Files
waggle-os/.github/workflows/ci.yml
Oleg Maslov b20b138fe4 moving
2026-09-02 10:14:22 +02:00

183 lines
6.5 KiB
YAML

name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 20
- name: Cache npm dependencies
uses: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-npm-
# NOTE: the switch to `npm ci` (deterministic, lockfile-faithful) is deferred
# to the deps/lockfile hardening pass, after the root package-lock.json is
# regenerated in sync with every workspace manifest. `npm install` is the
# safe, lockfile-tolerant install until then.
- run: npm install
# Real typecheck gate. The old step ran `npx tsc --noEmit` against the root
# tsconfig.json, whose `"files": ["apps/web/src/vite-env.d.ts"]` (and no
# `include`) typechecks essentially nothing. build:packages is the actual
# `tsc --build` chain for every @waggle/* package (shared → hive-mind-core →
# core → agent → server) and also emits the dist/ that apps/web unit tests
# import; typecheck:web is the real apps/web check (tsc -p tsconfig.app.json).
- name: Type check — workspace packages (tsc --build chain)
run: npm run build:packages
- name: Type check — web (apps/web, tsc -p tsconfig.app.json)
run: npm run typecheck:web
- name: Lint (root flat config)
run: npm run lint
- name: Tauri TS typecheck (app/scripts)
run: npx tsc -p app/tsconfig.json
# Runtime tests pack and install workspace packages. Build every ignored
# dist/ payload explicitly so CI proves a fresh checkout.
- name: Build package-install test runtimes
run: |
npm run build:hook-runtime
npm run build --workspace @waggle/cli
npm run build --workspace @waggle-ai/waggle
npm run build --workspace waggle-memory-mcp
- name: Unit tests — packages + cross-cutting (root vitest)
run: |
npm test -- \
--exclude=packages/cli/tests/cli-runtime.test.ts \
--exclude=packages/marketplace/tests/cli-runtime.test.ts \
--exclude=packages/hive-mind-cli/tests/cli-help.test.ts \
--exclude=packages/hive-mind-mcp-server/tests/runtime.test.ts \
--exclude=packages/launcher/tests/cli.test.ts \
--exclude=packages/memory-mcp/tests/runtime.test.ts \
--maxWorkers=2
# These tests each create a temporary project and run npm install. Running
# several cold installs in parallel makes individual test timeouts measure
# runner contention rather than package correctness.
- name: Package-install runtime tests (serial)
run: |
npx vitest run \
packages/cli/tests/cli-runtime.test.ts \
packages/marketplace/tests/cli-runtime.test.ts \
packages/hive-mind-cli/tests/cli-help.test.ts \
packages/hive-mind-mcp-server/tests/runtime.test.ts \
packages/launcher/tests/cli.test.ts \
packages/memory-mcp/tests/runtime.test.ts \
--maxWorkers=1 \
--no-file-parallelism
# The root vitest.config.ts excludes `apps/**`, so apps/web's own 131-file
# suite never ran in CI. Run it via its own vitest config (jsdom). Blocking.
- name: Unit tests — apps/web
run: npm run test -w apps/web
- name: Security audit (informational)
run: npm audit --audit-level=high
continue-on-error: true
# ADVISORY / NON-BLOCKING. `continue-on-error: true` means a red e2e run does
# NOT block merges — by design. These specs are broad product/audit journeys
# (full-product-audit, power-user-stress, competitive-benchmarks, …) that are
# historically flake-prone, so gating merges on them would produce false reds.
# The blocking `e2e-smoke` job above covers the stable launch, settings,
# memory, workspace, and mobile regression slice. This broad job stays
# advisory so exploratory audit coverage can report flakes without blocking
# merges.
e2e-smoke:
runs-on: ubuntu-latest
needs: test
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 20
- name: Cache npm dependencies
uses: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-npm-
- run: npm install
- name: Build packages
run: npm run build:packages
- name: Build frontend
run: npm run build
- name: Install Playwright browsers
run: npx playwright install --with-deps chromium
- name: Run blocking Playwright smoke journeys
run: npm run test:e2e:smoke
env:
WAGGLE_ECHO_MODE: "1"
NODE_ENV: test
WAGGLE_TRUST_LOCALHOST: "1"
e2e:
runs-on: ubuntu-latest
needs: test
continue-on-error: true
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 20
- name: Cache npm dependencies
uses: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-npm-
- run: npm install
# apps/web's tsc build imports @waggle/shared etc. which export dist/;
# build the workspace packages first (the deploy does this via build:all).
- name: Build packages
run: npm run build:packages
- name: Build frontend
run: npm run build
- name: Install Playwright browsers
run: npx playwright install --with-deps chromium
- name: Run Playwright E2E tests
run: npx playwright test tests/e2e/
env:
WAGGLE_ECHO_MODE: "1"
NODE_ENV: test
# D1: the e2e suite hits /api/* directly without a bearer token; trust
# loopback in CI's test server (prod default stays secure). Mirrors
# vitest.setup.ts and playwright.config.ts webServer.env.
WAGGLE_TRUST_LOCALHOST: "1"
- name: Upload Playwright report
if: failure()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: playwright-report/
retention-days: 14