3689d8c435
setup-pm-cache.test.mjs compared `if:` expressions as literal strings and
indexed `build-${platform}-${arch}-{release,commit}` by id. So the per-arch
split, or rewording a gate, broke it while the cache contract still held.
- A small evaluator for the Actions expression subset. Gates are asserted by
how they behave:
- The exact-key wheel save runs only for callers with extras or a test
environment, and never together with the rolling restore.
- The prune runs after a failure but not on cancel.
- The upload needs a successful prune.
- Desktop build legs are the jobs that use the desktop-build-cache action,
keyed by matrix target and cache-mode. A new check requires a write leg and
a read leg for every native target. The write leg runs only for tag builds;
the read leg runs for commit and channel builds.
- Candidate saves are evaluated: they run after a successful prepare of a
trusted dispatch (a tag build, or a main push for the payload). They do not
run on a failed prepare, a cancel, commit or channel builds, pull requests,
other branches, or a foreign ref.
- Selection gates are found by SELECTED_BUILD_SUCCEEDED. Each needs validate
plus one write and one read leg of a single target, and refuses a failed
admission. The selection logic and the "only gates consume legs" invariant
are covered in tests/ci/test_desktop_bundle_smoke.py.
211 lines
12 KiB
JavaScript
211 lines
12 KiB
JavaScript
import { readFileSync } from 'node:fs'
|
|
import { load } from 'js-yaml'
|
|
import { expect, it } from 'vitest'
|
|
|
|
const action = path => load(readFileSync(new URL(path, import.meta.url), 'utf8'))
|
|
const setup = action('../.github/actions/setup-pm/action.yml')
|
|
const save = action('../.github/actions/save-pm-cache/action.yml')
|
|
|
|
// Evaluates the Actions expression subset these gates use, so the tests pin
|
|
// how a gate behaves rather than how it is spelled. Status functions default
|
|
// to a healthy, uncancelled run; `status` overrides them.
|
|
const evaluate = (expression, { status = {}, ...context } = {}) => {
|
|
const lookup = path => path.split('.').reduce(
|
|
(value, key) => (value !== null && typeof value === 'object' ? value[key] : undefined), context) ?? ''
|
|
const statuses = { always: true, success: true, failure: false, cancelled: false, ...status }
|
|
const body = String(expression).trim().replace(/^\$\{\{/, '').replace(/\}\}$/, '')
|
|
.replace(/\b(?:inputs|steps|needs|github)(?:\.[\w-]+)+/g, path => JSON.stringify(lookup(path)))
|
|
.replace(/\b(always|success|failure|cancelled)\(\)/g, (_, name) => String(statuses[name]))
|
|
return Boolean(Function(`"use strict"; return (${body})`)())
|
|
}
|
|
|
|
it('restores compatible wheels without freezing a partial build under its dependency key', () => {
|
|
const cached = setup.runs.steps.find(step => step.id === 'python-cache')
|
|
const restored = setup.runs.steps.find(step => step.id === 'python-cache-restore')
|
|
const prefixes = restored.with['restore-keys'].trim().split('\n')
|
|
// Prefer this dependency set before falling back across dependency changes.
|
|
const rollingPrefix = prefixes[0]
|
|
expect(restored.with.key).toBe(`${rollingPrefix}\${{ github.run_id }}-\${{ github.run_attempt }}-\${{ github.job }}`)
|
|
expect(rollingPrefix).toBe(`${cached.with.key}-`)
|
|
expect(prefixes[1].trim()).toBe(cached.with['restore-keys'])
|
|
for (const boundary of ['target', 'os-version', 'python-version']) {
|
|
expect(prefixes[1]).toContain(`steps.prepare.outputs.${boundary}`)
|
|
}
|
|
expect(prefixes[1]).toContain("inputs.cache-suffix == ''")
|
|
expect(prefixes[1]).not.toContain('hashFiles')
|
|
// Only dependency-carrying callers save; tool-only jobs must not freeze an
|
|
// empty cache under the production key (a stub exact-hit blocks real saves).
