mengzhx/deepseek-harness
1
0
Fork 0
mirror of https://github.com/deepseek-ai/deepseek-harness.git synced 2026-08-29 04:26:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit '70396085b141370ce32de1be4e225b4384eaf46d' into HEAD

Browse Source 
# Conflicts:
#	.agents/notes/implemented/feature/2026-07-07-mcp-client-plugin.i18n.yaml
#	.agents/notes/implemented/feature/2026-07-20-code-mode-typed-tool-returns.i18n.yaml
#	.agents/notes/implemented/feature/2026-07-22-web-multimodal-image-input-and-durable-attachments.i18n.yaml
#	.agents/notes/implemented/feature/2026-07-22-web-multimodal-image-input-and-durable-attachments.md
#	.agents/notes/implemented/feature/2026-07-22-web-multimodal-image-input-and-durable-attachments.zh.md
#	.agents/notes/implemented/simplification/2026-07-23-acp-automation-only-protocol.i18n.yaml
#	docs/config-catalog.i18n.yaml
#	docs/module-graph.i18n.yaml
#	docs/module-graph.md
#	docs/module-graph.zh.md
#	docs/tool-catalog.i18n.yaml
#	docs/tool-catalog.md
#	docs/tool-catalog.zh.md
#	examples/acp-agent/tests/snapshots/advanced-toolchain/tool-schemas.expected.json
#	examples/acp-agent/tests/snapshots/both-mode-turn/tool-schemas.expected.json
#	examples/acp-agent/tests/snapshots/code-mode-turn/tool-schemas.expected.json
#	packages/core/tools/README.i18n.yaml
#	packages/core/tools/README.zh.md
#	packages/core/tools/src/code-mode.ts
#	packages/host/apiproxy/tests/api-proxy-models.spec.ts
#	packages/host/plugin-inventory/tests/inventory.spec.ts
#	packages/mcp/mcp-client/tests/mcp-client.e2e.ts
#	packages/mcp/mcp-client/tests/mcp-client.spec.ts
#	packages/self-modification/tool-cordis/src/api-catalog.ts
#	packages/test-support/acp-snapshot/README.i18n.yaml
#	pnpm-lock.yaml
This commit is contained in:
Tianyi Cui
2026-08-17 11:31:59 +08:00
parent b3e2de873d c5759d3506
commit b2f23f88ad
3845 changed files with 62208 additions and 100402 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+51 -33
View File
@@ -15,9 +15,21 @@ on:
- larger-runner-benchmark
- consolidated-runner-benchmark
# Cancel a superseded run on every event EXCEPT push. A push run carries the two
# self-hosted standby drills, which take longer than the interval between master
# merges, so cancelling supersedes a drill before it reaches a verdict and the
# lane yields no readiness evidence. Must be decided here: cancellation applies
# to the whole superseded run, so a job-level group cannot exempt its job.
# Negated rather than `== 'pull_request'` so workflow_dispatch keeps cancelling:
# a re-dispatched runner benchmark holds up to 12 larger runners for 15 minutes
# and shares this group with the drills on master, so queueing it would delay
# them. The guarantee is narrow — evaluated against the newly triggered run, so a
# dispatch on master still cancels a mid-flight drill, and a newer pending push
# displaces an older one. Bounds and rationale:
# .agents/notes/implemented/process/2026-07-26-ci-failover-runbook.md
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
cancel-in-progress: ${{ github.event_name != 'push' }}
permissions:
contents: read
@@ -37,8 +49,8 @@ jobs:
# build-backed consumer tail. The consumer job owns the only Linux build so
# all three jobs enter runner allocation independently.
#
# FAILOVER: each Linux enterprise job resolves its pool through the
# DSH_CI_FAILOVER repository variable. Unset (normal), the expressions
# FAILOVER (Linux): each Linux enterprise job resolves its pool through the
# DSH_CI_FAILOVER_LINUX repository variable. Unset (normal), the expressions
# pick the hosted enterprise pools below. Setting the variable to
# 'selfhosted' (repo Settings → Actions → Variables; writer-manageable
# repository state — not PR-editable, no merge required) retargets all
@@ -46,11 +58,12 @@ jobs:
