deepcode/.github/workflows/ci.yml at main · oratis/deepcode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
name: CI

on:
  push:
    branches: [main]
  # Stacked PRs target feature branches; every PR still needs the same gates.
  pull_request: {}

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    name: Typecheck + Lint + Test (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          # Need Node 22+ for fs.promises.glob (used by GlobTool).
          # @deepcode/core's `package.json` engines field requires >=22 too.
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Linux only: install bubblewrap + slirp4netns so the real-kernel sandbox
      # integration tests run (they skip when `bwrap` is absent, e.g. macOS/dev).
      #  · Ubuntu 24.04 restricts unprivileged user namespaces via AppArmor —
      #    relax it so bwrap can unshare namespaces on the runner.
      #  · The selective network-allowlist test runs an allowlisting DNS proxy on
      #    127.0.0.1:53; relax ip_unprivileged_port_start so :53 binds rootless.
      - name: Install sandbox tools (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y bubblewrap slirp4netns curl
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
          sudo sysctl -w net.ipv4.ip_unprivileged_port_start=53 || true

      - name: Typecheck
        run: pnpm typecheck

      - name: Lint
        run: pnpm lint

      - name: Format check
        run: pnpm format:check

      - name: Test
        # DC_SANDBOX_NET_TEST opts the selective-allowlist integration test in;
        # it self-skips on non-Linux / when bwrap/slirp4netns are absent.
        env:
          DC_SANDBOX_NET_TEST: '1'
        run: pnpm test

      - name: Build + app-server release gate
        run: pnpm release:check

      - name: Upload release-gate diagnostics
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: release-gate-${{ matrix.os }}
          path: apps/vscode/dist/release-gate-report.json
          if-no-files-found: ignore
          retention-days: 7

  link-check:
    name: Docs link check
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
      - name: Verify current documentation
        run: node scripts/check-docs.mjs

  desktop-preview:
    name: Desktop protocol journey
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Install Chromium
        run: pnpm --filter @deepcode/desktop exec playwright install --with-deps chromium
      - name: Exercise the desktop protocol fixture
        run: pnpm --filter @deepcode/desktop test:e2e
      - name: Upload browser diagnostics
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: desktop-playwright-report
          path: |
            apps/desktop/playwright-report
            apps/desktop/test-results
          if-no-files-found: ignore
          retention-days: 7

  desktop-rust:
    name: Desktop Rust check + test
    runs-on: macos-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
      - name: Show Rust toolchain
        run: rustc --version && cargo --version
      # Tauri validates every externalBin path in its build script. This job
      # only compiles/tests Rust and never executes or packages the sidecar, so
      # use a target-correct placeholder instead of copying a 100+ MB runtime.
      - name: Prepare Tauri sidecar placeholder
        run: |
          target="$(rustc -vV | sed -n 's/^host: //p')"
          runtime="apps/desktop/src-tauri/binaries/deepcode-runtime-${target}"
          mkdir -p "$(dirname "$runtime")"
          touch "$runtime"
          mkdir -p apps/server/dist-sidecar
          touch apps/server/dist-sidecar/app-server.cjs
      - name: Check and test Tauri backend
        run: |
          cargo check --manifest-path apps/desktop/src-tauri/Cargo.toml --locked
          cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml --locked