ci: bump actions/checkout from 6 to 7 #628
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, develop, port, feat/pranit] | |
| pull_request: | |
| branches: [main, develop, port, feat/pranit] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| NODE_VERSION: '22' | |
| BUN_VERSION: 'latest' | |
| CARGO_TERM_COLOR: always | |
| CENTRAL_LICENSE_KEY: '38A7449F-8FCA-45E9-8FA4-E2C656E0F3AE' | |
| jobs: | |
| # ============================================ | |
| # Frontend - Agent (TypeScript/React) | |
| # ============================================ | |
| typecheck: | |
| name: TypeScript (Agent) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - run: bun install --frozen-lockfile | |
| - run: bun run typecheck | |
| lint: | |
| name: ESLint (All Frontend) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - run: bun install --frozen-lockfile | |
| - run: bun run lint | |
| # Vitest tests for all frontend apps (agent, editor, common) | |
| vitest: | |
| name: Vitest (All Frontend) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - run: bun install --frozen-lockfile | |
| - run: bun run test | |
| build: | |
| name: Build (Agent) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - run: bun install --frozen-lockfile | |
| - run: bun run build:frontend | |
| env: | |
| NODE_OPTIONS: '--max-old-space-size=4096' | |
| # Only upload artifacts on main branch to save storage | |
| # continue-on-error prevents storage quota issues from failing the build | |
| - name: Upload build | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| continue-on-error: true | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: dist-agent-${{ github.sha }} | |
| path: dist/ | |
| retention-days: 3 | |
| # ============================================ | |
| # Frontend - Common (Shared Types/Utils) | |
| # ============================================ | |
| common-typecheck: | |
| name: TypeScript (Common) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - run: bun install --frozen-lockfile | |
| - run: bun run common:typecheck | |
| # ============================================ | |
| # Frontend - Shared Schemas (Zod Schemas) | |
| # ============================================ | |
| schemas-typecheck: | |
| name: TypeScript (Schemas) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - run: bun install --frozen-lockfile | |
| - run: bun run schemas:typecheck | |
| # ============================================ | |
| # Agent Bridge (TypeScript/Bun Sidecar) | |
| # ============================================ | |
| bridge-typecheck: | |
| name: TypeScript (Bridge) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - run: bun install --frozen-lockfile | |
| - run: bun run bridge:typecheck | |
| bridge-test: | |
| name: Test (Bridge) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - run: bun install --frozen-lockfile | |
| - run: bun run bridge:test | |
| # ============================================ | |
| # Backend - Rust/Tauri | |
| # ============================================ | |
| rust-fmt: | |
| name: Rust Format | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt | |
| - run: cargo fmt --all -- --check | |
| rust-clippy: | |
| name: Rust Clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y build-essential lld libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf | |
| echo "PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig" >> $GITHUB_ENV | |
| - name: Create placeholder binaries for CI | |
| run: | | |
| mkdir -p src-tauri/binaries | |
| touch src-tauri/binaries/agent-bridge-x86_64-unknown-linux-gnu | |
| touch src-tauri/binaries/claude-x86_64-unknown-linux-gnu | |
| chmod +x src-tauri/binaries/* | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo clippy --all-targets --all-features -- -D warnings | |
| rust-test: | |
| name: Rust Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y build-essential lld libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf | |
| echo "PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig" >> $GITHUB_ENV | |
| - name: Create placeholder binaries for CI | |
| run: | | |
| mkdir -p src-tauri/binaries | |
| touch src-tauri/binaries/agent-bridge-x86_64-unknown-linux-gnu | |
| touch src-tauri/binaries/claude-x86_64-unknown-linux-gnu | |
| chmod +x src-tauri/binaries/* | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo test --all-features | |
| rust-deny: | |
| name: Cargo Deny | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y build-essential lld libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf | |
| echo "PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig" >> $GITHUB_ENV | |
| - name: Create placeholder binaries for CI | |
| run: | | |
| mkdir -p src-tauri/binaries | |
