dotfiles/.github/workflows/ci.yml at main · edmundmiller/dotfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  # Run flake checks on Linux (NixOS configurations)
  check-linux:
    name: Flake Check (Linux)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - name: Run changed packages/pi-packages QA
        shell: bash
        run: |
          set -euo pipefail

          if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
            base_sha="${{ github.event.pull_request.base.sha }}"
          else
            base_sha="${{ github.event.before }}"
          fi

          if [[ "$base_sha" == "0000000000000000000000000000000000000000" ]]; then
            base_sha="$(git rev-list --max-parents=0 HEAD)"
          fi

          ./bin/qa-changed --base-ref "$base_sha" --head-ref "${{ github.sha }}"
      - uses: DeterminateSystems/nix-installer-action@main
      - uses: DeterminateSystems/magic-nix-cache-action@main
      - uses: DeterminateSystems/flake-checker-action@main

      - name: Run flake checks
        run: |
          # Check x86_64-linux specific outputs
          echo "::group::treefmt" && time nix build .#checks.x86_64-linux.treefmt --no-link && echo "::endgroup::"
          echo "::group::pre-commit" && time nix build .#checks.x86_64-linux.pre-commit --no-link && echo "::endgroup::"
          echo "::group::zunit-tests" && time nix build .#checks.x86_64-linux.zunit-tests --no-link && echo "::endgroup::"
          echo "::group::package-harness-tests" && time nix build .#checks.x86_64-linux.package-harness-tests --no-link && echo "::endgroup::"

      - name: Validate agent documentation contract
        shell: bash
        run: |
          set -euo pipefail
          if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
            base_sha="${{ github.event.pull_request.base.sha }}"
          else
            base_sha="${{ github.event.before }}"
          fi
          if [[ "$base_sha" == "0000000000000000000000000000000000000000" ]]; then
            base_sha="$(git rev-list --max-parents=0 HEAD)"
          fi

          docs=(AGENTS.md AGENT_WORKFLOW.md docs/README.md)
          while IFS= read -r doc; do
            case "$doc" in
              docs/agent-quality.md) ;;
              docs/*.md | */AGENTS.md) docs+=("$doc") ;;
            esac
          done < <(git diff --name-only --diff-filter=ACMR "$base_sha" "${{ github.sha }}" -- '*.md')

          for doc in "${docs[@]}"; do
            summary="$(head -n 7 "$doc")"
            for key in purpose applies_to entrypoint verification update_when; do
              grep -q "^${key}:" <<<"$summary" || { echo "FAIL: $doc missing $key in first 7 lines"; exit 1; }
            done
            test "$(sed -n '7p' "$doc")" = "---" || { echo "FAIL: $doc summary must close on line 7"; exit 1; }
          done

      - name: Skip NixOS config eval
        run: |
          echo "Skipping nuc eval in CI; openclaw-workspace is private"

  # Run flake checks on macOS (Darwin configurations)
  check-darwin:
    name: Flake Check (Darwin)
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - name: Run changed packages/pi-packages QA
        shell: bash
        run: |
          set -euo pipefail

          if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
            base_sha="${{ github.event.pull_request.base.sha }}"
          else
            base_sha="${{ github.event.before }}"
          fi

          if [[ "$base_sha" == "0000000000000000000000000000000000000000" ]]; then
            base_sha="$(git rev-list --max-parents=0 HEAD)"
          fi

          ./bin/qa-changed --base-ref "$base_sha" --head-ref "${{ github.sha }}"
      - uses: DeterminateSystems/nix-installer-action@main
      - uses: DeterminateSystems/magic-nix-cache-action@main

      - name: Run flake checks
        run: |
          # Check aarch64-darwin specific outputs
          echo "::group::treefmt" && time nix build .#checks.aarch64-darwin.treefmt --no-link && echo "::endgroup::"
          echo "::group::pre-commit" && time nix build .#checks.aarch64-darwin.pre-commit --no-link && echo "::endgroup::"
          echo "::group::zunit-tests" && time nix build .#checks.aarch64-darwin.zunit-tests --no-link && echo "::endgroup::"
          echo "::group::package-harness-tests" && time nix build .#checks.aarch64-darwin.package-harness-tests --no-link && echo "::endgroup::"

      - name: Check Darwin configurations evaluate
        run: |
          time nix eval .#darwinConfigurations.MacTraitor-Pro.system --apply 'x: "OK"'
          time nix eval .#darwinConfigurations.Seqeratop.system --apply 'x: "OK"'

  # Formatting check (runs on Linux, faster)
  format:
    name: Check Formatting
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: DeterminateSystems/nix-installer-action@main
      - uses: DeterminateSystems/magic-nix-cache-action@main

      - name: Check formatting
        run: time nix build .#checks.x86_64-linux.treefmt --no-link