Repository navigation
fix(ui-sdk): observe again after an empty worker mount table during sandbox setup (#2701) #5392
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "17 3 * * *" | |
| push: | |
| branches: [main] | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review, converted_to_draft] | |
| permissions: | |
| contents: read | |
| actions: read | |
| checks: read | |
| # Cancel obsolete PR heads. Preserve every integrated main commit's evidence. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| # Drafts run cheap gates; synchronize gives fast feedback. Open/ready/reopen | |
| # requests final affected confirmation. The proof gate refuses intermediate feedback. | |
| # Independent jobs start together; each PR owns its cancellation group (#1326). | |
| jobs: | |
| changeset: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 3 | |
| outputs: | |
| cadence: ${{ steps.plan.outputs.cadence }} | |
| endurance: ${{ steps.plan.outputs.endurance }} | |
| runtime: ${{ steps.plan.outputs.runtime }} | |
| runtime_host: ${{ steps.plan.outputs.runtime_host }} | |
| captures: ${{ steps.plan.outputs.captures }} | |
| layout: ${{ steps.plan.outputs.layout }} | |
| browser: ${{ steps.plan.outputs.browser }} | |
| unit: ${{ steps.plan.outputs.unit }} | |
| unit_shards: ${{ steps.plan.outputs.unit_shards }} | |
| verify: ${{ steps.plan.outputs.verify }} | |
| pack: ${{ steps.plan.outputs.pack }} | |
| run_browser: ${{ steps.reuse.outputs.run_browser }} | |
| run_layout: ${{ steps.reuse.outputs.run_layout }} | |
| reuse: ${{ steps.reuse.outputs.reuse }} | |
| red_main_oid: ${{ steps.plan.outputs.red_main_oid }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.4.2" | |
| - run: bun install --frozen-lockfile | |
| # Fail fast while main is red (#2942): hosted proof whose merge ref contains | |
| # the recorded bad commit is refused, except declared fixes. Drafts run cheap gates only. | |
| - name: Refuse doomed proof while main is red | |
| if: github.event_name == 'pull_request' && !github.event.pull_request.draft | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: bun scripts/red-main-cli.ts gate | |
| - name: Plan affected fast and local checks | |
| id: plan | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| PR_DRAFT: ${{ github.event.pull_request.draft }} | |
| run: bun scripts/ci-plan.ts | |
| - name: Validate requested candidate before product proof | |
| if: steps.plan.outputs.cadence == 'confirmation' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: bun scripts/candidate-proof.ts | |
| - name: Discover product scenario and assertion ownership | |
| if: steps.plan.outputs.cadence != 'draft' | |
| run: bun scripts/proof-inventory.ts | |
| # Plan outputs and retention decisions are set before any metadata gate can | |
| # fail, so a main push still runs its complete selected proof (#2942). | |
| - name: Retain only validated equivalent automatic proof | |
| id: reuse | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PR_DRAFT: ${{ github.event.pull_request.draft }} | |
| run: bun scripts/proof-reuse.ts | |
| - name: Lint, leakage and contribution workflow guards | |
| run: bun run lint | |
| - name: Env documentation matches its descriptors | |
| run: bun scripts/env-docs.ts --check | |
| - name: Validate all pending changeset package names | |
| run: bun scripts/check-changeset-packages.ts | |
| - name: Require a changeset for shipped package changes | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| run: | | |
| if [ "$GITHUB_EVENT_NAME" = pull_request ]; then | |
| bun scripts/check-changeset.ts "$BASE_SHA" | |
| elif [ "$GITHUB_EVENT_NAME" = push ]; then | |
| bun scripts/check-changeset.ts "$BEFORE_SHA" | |
| fi | |
