diff --git a/.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.i18n.yaml b/.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.i18n.yaml new file mode 100644 index 0000000000..47a1cfea29 --- /dev/null +++ b/.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.i18n.yaml @@ -0,0 +1,6 @@ +# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each +# side as of the last confirmed-consistent state. Both languages carry equal authority; +# after editing either side, bring the other along and re-record with: +# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.md +2026-09-06-release-rehearsal-selfhosted.md: a1f13f8e840a40c6d09f1b682c8baf505b8d0949 +2026-09-06-release-rehearsal-selfhosted.zh.md: 1b90bbe850b92e0b7c03ac3f6da03700e8eff034 diff --git a/.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.md b/.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.md new file mode 100644 index 0000000000..a1f13f8e84 --- /dev/null +++ b/.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.md @@ -0,0 +1,27 @@ +# Agent Note: trusted release rehearsals on persistent Linux runners + +Status: implemented + +English | [中文](2026-09-06-release-rehearsal-selfhosted.zh.md) + +## Problem + +Dependency-layout and release-pack rehearsals consume hosted Linux minutes without requiring npm or API credentials. Moving arbitrary pull-request code or credentialed publication onto a persistent shared host would weaken isolation; reusing a checkout without cleaning would also weaken the packed-payload proof. + +## Decision + +The two jobs in [release.yml](../../../../.github/workflows/release.yml) and the pack job in [release-vendor.yml](../../../../.github/workflows/release-vendor.yml) select the existing self-hosted Linux pool only with the writer-controlled `DSH_CI_FAILOVER_LINUX` repository variable set to `selfhosted`. The selector requires the canonical repository and a non-Dependabot actor, then admits only master pushes or same-repository, non-fork PRs whose author is not Dependabot. Manual dispatch always selects `ubuntu-24.04`, as do all other rejected contexts. The [failover runbook](2026-07-26-ci-failover-runbook.md) continues to own the independent main-CI switches and standby operation; this note adds only release-rehearsal eligibility. + +The runner labels are `[self-hosted, linux, x64, vm-backup]`. Runner registrations share one VM, not independent machine capacity. Each job uses its runner-private temporary volume for Node compile cache and node-gyp headers before pnpm setup, and a pnpm setup destination qualified by run, attempt, and job. The persistent pnpm store stays outside checkout cleanup; only GitHub-hosted runners restore the remote store cache. Neither rehearsal workflow saves remote caches. + +Checkout explicitly cleans ignored and untracked output before immutable installation and the existing builds. Full tag history, pack concurrency, dependency checks, tarball verification, and artifact retention remain unchanged. The packed-install verifier creates a fresh consumer outside the checkout, installs tarballs with npm, removes inherited Node resolution hooks, and deletes the consumer in `finally`; a warm pnpm store cannot substitute workspace links or stale build output for a tarball payload. The [npm release decision](2026-08-10-npm-release-sequences.md) still owns release families and publication. Both manual publish workflows remain entirely hosted and gain no credentials or registry changes here. + +## Alternatives considered + +Always-hosted rehearsals avoid persistent-host risk but retain all hosted minutes. Always-self-hosted rehearsals remove the portable fallback. A scheduling job or reusable workflow adds another logical job and hides the three short setup sequences. Allowing manual dispatch on arbitrary refs gives a maintainer action broader persistent-host access than the explicit event trust rule. + +## Consequences + +Unsetting the variable