flowkit/.github/workflows/ci.yml at main · devcodex-labs/flowkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:
  workflow_call:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    name: ${{ matrix.os }} / Node ${{ matrix.node }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, windows-2025]
        node: ['22.13.0', '24.22.1']
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: ${{ matrix.node }}
          cache: npm
          cache-dependency-path: package-lock.json
      - name: Install locked dependencies
        run: npm ci --ignore-scripts --no-audit --no-fund
      - name: Build, test, types and real tarball consumption
        run: |
          # Type rejection fixtures retain diagnostics in JSON evidence.
          echo "::remove-matcher owner=tsc::"
          npm run verify
      - name: Measure repeated Interactive Program loads (diagnostic, Ubuntu Node 24)
        if: ${{ matrix.os == 'ubuntu-24.04' && matrix.node == '24.22.1' }}
        run: node scripts/bench-interactive-load.mjs
      - name: Measure Interactive ledger writes and verify reopened receipt history
        if: ${{ matrix.os == 'ubuntu-24.04' && matrix.node == '24.22.1' }}
        run: node scripts/bench-interactive-ledger.mjs
      - name: Consume candidate package through all documentation examples
        env:
          FLOWKIT_DOCS_EVIDENCE: .tmp/docs/candidate.json
        run: npm run docs:examples
      - name: Keep documentation consumer evidence
        if: always()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: docs-consumer-${{ matrix.os }}-${{ matrix.node }}
          path: .tmp/docs/candidate.json
          include-hidden-files: true
          if-no-files-found: ignore
          retention-days: 14
      - name: Keep declaration evidence
        if: always()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: types-${{ matrix.os }}-${{ matrix.node }}
          path: .tmp/types/results.json
          include-hidden-files: true
          if-no-files-found: ignore
          retention-days: 14

  host-security-isolation:
    name: Host OS-user isolation / Node ${{ matrix.node }}
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        node: ['22.13.0', '24.22.1']
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: ${{ matrix.node }}
      - name: Install locked dependencies for M6 Host integration
        run: npm ci --ignore-scripts --no-audit --no-fund
      - name: Prove cross-UID model worker cannot read Host key or SQLite DB
        run: node tests/security/host-isolation.mjs
      - name: Verify the disposable Linux Host profile
        if: ${{ matrix.node == '24.22.1' }}
        run: sudo -n "$(command -v node)" tests/security/secure-host-linux.mjs
      - name: Prove M6 Host and isolated worker integration
        env:
          FLOWKIT_M6_ISOLATION: '1'
        run: node --test tests/integration/m6-e2e.test.mjs

  host-security-windows-profile:
    name: Host OS-user isolation / Windows
    runs-on: windows-2025
    timeout-minutes: 8
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: '24.22.1'
      - name: Verify the disposable Windows Host profile
        shell: powershell
        run: .\tests\security\secure-host-windows.ps1 -Node (Get-Command node.exe).Source -DisposableRunner

  website:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: '24.22.1'
          cache: npm
          cache-dependency-path: |
            package-lock.json
            website/package-lock.json
      - run: npm ci --ignore-scripts --no-audit --no-fund
      - run: npm --prefix website ci --ignore-scripts --no-audit --no-fund
      - run: npm run build
      - run: npm run docs:check
      - run: npm run docs:build
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: website-preview
          path: website/doc_build
          if-no-files-found: error
          retention-days: 14