformCopilotInvocation|TestPlatformPiInvocation)' -count=1 -timeout=5m
|
|
|
|
- name: Test Windows OpenCode oversized prompt reaches stdin
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
working-directory: server
|
|
# #6538: the daemon inlined the whole task prompt as an argv element,
|
|
# so every OpenCode task whose prompt cleared CreateProcess's 32,767
|
|
# character lpCommandLine limit failed to start at all, with Go
|
|
# reporting ERROR_FILENAME_EXCED_RANGE as the misleading "The filename
|
|
# or extension is too long". Only a real CreateProcess enforces that
|
|
# ceiling, so this cannot run in the ubuntu backend job. The test
|
|
# spawns a native .exe directly (a Chocolatey-installed opencode.exe is
|
|
# a real PE binary, not a .cmd shim) with an oversized prompt and pins
|
|
# that the process starts, argv stays free of the prompt, and the full
|
|
# payload arrives on stdin.
|
|
# -v so a silent skip or a -run pattern that stops matching is visible
|
|
# in the log instead of passing as "ok".
|
|
run: go test ./pkg/agent -v -run '^TestOpencodeExecuteOversizedPromptStartsOnWindows$' -count=1 -timeout=5m
|
|
|
|
- name: Test Windows agent process-tree ownership
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
working-directory: server
|
|
# A Job Object is the only way to prove whole-tree termination on
|
|
# Windows, and only a real Windows runner can exercise it: that a
|
|
# grandchild dies with the tree that owns it, that an unowned process
|
|
# still reports cleanup as unconfirmed, and that a descendant holding
|
|
# inherited stdout neither keeps Result blocked nor survives cleanup.
|
|
# -v makes RUN/PASS evidence explicit in CI logs.
|
|
run: go test ./pkg/agent -v -run '^(TestStartOwnedProcessTreeCapturesImmediateDescendants|TestStartOwnedProcessTreeLeavesNoSuspendedChild|TestWaitProcessGroupGoneWithoutOwnershipReportsUnconfirmed|TestCodexInitializeRetrySupportedWithOwnedProcessTree|TestCodexWindowsDescendantsDieWithTheOwnedProcessTree)$' -count=1 -timeout=5m
|
|
|
|
- name: Test Windows OpenClaw npm shim interpreter resolution
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
working-directory: server
|
|
# #6061: every OpenClaw task failed execenv prep on a Windows host with
|
|
# a bare `exit status 1` and no stderr. A batch shim resolves and runs
|
|
# fine while the `node` it re-execs is unreachable, and npm's real
|
|
# template prefers a co-located node.exe over PATH — none of which can
|
|
# be proven without a real cmd.exe host. These tests pin: the positive
|
|
# control (node on PATH → success), that a missing node surfaces
|
|
# cmd.exe's own stderr (the first run of this job disproved #6061's
|
|
# premise that it does not), that a genuinely silent shim DOES reach the
|
|
# new diagnostic, that a co-located interpreter is credited, that a
|
|
# context timeout is not misdiagnosed as a missing interpreter, and that
|
|
# TEMP/TMP are NOT load-bearing (the originally reported root cause,
|
|
# since retracted upstream).
|
|
# Scoped to the windows-tagged shim tests — the package's legacy
|
|
# OpenClaw HOME tests are not Windows-safe; the backend job still runs
|
|
# the full package plus the cross-platform half on Linux.
|
|
# -v so a skip (no node on the runner) is visible instead of passing
|
|
# silently as "ok".
|
|
run: go test ./internal/daemon/execenv -v -run '^TestWindowsOpenclawShim' -count=1 -timeout=5m