or changing it away from `selfhosted` routes subsequent eligible jobs to hosted Ubuntu. This is an operator-selected fallback, not automatic runner-health detection or failover for already queued jobs. The shared VM can still contend with other trusted jobs, and repository writers remain responsible for code admitted to its persistent trust domain. No workflow provisions host packages or changes global host configuration. + +[scripts/tests/ci-release-selfhosted.spec.ts](../../../../scripts/tests/ci-release-selfhosted.spec.ts) evaluates the committed selectors with trusted events and negative controls for forks, Dependabot, other repositories, non-master pushes, dispatches, missing PR data, and disabled switches. It pins setup ordering, checkout cleanup, hosted-only remote cache access, publication isolation, and the retained commands. Real release-build and packed-install execution remains the PR CI verification owner; selector tests do not claim to reproduce those builds. diff --git a/.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.zh.md b/.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.zh.md new file mode 100644 index 0000000000..1b90bbe850 --- /dev/null +++ b/.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.zh.md @@ -0,0 +1,27 @@ +# Agent Note: 在持久化 Linux 运行器上执行受信任的发布演练 + +Status: implemented + +[English](2026-09-06-release-rehearsal-selfhosted.md) | 中文 + +## Problem + +依赖布局检查和发布打包演练消耗托管 Linux 分钟，但不需要 npm 或 API 凭据。将任意拉取请求代码或携带凭据的发布任务放到持久化共享主机会削弱隔离；复用未经清理的检出目录也会削弱打包载荷验证。 + +## Decision + +[release.yml](../../../../.github/workflows/release.yml) 的两个作业和 [release-vendor.yml](../../../../.github/workflows/release-vendor.yml) 的打包作业仅在写权限维护者控制的仓库变量 `DSH_CI_FAILOVER_LINUX` 设为 `selfhosted` 时选择现有 Linux 自托管池。选择器要求当前仓库为正式仓库且触发者不是 Dependabot，然后只接纳 master 推送，或作者不是 Dependabot 的同仓库、非 fork PR（Pull Request）。手动触发始终选择 `ubuntu-24.04`，其他不满足条件的上下文也一样。[故障切换手册](2026-07-26-ci-failover-runbook.zh.md) 继续负责独立的主 CI 开关与热备操作；本记录只增加发布演练的准入规则。 + +运行器标签为 `[self-hosted, linux, x64, vm-backup]`。运行器注册共享一台虚拟机，不代表独立机器容量。每个作业在 pnpm 设置前将 Node 编译缓存与 node-gyp 头文件放在运行器私有临时卷上，pnpm 设置目标路径包含运行、重试次数和作业标识。持久化 pnpm 存储位于检出清理范围之外；只有 GitHub 托管运行器恢复远端存储缓存。两个演练工作流都不保存远端缓存。 + +检出操作显式清理被忽略和未跟踪的输出，再执行锁定依赖安装与现有构建。完整标签历史、打包并发、依赖检查、压缩包验证和产物保留期均保持不变。打包安装验证器在检出目录外创建全新的消费目录，用 npm 安装压缩包，移除继承的 Node 解析钩子，并在 `finally` 中删除消费目录；预热 pnpm 存储无法用工作区链接或过期构建输出代替压缩包载荷。[npm 发布决策](2026-08-10-npm-release-sequences.zh.md) 仍负责发布族与发布操作。两个手动发布工作流全部保留在托管运行器上，本改动不增加凭据，也不改变注册表。 + +## Alternatives considered + +始终使用托管演练可以避免持久化主机风险，但会保留全部托管分钟。始终自托管则失去可移植回退。增加调度作业或可复用工作流会多出一个逻辑作业，并隐藏三个简短的设置序列。允许任意引用的手动触发，会让维护者操作获得比明确事件信任规则更广的持久化主机访问权限。 + +## Consequences + +取消变量或将其改为非 `selfhosted` 值，会将后续符合条件的作业路由到托管 Ubuntu。这是运维人员选择的回退，不会自动探测运行器健康，也不会切换已排队的作业。共享虚拟机仍可能与其他受信任作业竞争资源；仓库写权限维护者仍对进入持久化信任域的代码负责。工作流不安装主机系统包，也不修改全局主机配置。 + +[scripts/tests/ci-release-selfhosted.spec.ts](../../../../scripts/tests/ci-release-selfhosted.spec.ts) 使用受信任事件和 fork、Dependabot、其他仓库、非 master 推送、手动触发、缺失 PR 数据、禁用开关等负向对照求值已提交的选择器。测试固定设置顺序、检出清理、仅托管运行器访问远端缓存、发布隔离和保留命令。真实发布构建与打包安装执行仍由 PR CI 验证；选择器测试不声称重现这些构建。 diff --git a/.github/workflows/release-vendor.yml b/.github/workflows/release-vendor.yml index 8e1d531a03..cd285e1d01 100644 --- a/.github/workflows/release-vendor.yml +++ b/.github/workflows/release-vendor.yml @@ -29,21 +29,39 @@ env: jobs: pack: name: Pack npm tarballs - runs-on: ubuntu-24.04 + # Persistent runners accept only trusted, credential-free rehearsals. + runs-on: >- + ${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted' + && github.repository == 'deepseek-harness/deepseek-harness' + && github.actor != 'dependabot[bot]' + && ((github.event_name == 'push' && github.ref == 'refs/heads/master') + || (github.event_name == 'pull_request' + && github.event.pull_request.head.repo.full_name == github.repository + && github.event.pull_request.head.repo.fork == false + && github.event.pull_request.user.login != 'dependabot[bot]')) + && fromJSON('["self-hosted", "linux", "x64", "vm-backup"]') + || 