| - name: Retention ledger and diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: proof-reuse-ledger | |
| path: | | |
| tmp/proof-reuse.json | |
| tmp/proof-inventory.json | |
| if-no-files-found: warn | |
| retention-days: 7 | |
| verify: | |
| # Packaging and verification are independent after cheap rejection gates. | |
| needs: changeset | |
| if: ${{ !cancelled() && (needs.changeset.result == 'success' || github.event_name == 'push') && needs.changeset.outputs.verify == 'true' }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 7 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.4.2" | |
| - id: verify_install | |
| timeout-minutes: 1 | |
| run: bun install --frozen-lockfile | |
| - name: Recompute the same affected selection | |
| id: verify_plan | |
| timeout-minutes: 1 | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| RED_MAIN_OID: ${{ needs.changeset.outputs.red_main_oid }} | |
| run: bun scripts/ci-plan.ts | |
| - name: Strict types and curated fast tests concurrently on this runner | |
| id: verify_proof | |
| timeout-minutes: 4 | |
| env: | |
| CI_COMMAND_RECEIPTS: tmp/verify-commands.jsonl | |
| run: bun scripts/ci-runner.ts | |
| - name: Verify setup and proof outcomes (best effort) | |
| if: always() | |
| env: | |
| INSTALL_OUTCOME: ${{ steps.verify_install.outcome }} | |
| PLAN_OUTCOME: ${{ steps.verify_plan.outcome }} | |
| PROOF_OUTCOME: ${{ steps.verify_proof.outcome }} | |
| CI_COMMAND_RECEIPTS: tmp/verify-commands.jsonl | |
| run: bun scripts/ci-verify-summary.ts | |
| pack: | |
| needs: changeset | |
| if: ${{ !cancelled() && (needs.changeset.result == 'success' || github.event_name == 'push') && needs.changeset.outputs.pack == 'true' }} | |
| timeout-minutes: 5 | |
| runs-on: ubuntu-24.04 | |
| env: | |
| GEMINI_API_KEY: "" | |
| ANTHROPIC_API_KEY: "" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.4.2" | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: "24" | |
| - run: bun install --frozen-lockfile | |
| - run: bun run build --jobs=2 | |
| - name: Pack, install and probe every publishable package | |
| # One table-driven script (scripts/ci-pack.ts): workspace pins first, | |
| # then each package's tarball entries, Bun and Node consumer imports | |
| # and probes, bins, the packed query/inbox checks, the published type | |
| # surface and the React 18 consumer. `bun run check:pack` runs this | |
| # job locally, so both run the same probes. | |
| run: bun scripts/ci-pack.ts | |
| unit: | |
| needs: changeset | |
| if: ${{ !cancelled() && (needs.changeset.result == 'success' || github.event_name == 'push') && needs.changeset.outputs.unit == 'true' }} | |
| runs-on: ubuntu-24.04 | |
| # Separate network setup from the unchanged proof budget (#2658). | |
| # 12 minutes setup + 30 minutes proof + 3 minutes for other steps. | |
| timeout-minutes: 45 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: ${{ fromJSON(needs.changeset.outputs.unit_shards) }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.4.2" | |
| # Native source freezes require dependency inodes owned by this checkout. | |
| - run: bun install --frozen-lockfile --backend=copyfile | |
| - name: Recompute affected proof on the actual checkout | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| RED_MAIN_OID: ${{ needs.changeset.outputs.red_main_oid }} | |
| run: bun scripts/ci-plan.ts | |
| - name: Real Chrome and offline Linux namespace prerequisites | |
| id: runtime_setup | |
| timeout-minutes: 12 | |
| run: bash scripts/ci-runtime-setup.sh | |
| - name: Complete unit proof | |
| id: runtime_proof | |
| timeout-minutes: 30 | |
| env: | |
| UNIT_SHARDS: ${{ strategy.job-total }} | |
| run: bun scripts/ci-proof.ts unit --shard=${{ matrix.shard }}/"$UNIT_SHARDS" | |