|
|
const saving = { toolchain: 'all', 'cache-python': 'true', 'save-python-cache': 'true', 'test-environment': 'false' }
|
|
expect(evaluate(cached.if, { inputs: { ...saving, extras: '' } })).toBe(false)
|
|
expect(evaluate(cached.if, { inputs: { ...saving, extras: 'voice' } })).toBe(true)
|
|
expect(evaluate(cached.if, { inputs: { ...saving, extras: '', 'test-environment': 'true' } })).toBe(true)
|
|
// A caller either saves the exact key or restores the rolling one, never both.
|
|
for (const saveCache of ['true', 'false']) {
|
|
const inputs = { ...saving, extras: 'voice', 'save-python-cache': saveCache }
|
|
expect(evaluate(restored.if, { inputs })).toBe(!evaluate(cached.if, { inputs }))
|
|
}
|
|
expect(setup.outputs['python-cache-key'].value).toContain('steps.python-cache-restore.outputs.cache-primary-key')
|
|
|
|
// A suffix-only namespace isolates smoke reads but still lets production
|
|
// restore smoke writes through its broad dependency fallback.
|
|
const namespace = "${{ inputs.cache-suffix || 'production' }}"
|
|
for (const template of [cached.with.key, restored.with.key, rollingPrefix]) {
|
|
const production = template.replace(namespace, 'production')
|
|
const smoke = template.replace(namespace, 'smoke-42-1')
|
|
expect(production.startsWith('setup-pm-uv-v3-production-')).toBe(true)
|
|
expect(smoke.startsWith('setup-pm-uv-v3-smoke-42-1-')).toBe(true)
|
|
expect(smoke.startsWith('setup-pm-uv-v3-production-')).toBe(false)
|
|
expect(production.startsWith('setup-pm-uv-v3-smoke-42-1-')).toBe(false)
|
|
}
|
|
})
|
|
|
|
it('explicit PM saves prune to the lock and do not prune during cancellation', () => {
|
|
const [prune, upload] = save.runs.steps
|
|
expect(evaluate(prune.if)).toBe(true)
|
|
expect(evaluate(prune.if, { status: { failure: true, success: false } })).toBe(true)
|
|
expect(evaluate(prune.if, { status: { cancelled: true, success: false } })).toBe(false)
|
|
expect(prune.run.split(/\s+/)).toEqual(expect.arrayContaining(['pm.build_env', '--exact-lock', '--cache', '--lock-source']))
|
|
expect(prune.env.PM_PYTHON).toBe('${{ inputs.python }}')
|
|
expect(prune.env.PM_CACHE).toBe('${{ inputs.path }}')
|
|
expect(prune.env.PM_LOCK_SOURCE).toBe('${{ github.workspace }}')
|
|
const pruned = outcome => ({ steps: { [prune.id]: { outcome } } })
|
|
expect(evaluate(upload.if, pruned('success'))).toBe(true)
|
|
expect(evaluate(upload.if, pruned('failure'))).toBe(false)
|
|
expect(evaluate(upload.if, { ...pruned('success'), status: { cancelled: true, success: false } })).toBe(false)
|
|
expect(upload.uses.split('@')[0]).toBe('actions/cache/save')
|
|
expect(upload.with).toEqual({ path: '${{ inputs.path }}', key: '${{ inputs.key }}' })
|
|
})
|
|
|
|
it('explicit npm snapshots remain replaceable and isolated from toolchain-only producers', () => {
|
|
const restored = setup.runs.steps.find(step => step.id === 'node-cache-restore')
|
|
expect(restored).toBeDefined()
|
|
const prefix = restored.with['restore-keys'].trim()
|
|
expect(restored.with.key).toBe(`${prefix}\${{ github.run_id }}-\${{ github.run_attempt }}`)
|
|
// A toolchain-only job must not shadow the desktop consumer's warm snapshot.