'ubuntu-24.04' }} steps: # Complete history: the release scripts read tags. - uses: actions/checkout@v6 with: fetch-depth: 0 persist-credentials: false + clean: true + + - name: Configure runner-private caches + run: | + echo "NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache" >> "$GITHUB_ENV" + echo "npm_config_devdir=${{ runner.temp }}/node-gyp" >> "$GITHUB_ENV" - uses: pnpm/action-setup@v4 with: - dest: ${{ runner.temp }}/setup-pnpm + dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }} - uses: actions/setup-node@v6 with: node-version: ${{ env.PRIMARY_NODE_VERSION }} + package-manager-cache: false - name: Configure pnpm store path id: pnpm-store @@ -54,6 +72,7 @@ jobs: echo "path=$store_path" >> "$GITHUB_OUTPUT" - uses: actions/cache/restore@v4 + if: runner.environment == 'github-hosted' with: path: ${{ steps.pnpm-store.outputs.path }} key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ad6c64ae67..d9812e9ab7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,19 +28,37 @@ env: jobs: dependencies: name: Dependency layout - runs-on: ubuntu-24.04 + # Persistent runners accept only trusted, credential-free rehearsals. + runs-on: >- + ${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted' + && github.repository == 'deepseek-harness/deepseek-harness' + && github.actor != 'dependabot[bot]' + && ((github.event_name == 'push' && github.ref == 'refs/heads/master') + || (github.event_name == 'pull_request' + && github.event.pull_request.head.repo.full_name == github.repository + && github.event.pull_request.head.repo.fork == false + && github.event.pull_request.user.login != 'dependabot[bot]')) + && fromJSON('["self-hosted", "linux", "x64", "vm-backup"]') + || 'ubuntu-24.04' }} steps: - uses: actions/checkout@v6 with: persist-credentials: false + clean: true + + - name: Configure runner-private caches + run: | + echo "NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache" >> "$GITHUB_ENV" + echo "npm_config_devdir=${{ runner.temp }}/node-gyp" >> "$GITHUB_ENV" - uses: pnpm/action-setup@v4 with: - dest: ${{ runner.temp }}/setup-pnpm + dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }} - uses: actions/setup-node@v6 with: node-version: ${{ env.PRIMARY_NODE_VERSION }} + package-manager-cache: false - name: Configure pnpm store path id: pnpm-store @@ -51,6 +69,7 @@ jobs: echo "path=$store_path" >> "$GITHUB_OUTPUT" - uses: actions/cache/restore@v4 + if: runner.environment == 'github-hosted' with: path: ${{ steps.pnpm-store.outputs.path }} key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }} @@ -68,21 +87,39 @@ jobs: pack: name: Pack npm tarballs - runs-on: ubuntu-24.04 + # Persistent runners accept only trusted, credential-free rehearsals. + runs-on: >- + ${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted' + && github.repository == 'deepseek-harness/deepseek-harness' + && github.actor != 'dependabot[bot]' + && ((github.event_name == 'push' && github.ref == 'refs/heads/master') + || (github.event_name == 'pull_request' + && github.event.pull_request.head.repo.full_name == github.repository + && github.event.pull_request.head.repo.fork == false + && github.event.pull_request.user.login != 'dependabot[bot]')) + && fromJSON('["self-hosted", "linux", "x64", "vm-backup"]') + || 'ubuntu-24.04' }} steps: # Complete history: the release scripts read tags. - uses: actions/checkout@v6 with: fetch-depth: 0 persist-credentials: false + clean: true + + - name: Configure runner-private caches + run: | + echo "NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache" >> "$GITHUB_ENV" + echo "npm_config_devdir=${{ runner.temp }}/node-gyp" >> "$GITHUB_ENV" - uses: pnpm/action-setup@v4 with: - dest: ${{ runner.temp }}/setup-pnpm + dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }} - uses: actions/setup-node@v6 with: node-version: ${{ env.PRIMARY_NODE_VERSION }} + package-manager-cache: false - name: Configure pnpm store path id: pnpm-store @@ -93,6 +130,7 @@ jobs: echo "path=$store_path" >> "$GITHUB_OUTPUT" - uses: actions/cache/restore@v4 + if: runner.environment == 'github-hosted' with: path: ${{ steps.pnpm-store.outputs.path }} key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }} diff --git a/docs/development.i18n.yaml b/docs/development.i18n.yaml index 14b86dfa27..6c7316250a 100644 --- a/docs/development.i18n.yaml +++ b/docs/development.