| - name: Environment setup and proof outcomes | |
| if: always() | |
| env: | |
| SETUP_OUTCOME: ${{ steps.runtime_setup.outcome }} | |
| PROOF_OUTCOME: ${{ steps.runtime_proof.outcome }} | |
| run: | | |
| printf 'Environment setup (infrastructure prerequisite, 12-minute limit): %s\nProof (30-minute limit): %s\n' \ | |
| "$SETUP_OUTCOME" "$PROOF_OUTCOME" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Proof receipts and failure diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: unit-proof-${{ matrix.shard }} | |
| path: | | |
| tmp/proof-checkout.json | |
| tmp/proof-resources.json | |
| tmp/runner-disk.json | |
| tmp/unit-memory.jsonl | |
| tmp/unit-report.xml | |
| tmp/unit-report-summary.json | |
| tmp/unit-worker-*.xml | |
| tmp/unit-worker-*.json | |
| tmp/unit-worker-diagnostics/ | |
| tmp/unit-timings.json | |
| tmp/measure-claude-*.json | |
| tmp/*-probe.json | |
| tmp/feature-capture-verification/ | |
| packages/ui-kit/.vitest-attachments/ | |
| packages/ui-react/.vitest-attachments/ | |
| .vitest-attachments/ | |
| tmp/diagram-renderer-proof/ | |
| tmp/mermaid-renderer-proof/ | |
| tmp/diagram-export-proof/ | |
| tmp/cold-capture/ | |
| tmp/share-review/ | |
| tmp/svg-proof/ | |
| packages/ui-kit/**/__screenshots__/**/*-[0-9]*.png | |
| packages/ui-react/**/__screenshots__/**/*-[0-9]*.png | |
| !packages/ui-kit/**/__screenshots__/**/*-linux.png | |
| !packages/ui-react/**/__screenshots__/**/*-linux.png | |
| include-hidden-files: true | |
| if-no-files-found: warn | |
| retention-days: 7 | |
| runtime: | |
| needs: changeset | |
| if: ${{ !cancelled() && (needs.changeset.result == 'success' || github.event_name == 'push') && needs.changeset.outputs.runtime == 'true' }} | |
| runs-on: ubuntu-24.04 | |
| # 12 minutes setup + unchanged 15 minutes proof + 3 minutes for other steps (#2658). | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.4.2" | |
| - run: bun install --frozen-lockfile | |
| - name: Recompute affected proof on the actual checkout | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| RED_MAIN_OID: ${{ needs.changeset.outputs.red_main_oid }} | |
| run: bun scripts/ci-plan.ts | |
| - name: Real Chrome and offline Linux namespace prerequisites | |
| id: runtime_setup | |
| timeout-minutes: 12 | |
| run: bash scripts/ci-runtime-setup.sh --native | |
| - name: Complete runtime proof | |
| id: runtime_proof | |
| timeout-minutes: 15 | |
| run: bun scripts/ci-proof.ts runtime | |
| - name: Environment setup and proof outcomes | |
| if: always() | |
| env: | |
| SETUP_OUTCOME: ${{ steps.runtime_setup.outcome }} | |
| PROOF_OUTCOME: ${{ steps.runtime_proof.outcome }} | |
| run: | | |
| printf 'Environment setup (infrastructure prerequisite, 12-minute limit): %s\nProof (15-minute limit): %s\n' \ | |
| "$SETUP_OUTCOME" "$PROOF_OUTCOME" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Proof receipts and failure diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: runtime-proof | |
| path: | | |
| tmp/native-host-proof/ | |
| tmp/proof-checkout.json | |
| tmp/proof-resources.json | |
| tmp/unit-report.xml | |
| tmp/unit-timings.json | |
| tmp/measure-claude-*.json | |
| tmp/*-probe.json | |
| tmp/feature-capture-verification/ | |
| packages/ui-kit/.vitest-attachments/ | |
| packages/ui-react/.vitest-attachments/ | |
| .vitest-attachments/ | |
| tmp/diagram-renderer-proof/ | |
| tmp/mermaid-renderer-proof/ | |
| tmp/diagram-export-proof/ | |
| tmp/cold-capture/ | |
| tmp/share-review/ | |
| tmp/svg-proof/ | |
| packages/ui-kit/**/__screenshots__/**/*-[0-9]*.png | |
| packages/ui-react/**/__screenshots__/**/*-[0-9]*.png | |
| !packages/ui-kit/**/__screenshots__/**/*-linux.png | |
| !packages/ui-react/**/__screenshots__/**/*-linux.png | |
