Skip to content
CI

Merge pull request #710 from flyingrobots/task/709-rootless-observati… #1532

Sign in to view logs

Merge pull request #710 from flyingrobots/task/709-rootless-observati…

Merge pull request #710 from flyingrobots/task/709-rootless-observati… #1532

Workflow file for this run

.github/workflows/ci.yml at ef39efa
# SPDX-License-Identifier: Apache-2.0
# © James Ross Ω FLYING•ROBOTS <https://github.com/flyingrobots>
name: CI
on:
push:
branches:
- main
pull_request:
permissions:
contents: read
jobs:
fmt:
name: Format
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: cargo fmt
run: cargo fmt --all -- --check
hook-regression:
name: Hook Regression Tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- name: verify-local hook regression
run: bash tests/hooks/test_verify_local.sh
- name: retired component reference regression
run: bash tests/docs/test_retired_component_refs.sh
- name: repository knowledge model regression
run: bash tests/docs/test_knowledge_model.sh
- name: ADR namespace regression
run: bash tests/docs/test_adr_namespace.sh
- name: generated rule truth regression
run: bash tests/docs/test_generated_rule_truth.sh
- name: determinism policy gate regression
run: node --test scripts/tests/classify_changes.test.cjs
- name: WASM ABI and optic boundary regression
run: node --test scripts/tests/wasm_abi_truth_test.mjs
clippy-libs-core:
name: Clippy (core libs)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
with:
components: clippy
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: cargo clippy (core libraries)
run: |
cargo clippy \
-p warp-core \
-p warp-geom \
-p warp-wasm \
-p echo-wasm-abi \
-p echo-edict-canonical \
-p echo-edict-provider-lowerer \
-p echo-runtime-schema \
-p echo-dry-tests \
-p echo-graph \
--lib -- -D warnings -D missing_docs
clippy-libs-support:
name: Clippy (support libs)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
with:
components: clippy
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: cargo clippy (support libraries)
run: |
cargo clippy \
-p echo-registry-api \
-p echo-wesley-gen \
-p echo-cas \
-p echo-scene-port \
-p echo-scene-codec \
-p echo-dind-harness \
-p echo-dind-tests \
--lib -- -D warnings -D missing_docs
clippy-bins:
name: Clippy (bins)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
with:
components: clippy
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: cargo clippy (binaries)
run: |
cargo clippy -p warp-math --all-targets -- -D warnings -D missing_docs
cargo clippy -p warp-cli --bins -- -D warnings -D missing_docs
cargo clippy -p echo-dind-harness --bins -- -D warnings -D missing_docs
cargo clippy -p echo-wesley-gen --bins -- -D warnings -D missing_docs
cargo clippy -p xtask --bins -- -D warnings -D missing_docs
clippy-warp-core-tests:
name: Clippy (warp-core test lanes)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
with:
components: clippy
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: cargo clippy (warp-core runtime inbox)
run: cargo clippy -p warp-core --features native_rule_bootstrap,host_test --test inbox -- -D warnings -D missing_docs
- name: cargo clippy (warp-core host_test admission fixtures)
run: |
cargo clippy -p warp-core --features host_test --test causal_fact_publication_tests -- -D warnings -D missing_docs
cargo clippy -p warp-core --features host_test --test optic_invocation_admission_tests -- -D warnings -D missing_docs
- name: cargo clippy (scheduler-owned executable Actions)
run: |
cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime --test executable_operation_pipeline_tests -- -D warnings -D missing_docs
cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test --test executable_operation_pipeline_tests -- -D warnings -D missing_docs
clippy-det-fixed:
name: Clippy (det_fixed)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
with:
components: clippy
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: cargo clippy (warp-core lib, det_fixed)
run: cargo clippy -p warp-core --lib --features det_fixed -- -D warnings -D missing_docs
test-workspace:
name: Tests (workspace sans warp-core)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: cargo test (workspace sans warp-core)
run: cargo test --workspace --exclude warp-core
- name: checked Edict provider crate assets are current and packaged
run: cargo +1.90.0 run --locked -p echo-wesley-gen --bin echo-edict-provider-assets -- --check-package-list
- name: checked Edict provider package is current
run: cargo +1.90.0 run --locked -p echo-wesley-gen --bin echo-edict-provider-package -- --check
- name: package publishable Edict canonical leaf