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write docs/development.md -development.md: 0f9e76f30e6fc65f242b7f4ce6e1bef79e3451b9 -development.zh.md: 6e98acf9d9cda5271b98c3afbf4b915673fde4d0 +development.md: a57c99d606a73cb938f339e080ab0ba05913902a +development.zh.md: 5439fec59cb7c245d655393690bf6c848cdf20fa diff --git a/docs/development.md b/docs/development.md index 0f9e76f30e..a57c99d606 100644 --- a/docs/development.md +++ b/docs/development.md @@ -122,6 +122,8 @@ Contributors can opt into the comprehensive local gate set with `pnpm run check: The keyless [CI workflow](../.github/workflows/ci.yml) groups independent gates into broad lanes and runs a smaller compatibility signal across supported Node versions. Artifact consumers wait for one build within their lane. The separate real-API workflow runs `pnpm run test:e2e` with its configured worker bound. See [scripts/run-gates.ts](../scripts/run-gates.ts) and the workflow files for the current gate and job inventory. +The credential-free dsh dependency-layout and dsh/vendor pack rehearsals use the existing Linux self-hosted pool only when `DSH_CI_FAILOVER_LINUX=selfhosted` and the event is a trusted master push or same-repository, non-fork, non-Dependabot pull request. All other cases, including manual dispatch, use `ubuntu-24.04`; manual publication stays hosted. See the [release rehearsal runner decision](../.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.md) for persistent-store isolation and fallback limits. + ### Daily commands The root [contributor instructions](../AGENTS.md#commands) summarize common commands, while [`package.json`](../package.json) and [scripts/run-gates.ts](../scripts/run-gates.ts) own the current script and gate inventories. Select the smallest checks that cover the changed surface. Documentation changes use `pnpm run doc-sync`; package-public behavior changes also update the owning README or JSDoc, and built-artifact checks require `pnpm run build` first. diff --git a/docs/development.zh.md b/docs/development.zh.md index 6e98acf9d9..5439fec59c 100644 --- a/docs/development.zh.md +++ b/docs/development.zh.md @@ -126,6 +126,8 @@ vendor manifest 守卫检查 `vendor/*/src` 下的改动是否连同对应的 `v keyless [CI 工作流](../.github/workflows/ci.yml) 将独立门禁分组到若干宽粒度 lane，并在受支持的 Node 版本上运行一组较小的兼容性检查。产物消费方在各自 lane 内等待一次 build。单独的真实 API 工作流按其配置的 worker 上限运行 `pnpm run test:e2e`。当前门禁和 job 清单以 [scripts/run-gates.ts](../scripts/run-gates.ts) 和工作流文件为准。 +不带凭据的 dsh 依赖布局检查与 dsh/vendor 打包演练仅在 `DSH_CI_FAILOVER_LINUX=selfhosted`，且事件为受信任的 master 推送或同仓库、非 fork、非 Dependabot 拉取请求时使用现有 Linux 自托管池。其余情况（包括手动触发）均使用 `ubuntu-24.04`；手动发布仍使用托管运行器。持久化存储隔离与回退限制见[发布演练运行器决策](../.agents/notes/implemented/process/2026-09-06-release-rehearsal-selfhosted.zh.md)。 + ### 日常命令 根目录的[贡献者说明](../AGENTS.md#commands)概述常用命令，[`package.json`](../package.json) 与 [scripts/run-gates.ts](../scripts/run-gates.ts) 则负责当前脚本和门禁清单。请选择覆盖变更表面的最小检查集。文档变更使用 `pnpm run doc-sync`；包公开行为变更还需更新所属 README 或 JSDoc，而基于构建产物的检查需要先运行 `pnpm run build`。 