# vm-backup pool and re-running the failed jobs is the entire switch —
# see .agents/notes/implemented/process/2026-07-26-ci-failover-runbook.md. The
# in-house pool's readiness is re-proven on every master push by the
# serial-linux-selfhosted standby lane below.
# serial-linux-selfhosted standby lane below. The Windows failover switch is
# the separate DSH_CI_FAILOVER_WINDOWS variable on the windows-native job below.
node-24:
if: github.event_name == 'pull_request'
runs-on: >-
${{ vars.DSH_CI_FAILOVER == 'selfhosted'
${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted'
&& github.event.pull_request.user.login != 'dependabot[bot]'
&& fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
|| 'dsh-ubuntu-24-04-16core' }}
@@ -84,7 +97,7 @@ jobs:
# compression and upload on the paid latency-critical path. Skipped
# under failover — see the coverage lane's identical rationale.
- uses: actions/cache/restore@v4
if: vars.DSH_CI_FAILOVER != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -102,7 +115,7 @@ jobs:
node-24-coverage:
if: github.event_name == 'pull_request'
runs-on: >-
${{ vars.DSH_CI_FAILOVER == 'selfhosted'
${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted'
&& github.event.pull_request.user.login != 'dependabot[bot]'
&& fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
|| 'dsh-ubuntu-24-04-16core' }}
@@ -112,7 +125,7 @@ jobs:
# shares one 64-core VM across six always-on runner instances, so each
# instance may use eight while keeping the worst case at 8 × 6 = 48
# workers; process-bound suites remain isolated in forks.
DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '6' }}
DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '6' }}
DSH_GATE_CONCURRENCY: '3'
steps:
- uses: actions/checkout@v6
@@ -139,7 +152,7 @@ jobs:
# already serves warm installs, while restoring the hosted archive
# would spend ~52 s pulling ~180 MB into that populated store.
- uses: actions/cache/restore@v4
if: vars.DSH_CI_FAILOVER != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -165,7 +178,7 @@ jobs:
node-24-consumers:
if: github.event_name == 'pull_request'
runs-on: >-
${{ vars.DSH_CI_FAILOVER == 'selfhosted'
${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted'
&& github.event.pull_request.user.login != 'dependabot[bot]'
&& fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
|| 'dsh-ubuntu-24-04-16core' }}
@@ -176,7 +189,7 @@ jobs:
DSH_OXLINT_THREADS: '8'
DSH_PUBLINT_CONCURRENCY: '8'
# Failover halves snapshot concurrency for the shared 64-core VM.
DSH_SNAPSHOT_MAX_CONCURRENCY: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '12' || '32' }}
DSH_SNAPSHOT_MAX_CONCURRENCY: ${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '12' || '32' }}
steps:
- uses: actions/checkout@v6
with:
@@ -200,7 +213,7 @@ jobs:
# Skipped under failover — see the coverage lane's identical rationale.
- uses: actions/cache/restore@v4
if: vars.DSH_CI_FAILOVER != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -210,7 +223,7 @@ jobs:
# Pull requests restore the cache normally produced by serial-linux on
# master; they do not pay compression and upload on the required path.
- uses: actions/cache/restore@v4
if: vars.DSH_CI_FAILOVER != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
with:
path: ~/.cache/ms-playwright
key: ${{ runner.os }}-playwright-${{ hashFiles('pnpm-lock.yaml') }}
@@ -231,14 +244,14 @@ jobs:
exit "$sandbox_status"
- name: Install Playwright Chromium and hosted dependencies
if: vars.DSH_CI_FAILOVER != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
run: pnpm --filter @deepseek-ai/dsh-frontend exec playwright install --with-deps chromium
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
run: pnpm --filter @deepseek-ai/dsh-web-frontend exec playwright install --with-deps chromium
# The persistent VM image owns Playwright's Linux system packages; do
# not mutate the shared host with apt on every failover run.
- name: Install Playwright Chromium on the failover VM
if: vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]'
run: pnpm --filter @deepseek-ai/dsh-frontend exec playwright install chromium
if: vars.DSH_CI_FAILOVER_LINUX == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]'
run: pnpm --filter @deepseek-ai/dsh-web-frontend exec playwright install chromium
- name: Run compatibility, snapshot, and artifact gates
run: pnpm run check:ci:consumers
@@ -425,13 +438,16 @@ jobs:
