feat(eve-sandbox): add a Coder workspace backend for Vercel's eve framework #46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| # PRs are covered by `pull_request`; the merge queue by `merge_group`. | |
| # Scoping `push` to main avoids a duplicate run on every PR branch | |
| # (push + pull_request) while still validating main after a queue merge. | |
| push: | |
| branches: [main] | |
| pull_request: | |
| merge_group: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| # One in-flight run per PR (or per ref elsewhere); cancel superseded PR runs. | |
| group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| build: | |
| name: Lint, typecheck, test, build (Node ${{ matrix.node }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # sandbox engines.node >=22 is the binding floor; agent (>=20) runs fine | |
| # on these. 26.3.0 matches the version pinned in mise.toml. | |
| node: ["22", "24", "26.3.0"] | |
| env: | |
| # Override the node version per matrix cell. MISE_LOCKFILE=false disables | |
| # mise's locked mode for this job: mise.lock only pins node 26.3.0, so the | |
| # 22/24 cells aren't in the lock and locked mode would refuse them. Tool | |
| # versions still come from mise.toml; the lock stays authoritative for local | |
| # dev and the (un-overridden) lint-workflows job below. | |
| MISE_NODE_VERSION: ${{ matrix.node }} | |
| MISE_LOCKFILE: "false" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Set up mise | |
| uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4 | |
| with: | |
| # Don't auto-install: the action force-adds `--locked` when a lockfile | |
| # is present, which fails for matrix node versions not in the lock. | |
| install: false | |
| - name: Install node and pnpm via mise | |
| run: mise install node pnpm | |
| - name: Resolve pnpm store path | |
| run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV" | |
| - name: Cache pnpm store | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: ${{ env.STORE_PATH }} | |
| key: ${{ runner.os }}-node${{ matrix.node }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-node${{ matrix.node }}-pnpm- | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Lint | |
| run: pnpm lint | |
| - name: Check formatting | |
| run: pnpm format:check | |
| # Build before typecheck and test: a package may depend on a sibling workspace | |
| # package's built output/types (e.g. @coder/ai-sdk-eve-sandbox imports | |
| # @coder/ai-sdk-sandbox). `pnpm -r build` runs in topological order, so each | |
| # dependency's dist/ exists before its dependents are typechecked, tested, or built. | |
| - name: Build | |
| run: pnpm build | |
| - name: Typecheck | |
| run: pnpm typecheck | |
| - name: Test | |
| run: pnpm test | |
| # ESM-only publish gates — sandbox + provider (the root scripts --filter them). | |
| # Run after build so dist/ exists. | |
| - name: Publint (sandbox, provider) | |
| run: pnpm publint | |
| - name: Are the types wrong? (sandbox, provider) | |
| run: pnpm attw | |
| lint-workflows: | |
| name: Lint workflows (actionlint + zizmor) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Install tools via mise | |
| uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4 | |
| - name: actionlint | |
| run: actionlint | |
| - name: zizmor | |
| run: zizmor .github/workflows | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| # Single, stable required status check. The branch ruleset requires exactly | |
| # one context named "Required"; it aggregates every other job, so it stays | |
| # valid no matter how the matrix or job list changes — 'success' only if all | |
| # passed. Runs in the merge queue (merge_group) too. | |
| Required: | |
| name: Required | |
| if: ${{ always() }} | |
| needs: [build, lint-workflows] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Verify all jobs succeeded | |
| env: | |
| BUILD_RESULT: ${{ needs.build.result }} | |
| LINT_RESULT: ${{ needs.lint-workflows.result }} | |
| run: | | |
| echo "build=$BUILD_RESULT lint-workflows=$LINT_RESULT" | |
| test "$BUILD_RESULT" = "success" | |
| test "$LINT_RESULT" = "success" |