claude@clouddev1
6d54c1e96c
Add sibling publish.yaml jobs (scoop-bucket, homebrew-tap) that render a manifest from the release .sha256 sidecars and idempotently push it to the org-level lazyeval/scoop-bucket and lazyeval/homebrew-tap repos, using the scoped lazyeval-ci bot token (LAZYEVAL_PKG_TOKEN). Render logic lives in dependency-free bash (the CI image has no jq/ruby): scripts/render-scoop-manifest.sh and scripts/render-homebrew-formula.sh. scripts/test-package-renders.sh exercises both: it validates the Scoop JSON with node and asserts fields on both manifests, and additionally runs `ruby -c` on the formula where ruby is present (dev box), skipping it gracefully otherwise. A new ci.yaml `manifests` job runs that test on every push so a render regression surfaces immediately, not at the next manual publish dispatch. The CI image has no ruby, so in CI the gate covers the Scoop JSON (node) and field assertions for both manifests; the formula's Ruby syntax is checked dev-side only (the static heredoc's variable parts cannot introduce syntax errors). - Scoop: x64 (gnu) + arm64 (gnullvm); #/-rename fragment so the bin shim is version-stable; checkver, no autoupdate (the pipeline is the updater). - Homebrew: on_macos/on_linux x arch bare-binary formula; no Windows. Docs: ADR-0056 Amendment 2 (+ README index, requirements D3). Unverified pending real use: scoop/brew install, the HEAD:main branch assumption, macOS Gatekeeper-via-brew on the ad-hoc-signed binary.
72 lines
3.1 KiB
YAML
72 lines
3.1 KiB
YAML
# The CI gate. Runs inside the prebuilt nix toolchain image (built + pushed by
|
|
# build-ci-image.yaml), so the pinned 1.95.0 toolchain is already warm — steps
|
|
# just enter the flake devShell and run cargo.
|
|
#
|
|
# Gate = fmt + clippy + test. The fmt gate (`cargo fmt --check`, stock defaults)
|
|
# was enabled once the tree was reformatted on main (ADR-ci-002 Amendment 1 /
|
|
# issue #35). The release job (static binary for D2) and the platform matrix
|
|
# layer on later, step by step.
|
|
#
|
|
# A separate, lightweight `manifests` job logic-tests the package-manifest
|
|
# render scripts (Scoop/Homebrew) used by publish.yaml — bash + node only, no
|
|
# toolchain — so a render regression surfaces on the breaking push rather than
|
|
# weeks later at the next manual publish dispatch (ADR-0056 Amendment 2).
|
|
name: ci
|
|
on:
|
|
push:
|
|
# Branch pushes only — a tag push hits the same commit the branch push
|
|
# already gated, so `branches: ['**']` drops the redundant tag-triggered
|
|
# run (the release workflow owns tags). Pushing commits + a tag together
|
|
# still gates the commits via the branch push.
|
|
branches: ['**']
|
|
# Skip the gate for changes that can't affect clippy/test — docs, markdown,
|
|
# and the website subproject (it has its own workflow, website.yaml, that
|
|
# builds + publishes it). A push touching crate code *and* these still runs
|
|
# (paths-ignore only skips when *all* changed files match).
|
|
# Note: flake/toolchain changes are NOT ignored — they can shift the
|
|
# toolchain and thus lint/test outcomes.
|
|
paths-ignore:
|
|
- 'docs/**'
|
|
- '**/*.md'
|
|
- 'website/**'
|
|
- '.gitea/workflows/website.yaml'
|
|
pull_request:
|
|
paths-ignore:
|
|
- 'docs/**'
|
|
- '**/*.md'
|
|
- 'website/**'
|
|
- '.gitea/workflows/website.yaml'
|
|
|
|
jobs:
|
|
gate:
|
|
runs-on: ci-public
|
|
# Public package → anonymous pull, no credentials needed.
|
|
container:
|
|
image: git.lazyeval.net/oli/rdbms-playground-ci:latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: fmt (check, stock defaults)
|
|
run: nix develop -c cargo fmt --check
|
|
- name: clippy (warnings denied)
|
|
run: nix develop -c cargo clippy --all-targets -- -D warnings
|
|
- name: test
|
|
run: nix develop -c cargo test --no-fail-fast
|
|
|
|
# Logic test for the package-manifest render scripts. Renders with DUMMY
|
|
# inputs and validates the output — it never publishes or touches the lazyeval
|
|
# repos (that is publish.yaml's manual job). Runs on the same image but skips
|
|
# nix: it needs only bash + node, both in the base image.
|
|
#
|
|
# NOTE: the CI image has no ruby, so the script's `ruby -c` formula syntax
|
|
# check is skipped here (it degrades gracefully); the Scoop JSON is still
|
|
# validated with node and both manifests' fields are asserted. Full formula
|
|
# syntax is checked dev-side (ruby present) on every pre-commit local run.
|
|
manifests:
|
|
runs-on: ci-public
|
|
container:
|
|
image: git.lazyeval.net/oli/rdbms-playground-ci:latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: render-script tests (Scoop + Homebrew)
|
|
run: bash scripts/test-package-renders.sh
|