diff --git a/scripts/tests/ci-release-selfhosted.spec.ts b/scripts/tests/ci-release-selfhosted.spec.ts new file mode 100644 index 0000000000..0b42c313ed --- /dev/null +++ b/scripts/tests/ci-release-selfhosted.spec.ts @@ -0,0 +1,148 @@ +/** Release rehearsal routing and persistent-runner isolation, without executing release builds. */ +import { readFileSync } from 'node:fs' +import { resolve } from 'node:path' +import { runInNewContext } from 'node:vm' +import { load } from 'js-yaml' +import { describe, expect, it } from 'vitest' + +const root = resolve(import.meta.dirname, '../..') +const repository = 'deepseek-harness/deepseek-harness' +const selfhosted = ['self-hosted', 'linux', 'x64', 'vm-backup'] +const hosted = 'ubuntu-24.04' + +interface Step { + name?: string + uses?: string + run?: string + if?: string + with?: Record +} +interface Workflow { + on: Record + permissions: Record + concurrency?: Record + jobs: Record +} + +function workflow(file: string): Workflow { + return load(readFileSync(resolve(root, '.github/workflows', file), 'utf8')) as Workflow +} + +// These selectors use only string/boolean comparisons and short-circuit operators, +// shared by Actions and JavaScript; absent Actions context properties read as ''. +function evaluate(expression: string, context: Record): unknown { + const source = expression.trim().replace(/^\$\{\{|\}\}$/g, '') + .replace(/\b(?:github|vars|runner)(?:\.[a-zA-Z_][a-zA-Z_0-9]*)+/g, + key => JSON.stringify(context[key] ?? '')) + return runInNewContext(source, { fromJSON: JSON.parse }, { timeout: 1000 }) as unknown +} + +const trustedPr = { + 'vars.DSH_CI_FAILOVER_LINUX': 'selfhosted', + 'github.repository': repository, + 'github.actor': 'maintainer', + 'github.event_name': 'pull_request', + 'github.ref': 'refs/pull/42/merge', + 'github.event.pull_request.head.repo.full_name': repository, + 'github.event.pull_request.head.repo.fork': false, + 'github.event.pull_request.user.login': 'contributor', +} +const trustedPush = { + 'vars.DSH_CI_FAILOVER_LINUX': 'selfhosted', + 'github.repository': repository, + 'github.actor': 'maintainer', + 'github.event_name': 'push', + 'github.ref': 'refs/heads/master', +} +const fallbackCases: Array<[string, Record]> = [ + ['unset switch', { ...trustedPr, 'vars.DSH_CI_FAILOVER_LINUX': '' }], + ['hosted switch', { ...trustedPr, 'vars.DSH_CI_FAILOVER_LINUX': 'hosted' }], + ['unknown switch', { ...trustedPr, 'vars.DSH_CI_FAILOVER_LINUX': 'true' }], + ['fork PR', { ...trustedPr, 'github.event.pull_request.head.repo.full_name': 'outsider/fork', 'github.event.pull_request.head.repo.fork': true }], + ['different head repository', { ...trustedPr, 'github.event.pull_request.head.repo.full_name': 'outsider/repo' }], + ['fork flag', { ...trustedPr, 'github.event.pull_request.head.repo.fork': true }], + ['Dependabot author rerun by maintainer', { ...trustedPr, 'github.event.pull_request.user.login': 'dependabot[bot]' }], + ['Dependabot PR actor', { ...trustedPr, 'github.actor': 'dependabot[bot]' }], + ['Dependabot push actor', { ...trustedPush, 'github.actor': 'dependabot[bot]' }], + ['non-master push', { ...trustedPush, 'github.ref': 'refs/heads/topic' }], + ['tag push', { ...trustedPush, 'github.ref': 'refs/tags/dsh-v1.0.0' }], + ['push in another repository', { ...trustedPush, 'github.repository': 'outsider/fork' }], + ['dispatch on master', { ...trustedPush, 'github.event_name': 'workflow_dispatch' }], + ['dispatch on topic', { ...trustedPush, 'github.event_name': 'workflow_dispatch', 'github.ref': 'refs/heads/topic' }], + ['dispatch on tag', { ...trustedPush, 'github.event_name': 'workflow_dispatch', 'github.ref': 'refs/tags/dsh-v1.0.0' }], + ['pull_request_target', { ...trustedPr, 'github.event_name': 'pull_request_target' }], + ['missing PR payload', { ...trustedPush, 'github.event_name': 'pull_request' }], +] + +for (const [file, jobIds] of [['release.yml', ['dependencies', 'pack']], ['release-vendor.yml', ['pack']]] as const) { + describe(file, () => { + const release = workflow(file) + it('preserves the logical jobs, rehearsal events and read-only permission', () => { + expect(Object.keys(release.jobs)).toEqual(jobIds) + expect(release.on).toEqual({ pull_request: null, push: { branches: ['master'] }, workflow_dispatch: null }) + expect(release.permissions).toEqual({ contents: 'read' }) + expect(release.concurrency).toEqual({ group: '${{ github.workflow }}-${{ github.ref }}', 