Files
desplega-ai__agent-fs/.github/workflows/ci.yml
T
2pac d5022bbdfd fix(release): sync-versions owns bun.lock and enforces bun pin parity; release v0.13.5 (#40)
v0.13.4 reached npm but its Docker and Fly builds failed on
`bun install --frozen-lockfile`. bun.lock still recorded workspace
versions 0.13.2 and FUSE optionalDependencies pins ^0.8.1. CI ran the
pinned bun 1.4.0, which tolerates that drift, while the image's floating
`oven/bun:1.4` tag resolved to 1.4.1, which refuses it. The tag content
cannot be fixed, so this ships as 0.13.5.

- scripts/sync-versions.ts: every bump now rewrites the bun.lock
  workspace versions and FUSE pins (version fields only, resolutions
  untouched). --check verifies them, and verifies that packageManager,
  both Dockerfile FROM oven/bun: tags, and every workflow bun-version:
  name the same exact bun. Floating tags fail the gate.
- scripts/release.sh: run bun install --frozen-lockfile before the
  check, the same gate the Docker build runs.
- Pin bun 1.4.1 in Dockerfile, package.json packageManager, and all
  workflows.
- Bump to 0.13.5.
- RELEASING.md + CLAUDE.md: document both invariants and the recovery
  rule for a broken tagged commit.
2026-09-04 15:38:05 +02:00

79 lines
2.5 KiB
YAML

name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true
jobs:
ci:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: oven-sh/setup-bun@v2
with:
bun-version: "1.4.1"
- run: bun install --frozen-lockfile
# Catches a partial version bump (root package.json moved but the
# sub-packages, Cargo.toml, or plugin.json were left behind) on the PR
# rather than at release time.
- name: Version sync
run: bun run scripts/sync-versions.ts --check
- name: Typecheck
run: bun run typecheck
- name: Build
run: bun run build
- name: Test
run: bun run test
- name: Coverage
run: bun run test:coverage
- name: OpenAPI spec freshness
run: |
bun run scripts/sync-openapi.ts
git diff --exit-code docs/openapi.json
# Credential-free CLI/API/MCP coverage. The local filesystem adapter keeps
# this job fork-safe and Docker-free; MinIO presigned URLs stay covered by
# the full local E2E mode, while FUSE has the dedicated smoke job below.
e2e:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: oven-sh/setup-bun@v2
with:
bun-version: "1.4.1"
- run: bun install --frozen-lockfile
- name: Run local-filesystem E2E suite
run: bun run scripts/e2e.ts "bun run packages/cli/src/index.ts --" --local-only
# FUSE smoke (Linux-only): build the helper, run the in-container mount test.
# macOS/Windows runners are excluded — FUSE is Linux-only by design.
fuse-smoke:
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Build FUSE helper (host target)
run: |
cd packages/fuse-helper
cargo build --release
- name: Run Docker FUSE smoke
run: |
# The harness builds a Ubuntu 24.04 image with fuse3 + /dev/fuse and
# mounts the helper against a stub socket. Linux-only.
bash packages/fuse-helper/docker/run-mount-test.sh
# Phase 5 will extend this with `bun run scripts/e2e.ts ... --fuse-only`
# once the e2e harness gains a --fuse-only flag. For Phase 4 the Docker
# smoke above is the single FUSE regression check.