| touch src-tauri/binaries/agent-bridge-x86_64-unknown-linux-gnu | |
| touch src-tauri/binaries/claude-x86_64-unknown-linux-gnu | |
| chmod +x src-tauri/binaries/* | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: Install cargo-deny | |
| run: cargo install cargo-deny --locked | |
| - name: Run cargo-deny | |
| run: cargo deny check | |
| rust-machete: | |
| name: Unused Dependencies | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y build-essential lld libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf | |
| echo "PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig" >> $GITHUB_ENV | |
| - name: Create placeholder binaries for CI | |
| run: | | |
| mkdir -p src-tauri/binaries | |
| touch src-tauri/binaries/agent-bridge-x86_64-unknown-linux-gnu | |
| touch src-tauri/binaries/claude-x86_64-unknown-linux-gnu | |
| chmod +x src-tauri/binaries/* | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - uses: bnjbvr/cargo-machete@main | |
| rust-doc: | |
| name: Documentation | |
| runs-on: ubuntu-latest | |
| env: | |
| RUSTDOCFLAGS: '-D warnings' | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y build-essential lld libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf | |
| echo "PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig" >> $GITHUB_ENV | |
| - name: Create placeholder binaries for CI | |
| run: | | |
| mkdir -p src-tauri/binaries | |
| touch src-tauri/binaries/agent-bridge-x86_64-unknown-linux-gnu | |
| touch src-tauri/binaries/claude-x86_64-unknown-linux-gnu | |
| chmod +x src-tauri/binaries/* | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo doc --no-deps --all-features | |
| rust-msrv: | |
| name: MSRV Check (1.88) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y build-essential lld libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf | |
| echo "PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig" >> $GITHUB_ENV | |
| - name: Create placeholder binaries for CI | |
| run: | | |
| mkdir -p src-tauri/binaries | |
| touch src-tauri/binaries/agent-bridge-x86_64-unknown-linux-gnu | |
| touch src-tauri/binaries/claude-x86_64-unknown-linux-gnu | |
| chmod +x src-tauri/binaries/* | |
| - uses: dtolnay/rust-toolchain@1.88.0 | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| cache-on-failure: false | |
| - run: cargo check --all-features | |
| # ============================================ | |
| # macOS DMG Build (Apple Silicon) | |
| # TEMPORARILY DISABLED - Uncomment when ready for release | |
| # | |
| # INSTALLATION INSTRUCTIONS (after downloading DMG): | |
| # The app is not notarized with Apple, so macOS will block it by default. | |
| # To install and run: | |
| # | |
| # 1. Mount the DMG: | |
| # open ~/Downloads/Orbit*.dmg | |
| # | |
| # 2. Copy to Applications: | |
| # cp -R "/Volumes/Orbit/Orbit.app" /Applications/ | |
| # | |
| # 3. Remove quarantine attribute (bypasses Gatekeeper): | |
| # xattr -cr /Applications/Orbit.app | |
| # | |
| # 4. Launch: | |
| # open /Applications/Orbit.app | |
| # | |
| # One-liner: | |
| # cp -R "/Volumes/Orbit/Orbit.app" /Applications/ && xattr -cr /Applications/Orbit.app && open /Applications/Orbit.app | |
| # | |
| # ============================================ | |
| # build-macos: | |
| # name: Build macOS DMG | |
| # runs-on: macos-15 | |
| # steps: | |
| # - uses: actions/checkout@v7 | |
| # | |
| # # Select Xcode 16.4 for macOS SDK 15.5 (16.3 = SDK 15.4) | |
| # - name: Select Xcode 16.4 | |
| # run: | | |
| # sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer | |
| # xcodebuild -version | |
| # xcrun --show-sdk-path | |
| # xcrun --show-sdk-version | |
| # | |
| # # Setup Bun for package management and agent-bridge sidecar | |
| # - uses: oven-sh/setup-bun@v2 | |
| # with: | |
| # bun-version: ${{ env.BUN_VERSION }} | |
| # - uses: actions/setup-node@v6 | |
| # with: | |
| # node-version: ${{ env.NODE_VERSION }} | |
| # - run: bun install --frozen-lockfile | |
| # | |
| # # Setup Rust | |
| # - uses: dtolnay/rust-toolchain@stable | |
| # with: | |
| # targets: aarch64-apple-darwin | |
| # - uses: Swatinem/rust-cache@v2 | |
| # with: | |
| # cache-on-failure: false | |
| # | |
| # # Build agent-bridge sidecar (Bun standalone binary) | |
| # # Note: bun install already resolved workspace dependencies (@orbit/shared-schemas) | |
| # - name: Build agent-bridge sidecar | |
| # run: | | |
| # cd agent-bridge | |
| # bun build ./src/index.ts --compile --target=bun-darwin-arm64 --outfile=../src-tauri/binaries/agent-bridge-aarch64-apple-darwin | |
| # chmod +x ../src-tauri/binaries/agent-bridge-aarch64-apple-darwin | |
| # | |
| # # Install Claude Code CLI and copy the binary | |
| # - name: Install Claude Code CLI | |
| # run: | | |
| # curl -fsSL https://claude.ai/install.sh | bash | |
