mirror of
https://github.com/stablyai/orca.git
synced 2026-10-01 16:02:03 +00:00
Neil
0fe8974354
* perf(ci): move six more jobs to the free ARM runner
Follows the static-analysis move, which measured 172s to 128s. Each of these was
checked for an x86 requirement rather than assumed portable.
pr.yml:
cross-version-wire source-only, tagged checkout plus in-process vitest
managed_hook_node18 Node 18 publishes linux-arm64; the per-platform
runtime files are read as data, so host arch is moot
codex_index_heal_contract @openai/codex ships @openai/codex-linux-arm64
shell_contracts fish 4.x is published for noble/arm64, zsh is in the
arm64 archive, so the fatal fish-4 gate still holds
mobile.yml:
verify 209s of its 298s is Vitest; no Android SDK, emulator,
gradle, Hermes or Watchman, no docker, no artifacts.
Gemfile.lock lists the generic `ruby` platform, so
frozen bundler resolves without an aarch64-linux entry
recording-pin pure Node plus git; the golden comparison masks
`platform`
Left on x86 deliberately:
package builds --x64 targets, its docker gates are
--platform linux/amd64, and it is where the glibc
floor check runs. node-pty's .symver pin is
arch-specific, so flipping would validate the arm64
pin and stop validating the shipped x64 one
orcad_browser Google ships no Linux arm64 Chrome
mobile_web_app same Chrome wall; its render check fails closed
git_compatibility its cache key carries runner.arch and the warmer is
x86, so flipping alone means a cold `make git` every
run
relay_integration no technical blocker, but x86 relay coverage is a
documented placement and the reusable workflow has no
per-job runner input
e2e and the ssh lanes the ssh jobs would silently retarget the tested
remote from linux-x64 to linux-arm64
* perf(ci): move xterm_patch_sync to ARM too
The patch check rebuilds 4 packages x 2 builds and byte-compares against the
checked-in bundles. Ran it on darwin-arm64: exit 0, in sync at 1362743 bytes,
with the full fetch-and-rebuild path exercised rather than a short-circuit. The
bundles were generated on Linux x64 and reproduce byte-for-byte on a different
arch and a different OS, so the output is host-independent.
236 lines
10 KiB
YAML
236 lines
10 KiB
YAML
name: Mobile Checks
|
|
|
|
on:
|
|
pull_request:
|
|
types:
|
|
- opened
|
|
- synchronize
|
|
- reopened
|
|
paths:
|
|
- 'mobile/**'
|
|
# Mobile launch contracts exercise the real host dispatcher and durable receipt store.
|
|
- 'src/main/agent-launch/**'
|
|
- 'src/main/runtime/rpc/**'
|
|
- 'src/main/runtime/runtime-rpc/**'
|
|
- 'src/main/runtime/runtime-rpc.ts'
|
|
- 'src/main/runtime/device-registry.ts'
|
|
- 'src/main/runtime/orca-runtime.ts'
|
|
- 'src/main/runtime/agent-session-*.ts'
|
|
- 'src/main/native-chat/agent-session-wire/**'
|
|
- 'src/shared/agent-launch-*.ts'
|
|
- 'src/shared/agent-session-*.ts'
|
|
- 'src/shared/new-workspace/worktree-create-collision.ts'
|
|
# Why: the mobile terminal link parsers are conformance-tested against
|
|
# these shared fixtures; desktop-side fixture edits must re-run this suite.
|
|
- 'src/shared/terminal-file-link-conformance.ts'
|
|
# Why: mobile imports the negotiated capability names directly and records
|
|
# the whole capability read verbatim in its goldens, so a capability added
|
|
# desktop-side rewrites a mobile fixture and must re-run this suite.
|
|
- 'src/shared/protocol-version.ts'
|
|
# Why: mobile's rpc-params-contract.ts is a type-only re-export of the
|
|
# generated params catalog, and mobile/tsconfig.json includes **/*.ts. A
|
|
# schema edit anywhere under here changes mobile's types, so a desktop-only
|
|
# change can break mobile's typecheck with no other mobile signal.
|
|
- 'src/shared/rpc-contract/**'
|
|
# Why: this job holds the only checks that load the Fastfile, so edits to
|
|
# it or to the release workflow it guards must re-run them.
|
|
- '.github/workflows/mobile.yml'
|
|
- '.github/actions/install-node-dependencies/**'
|
|
- '.github/workflows/mobile-ios-release.yml'
|
|
- 'config/scripts/mobile-release-check-scope*'
|
|
- 'config/scripts/mobile-test-change-scope*'
|
|
- 'config/scripts/pr-code-change-scope.mjs'
|
|
- 'config/scripts/mobile-recording-pin-checkout.test.mjs'