run: cargo package -p echo-edict-canonical --locked
build-edict-provider-lowerer:
name: Build and check Edict provider lowerer
runs-on: ubuntu-24.04
container:
image: docker.io/library/rust@sha256:3914072ca0c3b8aad871db9169a651ccfce30cf58303e5d6f2db16d1d8a7e58f
options: --platform linux/amd64
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
with:
components: clippy
targets: wasm32-unknown-unknown
- name: build, audit, and check exact component bytes
env:
GIT_CONFIG_COUNT: 1
GIT_CONFIG_KEY_0: safe.directory
GIT_CONFIG_VALUE_0: ${{ github.workspace }}
run: |
cargo xtask provider-lowerer-component check \
--target-dir target/provider-lowerer-component \
--output schemas/edict-provider/components/v1/lowerer.echo-dpo.component.wasm
- name: clippy (wasm32 Edict provider adapter)
run: cargo +1.90.0 clippy -p echo-edict-provider-lowerer --target wasm32-unknown-unknown --lib -- -D warnings -D missing_docs
build-edict-provider-verifier:
name: Build and check Edict provider verifier
runs-on: ubuntu-24.04
container:
image: docker.io/library/rust@sha256:3914072ca0c3b8aad871db9169a651ccfce30cf58303e5d6f2db16d1d8a7e58f
options: --platform linux/amd64
steps:
- uses: actions/checkout@v4
with:
submodules: false
persist-credentials: false
- uses: dtolnay/rust-toolchain@1.90.0
with:
components: clippy
targets: wasm32-unknown-unknown
- name: build, audit, and check exact verifier component bytes
env:
GIT_CONFIG_COUNT: 1
GIT_CONFIG_KEY_0: safe.directory
GIT_CONFIG_VALUE_0: ${{ github.workspace }}
run: |
cargo xtask provider-verifier-component check \
--target-dir target/provider-verifier-component \
--output schemas/edict-provider/components/v1/verifier.echo-dpo.component.wasm
- name: clippy (wasm32 Edict provider verifier)
run: cargo +1.90.0 clippy -p echo-edict-provider-verifier --target wasm32-unknown-unknown --lib -- -D warnings -D missing_docs
edict-provider-host-v1:
name: Edict provider host contract (Rust 1.94)
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
with:
targets: wasm32-unknown-unknown
- uses: dtolnay/rust-toolchain@1.94.0
with:
components: clippy
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
tests/edict-provider-host-v1 -> target/edict-provider-host-v1
- name: invoke and replay through the exact Edict host
run: scripts/verify-edict-provider-host-v1.sh
build-echo-cas-wasm:
name: Build echo-cas (wasm32)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
with:
targets: wasm32-unknown-unknown
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: cargo build (echo-cas, wasm32)
run: cargo build --target wasm32-unknown-unknown -p echo-cas
test-warp-core:
name: Tests (warp-core)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: Install cargo-nextest
uses: taiki-e/install-action@5ab5d1729c22acd8f798b267eadcfe5e5be6f5c2 # v2.68.27
with:
tool: nextest
- name: cargo nextest run (warp-core)
run: cargo nextest run -p warp-core
- name: cargo test (warp-core host_test admission fixtures)
run: |
cargo test -p warp-core --features host_test --test causal_fact_publication_tests
cargo test -p warp-core --features host_test --test optic_invocation_admission_tests
- name: cargo test (warp-core installed contract intent pipeline)
run: cargo test -p warp-core --features native_rule_bootstrap,host_test --test installed_contract_intent_pipeline_tests
- name: cargo test (warp-core provider proposal admission)
run: cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime --test provider_contract_admission_tests
- name: cargo test (scheduler-owned executable Actions)
run: |
cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime --test executable_operation_pipeline_tests
cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test --test executable_operation_pipeline_tests
- name: cargo test --doc (warp-core)
run: cargo test -p warp-core --doc
- name: PRNG golden regression (warp-math)
run: cargo test -p warp-math --features golden_prng --test prng_golden_regression
test:
name: Tests
runs-on: ubuntu-latest
needs:
- test-workspace
- test-warp-core
if: always()
steps:
- name: Require test shard success
shell: bash
run: |
set -euo pipefail
workspace_result="${{ needs.test-workspace.result }}"
warp_core_result="${{ needs.test-warp-core.result }}"
if [[ "$workspace_result" != "success" ]]; then
echo "workspace shard result: $workspace_result" >&2
exit 1
fi
if [[ "$warp_core_result" != "success" ]]; then
echo "warp-core shard result: $warp_core_result" >&2
exit 1
fi
echo "All test shards passed."
test-musl:
name: Tests (musl)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
with:
targets: x86_64-unknown-linux-musl
