chore(wheelhouse): cascade template@b41327836 #2797
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Seeded from the socket-wheelhouse CI preset, then owned by this repo: | |
| # edit it here. Fleet CI runs check + test through the LOCAL composite | |
| # actions under .github/actions/, inlined, so there is no cross-repo | |
| # reusable workflow and no first-party `uses:@sha`. | |
| name: ⚡ CI | |
| # PUSH, never pull_request. The fleet takes no outside contributions and | |
| # lands on main directly, so a pull_request trigger adds no coverage a push | |
| # trigger does not already give — and it is the fragile half: GitHub has | |
| # narrowed pull_request defaults for security, and a silently non-firing | |
| # trigger reads as a green repo with no CI at all. | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['*'] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # First step of every job is the third-party actions/checkout (GitHub fetches | |
| # it independently) to populate the workspace so the LOCAL `./.github/actions/*` | |
| # composites resolve. setup-and-install then re-checks-out — full history | |
| # (fetch-depth 0) in the check job, since the commit-history checks it runs | |
| # (AI-attribution, release-boundary) read the default branch's history and | |
| # refuse a shallow clone rather than false-green; the test matrix stays at | |
| # the default depth (25 — covers CI's other git operations) and runs the | |
| # zizmor Actions audit (its own `strategy.job-total < 2` skip runs it in the | |
| # non-matrix check job, skips it in the test matrix). | |
| check: | |
| name: 🔎 Check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| # First step can't call the local ./.github/actions/fleet/checkout | |
| # composite (nothing checked out yet); bootstrap the workspace with an | |
| # inline git-fetch, matching release-reconcile.yml's pattern. The full | |
| # history this job needs comes from setup-and-install's own | |
| # checkout-fetch-depth: '0' re-checkout below, so this bootstrap fetch | |
| # stays shallow. | |
| - name: Bootstrap checkout | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| SERVER_URL: ${{ github.server_url }} | |
| REPOSITORY: ${{ github.repository }} | |
| TRIGGER_REF: ${{ github.ref }} | |
| run: | | |
| set -euo pipefail | |
| git init -q | |
| git config --local advice.detachedHead false | |
| git remote remove origin 2>/dev/null || true | |
| git remote add origin "${SERVER_URL}/${REPOSITORY}" | |
| FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}") | |
| if [ -n "${GITHUB_TOKEN}" ]; then | |
| AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')" | |
| git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}" | |
| else | |
| git fetch "${FETCH_ARGS[@]}" | |
| fi | |
| git checkout -q --detach FETCH_HEAD | |
| - uses: ./.github/actions/fleet/setup-and-install | |
| with: | |
| # Authorizes a thin member's bundle download during install. Both | |
| # stay empty on a member with no payload App, which skips the mint. | |
| payload-token-client-id: ${{ vars.SOCKET_PAYLOAD_CLIENT_ID }} | |
| payload-token-private-key: ${{ secrets.SOCKET_PAYLOAD_APP_PRIVATE_KEY }} | |
| # Full history: the commit-history checks (AI-attribution, | |
| # release-boundary) read the default branch's history and refuse a | |
| # shallow clone rather than false-green. | |
| checkout-fetch-depth: '0' | |
| socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} | |
| - uses: ./.github/actions/fleet/run-script | |
| with: | |
| main-script: pnpm run check --all | |
| test: | |
| name: 🧪 Test | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 4 | |
| matrix: | |
| # JS/TS tests only need a fast Linux run; cross-platform behavior is | |
| # covered by unit tests, not the CI matrix. | |
| os: [ubuntu-latest] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 15 | |
| steps: | |
| # First step can't call the local ./.github/actions/fleet/checkout | |
| # composite (nothing checked out yet); bootstrap the workspace with an | |
| # inline git-fetch, matching release-reconcile.yml's pattern. | |
| - name: Bootstrap checkout | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| SERVER_URL: ${{ github.server_url }} | |
| REPOSITORY: ${{ github.repository }} | |
| TRIGGER_REF: ${{ github.ref }} | |
| run: | | |
| set -euo pipefail | |
| git init -q | |
| git config --local advice.detachedHead false | |
| git remote remove origin 2>/dev/null || true | |
| git remote add origin "${SERVER_URL}/${REPOSITORY}" | |
| FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}") | |
| if [ -n "${GITHUB_TOKEN}" ]; then | |
| AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')" | |
| git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}" | |
| else | |
| git fetch "${FETCH_ARGS[@]}" | |
| fi | |
| git checkout -q --detach FETCH_HEAD | |
| - uses: ./.github/actions/fleet/setup-and-install | |
| with: | |
| # Authorizes a thin member's bundle download during install. Both | |
| # stay empty on a member with no payload App, which skips the mint. | |
| payload-token-client-id: ${{ vars.SOCKET_PAYLOAD_CLIENT_ID }} | |
| payload-token-private-key: ${{ secrets.SOCKET_PAYLOAD_APP_PRIVATE_KEY }} | |
| socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} | |
| - uses: ./.github/actions/fleet/run-script | |
| env: | |
| # Authenticate build-time GitHub API reads (release listings, | |
| # prebuilt-artifact downloads). Unauthenticated calls share the | |
| # hosted runner's IP-scoped rate limit and 403 under load. | |
| GH_TOKEN: ${{ github.token }} | |
| with: | |
| setup-script: pnpm run build | |
| main-script: pnpm test --all |