bandscope/.github/workflows/ci.yml at develop · ContextualWisdomLab/bandscope · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
name: ci

on:
  push:
    branches:
      - develop
      - main
  pull_request:
    branches:
      - develop
      - main

concurrency:
  group: >-
    ${{ github.workflow }}-${{ github.repository }}-${{
    github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

env:
  GIT_CONFIG_COUNT: "1"
  GIT_CONFIG_KEY_0: init.defaultBranch
  GIT_CONFIG_VALUE_0: develop
  EXPECTED_NPM_VERSION: "10.9.9"

jobs:
  lock-validation:
    name: gate / ci / npm-lock-validation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "22.22.3"
          package-manager-cache: false
      - name: Activate pinned npm runtime
        run: corepack enable npm
      - name: Verify exact npm lockfile generator and bundled tar
        run: |
          test "$(npm --version)" = "$EXPECTED_NPM_VERSION"
          npm run check:npm-runtime
      - name: Validate the frozen package lock without lifecycle execution
        run: npm ci --ignore-scripts --no-audit --no-fund
      - name: Reject manifest or lockfile drift
        run: git diff --exit-code -- package.json package-lock.json

  verify:
    name: ci / build-and-test
    needs: lock-validation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "22.22.3"
          package-manager-cache: false
      - name: Activate pinned npm runtime
        run: corepack enable npm
      - name: Verify exact npm lockfile generator and bundled tar
        run: |
          test "$(npm --version)" = "$EXPECTED_NPM_VERSION"
          npm run check:npm-runtime
      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          version: "0.8.6"
          enable-cache: false
      - name: Install node dependencies
        run: npm ci
      - name: Sync Python dependencies
        run: uv sync --project services/analysis-engine --group dev --frozen
      - name: Install stable Rust toolchain
        run: rustup toolchain install stable --profile minimal
      - name: Build and install Rust numeric extension
        run: |
          VENV_PY="$PWD/services/analysis-engine/.venv/bin/python"
          uvx maturin@1.9.6 build --release \
            --manifest-path services/analysis-engine/rust/Cargo.toml \
            --interpreter "$VENV_PY" \
            --out services/analysis-engine/rust/dist
          uv pip install --python "$VENV_PY" services/analysis-engine/rust/dist/*.whl
      - name: Run quickcheck
        run: ./scripts/harness/quickcheck.sh

  rust-check:
    name: gate / ci / rust-check
    needs: lock-validation
    runs-on: macos-15
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "22.22.3"
          package-manager-cache: false
      - name: Activate pinned npm runtime
        run: corepack enable npm
      - name: Verify exact npm lockfile generator and bundled tar
        run: |
          test "$(npm --version)" = "$EXPECTED_NPM_VERSION"
          npm run check:npm-runtime
      - name: Install stable Rust toolchain
        run: rustup toolchain install stable --profile minimal
      - name: Install node dependencies
        run: npm ci
      - name: Build frontend
        run: npm run build --workspace @bandscope/desktop
      - name: Check Tauri shell
        run: cargo +stable check --manifest-path apps/desktop/src-tauri/Cargo.toml --locked
      - name: Test Tauri shell
        run: cargo +stable test --manifest-path apps/desktop/src-tauri/Cargo.toml --locked