cpex/.github/workflows/ci.yml at main · contextforge-org/cpex · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
# ===============================================================
# CI - Rust lint, test, examples, and docs gate
# ===============================================================

name: CI

on:
  push:
    branches: ["main", "dev"]
  pull_request:
    types: [opened, synchronize, ready_for_review]
    branches: ["main", "dev"]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"

jobs:
  lint:
    name: Lint (fmt + clippy)
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 1
      - name: Install Rust 1.96.0
        uses: dtolnay/rust-toolchain@1.96.0
        with:
          components: clippy, rustfmt
      - uses: Swatinem/rust-cache@v2
      - name: rustfmt
        run: cargo fmt --all -- --check
      - name: clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

  unused-deps:
    name: Unused deps (advisory)
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # Advisory only: cargo-machete static analysis false-positives on
    # macro/derive-only crates (thiserror, tracing, serde, async-trait). Surfaced
    # as a non-blocking signal until the reports are triaged in a follow-up.
    continue-on-error: true
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 1
      - name: Install cargo-machete
        run: cargo install cargo-machete --locked
      - run: cargo machete

  test:
    name: Test (workspace)
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 1
      - name: Install Rust 1.96.0
        uses: dtolnay/rust-toolchain@1.96.0
      - uses: Swatinem/rust-cache@v2
      - name: cargo test
        # Valkey/testcontainers integration tests are `#[ignore]`d by default
        # and run out-of-band, so this needs no Docker daemon. The Python host
        # e2e tests are also `#[ignore]`d here — the `python-e2e` job below runs
        # them with a real interpreter and framework checkout.
        run: cargo test --workspace

  # The Python host's end-to-end tests, actually run.
  #
  # These are `#[ignore]`d so the workspace job reports them as ignored rather
  # than passing bodies that never executed. This job builds the environment they
  # need and sets CPEX_REQUIRE_PYTHON_E2E=1, under which an unmet prerequisite
  # panics instead of skipping. So a missing interpreter or a stale worker.py
  # fails this job loudly — it cannot go quiet and still report green.
  python-e2e:
    name: Python host e2e (skips fail)
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 1
      # The Python framework lives on its own branch, and PyPI's `cpex` is behind
      # it (its worker.py predates the credential and extensions fields). The
      # *stable* 0.1.x branch is not enough either: it carries no
      # cpex/framework/isolated/worker.py at all. The companion branch below is
      # the one whose worker.py both consumes `credential` and delivers
      # `extensions=` to execute_plugin, which is what these tests gate on.
      #
      # This is a cross-branch dependency: when the Python side merges, retarget
      # this ref. Until then a wrong ref fails loudly (skips are errors here)
      # rather than silently skipping — which is the whole point of this job.
      - name: Checkout the cpex Python framework
        uses: actions/checkout@v7
        with:
          ref: "0.1.x"
          path: cpex-python
          fetch-depth: 1
      - name: Install Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install Rust 1.96.0
        uses: dtolnay/rust-toolchain@1.96.0
      - uses: Swatinem/rust-cache@v2
      - name: make test-python-e2e
        env:
          CPEX_PYTHON_SOURCE: ${{ github.workspace }}/cpex-python
        run: make test-python-e2e

  examples:
    name: Examples build (Rust + Go FFI)
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 1
      - name: Install Rust 1.96.0
        uses: dtolnay/rust-toolchain@1.96.0
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.25.4"
      - uses: Swatinem/rust-cache@v2
      # Builds every Rust example plus the Go demo (which links the release
      # cpex-ffi cdylib) — the cheapest guard against stale public-API usage.
      - name: make examples-build
        run: make examples-build

  package:
    name: Package (publish dry-run)
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 1
      - name: Install Rust 1.96.0
        uses: dtolnay/rust-toolchain@1.96.0
      # NOTE: intentionally NO Swatinem/rust-cache here, AND we wipe the registry
      # index before packaging. The committed Cargo.lock is byte-identical to a
      # fresh x86_64 resolution (verified in an amd64 container), so the lock is
      # not the problem. The failure comes from stale `~/.cargo/registry` state
      # the hosted runner carries: under the sparse protocol `cargo package
      # --locked` consults that partial local index, decides it can't satisfy the
      # committed lock, and aborts with "cannot update the lock file ... --locked"
      # ~1.4s in (too fast for a real network fetch). Removing the index forces a
      # clean fetch, against which Cargo.lock resolves cleanly — keeping this
      # dry-run deterministic.
      # Continuous dry-run of the crates.io release: build + verify a .crate for
      # every publishable member without uploading. Catches publishability
      # regressions (missing version reqs, packaging-excluded files, broken
      # inter-crate deps) on every push/PR, long before a release tag. Mirrors
      # `make publish-dry` and the release workflow's dry-run. The
      # `publish = false` crates are excluded (not part of the registry set):
      # the two FFI crates and the tutorial companion crate.
      - name: cargo package (no upload)
        run: |
          # Drop any pre-seeded registry index/cache so cargo fetches fresh and
          # --locked resolves against a clean index (see note above).
          rm -rf ~/.cargo/registry/index ~/.cargo/registry/cache
          cargo package --workspace --locked --exclude cpex-ffi --exclude cpex-demo-ffi --exclude cpex-tutorial

  docs:
    name: Docs Build
    uses: ./.github/workflows/docs-build.yaml