docs(www,tools): B2.3 website qualification on the v0.44 product surf… #1649
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: AutoFlow CI | |
| on: | |
| push: | |
| branches: [main, dev] | |
| pull_request: | |
| branches: [main, dev] | |
| workflow_call: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| dependency-review: | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| # v5.0.0 | |
| - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 | |
| with: | |
| fail-on-severity: high | |
| autoflow-ci: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| # v7.0.1 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| # #1156 R11: test the exact attested SHA — the PR head on | |
| # pull_request, github.sha on push/workflow_call/workflow_dispatch — | |
| # never checkout's default synthetic merge ref. | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| # #1156 (B2.6): mature OSS governance gates (ADR-0144) — fail fast, | |
| # before the heavy matrix. Binaries pinned by version + SHA-256; | |
| # zizmor-action pinned in tools/check-action-pins.ts. | |
| - name: actionlint (workflow lint) | |
| run: | | |
| curl -sSfL -o /tmp/actionlint.tar.gz \ | |
| https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz | |
| echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 /tmp/actionlint.tar.gz" | sha256sum -c - | |
| tar -xzf /tmp/actionlint.tar.gz -C /tmp actionlint | |
| /tmp/actionlint -color | |
| # v0.6.3 | |
| - uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 | |
| with: | |
| # Offline audits only: this gate must be deterministic and | |
| # reproducible locally (`zizmor --offline .github/workflows | |
| # .github/actions`); network-dependent audits stay out of CI. | |
| online-audits: false | |
| advanced-security: false | |
| version: '1.30.0' | |
| - name: gitleaks (secret scan) | |
| run: | | |
| curl -sSfL -o /tmp/gitleaks.tar.gz \ | |
| https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | |
| echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb /tmp/gitleaks.tar.gz" | sha256sum -c - | |
| tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks | |
| /tmp/gitleaks git --redact --verbose . | |
| - uses: ./.github/actions/setup-deno-workspace | |
| # ADR-0144 / #1229 (B2.7): generic toolchain gates are pinned OSS tool steps, not AutoFlow gates. | |
| - run: deno fmt --check | |
| - run: deno lint | |
| - run: deno task lint:markdown | |
| - run: deno task typecheck | |
| - name: Install Playwright browsers | |
| # All three engines up front: the gate's fixture:request-time:gate | |
| # runs the request-time fixture suite on Chromium, Firefox and WebKit. | |
| run: ./node_modules/.bin/playwright install --with-deps chromium firefox webkit | |
| - name: AutoFlow3 CI gate | |
| run: deno task autoflow:ci | |
| # Issue #628 (first slice): the generated dist/server artifact must boot | |
| # under plain Node, not just under the Deno CLI (#969). The runtime floor | |
| # is Node.js >= 24 (WHATWG URLPattern global), so the matrix asserts real | |
| # serving on 24 and the clean early error on 20. | |
| node-serve-smoke: | |
| name: dist/server Node smoke (Node ${{ matrix.node }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node: ['20', '24'] | |
| steps: | |
| # v7.0.1 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| # #1156 R11: same exact-SHA expression as every required job. | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| persist-credentials: false | |
| - uses: ./.github/actions/setup-deno-workspace | |
| # v7.0.0 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 | |
| with: | |
| node-version: ${{ matrix.node }} | |
| - name: Build the request-time fixture | |
| run: deno task fixture:request-time:build | |
| - name: Shim @openelement/adapter-vite/nitro-mount for Node resolution | |
| # The workspace publishes to JSR, so plain Node cannot resolve the | |
| # bare specifier the generated index.js imports. Materialize the | |
| # exact nitro-mount an npm consumer would get, transpiled from the | |
| # real source (type-only imports drop out). The shim lives under | |
| # dist/node_modules: on Node's resolution path from | |
| # dist/server/index.js, but invisible to the fixture's own Vite | |
| # config resolution (which walks up from the fixture root). | |
| run: | | |