|
|
# Why main too: a behaviour-change branch legitimately pins its own last fenced commit, and that
|
|
# commit only stops being reachable when the branch squash-merges. The pull_request run cannot
|
|
# see that; this one is where the pin guard finds it.
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- 'mobile/**'
|
|
- '.github/workflows/mobile.yml'
|
|
|
|
concurrency:
|
|
# Per commit on main, not per branch. GitHub cancels any PENDING run in a group when a new one
|
|
# queues, whatever `cancel-in-progress` says, so one shared main group drops the middle merge of
|
|
# three -- and a pin that breaks there is exactly what this workflow now checks for.
|
|
group: mobile-${{ github.event.pull_request.number || github.sha }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
verify:
|
|
if: github.event_name == 'pull_request'
|
|
# Why ARM: 209s of this job is Vitest and nothing here needs x86: no Android SDK, emulator, gradle,
|
|
# Hermes or Watchman, no docker, and no artifacts. The Gemfile.lock lists the generic `ruby`
|
|
# platform, so frozen bundler installs without an aarch64-linux entry.
|
|
runs-on: ubuntu-24.04-arm
|
|
|
|
env:
|
|
# Why: an unfrozen bundler silently re-resolves when Gemfile.lock drifts
|
|
# from the Gemfile, which is how the release jobs could land on different
|
|
# fastlane versions in the first place. Fail here instead.
|
|
BUNDLE_FROZEN: 'true'
|
|
|
|
defaults:
|
|
run:
|
|
working-directory: mobile
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 2
|
|
|
|
- uses: ./.github/actions/install-node-dependencies
|
|
with:
|
|
cache-dependency-path: |
|
|
pnpm-lock.yaml
|
|
mobile/pnpm-lock.yaml
|
|
|
|
- name: Detect Ruby release inputs
|
|
id: ruby-scope
|
|
shell: bash
|
|
working-directory: .
|
|
run: |
|
|
# Keep deletions when release files move into an application directory.
|
|
if ! git diff --name-only --no-renames -z HEAD^1 HEAD > "$RUNNER_TEMP/mobile-release-changes"; then
|
|
echo 'should_run=true' >> "$GITHUB_OUTPUT"
|
|
elif ! node config/scripts/mobile-release-check-scope.mjs "$RUNNER_TEMP/mobile-release-changes"; then
|
|
echo 'should_run=true' >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
# bundler-cache installs mobile/Gemfile.lock, so this job is also what
|
|
# proves the pinned fastlane the release workflow depends on still
|
|
# resolves — before a release run finds out.
|
|
- name: Setup Ruby and fastlane
|
|
if: steps.ruby-scope.outputs.should_run != 'false'
|
|
uses: ruby/setup-ruby@v1
|
|
with:
|
|
ruby-version: '3.3'
|
|
bundler-cache: true
|
|
working-directory: mobile
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
# Both compilers are read-only; finish them before starting the test workers.
|
|
- name: Typecheck
|
|
id: production-types
|
|
background: true
|
|
run: pnpm typecheck
|
|
|
|
# Why a ratchet and not the raw typecheck: mobile/tsconfig.json excludes test files, so until
|
|
# tsconfig.test.json existed nothing checked them, and at introduction 127 of the 632 had
|
|
# drifted. This fails when a test file that checks today stops checking, when a test leaves
|
|
# the program, and on @ts-nocheck; the baseline may only shrink.
|
|
- name: Typecheck tests (ratchet)
|
|
run: pnpm run check:tests-typecheck
|
|
|
|
- wait: production-types
|
|
|
|
# This includes the bridged replay of the whole recording corpus, which used to be a second
|
|
# step of its own behind RPC_FOUNDATION_BRIDGE=1. A gate nobody can forget to set is the point:
|
|
# it fails when a divergence class grows, when a divergence lands in no class at all, or when
|
|
# one of the 103 goldens inside the C1 page closure changes the verdict it is pinned to. It is
|
|
# ~3 min of test time on its own, and Vitest runs it on a worker beside the rest of the suite,
|
|
# so folding it in costs a fraction of that in wall time and one step less to skip.
|
|
- name: Detect mobile test inputs
|
|
id: test-scope
|
|
shell: bash
|
|
working-directory: .
