225 lines
8.9 KiB
YAML
225 lines
8.9 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
schedule:
|
|
- cron: '23 4 * * 1'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
env:
|
|
PYTHONUNBUFFERED: '1'
|
|
PIP_DISABLE_PIP_VERSION_CHECK: '1'
|
|
|
|
jobs:
|
|
capabilities:
|
|
name: Capabilities and shell quality
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- name: Install shell tools
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install --yes --no-install-recommends shellcheck jq
|
|
- name: Check capabilities
|
|
run: bash scripts/commands/check-capabilities.sh
|
|
- name: Validate Bash syntax
|
|
run: git ls-files -z '*.sh' | xargs -0 -r -n1 bash -n
|
|
- name: Lint Bash
|
|
run: shellcheck --severity=warning $(git ls-files '*.sh')
|
|
|
|
python:
|
|
name: Python tests and compilation
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
|
with:
|
|
python-version: '3.12'
|
|
- name: Compile Python sources
|
|
run: python -m compileall -q scripts shared
|
|
- name: Run Python tests
|
|
run: |
|
|
set -euo pipefail
|
|
for file in scripts/tests/test-*.py; do
|
|
echo "==> $file"
|
|
python "$file"
|
|
done
|
|
- name: Validate generated configuration
|
|
run: python scripts/checks/validate-config.py generated/codex-powershell/config.toml generated/claude-powershell/settings.json
|
|
|
|
powershell-on-ubuntu:
|
|
name: PowerShell tests on Ubuntu
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- name: Install PowerShell runtime
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
if ! command -v pwsh >/dev/null 2>&1; then
|
|
# Microsoft's signed apt repository; the job fails when PowerShell cannot be installed.
|
|
. /etc/os-release
|
|
wget -q -O "$RUNNER_TEMP/packages-microsoft-prod.deb" "https://packages.microsoft.com/config/$ID/$VERSION_ID/packages-microsoft-prod.deb"
|
|
sudo dpkg -i "$RUNNER_TEMP/packages-microsoft-prod.deb"
|
|
sudo apt-get update
|
|
sudo apt-get install --yes --no-install-recommends powershell
|
|
fi
|
|
pwsh -NoLogo -NoProfile -NonInteractive -Command '$PSVersionTable.PSVersion.ToString()'
|
|
- name: Run PowerShell tests
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
pwsh -NoLogo -NoProfile -NonInteractive -File ./scripts/commands/check-capabilities.ps1
|
|
pwsh -NoLogo -NoProfile -NonInteractive -File ./scripts/commands/build.ps1 -Summary
|
|
for file in scripts/tests/test-*.ps1; do
|
|
echo "==> $file"
|
|
pwsh -NoLogo -NoProfile -NonInteractive -File "$file" -Summary
|
|
done
|
|
|
|
build:
|
|
name: Build and inspect generated packages
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
needs: [capabilities, python]
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- name: Build packages
|
|
env:
|
|
REQUIRE_CODEX_SCHEMA: 'false'
|
|
run: bash scripts/commands/build.sh --summary
|
|
- name: Run build validation
|
|
run: bash scripts/tests/test-build-validation.sh --summary
|
|
- name: Check generated files are reproducible
|
|
run: |
|
|
before=$(find generated -type f -print0 | sort -z | xargs -0 sha256sum)
|
|
bash scripts/commands/build.sh --summary
|
|
after=$(find generated -type f -print0 | sort -z | xargs -0 sha256sum)
|
|
test "$before" = "$after"
|
|
|
|
shell-integration:
|
|
name: Bash integration and installation guards
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 25
|
|
needs: [build]
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- name: Build packages for integration checks
|
|
env:
|
|
REQUIRE_CODEX_SCHEMA: 'false'
|
|
run: bash scripts/commands/build.sh --summary
|
|
- name: Run integration tests
|
|
run: |
|
|
set -euo pipefail
|
|
bash scripts/tests/test-install-guards.sh --summary
|
|
bash scripts/tests/test-plugin-selection.sh --summary
|
|
bash scripts/tests/test-quick-update.sh --summary
