Skip to content

spike(plugins): plugin system prototype + voice-driven meme generator — DO NOT MERGE #609

spike(plugins): plugin system prototype + voice-driven meme generator — DO NOT MERGE

spike(plugins): plugin system prototype + voice-driven meme generator — DO NOT MERGE #609

Workflow file for this run

name: CI
on:
push:
branches: [main]
pull_request:
jobs:
test:
# Covers the pure-logic unit tests AND the Tier-1 E2E audio suite
# (FileAudioCapture + fixture-driven pipeline tests), which are plain
# `swift test` with a scripted engine — no submodules, no WhisperKit. The
# heavier real-engine Tier-2 job lives in e2e-nightly.yml. See
# docs/E2E_AUDIO_TESTING.md.
name: swift test (core logic)
runs-on: macos-14
steps:
- uses: actions/checkout@v4
- name: Select Xcode
# Third-party action pinned by commit SHA (v1.6.0) so a moved tag can't
# run unreviewed code in CI. latest-stable (not a hard version) on
# purpose: runner images rotate Xcode versions, and the manifest's
# swift-tools-version 6.0 already enforces the real floor (Xcode >= 16)
# by failing loudly if the image's stable Xcode is somehow too old.
uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
with:
xcode-version: latest-stable
- name: Show Swift version
run: swift --version
- name: Run unit tests
run: swift test
appcast:
# Verifies the Sparkle appcast generator (MAK-56) end-to-end with a throwaway
# key + dummy DMG: well-formed XML, correct enclosure metadata, and a
# signature that verifies. No secrets, no real signing. See
# scripts/test-gen-appcast.sh.
name: appcast generator self-test
runs-on: macos-14
steps:
- uses: actions/checkout@v4
- name: Run appcast generator self-test
run: ./scripts/test-gen-appcast.sh
build-app:
# Compiles the REAL mac app target — AppState, the 41 IO services, and every
# SwiftUI view — which `swift test` (OpenWhispCore only) never touches. This
# catches type errors in the AppKit/SwiftUI layer before they reach a release
# build (MAK-63).
#
# Runs in the LEAN configuration (WHISPERKIT=0 PARAKEET=0): this is the ONE
# sanctioned use of WHISPERKIT=0 — CI only. Lean mode swaps WhisperKit /
# FluidAudio for stub engines, so it skips the WhisperKit fork checkout and
# the long CoreML/native builds while STILL type-checking all the app source
# (the engine protocol seam is identical). Sparkle stays ON (default) so its
# updater service compiles too — it's just a cached prebuilt download, not a
# native build. No git submodules are needed in lean mode (whisper.cpp /
# llama.cpp are only pulled in by the full-fat engine builds), so checkout
# stays shallow and fast.
name: build mac app (lean)
runs-on: macos-14
timeout-minutes: 15
steps:
- uses: actions/checkout@v4
- name: Select Xcode
# Third-party action pinned by commit SHA (v1.6.0) so a moved tag can't
# run unreviewed code in CI. latest-stable (not a hard version) on
# purpose: runner images rotate Xcode versions, and the manifest's
# swift-tools-version 6.0 already enforces the real floor (Xcode >= 16).
uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
with:
xcode-version: latest-stable
- name: Show Swift version
run: swift --version
- name: Cache Sparkle framework
# fetch-sparkle.sh downloads a PINNED, checksum-verified prebuilt Sparkle
# into build/sparkle/<version>/. Cache it keyed on the workflow file so a
# version bump (which edits fetch-sparkle.sh -> not the key) still
# re-verifies via the script's own checksum gate, and the cache is reused
# across runs to avoid the network round-trip.
uses: actions/cache@v4
with:
path: build/sparkle
key: sparkle-${{ runner.os }}-${{ hashFiles('scripts/fetch-sparkle.sh') }}
- name: Build mac app (lean, WHISPERKIT=0 PARAKEET=0)
run: WHISPERKIT=0 PARAKEET=0 ./build.sh
ios-libraries:
# Guards the iOS consumability of the library products (MAK-51): a
# visibility or platform regression in core must not break the iPhone
# companion, which depends on these two products.
name: build OpenWhispCore + BridgeKit (iOS)
runs-on: macos-15
steps:
- uses: actions/checkout@v4
- name: Select Xcode
# Third-party action pinned by commit SHA (v1.6.0) so a moved tag can't
# run unreviewed code in CI. latest-stable (not a hard version) on
# purpose: runner images rotate Xcode versions, and the manifest's
# swift-tools-version 6.0 already enforces the real floor (Xcode >= 16)
# by failing loudly if the image's stable Xcode is somehow too old.
uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
with:
xcode-version: latest-stable
- name: Build OpenWhispCore for iOS
run: xcodebuild -scheme OpenWhispCore -destination 'generic/platform=iOS' build
- name: Build OpenWhispBridgeKit for iOS
run: xcodebuild -scheme OpenWhispBridgeKit -destination 'generic/platform=iOS' build
appstate-ratchet:
# AppState decomposition ratchet (MAK-32): fails if the tracked AppState
# source (AppState.swift + AppState+*.swift extensions) exceeds the checked-in
# high-water mark in scripts/appstate-loc-budget.txt. Keeps the god-object
# from silently regrowing while the strangler epic shrinks it. Pure text/LOC
# check — no toolchain, runs on Linux in seconds.
name: AppState LOC ratchet
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Check AppState LOC ratchet
run: ./scripts/check-appstate-ratchet.sh
third-party-pins:
# Supply-chain hygiene gate (MAK-64): every third_party/ submodule must be
# pinned to an upstream release tag (or be allowlisted with a reason), and
# any personal-fork dependency (initcore0/*) must carry a third_party/PATCHES.md
# entry documenting its delta. Fast + network-free — it only inspects
# .gitmodules, the checked-out submodule git state, and the *-dep manifests.
name: third_party pin hygiene
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
# Need submodules + their tags so `git describe --tags` can prove each
# pin is tag-reachable, entirely offline (no clones at check time).
submodules: true
fetch-depth: 0
- name: Fetch submodule tags
run: git submodule foreach 'git fetch --tags --quiet origin || true'
- name: Check third_party pins
run: ./scripts/check-third-party-pins.sh