| # # Copy from the installed location | |
| # cp "$HOME/.local/bin/claude" src-tauri/binaries/claude-aarch64-apple-darwin | |
| # chmod +x src-tauri/binaries/claude-aarch64-apple-darwin | |
| # ls -la src-tauri/binaries/ | |
| # | |
| # # Import Apple certificate into CI keychain for code signing | |
| # - name: Import Apple certificate | |
| # env: | |
| # APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| # APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| # run: | | |
| # CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12 | |
| # KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | |
| # KEYCHAIN_PASSWORD=$(openssl rand -base64 32) | |
| # | |
| # # Decode certificate | |
| # echo -n "$APPLE_CERTIFICATE" | base64 --decode -o $CERTIFICATE_PATH | |
| # | |
| # # Create temporary keychain | |
| # security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| # security set-keychain-settings -lut 21600 $KEYCHAIN_PATH | |
| # security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| # | |
| # # Import certificate | |
| # security import $CERTIFICATE_PATH -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH | |
| # security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| # security list-keychain -d user -s $KEYCHAIN_PATH | |
| # | |
| # # Verify | |
| # security find-identity -v -p codesigning $KEYCHAIN_PATH | |
| # | |
| # # Build Tauri app (includes frontend build via beforeBuildCommand) | |
| # # Tauri reads APPLE_* env vars for signing and notarization automatically | |
| # - name: Build Tauri macOS app | |
| # run: bunx tauri build --target aarch64-apple-darwin | |
| # env: | |
| # APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| # APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| # APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} | |
| # APPLE_ID: ${{ secrets.APPLE_ID }} | |
| # APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} | |
| # APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| # TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| # TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| # | |
| # # Upload DMG artifact | |
| # # Note: tauri build outputs to ./target/ (project root), not ./src-tauri/target/ | |
| # - name: Upload DMG | |
| # uses: actions/upload-artifact@v7 | |
| # with: | |
| # name: Orbit-macOS-arm64-${{ github.sha }} | |
| # path: target/aarch64-apple-darwin/release/bundle/dmg/*.dmg | |
| # retention-days: 7 | |
| # | |
| # # Clean up keychain (always runs, even on failure) | |
| # - name: Clean up keychain | |
| # if: always() | |
| # run: security delete-keychain $RUNNER_TEMP/app-signing.keychain-db 2>/dev/null || true | |
| # ============================================ | |
| # QUALITY GATE - Required status check | |
| # ============================================ | |
| ci-passed: | |
| name: CI Passed | |
| runs-on: ubuntu-latest | |
| needs: | |
| [ | |
| typecheck, | |
| lint, | |
| vitest, | |
| build, | |
| common-typecheck, | |
| schemas-typecheck, | |
| bridge-typecheck, | |
| bridge-test, | |
| rust-fmt, | |
| rust-clippy, | |
| rust-test, | |
| rust-deny, | |
| rust-machete, | |
| rust-doc, | |
| rust-msrv, | |
| ] | |
| if: always() | |
| steps: | |
| - name: Check results | |
| run: | | |
| # Agent frontend checks | |
| agent="${{ needs.typecheck.result }} ${{ needs.lint.result }} ${{ needs.build.result }}" | |
| # Common/Schemas checks | |
| shared="${{ needs.common-typecheck.result }} ${{ needs.schemas-typecheck.result }}" | |
| # Bridge checks | |
| bridge="${{ needs.bridge-typecheck.result }}" | |
| # Rust checks (required) | |
| rust="${{ needs.rust-fmt.result }} ${{ needs.rust-clippy.result }} ${{ needs.rust-test.result }}" | |
| rust+=" ${{ needs.rust-deny.result }} ${{ needs.rust-doc.result }} ${{ needs.rust-msrv.result }}" | |
| # Test checks (allow skipped - bridge tests skip in CI without API key) | |
| vitest_result="${{ needs.vitest.result }}" | |
| bridge_test_result="${{ needs.bridge-test.result }}" | |
| machete_result="${{ needs.rust-machete.result }}" | |
| for result in $agent $shared $bridge $rust; do | |
| if [[ "$result" != "success" ]]; then | |
| echo "[FAIL] CI failed" | |
| exit 1 | |
| fi | |
| done | |
| if [[ "$vitest_result" != "success" && "$vitest_result" != "skipped" ]]; then | |
| echo "[FAIL] Vitest frontend tests failed" | |
| exit 1 | |
| fi | |
| if [[ "$bridge_test_result" != "success" && "$bridge_test_result" != "skipped" ]]; then | |
| echo "[FAIL] Bridge tests failed" | |
| exit 1 | |
| fi | |
| # Warn but don't fail on unused deps | |
| if [[ "$machete_result" != "success" ]]; then | |
| echo "[WARN] Unused dependencies detected (non-blocking)" | |
| fi | |
| echo "[OK] All checks passed" |