calnode/.github/workflows/ci.yml at main · Calnode/calnode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: CI

# Type-checks the SvelteKit admin app (svelte-check) and builds + tests the Go backend on every
# push to main and on PRs. The Go binary go:embeds frontend/build, so the frontend is built first
# (otherwise `go build` fails on the missing embed dir). modernc SQLite is pure-Go → no CGO/C
# toolchain needed.
on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      # Full history, because the CLA check below needs the fork point of the pull
      # request, not just the tip of the base branch. The repository is small.
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      # The CLA signature ledger may only grow. Signatures live in
      # signatures/version1/cla.json, committed to main, and the contributor-assistant action
      # only ever appends to it. This step makes that invariant enforced rather than assumed:
      # no pull request may drop a contributor who had already signed. It matters because
      # cla.yml no longer locks merged PRs (see the comment there), so the ledger is the
      # guarantee rather than the locked conversation.
      - name: CLA ledger is append-only
        if: github.event_name == 'pull_request'
        run: |
          set -euo pipefail
          ledger=signatures/version1/cla.json
          base="origin/${{ github.base_ref }}"
          git fetch --no-tags origin "${{ github.base_ref }}"
          # Compare against the FORK POINT, not the tip of the base branch. Signatures
          # are committed to main by the CLA bot, so any signature added after a pull
          # request was opened is absent from its head by construction. Comparing with
          # today's main tip calls that "removed" and fails every older PR; comparing
          # with the merge base only sees entries the PR's own branch had.
          merge_base=$(git merge-base HEAD "$base" 2>/dev/null || true)
          if [ -z "$merge_base" ]; then
            echo "::warning::no merge base with $base (shallow clone?); skipping the append-only check"
            exit 0
          fi
          # Bootstrap case: if the fork point has no ledger yet, there is nothing to protect.
          if ! git cat-file -e "${merge_base}:${ledger}" 2>/dev/null; then
            echo "No CLA ledger at the fork point; nothing to protect yet."
            exit 0
          fi
          git show "${merge_base}:${ledger}" > /tmp/cla-base.json
          python3 - <<'PY'
          import json, sys

          def load(path):
              with open(path, encoding="utf-8") as handle:
                  return json.load(handle)["signedContributors"]

          base = load("/tmp/cla-base.json")
          head = load("signatures/version1/cla.json")
          # id is stable across a login rename; name is only for the message.
          base_by_id = {entry["id"]: entry.get("name", "?") for entry in base}
          head_ids = {entry["id"] for entry in head}
          removed = [f"{name} (id {sid})" for sid, name in base_by_id.items() if sid not in head_ids]
          if removed:
              sys.exit("CLA signatures may not be revoked, but these were removed: " + ", ".join(removed))
          print(f"CLA ledger append-only: {len(base_by_id)} signed at base, {len(head_ids)} now, none removed")
          PY

      - uses: pnpm/action-setup@v6
        with:
          version: 10.32.1

      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: frontend/pnpm-lock.yaml

      - name: Install frontend deps
        working-directory: frontend
        run: pnpm install --frozen-lockfile

      - name: svelte-check (frontend types)
        working-directory: frontend
        run: pnpm check

      - name: Build frontend (required by the Go embed)
        working-directory: frontend
        run: pnpm build

      # The unit tests above the browser do not exist: this suite mounts components in
      # a real Chromium and asserts COMPUTED STYLES, which is the only thing that
      # catches a bits-ui data-state that lost its @custom-variant remap. Logic stays
      # green while the component renders unstyled, so a type check and a build cannot
      # see it. It needs the browser binary, which is not in the pnpm store.
      - name: Install the browser for visual tests
        working-directory: frontend
        run: pnpm exec playwright install --with-deps chromium

      - name: Visual smoke tests (computed styles in a real browser)
        working-directory: frontend
        run: pnpm test:visual

      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: gofmt check
        run: |
          fmtout=$(gofmt -l .)
          if [ -n "$fmtout" ]; then
            echo "The following files are not gofmt'd:"
            echo "$fmtout"
            echo "Run: gofmt -w ."
            exit 1
          fi

      - name: go vet
        run: go vet ./...

      - name: go build
        run: go build ./...

      - name: go test
        run: go test ./...

      # Informational, never fails: the tests in internal/i18n are the gate. This prints
      # per-language coverage so a translation PR shows up in the log with its progress,
      # and so a language falling under the floor is visible before a user meets it.
      - name: Translation coverage
        run: go run ./cmd/i18n-coverage