common-auth/.github/workflows/ci.yml at main · cortexkit/common-auth · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
name: CI
on:
  push:
  pull_request:
  # The release workflow calls this on the tagged commit and publishes only if
  # every job here passes.
  workflow_call:
  # Nightly and on demand: the full mutation catalogue with --broad.
  schedule:
    - cron: "0 3 * * *"
  workflow_dispatch:
permissions:
  contents: read
env:
  # The reviewed cortexkit/commons revision the mutation runner is built from.
  CK_MUTATE_REV: 7d08e73722fa3e79bbcc2607753978ab768f1c6b
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
        with:
          node-version: "24"
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14
      - name: Install dependencies
        run: bun install --frozen-lockfile
      - name: Build
        run: bun run build
      - name: Typecheck
        run: bun run typecheck
      - name: Claustrum client floor (0.6.2) compatibility
        run: bun run check:claustrum-floor
      - name: OpenTUI 0.5.11 compatibility
        run: bun run check:opentui-0511
      - name: Lint
        run: bun run lint
      - name: Test
        run: bun test --reporter=junit --reporter-outfile=test-results.xml
      - name: Check source evidence
        run: bun scripts/check-sources.mjs docs/sources.md test-results.xml
  # Runs the real OpenCode 2 CLI (installed from npm at test time, pinned in
  # the test) against a loopback mock provider. It fails when a host release
  # stops firing, or moves, one of the hooks the /opencode2 subpath relies on.
  opencode2-placement:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
        with:
          node-version: "24"
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14
      - name: Install dependencies
        run: bun install --frozen-lockfile
      - name: OpenCode 2 placement contract
        env:
          COMMON_AUTH_OPENCODE2_E2E: "1"
        run: bun test --reporter=junit --reporter-outfile=opencode2-placement-results.xml test/opencode2/e2e/placement.e2e.test.ts
      - name: Check source evidence
        run: bun scripts/check-sources.mjs test/opencode2/e2e/sources.md opencode2-placement-results.xml

  # Mutation proofs (mutations.toml): each row breaks a guard and requires its
  # named test to fail. A pull request replays the rows its diff selects.
  mutations-pr:
    if: github.event_name == 'pull_request'
    needs: check
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
        with:
          node-version: "24"
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14
      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        id: mutate-cache
        with:
          path: ~/.cargo/bin/ck-mutate
          key: ${{ runner.os }}-${{ runner.arch }}-ck-mutate-${{ env.CK_MUTATE_REV }}
      - name: Install pinned mutation runner
        if: steps.mutate-cache.outputs.cache-hit != 'true'
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable
          cargo install --locked --git https://github.com/cortexkit/commons --rev "$CK_MUTATE_REV" cortexkit-mutate
      - name: Validate the catalogue
        run: ck-mutate check
      - name: Replay proofs selected by the PR diff
        run: ck-mutate run --diff origin/main --report "$RUNNER_TEMP/mutations-diff.json"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: always()
        with:
          name: mutations-pr
          path: ${{ runner.temp }}/mutations-diff.json
          if-no-files-found: ignore

  # Replays every row of mutations.toml on a push to main, and every row with
  # --broad nightly or on demand. release.yaml reuses this workflow through
  # workflow_call for a tag push; github.ref is then refs/tags/v..., which the
  # `if` below excludes, so a release waits only for the check and placement
  # jobs, never for a mutation replay.
  mutations-main:
    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    needs: check
    runs-on: ubuntu-latest
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
        with:
          node-version: "24"
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14
      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        id: mutate-cache
        with:
          path: ~/.cargo/bin/ck-mutate
          key: ${{ runner.os }}-${{ runner.arch }}-ck-mutate-${{ env.CK_MUTATE_REV }}
      - name: Install pinned mutation runner
        if: steps.mutate-cache.outputs.cache-hit != 'true'
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable
          cargo install --locked --git https://github.com/cortexkit/commons --rev "$CK_MUTATE_REV" cortexkit-mutate
      - name: Replay the full catalogue in an isolated shard
        run: ck-mutate run --all --shard ${{ matrix.shard }}/4 ${BROAD:+--broad} --report "$RUNNER_TEMP/mutations-all.json"
        env:
          BROAD: ${{ github.event_name != 'push' && 'true' || '' }}
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: always()
        with:
          name: mutations-${{ github.event_name == 'push' && 'main' || 'broad' }}-${{ matrix.shard }}
          path: ${{ runner.temp }}/mutations-all.json
          if-no-files-found: ignore