Maple/.github/workflows/nightly.yml at master · MaplePrivacyLabs/Maple · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
# Nightly checks that ci.yml's scheduled run does not cover: Bun advisories
# and the SQLCipher provider suite on every OS. (ci.yml's
# nightly run re-checks the Rust advisories and pinned sources.)
# One `ci-nightly` issue reports failures here and in ci.yml's scheduled run;
# a green night closes it. Nothing here gates a pull request.
name: Nightly

on:
  schedule:
    - cron: "47 5 * * *" # after ci.yml's 04:17 run, so the report includes it
  workflow_dispatch: # a dry run: the report is printed, not written to the issue

permissions:
  contents: read

concurrency:
  group: nightly
  cancel-in-progress: false

jobs:
  bun-audit:
    name: Bun advisories
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-nix
      - name: Audit every Bun lockfile
        run: |
          # shellcheck disable=SC2016 # The child shell expands its own variables.
          nix develop --no-update-lock-file .#ci -c bash -uo pipefail -c '
            status=0
            for project in sdk apps/maple-research/frontend apps/maple-auth services/updates services/agent-updates; do
              echo "::group::$project"
              (cd "$project" && bun --no-env-file audit --audit-level=high) || status=1
              echo "::endgroup::"
            done
            exit "$status"'

  agent-provider:
    name: Agent provider (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, xcode-27, windows-latest]
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - if: runner.os != 'Windows'
        uses: ./.github/actions/setup-nix
      - name: Select pinned Xcode
        if: runner.os == 'macOS'
        run: python3 scripts/ci/select-xcode.py
      - if: runner.os == 'Windows'
        uses: ./.github/actions/setup-agent-windows
      - name: Test released rusqlite against the static provider
        run: python3 scripts/ci/plan.py run agent-provider

  report:
    name: Report
    needs: [bun-audit, agent-provider]
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
      actions: read # ci.yml's latest scheduled run
      issues: write # the single ci-nightly issue
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - name: Create, update or close the ci-nightly issue
        env:
          GH_TOKEN: ${{ github.token }}
          NEEDS: ${{ toJSON(needs) }}
          CI_QUARANTINE: ${{ vars.CI_QUARANTINE }}
          DRY_RUN: ${{ github.event_name != 'schedule' }}
        run: python3 scripts/ci/nightly_report.py