Skip to content

ci: split Windows advisory checks #409

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Astro-Han merged 3 commits into from
May 3, 2026
Merged

ci: split Windows advisory checks #409

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a40e233
ci: split windows advisory checks
Astro-Han May 3, 2026
dfe3700
ci: tighten windows advisory workflow contract
Astro-Han May 3, 2026
3a6e58e
ci: keep windows advisory post-merge only
Astro-Han May 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
186 changes: 4 additions & 182 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,188 +342,10 @@ jobs:
retention-days: 7
path: packages/desktop-electron/.artifacts/unit/junit.xml

unit-windows:
name: unit-windows-${{ matrix.package }}
needs: changes
if: needs.changes.outputs.docs_only != 'true'
runs-on: windows-latest
# Windows unit jobs are advisory, package-scoped or shard-scoped. The
# 20-minute budget applies per matrix child; opencode has three parallel
# shards, so a full stall can consume up to three Windows runner slots.
timeout-minutes: 20
continue-on-error: true
strategy:
fail-fast: false
matrix:
include:
- package: app
uses_turbo: true
command: bun turbo test:ci --filter=@opencode-ai/app
report_path: packages/app/.artifacts/unit/junit.xml
# The opencode-* package values below are synthetic shard names for
# readable advisory checks and matrix keys, not package.json names.
# Direct bun test keeps opencode's test:ci timeout while allowing
# shard-local paths and reporter output. Shards are balanced by
# observed runtime, not directory count.
# Session also carries plugin, permission, util, skill, and root
# tests to keep the Windows shard runtimes close.
- package: opencode-session
uses_turbo: false
command: >-
cd packages/opencode && bun test
--timeout 30000
--reporter=junit
--reporter-outfile=.artifacts/unit/junit-windows-session.xml
test/session
test/plugin
test/permission
test/util
test/skill
test/index-runtime-namespace.test.ts
test/permission-agent.test.ts
report_path: packages/opencode/.artifacts/unit/junit-windows-session.xml
# Config and project cover configuration, project discovery, file,
# and GitHub workflow tests.
- package: opencode-config-project
uses_turbo: false
command: >-
cd packages/opencode && bun test
--timeout 30000
--reporter=junit
--reporter-outfile=.artifacts/unit/junit-windows-config-project.xml
test/config
test/project
test/worktree
test/file
test/github
test/settings
test/settings.test.ts
report_path: packages/opencode/.artifacts/unit/junit-windows-config-project.xml
# Server tools carries many smaller and faster directories, which is
# why it has more entries than the other two opencode shards.
- package: opencode-server-tools
uses_turbo: false
command: >-
cd packages/opencode && bun test
--timeout 30000
--reporter=junit
--reporter-outfile=.artifacts/unit/junit-windows-server-tools.xml
test/server
test/snapshot
test/tool
test/mcp
test/question
test/effect
test/agent
test/git
test/storage
test/provider
test/pty
test/share
test/script
test/memory
test/lsp
test/fixture
test/acp
test/bus
test/cli
test/global
test/format
test/account
test/sync
test/filesystem
test/patch
test/shell
test/control-plane
test/ide
test/installation
test/auth
report_path: packages/opencode/.artifacts/unit/junit-windows-server-tools.xml
- package: desktop
uses_turbo: true
command: bun turbo test:ci --filter=@opencode-ai/desktop-electron
report_path: packages/desktop-electron/.artifacts/unit/junit.xml
permissions:
contents: read
defaults:
run:
shell: bash
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # actions/checkout@v6
with:
persist-credentials: false

# Load-bearing: `bun install` runs `trustedDependencies`
# postinstalls from the root package.json (electron, node-pty,
# esbuild, tree-sitter at time of writing), which call `node`
# explicitly. Do not drop without first patching those scripts.
# Source of truth: grep `trustedDependencies` in package.json. (#70)
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # actions/setup-node@v6.4.0
with:
node-version: "24"

- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # oven-sh/setup-bun@v2
with:
bun-version: "1.3.13"

- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # actions/cache@v5
with:
path: ~/.bun/install/cache
key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
restore-keys: |
bun-${{ runner.os }}-

- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # actions/cache@v5
if: matrix.uses_turbo
with:
path: .turbo/cache
# Only app and desktop invoke Turbo in this Windows matrix.
key: turbo-${{ runner.os }}-unit-windows-${{ matrix.package }}-${{ hashFiles('turbo.json', '**/package.json', 'bun.lock') }}-${{ github.sha }}
restore-keys: |
turbo-${{ runner.os }}-unit-windows-${{ matrix.package }}-${{ hashFiles('turbo.json', '**/package.json', 'bun.lock') }}-
turbo-${{ runner.os }}-unit-windows-${{ matrix.package }}-

- run: bun install --frozen-lockfile

- name: Prepare unit artifact directory
if: matrix.uses_turbo == false
run: mkdir -p "$(dirname "${{ matrix.report_path }}")"

- name: unit
id: unit
continue-on-error: true
run: |
set +e
${{ matrix.command }}
status=$?
echo "exit_code=$status" >> "$GITHUB_OUTPUT"

if [ "$status" -ne 0 ]; then
{
echo "### Windows unit diagnostic"
echo ""
echo "- package: ${{ matrix.package }}"
echo "- exit code: $status"
echo "- status: failed advisory signal"
} >> "$GITHUB_STEP_SUMMARY"
fi

exit "$status"

- name: Upload unit artifacts
if: always()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v7
with:
name: unit-windows-${{ matrix.package }}-${{ github.run_attempt }}
include-hidden-files: true
if-no-files-found: ignore
retention-days: 7
path: ${{ matrix.report_path }}

# Aggregator for the `dev` branch ruleset. The required check on GitHub
# is `ci / check`; every new blocking job added above MUST be listed in
# `needs:` below, otherwise its failure will not block merge. Non-blocking
# signal jobs, such as `unit-windows-*`, intentionally stay outside this list.
# Compatibility aggregator for branch protection setups that require
# `ci / check`. The live dev ruleset currently requires the individual
# blocking jobs directly, so every blocking job added above should still
# be listed in `needs:` below.
# If the blocking list grows past ~5 entries, consider switching to
# `re-actors/alls-green` for dynamic aggregation (tracked in issue #54).
check:
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/desktop-smoke.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,9 +228,10 @@ jobs:
bun ./scripts/ci-smoke.ts packaged dev "$EXECUTABLE_PATH"
working-directory: packages/desktop-electron

# Aggregator for the `dev` branch ruleset. The required check on GitHub
# is `desktop-smoke / check`; every new job added above MUST be listed
# in `needs:` below, otherwise its failure will not block merge.
# Compatibility aggregator for branch protection setups that require
# `desktop-smoke / check`. The live dev ruleset currently requires
# `smoke-macos-arm64` directly, so every blocking job added above should
# still be listed in `needs:` below.
check:
if: always()
needs:
Expand Down
Loading
Loading