Repository navigation
fix(ci): close Rust dependency and deploy gate gaps #427
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit
Hold shift + click to select a range
21fdbb5
fix(ci): close Rust dependency and deploy gate gaps
qnbs 77cf15c
test(ci): cover workflow policy invariants
qnbs d65ec4e
docs(ci): complete aggregate dependency graph
qnbs 18859cb
fix(ci): remove stale classifier check
qnbs 4b02b15
docs: persist agent guidance
qnbs File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,144 @@ | ||
| #!/usr/bin/env node | ||
| import { strict as assert } from 'node:assert'; | ||
| import { readFileSync } from 'node:fs'; | ||
| import { dirname, relative, resolve } from 'node:path'; | ||
| import { fileURLToPath } from 'node:url'; | ||
|
|
||
| const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..'); | ||
| const TAURI_MANIFEST = resolve(ROOT, 'src-tauri/Cargo.toml'); | ||
| const WORKFLOW = resolve(ROOT, '.github/workflows/ci.yml'); | ||
| const WORKFLOW_PATH = '.github/workflows/ci.yml'; | ||
| const CORE_ROOT = 'crates/'; | ||
| const PROJECT_FIXTURES_ROOT = 'tests/fixtures/project-golden-masters/'; | ||
|
|
||
| function normalizePath(filePath) { | ||
| return filePath.replaceAll('\\', '/').replace(/^\.\//, ''); | ||
| } | ||
|
|
||
| function isWithin(filePath, root) { | ||
| return filePath === root.replace(/\/$/, '') || filePath.startsWith(root); | ||
| } | ||
|
|
||
| function localTauriDependencyRoots() { | ||
| const manifest = readFileSync(TAURI_MANIFEST, 'utf8'); | ||
| const pathValues = [...manifest.matchAll(/\bpath\s*=\s*"([^"]+)"/g)].map(([, value]) => value); | ||
| const roots = new Set(['src-tauri/']); | ||
|
|
||
| for (const value of pathValues) { | ||
| const dependencyPath = normalizePath(relative(ROOT, resolve(dirname(TAURI_MANIFEST), value))); | ||
| if (!dependencyPath || dependencyPath.startsWith('../')) { | ||
| throw new Error(`Tauri path dependency escapes the repository: ${value}`); | ||
| } | ||
| roots.add(`${dependencyPath.split('/')[0]}/`); | ||
| } | ||
|
|
||
| return [...roots]; | ||
| } | ||
|
|
||
| function classifyChangedFiles(files) { | ||
| const changedFiles = files.map(normalizePath).filter(Boolean); | ||
| const tauriRoots = localTauriDependencyRoots(); | ||
| const tauri = changedFiles.some( | ||
| (filePath) => filePath === WORKFLOW_PATH || tauriRoots.some((root) => isWithin(filePath, root)), | ||
| ); | ||
| const crates = changedFiles.some( | ||
| (filePath) => | ||
| filePath === WORKFLOW_PATH || | ||
| isWithin(filePath, CORE_ROOT) || | ||
| isWithin(filePath, PROJECT_FIXTURES_ROOT), | ||
| ); | ||
|
|
||
| return { tauri, crates }; | ||
| } | ||
|
|
||
| function jobBlock(workflow, jobName) { | ||
| const lines = workflow.split('\n'); | ||
| const start = lines.indexOf(` ${jobName}:`); | ||
| if (start === -1) throw new Error(`Could not find CI job: ${jobName}`); | ||
| const end = lines.findIndex((line, index) => index > start && /^ {2}[\w-]+:$/.test(line)); | ||
| return lines.slice(start, end === -1 ? lines.length : end).join('\n'); | ||
| } | ||
|
|
||
| function needsFor(workflow, jobName) { | ||
| const block = jobBlock(workflow, jobName); | ||
| const match = block.match(/^ {4}needs:\s*\[([^\]]+)\]/m); | ||
| if (!match) throw new Error(`CI job ${jobName} must use an inline needs list`); | ||
| return new Set( | ||
| match[1] | ||
| .split(',') | ||
| .map((item) => item.trim()) | ||
| .filter(Boolean), | ||
| ); | ||
| } | ||
|
|
||
| function checkWorkflowContract() { | ||
| const workflow = readFileSync(WORKFLOW, 'utf8'); | ||
| const changes = jobBlock(workflow, 'changes'); | ||
| const aggregateNeeds = needsFor(workflow, 'ci-success'); | ||
| const deployNeeds = needsFor(workflow, 'deploy'); | ||
|
|
||
| for (const requiredJob of [ | ||
| 'security', | ||
| 'quality', | ||
| 'changes', | ||
| 'rust-tauri', | ||
| 'core-rust', | ||
| 'build', | ||
| 'e2e', | ||
| 'vrt', | ||
| ]) { | ||
| assert(aggregateNeeds.has(requiredJob), `ci-success must include ${requiredJob}`); | ||
| } | ||
| assert(deployNeeds.has('ci-success'), 'deploy must depend on ci-success'); | ||
| assert(deployNeeds.has('build'), 'deploy must retain the build artifact dependency'); | ||
| assert.match( | ||
| jobBlock(workflow, 'deploy'), | ||
| /needs\.ci-success\.result\s*==\s*'success'/, | ||
| 'deploy must require a successful ci-success result', | ||
| ); | ||
| assert.match( | ||
| changes, | ||
| /node scripts\/check-ci-invariants\.mjs --self-test --check-workflow/, | ||
| 'changes must execute the CI invariant self-check', | ||
| ); | ||
| assert.match( | ||
| changes, | ||
| /node scripts\/check-ci-invariants\.mjs\s*>>\s*"\$GITHUB_OUTPUT"/, | ||
| 'changes must use the dependency-aware classifier for job outputs', | ||
| ); | ||
| } | ||
|
|
||
| function runSelfTests() { | ||
| const cases = [ | ||
| [['src-tauri/src/lib.rs'], { tauri: true, crates: false }], | ||
| [['crates/worldscript-project/src/lib.rs'], { tauri: true, crates: true }], | ||
| [['crates/worldscript-project/Cargo.toml'], { tauri: true, crates: true }], | ||
| [['crates/Cargo.lock'], { tauri: true, crates: true }], | ||
| [[WORKFLOW_PATH], { tauri: true, crates: true }], | ||
| [['components/App.tsx'], { tauri: false, crates: false }], | ||
| ]; | ||
|
|
||
| for (const [files, expected] of cases) { | ||
| assert.deepEqual(classifyChangedFiles(files), expected, `classification failed for ${files}`); | ||
| } | ||
| } | ||
|
|
||
| function main() { | ||
| const args = new Set(process.argv.slice(2)); | ||
| if (args.has('--self-test')) runSelfTests(); | ||
| if (args.has('--check-workflow')) checkWorkflowContract(); | ||
| if (args.has('--self-test') || args.has('--check-workflow')) return; | ||
|
|
||
| const files = readFileSync(0, 'utf8').split(/\r?\n/); | ||
| const result = classifyChangedFiles(files); | ||
| process.stdout.write(`tauri=${result.tauri}\ncrates=${result.crates}\n`); | ||
| } | ||
|
|
||
| try { | ||
| main(); | ||
| } catch (error) { | ||
| process.stderr.write( | ||
| `[ci-invariants] ${error instanceof Error ? error.message : String(error)}\n`, | ||
| ); | ||
| process.exitCode = 1; | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.