# its own unmasked conclusion but is deliberately absent from
# all-checks-passed.needs, so it never delays or changes that required
# verdict. Under normal operation it runs on the hosted larger runner; under
# failover (DSH_CI_FAILOVER=selfhosted) it retargets onto the in-house
# self-hosted Windows pool. Dependabot PRs are excluded from the self-hosted
# pool and stay queued for the hosted runner — see the failover runbook.
# Windows failover (DSH_CI_FAILOVER_WINDOWS=selfhosted) it retargets onto the
# in-house self-hosted Windows pool. Dependabot PRs are excluded from the
# self-hosted pool and stay queued for the hosted runner — see the failover
# runbook. This Windows switch is independent of the Linux
# DSH_CI_FAILOVER_LINUX variable that retargets the three required Linux jobs
# and the all-checks-passed verdict above.
windows-native:
if: github.event_name == 'pull_request'
runs-on: >-
${{ vars.DSH_CI_FAILOVER == 'selfhosted'
${{ vars.DSH_CI_FAILOVER_WINDOWS == 'selfhosted'
&& github.event.pull_request.user.login != 'dependabot[bot]'
&& fromJSON('["self-hosted", "dsh-win-ci", "windows"]')
|| 'dsh-windows-2025-16core' }}
@@ -529,7 +545,7 @@ jobs:
run: pnpm install --frozen-lockfile
- name: Install Playwright Chromium and system dependencies
run: pnpm --filter @deepseek-ai/dsh-frontend exec playwright install --with-deps chromium
run: pnpm --filter @deepseek-ai/dsh-web-frontend exec playwright install --with-deps chromium
- name: Prepare bubblewrap (unrestrict userns)
run: bash scripts/prepare-ci-bubblewrap.sh
@@ -549,7 +565,7 @@ jobs:
# re-runs the complete unsharded aggregate on the persistent 64-core VM,
# continuously proving that environment can take over a required lane if
# the hosted pools degrade (the switch is then setting the writer-manageable
# DSH_CI_FAILOVER variable — see the failover runbook, no merge required).
# DSH_CI_FAILOVER_LINUX variable — see the failover runbook, no merge required).
# Push-triggered, so this lane always executes the base branch's own
# workflow definition. (Under failover, pull_request jobs do reach these
# runners with the PR merge ref's workflow — the boundary there is
@@ -588,7 +604,7 @@ jobs:
# The persistent VM image owns Playwright's Linux system packages; this
# step also proves that browser provisioning remains usable for failover.
- name: Install Playwright Chromium
run: pnpm --filter @deepseek-ai/dsh-frontend exec playwright install chromium
run: pnpm --filter @deepseek-ai/dsh-web-frontend exec playwright install chromium
- name: Prepare bubblewrap (unrestrict userns)
run: bash scripts/prepare-ci-bubblewrap.sh
@@ -635,11 +651,11 @@ jobs:
# move re-runs the complete unsharded Windows gate inventory on the persistent
# VM, continuously proving that environment can take over the required
# `windows` lane if the hosted pool degrades (the switch is setting the
# writer-manageable DSH_CI_FAILOVER variable — see the failover runbook, no
# merge required). Push-triggered, so this lane always executes the base
# branch's own workflow definition. Non-blocking for pull requests; absent
# from all-checks-passed.needs by design — the required `windows` job owns
# the PR verdict. No cache steps because the VM's persistent pnpm store
# writer-manageable DSH_CI_FAILOVER_WINDOWS variable — see the failover
# runbook, no merge required). Push-triggered, so this lane always executes
# the base branch's own workflow definition. Non-blocking for pull requests;
# absent from all-checks-passed.needs by design — the required `windows` job
# owns the PR verdict. No cache steps because the VM's persistent pnpm store
# and tool caches make them redundant (and saving here would poison the
# hosted cache namespace with self-hosted paths).
serial-windows:
@@ -902,11 +918,13 @@ jobs:
all-checks-passed:
name: all checks passed
# This bookkeeping-only verdict must not depend on custom-pool
# provisioning — and under failover it follows the same selector as the
# worker jobs it aggregates, so a standard-hosted outage cannot strand
# the branch-protection verdict either.
# provisioning — and under Linux failover it follows the same selector as
# the worker jobs it aggregates, so a standard-hosted outage cannot strand
# the branch-protection verdict either. It retargets with the Linux switch
# (DSH_CI_FAILOVER_LINUX), not the Windows one, because it aggregates the
# required Linux workers and runs on the vm-backup pool.
runs-on: >-
${{ vars.DSH_CI_FAILOVER == 'selfhosted'
${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted'
&& github.event.pull_request.user.login != 'dependabot[bot]'
&& fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
|| 'ubuntu-latest' }}