Merge branch 'runxhq:main' into main #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| js-checks: | |
| runs-on: ubuntu-latest | |
| env: | |
| RUNX_SKILL_VERSION_BASE: ${{ github.event.pull_request.base.sha || github.event.before }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10.18.2 | |
| - name: Setup Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| cache-dependency-path: pnpm-lock.yaml | |
| - name: Restore check caches | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| node_modules/.cache/tsc | |
| .build | |
| key: ${{ runner.os }}-oss-checks-${{ hashFiles('pnpm-lock.yaml', 'package.json', 'tsconfig*.json', 'packages/**/tsconfig.json', 'packages/**/package.json') }} | |
| restore-keys: | | |
| ${{ runner.os }}-oss-checks- | |
| - name: Setup Rust | |
| run: rustup show | |
| - name: Cargo cache | |
| # verify:fast builds the debug runx + fixture-oracle binaries; without this | |
| # cache the whole dependency tree recompiles cold on every run. | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: crates | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Verify | |
| run: pnpm verify:fast | |
| - name: Verify fast plan coverage | |
| run: pnpm verify:fast:plan-check | |
| demo-checks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10.18.2 | |
| - name: Setup Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| cache-dependency-path: pnpm-lock.yaml | |
| - name: Restore check caches | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| node_modules/.cache/tsc | |
| .build | |
| key: ${{ runner.os }}-oss-checks-${{ hashFiles('pnpm-lock.yaml', 'package.json', 'tsconfig*.json', 'packages/**/tsconfig.json', 'packages/**/package.json') }} | |
| restore-keys: | | |
| ${{ runner.os }}-oss-checks- | |
| - name: Setup Rust | |
| run: rustup show | |
| - name: Cargo cache | |
| # test:heavy:graph builds the debug runx binary via test-workspace.mjs; | |
| # without this cache the whole dependency tree recompiles cold on every run. | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: crates | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Demo and local payment dogfood | |
| run: | | |
| pnpm demos:check | |
| pnpm x402:dogfood:local | |
| - name: Heavy graph Vitest | |
| run: pnpm test:heavy:graph | |
| rust-checks: | |
| runs-on: ubuntu-latest | |
| env: | |
| CARGO_INCREMENTAL: "0" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Setup Rust | |
| run: rustup show | |
| - name: Setup Rust nightly | |
| uses: dtolnay/rust-toolchain@nightly | |
| with: | |
| components: rustfmt, clippy | |
| - name: Install Rust test and advisory tools | |
| uses: taiki-e/install-action@v2 | |
| with: | |
| # Prebuilt binaries instead of compiling from source on every cache miss. | |
| # cargo-public-api is snapshot-sensitive; keep this in sync with | |
| # scripts/check-rust-kernel-parity.mjs. | |
| tool: cargo-nextest,cargo-deny,cargo-public-api@0.51.0 | |
| - name: Cargo cache | |
| # Same Rust-aware cache the cloud workflow uses for oss/crates: keys on the | |
| # lockfile and rustc version and prunes stale artifacts, so the target tree | |
| # does not bloat the cache (it grew to ~183GB locally under the old scheme). | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: crates | |
| - name: Rust checks | |
| working-directory: crates | |
| run: | | |
| cargo fmt --all --check | |
| cargo clippy --workspace --all-targets --all-features -- -D warnings | |
| cargo nextest run --workspace --all-features --no-fail-fast | |
| # nextest does not run doctests; runx-contracts (fingerprint), runx-parser | |
| # (yaml), and runx-sdk (command) carry doctests, so keep this gated. | |
| cargo test --workspace --all-features --doc | |
| cargo package -p runx-cli --list | |
| - name: License boundary guard | |
| run: | | |
| node scripts/check-license-edges.mjs --check manifest-complete | |
| node scripts/check-license-edges.mjs --check identifiers | |
| cargo metadata --manifest-path crates/Cargo.toml --format-version 1 | node scripts/check-license-edges.mjs --check edges | |
| - name: Cargo policy | |
| run: cargo deny --manifest-path crates/Cargo.toml check advisories bans licenses sources | |
| - name: Rust public API snapshot | |
| run: node scripts/check-rust-kernel-parity.mjs --api-only | |
| skill-harness: | |
| # One catalog-wide behavioral sweep. Skill Lab is the sole authoring path, | |
| # so there is no parallel template-generator smoke lane. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10.18.2 | |
| - name: Setup Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| cache-dependency-path: pnpm-lock.yaml | |
| - name: Setup Rust | |
| run: rustup show | |
| - name: Install workspace dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build workspace packages | |
| run: node scripts/build-workspace.mjs | |
| - name: Cargo cache | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: crates | |
| - name: Build runtime binaries | |
| working-directory: crates | |
| run: | | |
| cargo build -p runx-cli | |
| cargo build -p runx-js-worker | |
| - name: Audit official skill operator value | |
| run: node scripts/audit-core-skills.mjs --check --json | |
| - name: Catalog harness sweep | |
| # The official lock is the catalog source of truth. The sweep fails on | |
| # every unallowed harness failure, so a duplicate hard-coded skill count | |
| # would only drift from that owner. | |
| env: | |
| RUNX_RECEIPT_SIGN_KID: ci-skill-harness | |
| RUNX_RECEIPT_SIGN_ED25519_SEED_BASE64: QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI= | |
| RUNX_RECEIPT_SIGN_ISSUER_TYPE: hosted | |
| run: | | |
| set -euo pipefail | |
| node scripts/harness-sweep.mjs \ | |
| --runx-bin crates/target/debug/runx --no-build | |
| windows-process-lifecycle: | |
| # The Windows Job Object boundary cannot be proved by Linux emulation. | |
| # Keep this lane deliberately narrow: two runtime ownership tests and the | |
| # platform watchdog self-test, not another workspace-wide matrix build. | |
| runs-on: windows-latest | |
| timeout-minutes: 8 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Setup Rust | |
| run: rustup show | |
| - name: Cargo cache | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: crates | |
| - name: Prove Windows process-tree ownership | |
| working-directory: crates | |
| run: cargo test -p runx-runtime --features cli-tool,mcp windows_ -- --test-threads=1 --nocapture | |
| - name: Prove watchdog timeout semantics | |
| run: node scripts/harness-sweep.mjs --self-test | |
| checks: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - js-checks | |
| - demo-checks | |
| - rust-checks | |
| - skill-harness | |
| - windows-process-lifecycle | |
| steps: | |
| - name: Done | |
| run: echo "All CI lanes passed." |