b0ab0162b0
Run the entire CI workflow before Docker build and tests. Require Nix, native payload smoke tests, install/update E2E and signed-package upgrade acceptance before publishing. Keep Desktop Playwright E2E deferred. Archive tested Docker images and signed bundle candidates with provenance and hashes. Publishers consume those exact artifacts without rebuilding. Advance stable channels only after all required publications succeed. Keep canaries on their separate path and reject direct stable-builder publication that bypasses the gate. Move shared release transport, manifests and gates to Python. Keep native Electron adapters in JS and share feed/MIME facts as JSON. Replace the R2/feed JS implementation and move its protocol tests to Python. Verified targeted Python and JS tests, real loopback transport and CLI execution, temporary Git admission, workflow graph lint, and typechecks. No live stable release was run. Native signing, package upgrades and real registry/Store promotion still need their release-run receipts. Separate services cannot promote atomically. A promotion failure keeps the run red.
77 lines
3.1 KiB
YAML
77 lines
3.1 KiB
YAML
# .github/workflows/rust-tests.yml
|
|
name: Rust tests
|
|
|
|
# `cargo test` for the Tauri bootstrap installer (Hermes-Setup). Nothing in CI
|
|
# compiled this crate before: `.rs` lives under `apps/`, so the change
|
|
# classifier matched it as `frontend` and ran the TypeScript matrix, which
|
|
# cannot notice a Rust error. The crate's unit tests existed in the tree and had
|
|
# never run.
|
|
#
|
|
# Linux runner on purpose. The pipe-drain tests in src/powershell.rs need a real
|
|
# process tree whose grandchild inherits the parent's stdout, and their fixture
|
|
# is `#[cfg(unix)]`; the Windows half of that same contract is covered by
|
|
# `-SelfTestPipeDrain` in scripts/desktop-update/windows.ps1 on the Windows
|
|
# lane. A Windows runner here would compile them out and report green over zero
|
|
# coverage.
|
|
|
|
on:
|
|
workflow_call:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: rust-tests-${{ github.ref_type == 'tag' && github.run_id || github.ref }}
|
|
cancel-in-progress: ${{ github.ref_type != 'tag' }}
|
|
|
|
jobs:
|
|
bootstrap-installer:
|
|
name: cargo test (bootstrap installer)
|
|
# cargo builds codegen units and test binaries in parallel across the
|
|
# cores. This lane also builds the crate from the start when Cargo.toml
|
|
# changes.
|
|
runs-on: ubuntu-latest-32-core
|
|
timeout-minutes: 30
|
|
defaults:
|
|
run:
|
|
working-directory: apps/bootstrap-installer/src-tauri
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
# Tauri links against the system webkit2gtk on Linux, so the crate does
|
|
# not compile without these even for `cargo test --lib`.
|
|
- name: Install Tauri system dependencies
|
|
working-directory: .
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install --no-install-recommends -y \
|
|
libwebkit2gtk-4.1-dev \
|
|
libappindicator3-dev \
|
|
librsvg2-dev \
|
|
libxdo-dev \
|
|
libssl-dev \
|
|
patchelf
|
|
|
|
# Keyed on Cargo.toml, not Cargo.lock: apps/bootstrap-installer/.gitignore
|
|
# excludes the lockfile (a create-tauri-app scaffold default), so there is
|
|
# nothing pinned to hash and `--locked` cannot be used. That also means
|
|
# this crate re-resolves its whole dependency graph on every build, which
|
|
# is a real gap for a signed installer given the pinning policy in
|
|
# AGENTS.md — tracking separately rather than widening this PR.
|
|
#
|
|
# No restore-keys: a partial hit leaves a stale target dir, and cargo
|
|
# re-resolves correctly on top of a Cargo.toml-keyed hit anyway.
|
|
- name: Restore cargo cache
|
|
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
|
|
with:
|
|
path: |
|
|
~/.cargo/registry
|
|
~/.cargo/git
|
|
apps/bootstrap-installer/src-tauri/target
|
|
key: cargo-${{ runner.os }}-${{ hashFiles('apps/bootstrap-installer/src-tauri/Cargo.toml') }}
|
|
|
|
# --lib only: the integration/bin targets would need a built frontend
|
|
# (vite dist) that this lane deliberately does not produce.
|
|
- name: cargo test
|
|
run: cargo test --lib
|