spike(plugins): plugin system prototype + voice-driven meme generator — DO NOT MERGE #609
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| test: | |
| # Covers the pure-logic unit tests AND the Tier-1 E2E audio suite | |
| # (FileAudioCapture + fixture-driven pipeline tests), which are plain | |
| # `swift test` with a scripted engine — no submodules, no WhisperKit. The | |
| # heavier real-engine Tier-2 job lives in e2e-nightly.yml. See | |
| # docs/E2E_AUDIO_TESTING.md. | |
| name: swift test (core logic) | |
| runs-on: macos-14 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Select Xcode | |
| # Third-party action pinned by commit SHA (v1.6.0) so a moved tag can't | |
| # run unreviewed code in CI. latest-stable (not a hard version) on | |
| # purpose: runner images rotate Xcode versions, and the manifest's | |
| # swift-tools-version 6.0 already enforces the real floor (Xcode >= 16) | |
| # by failing loudly if the image's stable Xcode is somehow too old. | |
| uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0 | |
| with: | |
| xcode-version: latest-stable | |
| - name: Show Swift version | |
| run: swift --version | |
| - name: Run unit tests | |
| run: swift test | |
| appcast: | |
| # Verifies the Sparkle appcast generator (MAK-56) end-to-end with a throwaway | |
| # key + dummy DMG: well-formed XML, correct enclosure metadata, and a | |
| # signature that verifies. No secrets, no real signing. See | |
| # scripts/test-gen-appcast.sh. | |
| name: appcast generator self-test | |
| runs-on: macos-14 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run appcast generator self-test | |
| run: ./scripts/test-gen-appcast.sh | |
| build-app: | |
| # Compiles the REAL mac app target — AppState, the 41 IO services, and every | |
| # SwiftUI view — which `swift test` (OpenWhispCore only) never touches. This | |
| # catches type errors in the AppKit/SwiftUI layer before they reach a release | |
| # build (MAK-63). | |
| # | |
| # Runs in the LEAN configuration (WHISPERKIT=0 PARAKEET=0): this is the ONE | |
| # sanctioned use of WHISPERKIT=0 — CI only. Lean mode swaps WhisperKit / | |
| # FluidAudio for stub engines, so it skips the WhisperKit fork checkout and | |
| # the long CoreML/native builds while STILL type-checking all the app source | |
| # (the engine protocol seam is identical). Sparkle stays ON (default) so its | |
| # updater service compiles too — it's just a cached prebuilt download, not a | |
| # native build. No git submodules are needed in lean mode (whisper.cpp / | |
| # llama.cpp are only pulled in by the full-fat engine builds), so checkout | |
| # stays shallow and fast. | |
| name: build mac app (lean) | |
| runs-on: macos-14 | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Select Xcode | |
| # Third-party action pinned by commit SHA (v1.6.0) so a moved tag can't | |
| # run unreviewed code in CI. latest-stable (not a hard version) on | |
| # purpose: runner images rotate Xcode versions, and the manifest's | |
| # swift-tools-version 6.0 already enforces the real floor (Xcode >= 16). | |
| uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0 | |
| with: | |
| xcode-version: latest-stable | |
| - name: Show Swift version | |
| run: swift --version | |
| - name: Cache Sparkle framework | |
| # fetch-sparkle.sh downloads a PINNED, checksum-verified prebuilt Sparkle | |
| # into build/sparkle/<version>/. Cache it keyed on the workflow file so a | |
| # version bump (which edits fetch-sparkle.sh -> not the key) still | |
| # re-verifies via the script's own checksum gate, and the cache is reused | |
| # across runs to avoid the network round-trip. | |
| uses: actions/cache@v4 | |
| with: | |
| path: build/sparkle | |
| key: sparkle-${{ runner.os }}-${{ hashFiles('scripts/fetch-sparkle.sh') }} | |
| - name: Build mac app (lean, WHISPERKIT=0 PARAKEET=0) | |
| run: WHISPERKIT=0 PARAKEET=0 ./build.sh | |
| ios-libraries: | |
| # Guards the iOS consumability of the library products (MAK-51): a | |
| # visibility or platform regression in core must not break the iPhone | |
| # companion, which depends on these two products. | |
| name: build OpenWhispCore + BridgeKit (iOS) | |
| runs-on: macos-15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Select Xcode | |
| # Third-party action pinned by commit SHA (v1.6.0) so a moved tag can't | |
| # run unreviewed code in CI. latest-stable (not a hard version) on | |
| # purpose: runner images rotate Xcode versions, and the manifest's | |
| # swift-tools-version 6.0 already enforces the real floor (Xcode >= 16) | |
| # by failing loudly if the image's stable Xcode is somehow too old. | |
| uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0 | |
| with: | |
| xcode-version: latest-stable | |
| - name: Build OpenWhispCore for iOS | |
| run: xcodebuild -scheme OpenWhispCore -destination 'generic/platform=iOS' build | |
| - name: Build OpenWhispBridgeKit for iOS | |
| run: xcodebuild -scheme OpenWhispBridgeKit -destination 'generic/platform=iOS' build | |
| appstate-ratchet: | |
| # AppState decomposition ratchet (MAK-32): fails if the tracked AppState | |
| # source (AppState.swift + AppState+*.swift extensions) exceeds the checked-in | |
| # high-water mark in scripts/appstate-loc-budget.txt. Keeps the god-object | |
| # from silently regrowing while the strangler epic shrinks it. Pure text/LOC | |
| # check — no toolchain, runs on Linux in seconds. | |
| name: AppState LOC ratchet | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Check AppState LOC ratchet | |
| run: ./scripts/check-appstate-ratchet.sh | |
| third-party-pins: | |
| # Supply-chain hygiene gate (MAK-64): every third_party/ submodule must be | |
| # pinned to an upstream release tag (or be allowlisted with a reason), and | |
| # any personal-fork dependency (initcore0/*) must carry a third_party/PATCHES.md | |
| # entry documenting its delta. Fast + network-free — it only inspects | |
| # .gitmodules, the checked-out submodule git state, and the *-dep manifests. | |
| name: third_party pin hygiene | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # Need submodules + their tags so `git describe --tags` can prove each | |
| # pin is tag-reachable, entirely offline (no clones at check time). | |
| submodules: true | |
| fetch-depth: 0 | |
| - name: Fetch submodule tags | |
| run: git submodule foreach 'git fetch --tags --quiet origin || true' | |
| - name: Check third_party pins | |
| run: ./scripts/check-third-party-pins.sh |