diff --git a/.bazelrc b/.bazelrc index f1c0ae4..d43e11d 100644 --- a/.bazelrc +++ b/.bazelrc @@ -3,7 +3,9 @@ # ============================================================================= common --enable_bzlmod -common --registry=https://raw.githubusercontent.com/tinyland-inc/bazel-registry/main +# Keep the in-house registry immutable. Advance this SHA deliberately together +# with remote GF validation; never float the package graph at `main`. +common --registry=https://raw.githubusercontent.com/tinyland-inc/bazel-registry/c5986e30831b5fc4f2ed0b70982089b2d15b1c37 common --registry=https://bcr.bazel.build # Build performance diff --git a/.bazelversion b/.bazelversion index 0e79152..2b0aa21 100644 --- a/.bazelversion +++ b/.bazelversion @@ -1 +1 @@ -8.1.1 +8.2.1 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9732942..1866daf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,12 +18,11 @@ concurrency: jobs: package: - uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@v2.5.1 + uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@a929a9c7451a6213c7535e6d57a231a279463c00 with: runner_mode: repo_owned runner_labels_json: ${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }} workspace_mode: isolated - publish_mode: hosted_exception npm_publish_mode: disabled node_versions: '["20", "22"]' publish_node_version: "22" @@ -37,6 +36,9 @@ jobs: build_command: pnpm build package_check_command: pnpm check:package bazel_targets: "//:typecheck //:pkg //:test" + # Bootstrap the first committed lock from GF. After the remote artifact is + # committed, enable verify_bzlmod_lock in the signed follow-up. + emit_bzlmod_lock_artifact: true # Cache-first shared-cache-backed Bazel validation (TIN-2110 pilot). # Routes the Bazel validation through the fail-closed cache-attachment # contract + --config=ci-cached --remote_cache=$BAZEL_REMOTE_CACHE @@ -50,41 +52,23 @@ jobs: # Repo-local lane for the write-time double-booking proof (TIN-2764). The # reusable job above runs `pnpm test:integration` with no database, so the - # homegrown concurrency suite skips there; this job stands up a Postgres - # service and runs the same command with DATABASE_URL set, exercising the - # practitioner-day advisory lock against a real database. This is - # intentionally NOT part of the reusable workflow (which stays untouched). - # - # Runner: GitHub-hosted ubuntu-latest, NOT the org self-hosted pool. A - # `services:` container with `localhost:5432` port mapping only resolves when - # the job runs directly on a Docker-on-host VM. The org's PRIMARY_LINUX runners - # are in-cluster/ARC (k8s) where the service is a sibling pod unreachable on - # localhost without DinD, which would make beforeAll's connect throw and paint - # this proof job a persistent red instead of running it. ubuntu-latest is free - # for this public repo and supports service containers natively. + # homegrown concurrency suite skips there. This lane provisions PostgreSQL + # from the repo's pinned flake on the same GF capability class as package CI; + # it never falls back to a hosted runner or depends on ARC service-container + # localhost semantics. integration-postgres: - name: Integration (Postgres service) - runs-on: ubuntu-latest - services: - postgres: - image: postgres:16-alpine - env: - POSTGRES_PASSWORD: postgres - POSTGRES_DB: scheduling_kit_test - ports: - - 5432:5432 - options: >- - --health-cmd "pg_isready -U postgres" - --health-interval 10s - --health-timeout 5s - --health-retries 10 + name: Integration (GF PostgreSQL) + runs-on: ${{ fromJSON(vars.PRIMARY_LINUX_RUNNER_LABELS_JSON) }} env: - # The job runs on the runner host (not inside a job container), so the - # service is reachable on localhost via the mapped port. - DATABASE_URL: postgres://postgres:postgres@localhost:5432/scheduling_kit_test + PGHOST: 127.0.0.1 + PGPORT: "55432" + PGUSER: postgres + PGDATABASE: scheduling_kit_test + DATABASE_URL: postgres://postgres@127.0.0.1:55432/scheduling_kit_test PG_INTEGRATION: "1" steps: - uses: actions/checkout@v4 + - uses: tinyland-inc/ci-templates/.github/actions/nix-setup@v3.1.0 - uses: pnpm/action-setup@v4 with: version: "9.15.9" @@ -93,19 +77,21 @@ jobs: node-version: "22" - run: pnpm install --frozen-lockfile - run: pnpm exec svelte-kit sync - # Preflight: fail with an actionable message if the service container is - # not reachable, rather than letting the suite's beforeAll connect throw a - # confusing error deeper in the run. - - name: Wait for Postgres + - name: Run integration proof with pinned PostgreSQL + shell: bash run: | - for i in $(seq 1 30); do - if pg_isready -h localhost -p 5432 -U postgres; then - echo "postgres is ready" - exit 0 - fi - echo "waiting for postgres (attempt $i)..." - sleep 2 - done - echo "postgres service never became reachable on localhost:5432" >&2 - exit 1 - - run: pnpm test:integration + set -euo pipefail + export CI_NODE_BIN_DIR="$(dirname "$(command -v node)")" + export CI_PNPM_BIN="$(command -v pnpm)" + nix develop .#ci-postgres --command bash <<'POSTGRES_PROOF' + set -euo pipefail + export PGDATA="$RUNNER_TEMP/scheduling-kit-postgres-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" + export PATH="$CI_NODE_BIN_DIR:$(dirname "$CI_PNPM_BIN"):$PATH" + initdb --username="$PGUSER" --auth=trust "$PGDATA" + pg_ctl -D "$PGDATA" -l "$RUNNER_TEMP/scheduling-kit-postgres.log" \ + -o "-h $PGHOST -p $PGPORT" -w start + trap 'pg_ctl -D "$PGDATA" -w stop -m fast >/dev/null 2>&1 || true' EXIT + createdb --maintenance-db=postgres "$PGDATABASE" + pg_isready -h "$PGHOST" -p "$PGPORT" -U "$PGUSER" -d "$PGDATABASE" + "$CI_PNPM_BIN" test:integration + POSTGRES_PROOF diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 8420c83..e2d54d7 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -23,12 +23,11 @@ concurrency: jobs: package: - uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@v2.5.1 + uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@a929a9c7451a6213c7535e6d57a231a279463c00 with: runner_mode: repo_owned runner_labels_json: ${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }} workspace_mode: isolated - publish_mode: hosted_exception npm_publish_mode: disabled node_versions: '["20", "22"]' publish_node_version: "22" @@ -42,6 +41,7 @@ jobs: build_command: pnpm build package_check_command: pnpm check:package bazel_targets: "//:typecheck //:pkg //:test" + emit_bzlmod_lock_artifact: true # Cache-first shared-cache-backed Bazel validation (TIN-2110 pilot). # Same opt-in lane as CI; endpoint injected at runtime, no executor. cache_backed: true diff --git a/README.md b/README.md index bd17e0b..5f4cde0 100644 --- a/README.md +++ b/README.md @@ -38,7 +38,7 @@ bazel_dep(name = "tummycrypt_scheduling_kit", version = "0.11.1") with the registry line (already in this repo's `.bazelrc`): ```text -common --registry=https://raw.githubusercontent.com/tinyland-inc/bazel-registry/main +common --registry=https://raw.githubusercontent.com/tinyland-inc/bazel-registry/c5986e30831b5fc4f2ed0b70982089b2d15b1c37 ``` npm-ecosystem consumers outside the Bazel module graph install the derived diff --git a/flake.nix b/flake.nix index 7bf84f2..2b3aaf6 100644 --- a/flake.nix +++ b/flake.nix @@ -76,6 +76,12 @@ checks.docs = docsSite; checks.release-metadata = releaseMetadataCheck; + # Remote-only database proof used by the GF integration lane. Keeping + # PostgreSQL in the locked flake avoids a hosted service-container path. + devShells.ci-postgres = pkgs.mkShellNoCC { + packages = [ pkgs.postgresql_16 ]; + }; + devShells.default = pkgs.mkShellNoCC { packages = with pkgs; [ actionlint