rob thijssen
44d32b4432
Some checks failed
ci / gate (push) Has been cancelled
The rust gate builds and tests with --locked, so a change that would move Cargo.lock fails instead of resolving something new. A dependency policy step runs cargo deny check (licenses, advisories, bans, sources from deny.toml) and cargo machete, both now in the runner image (gongfoo bd936d3, images run 284). deps.yaml runs the advisory check daily on the rust runner, so an advisory published against a dependency the lockfile already pins turns red within a day whether or not anyone pushes. Closes #49 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW
98 lines
3.5 KiB
YAML
98 lines
3.5 KiB
YAML
name: ci
|
|
|
|
# The quality gate (architecture/generic.md §12): format, lint as error, tests,
|
|
# and a frontend that typechecks and builds. Packaging and release live in
|
|
# their own workflow once the packaging epic lands.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
gate:
|
|
# `rust-gtk3`, not `rust`: tauri-build links against GTK and WebKitGTK dev
|
|
# libraries, which only that image carries (gitea-runners.md §3).
|
|
runs-on: rust-gtk3
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: webview dependencies
|
|
working-directory: ui
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: webview gate
|
|
working-directory: ui
|
|
run: |
|
|
set -euo pipefail
|
|
pnpm typecheck
|
|
pnpm lint
|
|
pnpm format:check
|
|
pnpm build
|
|
|
|
- name: rust gate
|
|
# --locked: a build that would change Cargo.lock fails rather than
|
|
# quietly resolving something new (#49).
|
|
run: |
|
|
set -euo pipefail
|
|
cargo fmt --check --all
|
|
cargo clippy --locked --workspace --all-targets -- -D warnings
|
|
cargo test --locked --workspace
|
|
|
|
- name: dependency policy
|
|
# deny.toml: licenses, advisories, bans and sources; machete: crates
|
|
# declared and never used. Both ship in the runner image (gongfoo
|
|
# runner-rust). The daily run in deps.yaml catches an advisory
|
|
# published against an unchanged lockfile (#49).
|
|
run: |
|
|
set -euo pipefail
|
|
cargo deny --version
|
|
cargo deny check
|
|
cargo machete
|
|
|
|
- name: rust talks to the webview through one file
|
|
# `ui/src/api/wallet.ts` is the only module allowed to import Tauri's
|
|
# IPC. A screen that reaches for `invoke` itself bypasses the typed
|
|
# client and its error mapping, and this is where that is caught.
|
|
run: |
|
|
set -euo pipefail
|
|
hits=$(grep -rl "@tauri-apps/api/core" ui/src || true)
|
|
if [ "$hits" != "ui/src/api/wallet.ts" ]; then
|
|
echo "Tauri IPC imported outside ui/src/api/wallet.ts:"; echo "$hits"; exit 1
|
|
fi
|
|
|
|
- name: dev node
|
|
# The chain adapter's integration tests run against a real
|
|
# `quantus-node --dev` from the pinned release (script/dev-node.sh).
|
|
# Started here, in the background, so the next step can use it; the
|
|
# runner is ephemeral, so nothing is cleaned up.
|
|
run: |
|
|
set -euo pipefail
|
|
script/dev-node.sh > dev-node.log 2>&1 &
|
|
for _ in $(seq 1 60); do
|
|
if curl -s -m 2 -H 'content-type: application/json' \
|
|
-d '{"jsonrpc":"2.0","id":1,"method":"system_chain","params":[]}' \
|
|
http://127.0.0.1:9944 | grep -q DevNet; then
|
|
echo "dev node up"; exit 0
|
|
fi
|
|
sleep 2
|
|
done
|
|
echo "dev node did not come up"; tail -50 dev-node.log; exit 1
|
|
|
|
- name: chain adapter against the dev node
|
|
env:
|
|
WALLET_DEV_NODE: ws://127.0.0.1:9944
|
|
# Only the tests that need a node; their names all end in
|
|
# `on_a_dev_node` or `on_dev_node`. Network tests against public
|
|
# nodes stay ignored here.
|
|
run: cargo test -p wallet-data -- --ignored dev_node
|
|
|
|
- name: generated types are current
|
|
# `cargo test` regenerates ui/src/api/generated via ts-rs. A diff here
|
|
# means an entities change was committed without its TypeScript.
|
|
run: git diff --exit-code -- ui/src/api/generated
|