|
|
bash scripts/tests/test-managed-install.sh --summary
|
|
bash scripts/tests/test-shell-packages.sh --summary
|
|
bash scripts/tests/test-runtime-status.sh --summary
|
|
bash scripts/tests/test-install-selections.sh --summary
|
|
bash scripts/tests/test-command-summaries.sh --summary
|
|
- name: Run doctor and prompt budget checks
|
|
run: |
|
|
bash scripts/commands/doctor.sh --summary
|
|
bash scripts/commands/prompt-budget.sh --summary
|
|
- name: Verify dry-run installation safety
|
|
run: |
|
|
bash scripts/commands/install.sh --summary --dry-run --client both --shell bash
|
|
bash scripts/commands/update.sh --summary --dry-run --client both --shell bash
|
|
|
|
client-smoke:
|
|
name: Installed client configuration smoke tests
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
needs: [build]
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
|
with:
|
|
python-version: '3.12'
|
|
- name: Build packages
|
|
run: bash scripts/commands/build.sh --summary
|
|
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v22.16.0
|
|
with:
|
|
node-version: '24'
|
|
- name: Install current client CLIs
|
|
run: npm install --global @openai/codex @anthropic-ai/claude-code
|
|
- name: Install Claude sandbox dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install --yes --no-install-recommends bubblewrap socat
|
|
- name: Validate current Codex and Claude settings
|
|
run: |
|
|
set -euo pipefail
|
|
schema_home=$(mktemp -d)
|
|
cp generated/codex-powershell/config.toml "$schema_home/config.toml"
|
|
CODEX_HOME="$schema_home" codex --strict-config --help >/dev/null
|
|
claude --settings generated/claude-powershell/settings.json --help >/dev/null
|
|
- name: Run client behavior smoke tests
|
|
env:
|
|
AI_CONFIG_REQUIRE_CLIENTS: '1'
|
|
run: timeout 900 python scripts/tests/test-client-smoke.py -v
|
|
|
|
qmd:
|
|
name: QMD local search integration
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
needs: [python]
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v22.16.0
|
|
with:
|
|
node-version: '24'
|
|
- name: Install QMD
|
|
run: npm install --global @tobilu/qmd@2.8.3
|
|
- name: Run QMD unit tests
|
|
run: node --test scripts/tests/test-qmd-lib.mjs scripts/tests/test-qmd-daemon.mjs scripts/tests/test-qmd-search.mjs scripts/tests/test-qmd-warm.mjs scripts/tests/test-qmd-benchmark.mjs
|
|
- uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: .cache/qmd-models
|
|
key: qmd-models-${{ runner.os }}-2.8.3-qwen3
|
|
- name: Run QMD integration test with real models
|
|
env:
|
|
QMD_TEST_CACHE: ${{ github.workspace }}/.cache/qmd-models
|
|
run: node --test scripts/tests/test-qmd-integration.mjs
|
|
|
|
security:
|
|
name: CI configuration security checks
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- name: Reject unsafe workflow settings
|
|
run: |
|
|
set -euo pipefail
|
|
unsafe_patterns='runs-on:[[:space:]]*windows|pull_request_'
|
|
unsafe_patterns+='target|permissions:[[:space:]]*write-all|actions/checkout@'
|
|
unsafe_patterns+='v|actions/setup-python@'
|
|
unsafe_patterns+='v|curl[[:space:]].*\|[[:space:]]*(bash|sh)|wget[[:space:]].*\|[[:space:]]*(bash|sh)'
|
|
! grep -RInE "$unsafe_patterns" .gitea/workflows
|
|
test "$(grep -Roh 'runs-on: ubuntu-latest' .gitea/workflows | wc -l)" -ge 1
|
|
test "$(grep -Roh 'uses: actions/[^@]*@[0-9a-f]\{40\}' .gitea/workflows | wc -l)" -ge 1
|
|
- name: Check for tracked secrets
|
|
run: |
|
|
set -euo pipefail
|
|
if git ls-files | grep -E '(^|/)(\.env($|\.)|.*\.(pem|key))$'; then
|
|
echo 'Potential secret file or private key tracked' >&2
|
|
exit 1
|
|
fi
|
|
if git ls-files -z | xargs -0 -r grep -IlE 'BEGIN (RSA|OPENSSH|EC) PRIVATE KEY'; then
|
|
echo 'Potential private key material tracked' >&2
|
|
exit 1
|
|
fi
|