mirror of
https://github.com/stablyai/orca.git
synced 2026-10-30 16:47:34 +00:00
OrcaWinandOrcaWin
61ad1ba166
* ci: move routine checks and unsigned builds to Blacksmith * ci: retain GitHub Mac images for isolated SSH fixtures * ci: keep shared terminal perf preparation on Blacksmith * test: allow encrypted slow-link fixture to finish on ARM CI --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
96 lines
4.5 KiB
YAML
96 lines
4.5 KiB
YAML
name: Coding Plan credential contract
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
|
|
paths:
|
|
- 'src/main/zcode/**'
|
|
- 'src/shared/node-bounded-file-reader*'
|
|
- 'src/main/rate-limits/**'
|
|
- 'src/shared/secure-file*'
|
|
- 'src/shared/secure-path-windows-acl*'
|
|
- 'src/shared/windows-security-descriptor*'
|
|
- '.github/workflows/zcode-account-contract.yml'
|
|
- '.github/workflows/zcode-credential-contract.yml'
|
|
- 'config/scripts/zcode-credential-workflow.test.mjs'
|
|
workflow_dispatch:
|
|
workflow_call:
|
|
inputs:
|
|
contract:
|
|
description: Keep the account workflow's manual entry point on its original test group.
|
|
type: string
|
|
default: credentials
|
|
permissions:
|
|
contents: read
|
|
concurrency:
|
|
group: coding-plan-contract-${{ github.event.pull_request.number || github.ref }}-${{ inputs.contract || 'credentials' }}
|
|
cancel-in-progress: true
|
|
jobs:
|
|
credential-files:
|
|
if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
|
|
name: ZCode credentials (${{ matrix.os }})
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-22.04, macos-15, windows-2022]
|
|
runs-on: ${{ fromJSON('{"ubuntu-22.04":"blacksmith-4vcpu-ubuntu-2204","macos-15":"blacksmith-6vcpu-macos-15","windows-2022":"blacksmith-4vcpu-windows-2025"}')[matrix.os] || matrix.os }}
|
|
timeout-minutes: 20
|
|
env:
|
|
ORCA_BACKGROUND_LAUNCH: '1'
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 2
|
|
persist-credentials: false
|
|
- name: Select credential test groups
|
|
id: scope
|
|
shell: bash
|
|
env:
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
MANUAL_ACCOUNT: ${{ inputs.contract == 'account' }}
|
|
MANUAL_CREDENTIALS: ${{ inputs.contract != 'account' }}
|
|
run: |
|
|
if [ "$EVENT_NAME" != pull_request ]; then
|
|
echo "account=$MANUAL_ACCOUNT" >> "$GITHUB_OUTPUT"
|
|
echo "credentials=$MANUAL_CREDENTIALS" >> "$GITHUB_OUTPUT"
|
|
else
|
|
account=true
|
|
credentials=true
|
|
diff_status=2
|
|
if git rev-parse --verify HEAD^1 >/dev/null 2>&1; then
|
|
diff_status=0
|
|
git diff --quiet --no-renames HEAD^1 HEAD || diff_status=$?
|
|
fi
|
|
if [ "$diff_status" = 1 ]; then
|
|
if git diff --quiet --no-renames HEAD^1 HEAD -- \
|
|
src/main/zcode/ ':(glob)src/shared/node-bounded-file-reader*' src/main/rate-limits/ \
|
|
.github/workflows/zcode-account-contract.yml \
|
|
.github/workflows/zcode-credential-contract.yml \
|
|
config/scripts/zcode-credential-workflow.test.mjs; then
|
|
account=false
|
|
fi
|
|
if git diff --quiet --no-renames HEAD^1 HEAD -- \
|
|
src/main/zcode/ ':(glob)src/shared/secure-file*' ':(glob)src/shared/secure-path-windows-acl*' \
|
|
':(glob)src/shared/windows-security-descriptor*' \
|
|
.github/workflows/zcode-credential-contract.yml \
|
|
config/scripts/zcode-credential-workflow.test.mjs; then
|
|
credentials=false
|
|
fi
|
|
fi
|
|
echo "account=$account" >> "$GITHUB_OUTPUT"
|
|
echo "credentials=$credentials" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
- uses: ./.github/actions/install-node-dependencies
|
|
id: dependencies
|
|
with:
|
|
native-runtime: node
|
|
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
|
|
id: bun
|
|
with:
|
|
bun-version-file: config/.bun-version
|
|
- name: Verify read-only credentials and account changes
|
|
if: ${{ !cancelled() && steps.scope.outputs.account == 'true' && steps.dependencies.outcome == 'success' && steps.bun.outcome == 'success' }}
|
|
run: pnpm test src/main/zcode/zcode-v2-plan-credentials.test.ts src/main/zcode/zcode-v2-personal-overlay-raw-json.test.ts src/main/rate-limits/service-zcode-usage.test.ts src/shared/node-bounded-file-reader-sync.test.ts
|
|
- name: Verify rollback and native Windows permissions
|
|
if: ${{ !cancelled() && steps.scope.outputs.credentials == 'true' && steps.dependencies.outcome == 'success' && steps.bun.outcome == 'success' }}
|
|
run: pnpm test src/main/zcode/zcode-plan-api-key-store.test.ts src/main/zcode/zcode-plan-api-key-store-plaintext-rollback.test.ts src/main/zcode/zcode-plan-api-key-store-publication-race.test.ts src/main/zcode/zcode-plan-api-key-store-native-windows.test.ts src/shared/secure-file.test.ts
|