terraphim-ai/.github/workflows/continue-integration.yml at main · terraphim/terraphim-ai · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
name: Continue integration
on:
  pull_request:
    paths: ['integrations/continue/**', '.github/workflows/continue-integration.yml']
  push:
    branches: [main]
    tags: ['terraphim_continue-v*']
    paths: ['integrations/continue/**', '.github/workflows/continue-integration.yml']
  workflow_dispatch:
permissions:
  contents: read
jobs:
  verify-and-package:
    timeout-minutes: 10
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: '3.12'
      - name: Install pinned MCP SDK
        run: python -m pip install -r integrations/continue/requirements.txt
      - name: Verify released CLI and actual MCP outputs
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/continue-grep"
          cd "$RUNNER_TEMP/continue-grep"
          curl --fail --location --retry 3 --output grep.tar.gz https://github.com/terraphim/terraphim-clients/releases/download/v1.21.19/terraphim-grep-1.21.19-x86_64-unknown-linux-musl.tar.gz
          echo 'd95ae22a7a84c294e700e957ff94ad25195481fce80ea7673a240c6240257220  grep.tar.gz' | sha256sum --check --strict
          tar -xzf grep.tar.gz
          binary="$(python -c 'from pathlib import Path; p=list(Path(".").rglob("terraphim-grep")); assert len(p)==1; print(p[0].resolve())')"
          cd "$GITHUB_WORKSPACE"
          TERRAPHIM_GREP_BINARY="$binary" TERRAPHIM_EXPORTED_GRAPH="$GITHUB_WORKSPACE/integrations/continue/risk-concern.exported.json" TERRAPHIM_CONTINUE_RECEIPT="$RUNNER_TEMP/continue-receipt.json" python -m unittest discover -s integrations/continue 2>&1 | tee "$RUNNER_TEMP/continue-test.log"
      - name: Package separate integration
        run: python integrations/continue/package.py continue-dist
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: terraphim-continue-integration
          path: |
            continue-dist/*
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        if: always()
        with:
          name: terraphim-continue-output-proof
          path: |
            ${{ runner.temp }}/continue-receipt.json
            ${{ runner.temp }}/continue-test.log
  attach-to-published-release:
    if: startsWith(github.ref, 'refs/tags/terraphim_continue-v')
    needs: verify-and-package
    timeout-minutes: 15
    environment: continue-releases
    concurrency:
      group: continue-release-${{ github.ref }}
      cancel-in-progress: false
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: terraphim-continue-integration
          path: integration
      - name: Attach separately downloadable integration
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.ref_name }}
          GH_REPO: ${{ github.repository }}
        shell: bash
        run: |
          set -euo pipefail
          expected="$(python -c 'import json; m=json.load(open("integrations/continue/integration.json")); print(m["tagPrefix"] + m["version"])')"
          test "$RELEASE_TAG" = "$expected"
          version="$(python -c 'import json; print(json.load(open("integrations/continue/integration.json"))["version"])')"
          export CONTINUE_ARCHIVE_NAME="terraphim-continue-integration-$version.zip"
          cd integration
          sha256sum --check --strict terraphim-continue-SHA256SUMS
          qualify_source() {
            python ../integrations/continue/verify_source.py --tag "$RELEASE_TAG" --qualified "$GITHUB_SHA" --archive "$CONTINUE_ARCHIVE_NAME"
          }
          qualify_source
          # Dedicated tag/release only. Existing release is accepted only for identical assets.
          if gh release view "$RELEASE_TAG" --json assets > existing.json 2>/dev/null; then
            python -c 'import json,os; a=json.load(open("existing.json"))["assets"]; assert sorted(x["name"] for x in a)==sorted(["terraphim-continue-SHA256SUMS",os.environ["CONTINUE_ARCHIVE_NAME"]])'
            mkdir existing
            gh release download "$RELEASE_TAG" --dir existing
            cmp "$CONTINUE_ARCHIVE_NAME" "existing/$CONTINUE_ARCHIVE_NAME"
            cmp terraphim-continue-SHA256SUMS existing/terraphim-continue-SHA256SUMS
          else
            qualify_source
            gh release create "$RELEASE_TAG" --verify-tag --draft --title "Terraphim Continue integration $version" --notes "Agent-mode MCP tools backed by separately installed terraphim-grep. The packaged README includes runnable terraphim-grep synonym-search and terraphim-agent authored-memory capture/readback examples, verified with clients v1.21.20. See https://terraphim.ai/how-tos/synonym-search/ and https://terraphim.ai/posts/cold-start-tax-agentic-memory/. Actual SDK transport qualified; native Continue UI and full editor parity remain unqualified." --latest=false
            qualify_source
            gh release upload "$RELEASE_TAG" "$CONTINUE_ARCHIVE_NAME" terraphim-continue-SHA256SUMS
          fi
          qualify_source
          gh release edit "$RELEASE_TAG" --draft=false --latest=false
          # No authentication header, curl configuration or netrc: verify the public release.
          mkdir public-readback
          curl -q --fail --location --retry 10 --retry-delay 5 --max-time 20 --output "public-readback/$CONTINUE_ARCHIVE_NAME" "https://github.com/$GH_REPO/releases/download/$RELEASE_TAG/$CONTINUE_ARCHIVE_NAME"
          curl -q --fail --location --retry 10 --retry-delay 5 --max-time 20 --output public-readback/terraphim-continue-SHA256SUMS "https://github.com/$GH_REPO/releases/download/$RELEASE_TAG/terraphim-continue-SHA256SUMS"
          cmp "$CONTINUE_ARCHIVE_NAME" "public-readback/$CONTINUE_ARCHIVE_NAME"
          cmp terraphim-continue-SHA256SUMS public-readback/terraphim-continue-SHA256SUMS
          cd public-readback
          sha256sum --check --strict terraphim-continue-SHA256SUMS
      - name: Preserve actual public release readback
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: terraphim-continue-public-readback
          path: integration/public-readback/