|
|
for (const boundary of ['github.job', 'node-cache-dependency-path', 'cache-suffix', 'target', 'npm-version']) {
|
|
expect(prefix).toContain(boundary)
|
|
}
|
|
expect(setup.outputs['node-cache-key'].value).toContain('steps.node-cache-restore.outputs.cache-primary-key')
|
|
})
|
|
|
|
// Key isolation, offline wheel/receipt relocation and the transport action are
|
|
// covered by tests/scripts/test_desktop_build_cache.py. These declarations guard
|
|
// the caller seam: a cache hit never replaces preparation.
|
|
const desktop = action('../.github/workflows/desktop-bundled-release.yml')
|
|
const payload = action('../.github/workflows/pm-bundle.yml')
|
|
const BUILD_CACHE = './.github/actions/desktop-build-cache'
|
|
// Jobs are found by the cache action they use, not by id: build legs get
|
|
// split and renamed while this contract stays the same.
|
|
const cacheUsers = workflow => Object.entries(workflow.jobs)
|
|
.filter(([, job]) => (job.steps ?? []).some(step => step.uses === BUILD_CACHE))
|
|
const targetOf = job => job.strategy.matrix.target.map(row => row.label)
|
|
const desktopLegs = cacheUsers(desktop)
|
|
|
|
const SHA = 'a'.repeat(40)
|
|
const dispatches = {
|
|
tag: { build_commit: '', channel: '', 'release-phase': '', upload_release: true },
|
|
commit: { build_commit: SHA, channel: '', 'release-phase': '', upload_release: false },
|
|
channel: { build_commit: SHA, channel: 'preview', 'release-phase': '', upload_release: false },
|
|
}
|
|
const admitted = labels => ({
|
|
validate: { result: 'success', outputs: Object.fromEntries(labels.map(label => [label, 'true'])) },
|
|
})
|
|
// Payload snapshots are shared by every later build; only a trusted main push writes them.
|
|
const payloadEvents = {
|
|
trusted: { event_name: 'push', ref: 'refs/heads/main', sha: SHA },
|
|
pullRequest: { event_name: 'pull_request', ref: 'refs/heads/main', sha: SHA },
|
|
branch: { event_name: 'push', ref: 'refs/heads/feature', sha: SHA },
|
|
}
|
|
|
|
it('finds a release and a commit leg for every native target, and the payload producer', () => {
|
|
const legs = desktopLegs.map(([, job]) => `${targetOf(job)}:${job['cache-mode']}`).sort()
|
|
const targets = ['darwin-arm64', 'darwin-x64', 'win32-arm64', 'win32-x64']
|
|
expect(legs).toEqual(targets.flatMap(target => [`${target}:read`, `${target}:write`]).sort())
|
|
expect(cacheUsers(payload)).toHaveLength(1)
|
|
})
|
|
|
|
it.each([
|
|
...desktopLegs.map(([id, job]) => [id, job, 'desktop', 'scripts/bundles/desktop.py']),
|
|
...cacheUsers(payload).map(([id, job]) => [id, job, 'payload-test', 'scripts/bundles/native_build.py']),
|
|
])('%s restores, admits and saves candidates before consuming them', (id, job, producer, driver) => {
|
|
const cacheMode = job['cache-mode']
|
|
if (cacheMode) {
|
|
expect(job.needs).toEqual(['validate'])
|
|
// Only the release branch writes the shared cache; commit and channel
|
|
// builds of unreviewed inputs run the read-only leg.
|
|
const needs = admitted(targetOf(job))
|
|
expect(evaluate(job.if, { inputs: dispatches.tag, needs })).toBe(cacheMode === 'write')
|
|
expect(evaluate(job.if, { inputs: dispatches.commit, needs })).toBe(cacheMode === 'read')
|
|
expect(evaluate(job.if, { inputs: dispatches.channel, needs })).toBe(cacheMode === 'read')
|
|
}
|
|
const cacheSteps = job.steps.filter(step => step.uses === BUILD_CACHE)
|
|
expect(cacheSteps.map(step => step.with.phase)).toEqual(['restore', 'save'])
|
|
const [restore, upload] = cacheSteps
|
|
const prepare = job.steps.find(step => step.id === 'prepare')
|
|
const builds = job.steps.filter(step => step.run?.includes(driver) && step.run.includes('--prepared '))
|
|
expect(prepare).toBeDefined()
|
|
expect(builds).not.toHaveLength(0)
|
|
expect(prepare.run).toContain(driver)
|
|
expect(prepare.run).toContain('--prepare-only')
|
|
// Admission runs on warm hits too; a failed preparation must fail the job.
