chore(release): pin Parachute App 0.20.16 (voice Waves 1+2) #247
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI — typecheck + test the two Vault Cloud workers (under real workerd via | |
| # @cloudflare/vitest-pool-workers) and the dormant control plane (root bun test). | |
| # | |
| # Load-bearing setup notes (all three jobs): | |
| # - workers/vault depends on @openparachute/core via | |
| # `file:../../../parachute-vault/core` — a SIBLING checkout of the public | |
| # parachute-vault repo, OUTSIDE this repo. Bun copies it into node_modules | |
| # at install time, so each job clones parachute-vault@main next to this | |
| # checkout BEFORE `bun install`. The root install covers the whole | |
| # workspace (workers/*), which is why even the identity/control-plane jobs | |
| # need the sibling present. | |
| # - workers/identity depends on @openparachute/door-contract via | |
| # `file:../../../parachute-hub/packages/door-contract`. Every job uses | |
| # scripts/materialize-door-contract.sh before install to fetch or verify the | |
| # exact Hub commit in scripts/door-contract-source.env and rebuild dist. | |
| # - The control-plane source-boundary suite executes build-spa.sh's dirty | |
| # checkout guard against an isolated clone, so that job also fetches the | |
| # exact App commit from scripts/spa-source.env as a sibling checkout. | |
| # - bun.lock is COMMITTED (cloud#44, 2026-07-09) — registry deps install | |
| # pinned from the lockfile (the vitest-3.2.7 drift broke main), so the | |
| # download cache is keyed on bun.lock. The Vault file dependency still | |
| # follows main deliberately (see #45); the Hub file dependency is pinned. | |
| # - Root `bun run typecheck` IS run now (control-plane job): cloud#23 (stripe | |
| # caret drift) is closed — `stripe` is pinned EXACT ("22.1.0") and the | |
| # committed lockfile pins the rest, so an install can no longer resolve | |
| # 22.3.0's API-version type drift. The two worker typechecks are also run. | |
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| identity-worker: | |
| name: identity worker (typecheck + vitest/workerd) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | |
| - name: Clone parachute-vault (sibling file dep for @openparachute/core) | |
| # actions/checkout can't place a repo outside $GITHUB_WORKSPACE, so a | |
| # plain clone puts the sibling where the file: path resolves. | |
| run: | | |
| git clone --depth 1 https://github.com/ParachuteComputer/parachute-vault.git "$GITHUB_WORKSPACE/../parachute-vault" | |
| echo "parachute-vault @ $(git -C "$GITHUB_WORKSPACE/../parachute-vault" rev-parse HEAD)" | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.13 # keep consistent with local dev | |
| - name: Materialize pinned Hub door-contract dependency | |
| run: bash scripts/materialize-door-contract.sh | |
| - name: Cache bun download cache | |
| uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-bun- | |
| - name: Install (lockfile-pinned — copies the core file dep into node_modules) | |
| run: bun install | |
| - name: Typecheck workers/identity | |
| working-directory: workers/identity | |
| run: bun run typecheck | |
| - name: Test workers/identity (vitest under workerd) | |
| working-directory: workers/identity | |
| run: bun x vitest run | |
| vault-worker: | |
| name: vault worker (typecheck + vitest/workerd) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | |
| - name: Clone parachute-vault (sibling file dep for @openparachute/core) | |
| run: | | |
| git clone --depth 1 https://github.com/ParachuteComputer/parachute-vault.git "$GITHUB_WORKSPACE/../parachute-vault" | |
| echo "parachute-vault @ $(git -C "$GITHUB_WORKSPACE/../parachute-vault" rev-parse HEAD)" | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.13 # keep consistent with local dev | |
| - name: Materialize pinned Hub door-contract dependency | |
| run: bash scripts/materialize-door-contract.sh | |
| - name: Cache bun download cache | |
| uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-bun- | |
| - name: Install (lockfile-pinned — copies the core file dep into node_modules) | |
| run: bun install | |
| - name: Typecheck workers/vault | |
| working-directory: workers/vault | |
| run: bun run typecheck | |
| - name: Test workers/vault (vitest under workerd) | |
| working-directory: workers/vault | |
| run: bun x vitest run | |
| control-plane: | |
| name: control plane (root bun test) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | |
| - name: Clone parachute-vault (sibling file dep for @openparachute/core) | |
| # Needed even here — the root workspace install resolves workers/vault's | |
| # file dep regardless of which package's tests run. | |
| run: | | |
| git clone --depth 1 https://github.com/ParachuteComputer/parachute-vault.git "$GITHUB_WORKSPACE/../parachute-vault" | |
| echo "parachute-vault @ $(git -C "$GITHUB_WORKSPACE/../parachute-vault" rev-parse HEAD)" | |
| - name: Fetch pinned parachute-app (source-boundary regression fixture) | |
| run: | | |
| source scripts/spa-source.env | |
| APP_REPO="$GITHUB_WORKSPACE/../parachute-app" | |
| git init "$APP_REPO" | |
| git -C "$APP_REPO" remote add origin https://github.com/ParachuteComputer/parachute-app.git | |
| git -C "$APP_REPO" fetch --depth 1 origin "$SPA_APP_REF" | |
| git -C "$APP_REPO" checkout --detach FETCH_HEAD | |
| test "$(git -C "$APP_REPO" rev-parse HEAD)" = "$SPA_APP_REF" | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.13 # keep consistent with local dev | |
| - name: Materialize pinned Hub door-contract dependency | |
| run: bash scripts/materialize-door-contract.sh | |
| - name: Cache bun download cache | |
| uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-bun- | |
| - name: Install (lockfile-pinned — copies the core file dep into node_modules) | |
| run: bun install | |
| # Root `bun run typecheck` — re-enabled now that cloud#23 (stripe caret | |
| # drift) is closed: `stripe` is pinned EXACT ("22.1.0") so `^22.1.0` can | |
| # no longer silently resolve to 22.3.0's API-version type drift. This gate | |
| # was previously masking real control-plane typecheck errors on every PR. | |
| - name: Typecheck control plane (root tsc) | |
| run: bun run typecheck | |
| - name: Test control plane (root bun test) | |
| run: bun run test |