|
|
|
|
- name: Test Windows isolated repo checkout is committable
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
working-directory: server
|
|
# #6449: on Windows the daemon now hands Codex tasks a checkout whose
|
|
# .git lives inside the task workdir, because a linked worktree's
|
|
# external gitdir stays read-only under the native sandbox and breaks
|
|
# `git add` / `git commit` at the end of a task. Two of the guarantees
|
|
# are claims about Windows itself and cannot be made on ubuntu: that
|
|
# Git puts the gitdir inside the task directory, and that the clone's
|
|
# objects are private copies rather than NTFS hard links sharing one
|
|
# file and one security descriptor with the daemon-owned cache. The
|
|
# cross-volume test covers what a hard link cannot express at all.
|
|
# Scoped to the two windows-tagged tests by exact name. A prefix match
|
|
# also caught the package's cross-platform isolated-checkout test,
|
|
# which cannot run here: repocache derives a cache directory name from
|
|
# the full source repo path, so a t.TempDir() path that already embeds
|
|
# a long test name doubles and blows past MAX_PATH. That test belongs
|
|
# to the ubuntu backend job, which runs the whole package.
|
|
# -v so a skip (single-volume runner) is visible instead of passing
|
|
# silently as "ok".
|
|
run: go test ./internal/daemon/repocache -v -run '^(TestIsolatedCheckoutIsCommittableOnWindows|TestIsolatedCheckoutAcrossVolumesOnWindows)$' -count=1 -timeout=5m
|
|
|
|
- name: Test Windows directory-junction link safety
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
working-directory: server
|
|
# MUL-6000: the per-task codex-home links the user's real skills into
|
|
# the task directory instead of copying them. On Windows that link is a
|
|
# directory junction whenever os.Symlink is denied (no Developer Mode),
|
|
# and a junction is the one link shape a ModeSymlink check misses:
|
|
# since Go 1.23 os.Lstat reports it as ModeDir|ModeIrregular with no
|
|
# ModeSymlink bit, while its DirEntry still answers IsDir() == true, so
|
|
# filepath.WalkDir descends into the target. Two claims about Windows
|
|
# itself cannot be made on ubuntu: that the per-task skills wipe
|
|
# (os.RemoveAll) drops the junction rather than the user's files, and
|
|
# that the GC's artifact sweep and size accounting refuse to walk
|
|
# through one. The tests call mklink /J directly so the junction shape
|
|
# is exercised even on a runner where symlinks are permitted.
|
|
# -v so a skip is visible instead of passing silently as "ok".
|
|
run: |
|
|
go test ./internal/daemon/execenv -v -run '^(TestSeedUserCodexSkills|TestHydrateCodexSkills)' -count=1 -timeout=5m
|
|
go test ./internal/daemon -v -run '^(TestCleanTaskArtifacts_DoesNotFollowDirectoryJunction|TestTaskSize_DoesNotCountDirectoryJunction)$' -count=1 -timeout=5m
|
|
|
|
- name: Test Windows task temp dir sweep survives a sharing violation
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
working-directory: server
|
|
# The GC's task temp sweep has to cope with a file it cannot delete: a
|
|
# leftover child process holding one open is what left 174 directories
|
|
# behind in #7364. Only a real Windows filesystem produces that sharing
|
|
# violation — on unix an open file unlinks fine — so this is the only
|
|
# place we can prove the two things that matter: the failed cleanup
|
|
# keeps .task_lock (without it the directory reads as a pre-lock
|
|
# leftover and stops being reclaimable on liveness), and the next cycle
|
|
# removes the directory once the handle closes.
|
|
# -v so a skip is visible instead of passing silently as "ok".
|
|
run: go test ./internal/daemon/execenv -v -run '^TestPruneTaskTempDirsSurvivesRealSharingViolation$' -count=1 -timeout=5m
|
|
|
|
- name: Test Windows agent executable junction resolution
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
working-directory: server
|
|
# The standalone Codex installer exposes bin as a directory junction.
|
|
# filepath.EvalSymlinks cannot traverse that reparse-point shape, so
|
|
# only a real Windows filesystem proves both PATH discovery and an
|
|
# explicitly configured path reach the release executable. The same job
|
|
# covers the npm shape, where the entry point is a `.cmd` shim that only
|
|
# the command interpreter can run.
|
|
run: go test ./internal/daemon -v -run '^(TestCanonicalExecutablePath|TestTrimExtendedLengthPrefix|TestResolveAgentExecutablePathKeeps|TestResolveAgentEntry(FollowsRetargetedInstallerJunction|CanonicalizesRediscoveredJunction|ForLaunchKeepsCmdShimLaunchable|ForLaunchRejectsUnverifiedInitialJunctionTarget|ForLaunchRejectsRediscoveredJunctionWhenFinalPathResolutionFails|DoesNotSharePreRetargetSingleflightResult|ForLaunchFailsWhenJunctionKeepsRetargeting)|TestHandleTaskReportsWindowsCodexProcessStartFailure)' -count=1 -timeout=5m
|
|
|
|
- name: Build Windows CLI helper entrypoint
|
|
if: ${{ needs.changes.outputs.backend == 'true' }}
|
|
working-directory: server
|
|
run: go build ./cmd/multica
|
|
|
|
image-budget:
|
|
# Soft gate against the 21.7MB of raw PNG/JPG that MUL-6352 cleared out:
|
|
# a bitmap added or grown past 300KB fails until the PR description says
|
|
# why. Pull requests only — a push to main has no description to read,
|
|
# and the branch it came from was already checked.
|
|
needs: changes
|
|
if: ${{ github.event_name == 'pull_request' && needs.changes.outputs.images == 'true' }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
# The check diffs against the base branch, which a shallow
|
|
# clone does not contain.
|
|
fetch-depth: 0
|
|
|
|
- name: Check image budget
|
|
env:
|
|
PR_BODY: ${{ github.event.pull_request.body }}
|
|
run: node scripts/check-image-budget.mjs --base "origin/${{ github.base_ref }}"
|
|
|
|
installer:
|
|
# Stub-driven shell tests for scripts/install.sh and scripts/install.ps1.
|
|
# Kept off the heavy backend job so installer regressions surface
|
|
# independently, and exercised on macOS too because the installer targets
|
|
# macOS/Homebrew and `tar` / `sed` / `mktemp` differ between BSD and GNU
|
|
# userlands. Windows runs the PowerShell installer's own suite: the two
|
|
# installers share one port contract, and neither is covered by the
|
|
# frontend job.
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-latest, macos-latest, windows-latest]
|
|
runs-on: ${{ matrix.os }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Test shell installers
|
|
if: runner.os != 'Windows'
|
|
run: bash scripts/install.test.sh
|
|
|
|
- name: Test PowerShell installer
|
|
if: runner.os == 'Windows'
|
|
shell: pwsh
|
|
run: ./scripts/install.ps1.test.ps1
|