|
|
for (const step of [restore, prepare, ...builds]) {
|
|
expect(step.if).toBeUndefined()
|
|
expect(step['continue-on-error']).toBeUndefined()
|
|
}
|
|
expect(job.steps.indexOf(prepare)).toBeGreaterThan(job.steps.indexOf(restore))
|
|
expect(job.steps.indexOf(upload)).toBeGreaterThan(job.steps.indexOf(prepare))
|
|
for (const build of builds) {
|
|
expect(job.steps.indexOf(build)).toBeGreaterThan(job.steps.indexOf(upload))
|
|
expect(build.run).not.toContain('--prepare-only')
|
|
}
|
|
expect(restore.with.producer).toBe(producer)
|
|
expect(restore.with.source).toBe('${{ github.workspace }}')
|
|
expect(upload.with).toEqual({
|
|
...restore.with,
|
|
phase: 'save',
|
|
key: `\${{ steps.${restore.id}.outputs.cache-key }}`,
|
|
})
|
|
// No cache-hit gate: immutable underfilled snapshots must be replaceable.
|
|
// A failed/cancelled preparation cannot publish; later build failure cannot
|
|
// discard an already-saved candidate snapshot.
|
|
const saves = (context, outcome = 'success') => evaluate(upload.if, {
|
|
...context, steps: { prepare: { outcome } }, status: { failure: outcome !== 'success' },
|
|
})
|
|
const trusted = cacheMode
|
|
? { inputs: dispatches.tag }
|
|
: { inputs: { ref: '' }, github: payloadEvents.trusted }
|
|
expect(saves(trusted)).toBe(true)
|
|
expect(saves(trusted, 'failure')).toBe(false)
|
|
expect(evaluate(upload.if, { ...trusted, steps: { prepare: { outcome: 'success' } },
|
|
status: { cancelled: true, success: false } })).toBe(false)
|
|
const untrusted = cacheMode
|
|
? [{ inputs: dispatches.commit }, { inputs: dispatches.channel }]
|
|
: [
|
|
{ inputs: { ref: '' }, github: payloadEvents.pullRequest },
|
|
{ inputs: { ref: '' }, github: payloadEvents.branch },
|
|
{ inputs: { ref: 'b'.repeat(40) }, github: payloadEvents.trusted },
|
|
]
|
|
for (const context of untrusted) {
|
|
expect(saves(context)).toBe(false)
|
|
}
|
|
})
|
|
|
|
it('each selection gate joins exactly one target\'s two trust branches after admission', () => {
|
|
const legs = Object.fromEntries(desktopLegs.map(([id, job]) => [id, job]))
|
|
const gates = Object.values(desktop.jobs).filter(job => job.env?.SELECTED_BUILD_SUCCEEDED)
|
|
expect(gates).toHaveLength(4)
|
|
for (const gate of gates) {
|
|
const [admission, ...branches] = gate.needs
|
|
expect(admission).toBe('validate')
|
|
expect(branches.map(id => legs[id]?.['cache-mode']).sort()).toEqual(['read', 'write'])
|
|
const [label] = new Set(branches.flatMap(id => targetOf(legs[id])))
|
|
expect(new Set(branches.flatMap(id => targetOf(legs[id]))).size).toBe(1)
|
|
// The gate runs always() to judge a skipped branch, so it must still
|
|
// refuse a failed admission itself.
|
|
const needs = admitted([label])
|
|
expect(evaluate(gate.if, { inputs: dispatches.tag, needs })).toBe(true)
|
|
expect(evaluate(gate.if, { inputs: dispatches.tag,
|
|
needs: { validate: { ...needs.validate, result: 'failure' } } })).toBe(false)
|
|
}
|
|
})
|