patchbay/.github/workflows/ci.yml at main · pathorsAI/patchbay · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

# A newer push to the same branch makes the in-flight run irrelevant.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  # The Rust workspace: core + `pb` + `patchbay-mcp`.
  rust:
    name: workspace (macOS)
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4

      # `toolchain:` is not decoration. rust-toolchain defaults it to
      # `github.action_ref`, which is how `@stable` normally selects the
      # channel — pinned to a SHA that default becomes the SHA, so the channel
      # has to be named here or the action fails to resolve one.
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: stable
          components: rustfmt, clippy

      - name: Cache cargo
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2

      - name: Format
        run: cargo fmt --all --check

      - name: Clippy
        run: cargo clippy --workspace --all-targets --locked -- -D warnings

      - name: Test
        run: cargo test --workspace --locked

      - name: Build
        run: cargo build --workspace --locked

  # The Tauri panel. `app/src-tauri` is excluded from the root workspace and
  # carries its own lockfile, so it gets its own checks and its own cache.
  app:
    name: panel (macOS)
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: latest

      - name: Install Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: stable
          components: clippy

      - name: Cache cargo (src-tauri)
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          workspaces: app/src-tauri
          key: src-tauri

      # --ignore-scripts: nothing in the dependency tree has a lifecycle script
      # this build needs (the platform binaries for esbuild and the tauri CLI
      # arrive as optional deps, not as postinstall downloads), so running them
      # would only widen what a compromised package can reach.
      - name: Install front-end deps
        run: bun install --frozen-lockfile --ignore-scripts
        working-directory: app

      # `bun run build` is `tsc && vite build`: typecheck plus the production
      # bundle that tauri-build embeds. It must run before the Rust steps
      # because tauri.conf.json points frontendDist at app/dist.
      - name: Build front end
        run: bun run build
        working-directory: app

      # Every tool the core reports must have a brand mark in the panel. This
      # is a set difference — the tool keys `pb status --json` emits minus the
      # keys ToolLogo.tsx registers — and it exists because the failure it
      # catches is silent: a new probe lands, its card renders a two-letter
      # monogram next to two dozen real logos, and nobody notices in review.
      # See the rule in CONTRIBUTING.md.
      - name: Logo check (every tool has a mark)
        run: |
          cargo run -q --locked -p patchbay-cli -- status --json \
            | bun scripts/ci/logo-check.ts

      - name: Clippy (src-tauri)
        run: cargo clippy --all-targets --locked -- -D warnings
        working-directory: app/src-tauri

      - name: Build (src-tauri)
        run: cargo build --locked
        working-directory: app/src-tauri

  # patchbay-core on Linux, tests only.
  #
  # The paths the probes read are macOS-shaped (~/Library/..., Keychain notes)
  # and that is a deliberate product decision, not an accident — but it lives
  # in the *data*, not in the build: paths.rs has no `cfg(target_os)` branch,
  # it builds every location as a plain string under a home directory the
  # caller supplies, and the suite supplies a synthetic one. Nothing in core
  # shells out to a macOS binary at test time either; the Keychain calls in
  # keystore.rs are covered through MemoryKeystore.
  #
  # So the core suite is portable today, and this job is what keeps it that
  # way — it fails the moment someone reaches for a real $HOME, a `security`
  # invocation or a platform cfg inside core. It is not a claim that patchbay
  # runs on Linux; `pb`, the panel and the probes are still macOS-only, which
  # is why only this one crate is built here.
  linux-core:
    name: core (Linux)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          key: linux-core

      - name: Test
        run: cargo test -p patchbay-core --locked