- name: Install musl tools
run: sudo apt-get update && sudo apt-get install -y musl-tools
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
# Intentionally test only warp-core under MUSL; warp-wasm targets wasm32
# (wasm-bindgen/js-sys) and has separate cross-compilation concerns.
- name: cargo test (warp-core, musl)
run: cargo test -p warp-core --target x86_64-unknown-linux-musl
test-det-fixed:
name: Tests (det_fixed)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: cargo test (warp-core, det_fixed)
run: cargo test -p warp-core --features det_fixed
test-musl-det-fixed:
name: Tests (musl, det_fixed)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
with:
targets: x86_64-unknown-linux-musl
- name: Install musl tools
run: sudo apt-get update && sudo apt-get install -y musl-tools
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: cargo test (warp-core, musl, det_fixed)
run: cargo test -p warp-core --features det_fixed --target x86_64-unknown-linux-musl
rust-version:
name: Rust Version Guard
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
- name: Check workspace rust-version declarations
shell: bash
run: |
set -euo pipefail
script="scripts/check_rust_versions.sh"
if [[ ! -x "$script" ]]; then
echo "Error: $script is missing or not executable" >&2
ls -la scripts || true
exit 1
fi
"$script"
- name: Rust version checker self-tests
shell: bash
run: |
set -euo pipefail
bash scripts/tests/check_rust_versions_test.sh
wasm-package-boundary:
name: WASM Package Boundary
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- uses: actions/setup-node@v4
with:
node-version: 22
- name: Install wasm32 target
run: rustup target add wasm32-unknown-unknown
- name: Install wasm-pack
run: cargo install wasm-pack --version 0.14.0 --locked
- name: WASM package export smoke test
shell: bash
run: |
set -euo pipefail
bash scripts/tests/warp_wasm_package_exports_test.sh
man-pages:
name: Man Pages Freshness
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: Check generated echo-cli man pages
run: cargo xtask man-pages --check
deterministic-math-guard:
name: Deterministic Math Guard
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Forbid raw trig in warp-math
shell: bash
run: |
set -euo pipefail
script="scripts/check_no_raw_trig.sh"
if [[ ! -x "$script" ]]; then
echo "Error: $script is missing or not executable" >&2
ls -la scripts || true
exit 1
fi
"$script"
determinism-guards:
name: Determinism Guards
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Ban globals
shell: bash
run: |
set -euo pipefail
script="scripts/ban-globals.sh"
if [[ ! -x "$script" ]]; then
echo "Error: $script is missing or not executable" >&2
ls -la scripts || true
exit 1
fi
"$script"
- name: Ban nondeterminism
shell: bash
run: |
set -euo pipefail
script="scripts/ban-nondeterminism.sh"
if [[ ! -x "$script" ]]; then
echo "Error: $script is missing or not executable" >&2
ls -la scripts || true
exit 1
fi
"$script"
- name: Ban unordered ABI containers
shell: bash
run: |
set -euo pipefail
script="scripts/ban-unordered-abi.sh"
if [[ ! -x "$script" ]]; then
echo "Error: $script is missing or not executable" >&2
ls -la scripts || true
exit 1
fi
"$script"
dind-pr:
name: DIND (PR set)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@1.90.0
- uses: actions/setup-node@v4
with:
node-version: "20"
- name: Run DIND PR suite (full hash)
run: node scripts/dind-run-suite.mjs --tags pr
benches:
name: Benchmarks (compilation gate)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
- uses: Swatinem/rust-cache@v2
with:
workspaces: |
.
- name: cargo check (benches)
run: cargo check --benches -p warp-benches
# MSRV job removed per policy: use @stable everywhere
rustdoc:
name: Rustdoc (warnings gate)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: false
- uses: dtolnay/rust-toolchain@1.90.0
- uses: Swatinem/rust-cache@v2
- name: rustdoc warnings gate (warp-core)
run: RUSTDOCFLAGS="-D warnings" cargo doc -p warp-core --no-deps
- name: rustdoc warnings gate (warp-geom)
run: RUSTDOCFLAGS="-D warnings" cargo doc -p warp-geom --no-deps
- name: rustdoc warnings gate (warp-wasm)
run: |
if [ -f crates/warp-wasm/Cargo.toml ]; then RUSTDOCFLAGS="-D warnings" cargo doc -p warp-wasm --no-deps; fi
deny:
name: Dependency Policy (cargo-deny)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- name: Pre-fetch crates (locked)
run: cargo fetch --locked
- name: cargo-audit runner self-tests
shell: bash
run: |
set -euo pipefail
bash scripts/tests/run_cargo_audit_test.sh
- name: Run cargo-deny
uses: EmbarkStudios/cargo-deny-action@76cd80eb775d7bbbd2d80292136d74d39e1b4918 # v2.0.14