github-device-sync/.github/workflows/platforms.yml at main · NDDev-OpenNetwork/github-device-sync · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
# Coverage for the shipped platforms that `ubuntu-latest` does not exercise.
#
# `release-installation.schema.json` and `bundle-trust.schema.json` declare
# `target_os: {"enum": ["darwin", "linux"]}` and
# `target_arch: {"enum": ["amd64", "arm64"]}`, so four combinations are shipped
# and the release builder emits them. Until this workflow existed only
# linux/amd64 ran anything; the rest were cross-compiled and never executed.
#
# Cross-compilation proves a target builds. It says nothing about behaviour, and
# this engine is made of the things that differ across platforms: path
# resolution, os.Root confinement, file locking, temp directory semantics, case
# sensitivity. `agent-runtime` tests the same two systems for the same reason.
#
# A separate workflow rather than a matrix inside `gds-ci.yml`, because that file
# is a generated projection carrying a single `.Runner`; widening it means
# changing the engine's template and generator and regenerating under the
# governed projection path. `.github` is outside `developmentBundleSourcePaths`,
# so a file here leaves the bundle lock alone — the same reason
# `release-bundle.yml` and `codeql.yml` already sit beside the generated workflow.
name: platforms

on:
  pull_request:
  push:
    branches: [main]

permissions: {}

concurrency:
  group: platforms-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  platform:
    # `macos-latest` is Apple Silicon, so it covers darwin/arm64. `ubuntu-24.04-arm`
    # covers linux/arm64. Both are standard hosted runners and unmetered on public
    # repositories; macOS-XL and larger runners are billed even here and are not used.
    # Standard Intel macOS runners remain available as macos-15-intel. Together
    # with the main Linux X64 workflow these jobs execute all four shipped targets.
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 20
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: darwin-arm64
            runner: macos-latest
          - name: linux-arm64
            runner: ubuntu-24.04-arm
          - name: darwin-amd64
            runner: macos-15-intel
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true
      # The repository's own declared commands, from `.gds/repository.yaml`,
      # so this lane cannot drift into testing something else.
      - name: go vet
        run: go vet ./...
      - name: go build
        run: go build -trimpath ./core/cmd/gds
      - name: go test
        # The integration package can exceed Go's default 10m aggregate
        # budget on Intel runners. Per-operation deadlines remain intact;
        # the suite and the enclosing job both keep explicit upper bounds.
        run: go test -timeout=15m ./...