| include-hidden-files: true | |
| if-no-files-found: warn | |
| retention-days: 7 | |
| runtime_host: | |
| needs: changeset | |
| if: ${{ !cancelled() && (needs.changeset.result == 'success' || github.event_name == 'push') && needs.changeset.outputs.runtime_host == 'true' }} | |
| runs-on: ubuntu-24.04 | |
| # 12 minutes setup + unchanged 15 minutes proof + 3 minutes for other steps (#2658). | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.4.2" | |
| - run: bun install --frozen-lockfile | |
| - name: Recompute affected proof on the actual checkout | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| RED_MAIN_OID: ${{ needs.changeset.outputs.red_main_oid }} | |
| run: bun scripts/ci-plan.ts | |
| - name: Real Chrome and offline Linux namespace prerequisites | |
| id: runtime_setup | |
| timeout-minutes: 12 | |
| run: bash scripts/ci-runtime-setup.sh --native | |
| # Diagnostic only: names the task that queues each deleted checkpoint (#1967). | |
| - name: Start btrfs dead-root kernel trace | |
| run: | | |
| mkdir -p tmp/native-host-proof | |
| sudo bash scripts/native-proof/dead-root-trace.sh start tmp/native-host-proof/dead-root-trace.txt | |
| - name: Start optional owned-loop kernel trace | |
| continue-on-error: true | |
| run: sudo python3 -I -S scripts/native-proof/loop-trace.py start tmp/native-host-proof/owned-loop-trace.json | |
| - name: Complete native hosted runtime proof | |
| id: runtime_proof | |
| timeout-minutes: 15 | |
| run: bun scripts/ci-proof.ts runtime_host | |
| - name: Stop optional owned-loop kernel trace | |
| continue-on-error: true | |
| if: always() | |
| run: sudo python3 -I -S scripts/native-proof/loop-trace.py stop | |
| - name: Stop and classify btrfs dead-root kernel trace | |
| if: always() | |
| run: | | |
| sudo bash scripts/native-proof/dead-root-trace.sh stop | |
| if [ -f tmp/native-host-proof/dead-root-trace.txt ]; then | |
| bun scripts/native-proof/dead-root-trace.ts tmp/native-host-proof/dead-root-trace.txt tmp/native-host-proof | |
| fi | |
| - name: Environment setup and proof outcomes | |
| if: always() | |
| env: | |
| SETUP_OUTCOME: ${{ steps.runtime_setup.outcome }} | |
| PROOF_OUTCOME: ${{ steps.runtime_proof.outcome }} | |
| run: | | |
| printf 'Environment setup (infrastructure prerequisite, 12-minute limit): %s\nProof (15-minute limit): %s\n' \ | |
| "$SETUP_OUTCOME" "$PROOF_OUTCOME" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Proof receipts and failure diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: runtime-host-proof | |
| path: | | |
| tmp/native-host-proof/ | |
| tmp/reference-pool-proof/ | |
| tmp/worker-identity-proof/ | |
| tmp/proof-checkout.json | |
| tmp/proof-resources.json | |
| tmp/unit-report.xml | |
| tmp/unit-timings.json | |
| tmp/measure-claude-*.json | |
| tmp/*-probe.json | |
| tmp/feature-capture-verification/ | |
| packages/ui-kit/.vitest-attachments/ | |
| packages/ui-react/.vitest-attachments/ | |
| .vitest-attachments/ | |
| tmp/diagram-renderer-proof/ | |
| tmp/mermaid-renderer-proof/ | |
| tmp/diagram-export-proof/ | |
| tmp/cold-capture/ | |
| tmp/share-review/ | |
| tmp/svg-proof/ | |
| packages/ui-kit/**/__screenshots__/**/*-[0-9]*.png | |
| packages/ui-react/**/__screenshots__/**/*-[0-9]*.png | |
| !packages/ui-kit/**/__screenshots__/**/*-linux.png | |
| !packages/ui-react/**/__screenshots__/**/*-linux.png | |
| include-hidden-files: true | |
| if-no-files-found: warn | |
| retention-days: 7 | |
| browser: | |
| needs: changeset | |
| if: ${{ !cancelled() && (needs.changeset.result == 'success' || github.event_name == 'push') && needs.changeset.outputs.browser == 'true' && needs.changeset.outputs.run_browser == 'true' }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [1, 2, 3] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.4.2" | |