| shim=packages/adapter-vite/__fixtures__/request-time/dist/node_modules/@openelement/adapter-vite | |
| mkdir -p "$shim" | |
| ./node_modules/.bin/esbuild packages/adapter-vite/src/nitro-mount.ts \ | |
| --format=esm --outfile="$shim/nitro-mount.js" | |
| printf '{ "name": "@openelement/adapter-vite", "version": "0.0.0-smoke", "type": "module", "exports": { "./nitro-mount": "./nitro-mount.js" } }\n' \ | |
| > "$shim/package.json" | |
| - name: Boot dist/server/serve.mjs under Node ${{ matrix.node }} | |
| working-directory: packages/adapter-vite/__fixtures__/request-time | |
| run: | | |
| set -u | |
| if [ "${{ matrix.node }}" = "24" ]; then | |
| OPEN_ELEMENT_PORT=4891 OPEN_ELEMENT_HOST=127.0.0.1 node dist/server/serve.mjs & | |
| server_pid=$! | |
| trap 'kill $server_pid 2>/dev/null || true' EXIT | |
| for _ in $(seq 1 50); do | |
| curl -sf -o /dev/null http://127.0.0.1:4891/ && break | |
| sleep 0.2 | |
| done | |
| curl -sf http://127.0.0.1:4891/ | grep -q 'request-time fixture home' | |
| curl -sf http://127.0.0.1:4891/live | grep -q 'request-time live' | |
| else | |
| # Below the URLPattern floor (#969): serve.mjs must fail fast | |
| # with guidance, not a SyntaxError/ReferenceError. | |
| if node dist/server/serve.mjs > serve-error.log 2>&1; then | |
| echo 'expected a clean early exit below the runtime floor' | |
| exit 1 | |
| fi | |
| grep -q 'requires a runtime with WHATWG URLPattern' serve-error.log | |
| fi | |
| # #1276 (B1.3-F1): the definePage route SSR tag-mismatch defect shipped | |
| # because the workspace runtime qualification was not CI-gated. Run the full | |
| # qualification leg (starter build -> Node 24 standalone + Wrangler workerd, | |
| # byte-identical HTML across both) as a required CI job so this defect class | |
| # cannot regress silently. Needs real Node 24 (the serve.mjs runtime floor, | |
| # #969) — the autoflow-ci job itself has no Node setup. | |
| workspace-qualification: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| # v7.0.1 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| # #1156 R11: same exact-SHA expression as every required job. | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| persist-credentials: false | |
| - uses: ./.github/actions/setup-deno-workspace | |
| # v7.0.0 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 | |
| with: | |
| node-version: '24' | |
| - name: Workspace runtime qualification (Node 24 + workerd) | |
| run: deno task fullstack:workspace-qualification | |
| # #1156 (ADR-0146): one deterministic exact-SHA PR full-CI evidence artifact. | |
| # This job runs only for pull requests and only after every required | |
| # full-matrix job succeeded (default needs gating — no `if: always()`), so a | |
| # failed, skipped or cancelled matrix leg produces no artifact at all. The | |
| # record is derived from trusted workflow context (github.* / needs.*), | |
| # never from user-controlled inputs; the release lane independently resolves | |
| # the run through the GitHub API before trusting any field. | |
| pr-full-ci-evidence: | |
| name: pr-full-ci-evidence | |
| if: github.event_name == 'pull_request' | |
| needs: [dependency-review, autoflow-ci, node-serve-smoke, workspace-qualification] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| steps: | |
| # v7.0.1 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| # #1156 R11: the aggregation job checks out the exact SHA it attests. | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| persist-credentials: false | |
| - uses: ./.github/actions/setup-deno-workspace | |
| - name: Write exact-SHA PR CI evidence record | |
| env: | |
| # R11: one trusted expression for checkout, attestation and naming. | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| RUN_ID: ${{ github.run_id }} | |
| RUN_ATTEMPT: ${{ github.run_attempt }} | |
| REPOSITORY: ${{ github.repository }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| NEEDS_JSON: ${{ toJSON(needs) }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| run: deno run --allow-env --allow-write tools/autoflow/write-pr-ci-evidence.ts | |
| # v7.0.1 | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a | |
| with: | |
| name: pr-full-ci-evidence-${{ github.event.pull_request.head.sha || github.sha }} | |
| path: pr-full-ci-evidence.json | |
| if-no-files-found: error | |
| retention-days: 90 |