'cancel-in-progress': false }) + }) + for (const jobId of jobIds) { + describe(jobId, () => { + const job = release.jobs[jobId]! + it('routes trusted PRs and master pushes onto the existing Linux pool', () => { + expect(evaluate(job['runs-on'], trustedPr)).toEqual(selfhosted) + expect(evaluate(job['runs-on'], trustedPush)).toEqual(selfhosted) + expect(evaluate(job['runs-on'], { ...trustedPush, 'vars.DSH_CI_FAILOVER_LINUX': '' })).toBe(hosted) + }) + it.each(fallbackCases)('keeps %s hosted', (_name, context) => { + expect(evaluate(job['runs-on'], context)).toBe(hosted) + }) + it('cleans stale checkout output and isolates setup before any pnpm invocation', () => { + expect(job.steps[0]).toMatchObject({ uses: 'actions/checkout@v6', with: { clean: true, 'persist-credentials': false } }) + const cacheIndex = job.steps.findIndex(step => step.run?.includes('NODE_COMPILE_CACHE=')) + const pnpmIndex = job.steps.findIndex(step => step.uses?.startsWith('pnpm/') || /\bpnpm\b/.test(step.run ?? '')) + expect(cacheIndex).toBeGreaterThan(0) + expect(cacheIndex).toBeLessThan(pnpmIndex) + expect(job.steps[cacheIndex]?.run).toContain('echo "NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache" >> "$GITHUB_ENV"') + expect(job.steps[cacheIndex]?.run).toContain('echo "npm_config_devdir=${{ runner.temp }}/node-gyp" >> "$GITHUB_ENV"') + expect(job.steps.find(step => step.uses === 'pnpm/action-setup@v4')?.with?.dest) + .toBe('${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}') + expect(job.steps.find(step => step.name === 'Install (immutable)')?.run).toBe('pnpm install --frozen-lockfile') + }) + it('uses the persistent store without remote cache reads or writes on self-hosted', () => { + expect(job.steps.find(step => step.name === 'Configure pnpm store path')?.run).toContain('store_root="$HOME/.local/share/pnpm/store"') + const caches = job.steps.filter(step => step.uses?.startsWith('actions/cache')) + expect(caches.map(step => step.uses)).toEqual(['actions/cache/restore@v4']) + for (const step of caches) { + expect(evaluate(step.if!, { 'runner.environment': 'self-hosted' })).toBe(false) + expect(evaluate(step.if!, { 'runner.environment': 'github-hosted' })).toBe(true) + } + const nodeSetup = job.steps.find(step => step.uses === 'actions/setup-node@v6') + expect(nodeSetup?.with?.cache).toBeUndefined() + expect(nodeSetup?.with?.['package-manager-cache']).toBe(false) + }) + it('retains the dependency and pack verification commands', () => { + const commands = job.steps.flatMap(step => step.run === undefined ? [] : [step.run]) + if (jobId === 'dependencies') { + expect(commands).toContain('pnpm run verify-package-dependencies') + expect(commands).toContain('pnpm run verify-npm-install-layout') + } else { + const family = file === 'release.yml' ? 'dsh' : 'vendor' + const output = family === 'dsh' ? 'dist/npm' : 'dist/npm-vendor' + expect(job.steps[0]?.with?.['fetch-depth']).toBe(0) + expect(commands).toContain('pnpm run release:verify --family ' + family) + expect(commands).toContain('pnpm run ' + (family === 'dsh' ? 'build:official' : 'build:lib:host')) + expect(commands).toContain('pnpm run release:pack --family ' + family + ' --out ' + output + ' --concurrency 8') + expect(commands).toContain('pnpm run release:verify-packed-install --family ' + family + ' --from ' + output + + (family === 'dsh' ? ' --from dist/npm-vendor --from dist/npm-landlock' : '')) + expect(job.steps.at(-1)).toMatchObject({ uses: 'actions/upload-artifact@v4', with: { path: output + '/*', 'retention-days': 7 } }) + } + expect(JSON.stringify(job)).not.toMatch(/secrets\.|release:publish|npm-publish/) + }) + }) + } + }) +} + +it.each(['release-publish.yml', 'release-vendor-publish.yml'])('keeps %s manual and entirely hosted', (file) => { + const publish = workflow(file) + expect(publish.on).toEqual({ workflow_dispatch: null }) + for (const job of Object.values(publish.jobs)) expect(job['runs-on']).toBe(hosted) +})