| - run: bun install --frozen-lockfile | |
| - name: Recompute affected proof on the actual checkout | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| RED_MAIN_OID: ${{ needs.changeset.outputs.red_main_oid }} | |
| run: bun scripts/ci-plan.ts | |
| - name: Complete browser proof | |
| run: bun scripts/ci-proof.ts browser --shard=${{ matrix.shard }}/3 | |
| - name: Proof receipts and failure diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: browser-proof-${{ matrix.shard }} | |
| path: | | |
| tmp/proof-checkout.json | |
| tmp/proof-resources.json | |
| tmp/proof-cases.json | |
| tmp/unit-report.xml | |
| tmp/unit-timings.json | |
| tmp/measure-claude-*.json | |
| tmp/*-probe.json | |
| tmp/feature-capture-verification/ | |
| packages/ui-kit/.vitest-attachments/ | |
| packages/ui-react/.vitest-attachments/ | |
| .vitest-attachments/ | |
| tmp/diagram-renderer-proof/ | |
| tmp/mermaid-renderer-proof/ | |
| tmp/diagram-export-proof/ | |
| tmp/diagram-export-native-prepared/*/*/release.svg | |
| tmp/diagram-export-native-prepared/*/*/release.png | |
| tmp/diagram-export-native-prepared/*/*/release.pdf | |
| tmp/diagram-export-native-prepared/*/*/origin.svg | |
| tmp/diagram-export-native-prepared/*/*/origin.png | |
| tmp/diagram-export-native-prepared/*/*/origin.pdf | |
| tmp/diagram-export-native-prepared/*/*/producer.json | |
| tmp/cold-capture/ | |
| tmp/share-review/ | |
| tmp/svg-proof/ | |
| packages/ui-kit/**/__screenshots__/**/*-[0-9]*.png | |
| packages/ui-react/**/__screenshots__/**/*-[0-9]*.png | |
| !packages/ui-kit/**/__screenshots__/**/*-linux.png | |
| !packages/ui-react/**/__screenshots__/**/*-linux.png | |
| include-hidden-files: true | |
| if-no-files-found: warn | |
| retention-days: 7 | |
| layout: | |
| needs: changeset | |
| if: ${{ !cancelled() && (needs.changeset.result == 'success' || github.event_name == 'push') && needs.changeset.outputs.layout == 'true' && needs.changeset.outputs.run_layout == 'true' }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 25 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [1, 2] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.4.2" | |
| - run: bun install --frozen-lockfile | |
| - name: Recompute affected proof on the actual checkout | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| RED_MAIN_OID: ${{ needs.changeset.outputs.red_main_oid }} | |
| run: bun scripts/ci-plan.ts | |
| - name: Complete layout proof | |
| run: bun scripts/ci-proof.ts layout --shard=${{ matrix.shard }}/2 | |
| - name: Proof receipts and failure diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: layout-proof-${{ matrix.shard }} | |
| path: | | |
| tmp/proof-checkout.json | |
| tmp/proof-resources.json | |
| tmp/proof-cases.json | |
| tmp/unit-report.xml | |
| tmp/unit-timings.json | |
| tmp/measure-claude-*.json | |
| tmp/*-probe.json | |
| tmp/feature-capture-verification/ | |
| packages/ui-kit/.vitest-attachments/ | |
| packages/ui-react/.vitest-attachments/ | |
| .vitest-attachments/ | |
| tmp/diagram-renderer-proof/ | |
| tmp/mermaid-renderer-proof/ | |
| tmp/diagram-export-proof/ | |
| tmp/hygiene-proof/ | |
| tmp/cold-capture/ | |
| tmp/share-review/ | |
| tmp/svg-proof/ | |
| packages/ui-kit/**/__screenshots__/**/*-[0-9]*.png | |
| packages/ui-react/**/__screenshots__/**/*-[0-9]*.png | |
| !packages/ui-kit/**/__screenshots__/**/*-linux.png | |
| !packages/ui-react/**/__screenshots__/**/*-linux.png | |
| include-hidden-files: true | |
| if-no-files-found: warn | |
| retention-days: 7 | |
| captures: | |
| needs: changeset | |
