Repository navigation
chore: version packages #14
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Runs every conformance corpus rule's own fixtures, as a smoke test. | |
| # | |
| # ## Why this is its own workflow | |
| # | |
| # It is the one job here that deliberately executes a rule's `check.ts`. That | |
| # is arbitrary code by design — the runtime tier exists to run it — and a job | |
| # with that power should be readable as its own thing rather than buried as a | |
| # step inside a general one. | |
| # | |
| # ## Two honest caveats, so nobody reads more into this than it does | |
| # | |
| # **It does not block a merge.** Branch protection requires `Validate` and | |
| # nothing else, so a failure here is visible and advisory until someone adds | |
| # this check to the protection rule. That is the same reason the house-style | |
| # scan lives inside `validate.yml` rather than beside it. | |
| # | |
| # **It is the one place these rules' fixtures run.** The rules are the | |
| # conformance corpus published as `@taskless/cli/reference.json`, and | |
| # `test/reference.test.ts` only proves that payload matches the asset trees. | |
| # This job proves the trees themselves hold: it copies the manifest's own | |
| # written-path list, read straight off `assets/reference-*/`, into one bare project | |
| # and runs the engines over it. A corpus rule that fails its own cases would | |
| # hand another team a broken oracle. | |
| name: Reference corpus | |
| on: | |
| push: | |
| branches: [main] | |
| # No `branches:` filter, and `ready_for_review` named explicitly. See the long | |
| # note in `validate.yml`: a filtered workflow silently stopped running on | |
| # stacked PRs past a certain depth, and `ready_for_review` is not in the | |
| # default event set. | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| permissions: | |
| contents: read | |
| # This workflow runs the CLI this repository builds. Its telemetry is the same | |
| # production client a user's install has, so every invocation here would count | |
| # as adoption. Opting out is the CLI's own switch, read by the built binary. | |
| env: | |
| TASKLESS_TELEMETRY_DISABLED: "1" | |
| jobs: | |
| reference-corpus: | |
| name: Reference corpus | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version-file: .nvmrc | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build | |
| run: pnpm build | |
| # A bare project, not this repository. The runtime rule flags undeclared | |
| # `process.env` reads and the sg rule flags `eval`, so running these over | |
| # a checkout of the CLI would report the CLI's own code -- a scan of the | |
| # wrong tree that happens to produce output. | |
| - name: Stage every shipped rule in one bare project | |
| run: | | |
| set -euo pipefail | |
| PROJECT="$(mktemp -d)" | |
| echo "PROJECT=$PROJECT" >> "$GITHUB_ENV" | |
| git -C "$PROJECT" init -q | |
| node packages/cli/dist/index.js init -d "$PROJECT" | |
| # Engine, id and asset directory come from the manifest, so adding a | |
| # fourth sample needs no edit here. | |
| # The script writes the file itself. Redirecting its stdout here | |
| # captured pnpm's platform warnings alongside the manifest, and the | |
| # loop below then tried to stage a rule named "WARN". | |
| pnpm --filter @taskless/cli corpus:manifests /tmp/manifests.txt | |
| cat /tmp/manifests.txt | |
| # The trailing field is the manifest's own written-path list, so this | |
| # stages exactly the rule and its cases. A `cp -R` of the asset | |
| # directory would also land `prompt.md`, the generation request, and | |
| # this job would be judging a tree no generator is asked to produce. | |
| while read -r engine ruleId assetDir paths; do | |
| [ -z "$engine" ] && continue | |
| RULE="$PROJECT/.taskless/rules/$engine/$ruleId" | |
| for path in $paths; do | |
| mkdir -p "$RULE/$(dirname "$path")" | |
| cp "packages/cli/assets/$assetDir/$path" "$RULE/$path" | |
| done | |
| echo "staged $engine/$ruleId" | |
| done < /tmp/manifests.txt | |
| - name: Validate | |
| run: node packages/cli/dist/index.js validate -d "$PROJECT" | |
| # `--dangerously-run-scripts` is the whole point of this job: without it | |
| # the fixtures do not run, and `verify` says so rather than reporting a | |
| # pass. A green run here means they executed. | |
| - name: Run every rule's fixtures | |
| run: | | |
| set -euo pipefail | |
| node packages/cli/dist/index.js verify --json --dangerously-run-scripts -d "$PROJECT" | tee /tmp/report.json | |
| node -e ' | |
| const report = JSON.parse(require("fs").readFileSync("/tmp/report.json", "utf8")); | |
| const expected = require("fs").readFileSync("/tmp/manifests.txt", "utf8") | |
| .split("\n").filter(Boolean).map((line) => line.split(" ")[1]); | |
| for (const id of expected) { | |
| const rule = report.rules.find((r) => r.ruleId === id); | |
| if (!rule) throw new Error("no report for " + id); | |
| // `ran` as well as `ok`: a rule reporting a pass for fixtures | |
| // that never executed is the defect these runners exist to catch. | |
| if (rule.ran !== true) throw new Error(id + " fixtures did not run: " + JSON.stringify(rule)); | |
| if (rule.ok !== true) throw new Error(id + " fixtures failed: " + JSON.stringify(rule.errors)); | |
| } | |
| console.log("all " + expected.length + " reference rules ran and passed"); | |
| ' |