|
|
run: |
|
|
if ! git diff --name-only --no-renames -z HEAD^1 HEAD > "$RUNNER_TEMP/mobile-test-changes"; then
|
|
echo 'should_run=true' >> "$GITHUB_OUTPUT"
|
|
elif ! node config/scripts/mobile-test-change-scope.mjs "$RUNNER_TEMP/mobile-test-changes"; then
|
|
echo 'should_run=true' >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Test
|
|
if: steps.test-scope.outputs.should_run != 'false'
|
|
env:
|
|
ORCA_BACKGROUND_LAUNCH: '1'
|
|
run: pnpm test
|
|
|
|
- name: Test iOS release version resolution
|
|
if: steps.ruby-scope.outputs.should_run != 'false'
|
|
run: ruby fastlane/ios_release_version_test.rb
|
|
|
|
- name: Test TestFlight lane arguments
|
|
if: steps.ruby-scope.outputs.should_run != 'false'
|
|
run: ruby fastlane/fastfile_testflight_arguments_test.rb
|
|
|
|
# Why: nothing else in CI loads the Fastfile, so a syntax error, a broken
|
|
# require, or an undefined constant only surfaces mid-release — the
|
|
# ios-distribute job failed every run for six days that way. `lanes` just
|
|
# loads and lists, so it needs no App Store Connect credentials and makes
|
|
# no network calls to Apple.
|
|
- name: Smoke-check the Fastfile
|
|
if: steps.ruby-scope.outputs.should_run != 'false'
|
|
env:
|
|
FASTLANE_SKIP_UPDATE_CHECK: '1'
|
|
FASTLANE_OPT_OUT_USAGE: '1'
|
|
run: bundle exec fastlane lanes
|
|
|
|
- name: Lint
|
|
run: pnpm lint
|
|
|
|
- name: Check formatting
|
|
run: pnpm format:check
|
|
|
|
recording-pin:
|
|
name: RPC recording pin
|
|
# Why ARM: pure Node plus git; the golden comparison masks `platform`.
|
|
runs-on: ubuntu-24.04-arm
|
|
|
|
defaults:
|
|
run:
|
|
working-directory: mobile
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
# The ancestry verdict is read straight off history. On a shallow checkout
|
|
# `git merge-base --is-ancestor` answers from grafted parents, so the guard refuses to
|
|
# answer at all rather than reporting a pass it has no evidence for -- and the pinned tree
|
|
# below has to be checkable out.
|
|
fetch-depth: 0
|
|
# Ancestry needs commits; the pinned worktree fetches its historical blobs on demand.
|
|
filter: blob:none
|
|
|
|
- uses: ./.github/actions/install-node-dependencies
|
|
with:
|
|
cache-dependency-path: |
|
|
pnpm-lock.yaml
|
|
mobile/pnpm-lock.yaml
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
# Seconds. No `--ref`, so the pin is judged against the same tree it was read out of. On a
|
|
# pull request that is the merge preview, which already carries main's repins; judging the
|
|
# branch head instead fails every branch cut before the day's repin, and its instruction would
|
|
# tell the author to pin their own head -- creating the break this guard exists to catch. A
|
|
# branch that pins its own commit passes here and fails on the push after the squash, which is
|
|
# where the pin actually leaves the history.
|
|
- name: Check the recording pin is reachable
|
|
shell: bash
|
|
run: pnpm exec tsx scripts/rpc-recording-pin-guard.mts ancestry
|
|
|
|
# ~2 min locally for the record itself, so it is gated rather than run twice over. A pull
|
|
# request that moves none of the corpus, the manifest or the recorder cannot move this
|
|
# verdict away from the one the base commit already published, and `verify` replays the
|
|
# corpus against the branch tree in the meantime. A push to main has no `verify` job and is
|
|
# where a squash lands a spliced corpus, so there it always runs.
|
|
- name: Reproduce the corpus from the pinned tree
|
|
shell: bash
|
|
env:
|
|
PIN_GUARD_BASE: ${{ github.event.pull_request.base.sha }}
|
|
run: |
|
|
if [ -n "$PIN_GUARD_BASE" ]; then
|
|
pnpm exec tsx scripts/rpc-recording-pin-guard.mts reproduce --if-changed-since "$PIN_GUARD_BASE"
|
|
else
|
|
pnpm exec tsx scripts/rpc-recording-pin-guard.mts reproduce
|
|
fi
|