| if: ${{ !cancelled() && (needs.changeset.result == 'success' || github.event_name == 'push') && needs.changeset.outputs.captures == 'true' }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.4.2" | |
| - run: bun install --frozen-lockfile | |
| - name: Recompute affected proof on the actual checkout | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| RED_MAIN_OID: ${{ needs.changeset.outputs.red_main_oid }} | |
| run: bun scripts/ci-plan.ts | |
| - name: Complete captures proof | |
| run: bun scripts/ci-proof.ts captures | |
| - name: Proof receipts and failure diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: captures-proof | |
| path: | | |
| tmp/proof-checkout.json | |
| tmp/proof-resources.json | |
| tmp/unit-report.xml | |
| tmp/unit-timings.json | |
| tmp/measure-claude-*.json | |
| tmp/*-probe.json | |
| tmp/feature-capture-verification/ | |
| packages/ui-kit/.vitest-attachments/ | |
| packages/ui-react/.vitest-attachments/ | |
| .vitest-attachments/ | |
| tmp/diagram-renderer-proof/ | |
| tmp/mermaid-renderer-proof/ | |
| tmp/diagram-export-proof/ | |
| tmp/cold-capture/ | |
| tmp/share-review/ | |
| tmp/svg-proof/ | |
| packages/ui-kit/**/__screenshots__/**/*-[0-9]*.png | |
| packages/ui-react/**/__screenshots__/**/*-[0-9]*.png | |
| !packages/ui-kit/**/__screenshots__/**/*-linux.png | |
| !packages/ui-react/**/__screenshots__/**/*-linux.png | |
| include-hidden-files: true | |
| if-no-files-found: warn | |
| retention-days: 7 | |
| endurance: | |
| needs: changeset | |
| if: ${{ !cancelled() && (needs.changeset.result == 'success' || github.event_name == 'push') && needs.changeset.outputs.endurance == 'true' }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.4.2" | |
| - run: bun install --frozen-lockfile | |
| - name: Recompute affected proof on the actual checkout | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| RED_MAIN_OID: ${{ needs.changeset.outputs.red_main_oid }} | |
| run: bun scripts/ci-plan.ts | |
| - name: Complete endurance proof | |
| run: bun scripts/ci-proof.ts endurance | |
| - name: Proof receipts and failure diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: endurance-proof | |
| path: | | |
| tmp/proof-checkout.json | |
| tmp/proof-resources.json | |
| tmp/proof-cases.json | |
| tmp/unit-report.xml | |
| tmp/unit-timings.json | |
| tmp/measure-claude-*.json | |
| tmp/*-probe.json | |
| tmp/feature-capture-verification/ | |
| packages/ui-kit/.vitest-attachments/ | |
| packages/ui-react/.vitest-attachments/ | |
| .vitest-attachments/ | |
| tmp/diagram-renderer-proof/ | |
| tmp/mermaid-renderer-proof/ | |
| tmp/diagram-export-proof/ | |
| tmp/cold-capture/ | |
| tmp/share-review/ | |
| tmp/svg-proof/ | |
| packages/ui-kit/**/__screenshots__/**/*-[0-9]*.png | |
| packages/ui-react/**/__screenshots__/**/*-[0-9]*.png | |
| !packages/ui-kit/**/__screenshots__/**/*-linux.png | |
| !packages/ui-react/**/__screenshots__/**/*-linux.png | |
| include-hidden-files: true | |
| if-no-files-found: warn | |
| retention-days: 7 | |
| proof: | |
| name: ${{ github.event_name != 'pull_request' && 'integrated or exhaustive proof' || github.event.pull_request.draft && 'draft gates' || 'proof' }} | |
| # Evaluate even after failures or skips; never interpret missing selected proof as green. | |
| needs: [changeset, verify, pack, unit, runtime, runtime_host, browser, layout, captures, endurance] | |
| if: ${{ always() && !cancelled() }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 3 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.4.2" | |
| - run: bun install --frozen-lockfile | |
| - name: Require every selected proof category to pass | |
| env: | |
| PROOF_NEEDS: ${{ toJSON(needs) }} | |
| GH_TOKEN: ${{ github.token }} | |
| run: bun scripts/ci-proof.ts aggregate |