devdeck/.github/workflows/ci.yml at main · writingdeveloper/devdeck · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:
  workflow_call:

permissions:
  contents: read

jobs:
  test:
    name: build & test (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    env:
      # The unit tests + tsc don't need the Electron/Playwright binaries — skip the heavy downloads.
      ELECTRON_SKIP_BINARY_DOWNLOAD: '1'
      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: '.nvmrc'
          cache: npm
      - run: npm ci
      - run: npm run build
      - run: npm test
      - run: npm run check:docs
      # Verify the macOS launcher's generated AppleScript compiles on a real Mac (no GUI needed).
      - name: Validate generated AppleScript compiles
        if: runner.os == 'macOS'
        run: node scripts/check-applescript.mjs

  qa:
    # The Playwright/axe audit (a11y per view + the IPC surface round-trips) was previously
    # manual-only — its gates never ran on a PR. One Linux leg under xvfb keeps it cheap.
    name: qa audit (a11y + ipc, linux)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: '.nvmrc'
          cache: npm
      - run: npm ci
      - run: npm run build
      # ubuntu-24.04 runners restrict unprivileged user namespaces (AppArmor), which kills the
      # Electron/Chromium sandbox before a window ever appears — firstWindow() then times out.
      - name: Allow unprivileged user namespaces for the Electron sandbox
        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
      - name: Install a window manager for real maximize and restore journeys
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends openbox
      # The audit verifies cockpit.gitInfo resolves the repo's branch. actions/checkout leaves the repo
      # in detached HEAD (no current branch), so that check would fail for an environment reason unrelated
      # to the app — put the checkout on a real branch first. (Local `npm run qa:audit` is already on one.)
      - name: Put the checkout on a branch for the gitInfo check
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          git checkout -B ci-audit
      - name: Run the audit under a virtual display
        run: xvfb-run -a node qa/audit.mjs
        env:
          DEBUG: 'pw:browser' # if launch fails again, the electron process's own stderr lands in the log
      - name: Run the multilingual user journeys
        run: xvfb-run -a sh -c 'openbox --sm-disable >/tmp/devdeck-openbox.log 2>&1 & node qa/screenshot.mjs'
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: qa-audit-and-journeys
          path: qa/shots/

  resilience:
    name: failure and recovery journeys (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: '.nvmrc'
          cache: npm
      - run: npm ci
      - name: Check dependency advisories
        if: runner.os == 'Linux'
        run: |
          npm audit --audit-level=high
          npm audit --omit=dev --audit-level=moderate
      - run: npm run build
      - name: Allow Electron sandbox
        if: runner.os == 'Linux'
        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
      - name: Run Linux failure and recovery journeys
        if: runner.os == 'Linux'
        run: xvfb-run -a node qa/resilience.mjs
      - name: Run Windows failure and recovery journeys
        if: runner.os == 'Windows'
        run: node qa/resilience.mjs
      - name: Run Linux maintenance regressions
        if: runner.os == 'Linux'
        run: xvfb-run -a node qa/maintenance.mjs
      - name: Run Windows maintenance regressions
        if: runner.os == 'Windows'
        run: node qa/maintenance.mjs
      - name: Verify host and two viewers agree on committed session titles
        if: runner.os == 'Windows'
        run: node qa/session-sync.mjs
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: qa-resilience-${{ matrix.os }}
          path: |
            qa/shots/resilience/
            qa/shots/maintenance/
            qa/shots/session-sync/