mward4/deepseek-harness
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 32 Wiki Activity

Merge master into job lifecycle timing and refresh owned fixtures

Browse Source
This commit is contained in:
fz committed 2026-10-08 11:02:16 +08:00
2 parents 95fec5694e b4443d4a90
commit 672b384eea
5646 files changed
+135257 -53826
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/build-exe-for-python-sdk.yml
+14 -11
View File
@@ -72,7 +72,7 @@ jobs:
version: ${{ steps.version.outputs.version }}
repository-version: ${{ steps.version.outputs.repository-version }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
- name: Resolve repository version
id: version
@@ -130,7 +130,7 @@ jobs:
&& 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
timeout-minutes: 5
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
- uses: actions/[email protected]
with:
@@ -145,7 +145,7 @@ jobs:
--package sdk
--output-dir dist-python
- uses: actions/upload-artifact@v7
- uses: actions/upload-artifact@v7.0.1
with:
name: deepseek_harness_sdk-${{ needs.plan.outputs.version }}-py3-none-any.whl
path: dist-python/deepseek_harness_sdk-${{ needs.plan.outputs.version }}-py3-none-any.whl
@@ -168,11 +168,11 @@ jobs:
matrix:
include: ${{ fromJSON(needs.plan.outputs.matrix) }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-js-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
@@ -185,7 +185,7 @@ jobs:
# setup-node's built-in pnpm store cache keys on platform AND arch, so
# the Linux architectures sharing runner.os stay on separate caches.
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: 24
cache: pnpm
@@ -199,7 +199,7 @@ jobs:
# Cache pkg's target Node binary; lockfile changes roll the
# exact key while the restore prefix can seed its replacement.
- uses: actions/cache@v4
- uses: actions/cache@v6.1.0
with:
path: ~/.pkg-cache
key: pkg-fetch-${{ matrix.target }}-${{ hashFiles('pnpm-lock.yaml') }}
@@ -232,7 +232,8 @@ jobs:
esac
addon_dir="$(realpath packages/subprocess/subprocess-local/node_modules/node-pty)"
pnpm_setup_root="$(realpath "$(dirname "$(dirname "$PNPM_HOME")")")"
(cd "$addon_dir" && npm_config_build_from_source=true pnpm run install)
# Verification installs would install node-gyp inside the package and package it into the exe.
(cd "$addon_dir" && npm_config_build_from_source=true pnpm --config.verifyDepsBeforeRun=false run install)
addon="$addon_dir/build/Release/pty.node"
[ -f "$addon_dir/build/Makefile" ] || {
echo "::error::node-pty install did not generate $addon_dir/build/Makefile"
@@ -259,7 +260,9 @@ jobs:
- name: Build single-exe
env:
DSH_BUILD_CLIENT_PROFILE: official
run: pnpm exec tsx scripts/build-exe-for-python-sdk.ts --targets=${{ matrix.target }}
run: >-
pnpm exec tsx scripts/build-exe-for-python-sdk.ts --targets=${{ matrix.target }}
${{ inputs.ci && github.event_name == 'pull_request' && '--artifacts-only' || '' }}
- name: Resolve platform outputs (POSIX)
id: runtime-posix
@@ -308,7 +311,7 @@ jobs:
--runtime-exe "${{ steps.runtime-posix.outputs.exe || steps.runtime-windows.outputs.exe }}"
--output-dir dist-python
- uses: actions/download-artifact@v8
- uses: actions/download-artifact@v8.0.1
with:
name: deepseek_harness_sdk-${{ needs.plan.outputs.version }}-py3-none-any.whl
path: dist-python
@@ -497,7 +500,7 @@ jobs:
env -u PYTHONPATH -u DSH_RUNTIME_MODE /tmp/dsh-sdk/bin/python /work/scripts/smoke-python-runtime.py --scenario sdk-mcp --installed-wheel
'
- uses: actions/upload-artifact@v7
- uses: actions/upload-artifact@v7.0.1
with:
name: ${{ steps.runtime-posix.outputs.wheel || steps.runtime-windows.outputs.wheel }}
path: dist-python/${{ steps.runtime-posix.outputs.wheel || steps.runtime-windows.outputs.wheel }}
.github/workflows/build-preview-cloudflare.yml
+6 -6
View File
@@ -35,15 +35,15 @@ jobs:
runs-on: ubuntu-24.04
name: cloudflare pages preview
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -57,7 +57,7 @@ jobs:
# Read-only: the preview lane consumes the default-branch cache without
# putting cache upload on its own path.
- uses: actions/cache/restore@v4
- uses: actions/cache/restore@v6.1.0
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -69,9 +69,9 @@ jobs:
# apps/web consumes workspace packages as built lib products, and
# build:preview packs the image through the packer's installed bin
# (lib/bin.js), so neither half exists before the full build runs.
# (lib/bin.js), so neither half exists before the artifact build runs.
- name: Build workspace
run: pnpm run build
run: pnpm run build --artifacts-only
- name: Build the preview page and pack the VFS image
env:
.github/workflows/ci-master.yml
+22 -22
View File
@@ -48,15 +48,15 @@ jobs:
name: windows node 24 / wine
timeout-minutes: 15
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -68,7 +68,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- uses: actions/cache/restore@v4
- uses: actions/cache/restore@v6.1.0
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -80,7 +80,7 @@ jobs:
id: wine-cache-key
run: echo "key=wine-debs-${ImageOS:-linux}-${ImageVersion:-v0}" >> "$GITHUB_OUTPUT"
- uses: actions/cache@v4
- uses: actions/cache@v6.1.0
with:
path: ~/wine-debs
key: ${{ steps.wine-cache-key.outputs.key }}
@@ -139,21 +139,21 @@ jobs:
# github.event.before, so full history is required: depth 2 would miss it
# on multi-commit or force pushes; full fetch is cheap here because
# checkout resolves against the VM's local mirror.
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
# Redirect the Node compile cache (enabled by pnpm and TypeScript) off
# the root partition's /tmp before the first pnpm call in this lane —
# see .agents/notes/implemented/process/2026-08-28-ci-node-compile-cache-data-disk.md.
# the root partition's /tmp before the first pnpm call in this lane.
# see .github/workflows/ci.yml.
- name: Redirect Node compile cache to runner temp
run: echo "NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache" >> "$GITHUB_ENV"
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -191,13 +191,13 @@ jobs:
name: serial / macos
runs-on: macos-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -230,7 +230,7 @@ jobs:
runs-on: [self-hosted, dsh-win-ci, windows]
timeout-minutes: 120
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
- name: Enable Developer Mode (symlink support)
shell: pwsh
@@ -238,11 +238,11 @@ jobs:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
/t REG_DWORD /f /v "AllowDevelopmentWithoutDevLicense" /d "1"
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -356,15 +356,15 @@ jobs:
blacksmith: ''
workload: production-site
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
# The benchmark's Windows lanes deliberately skip the store cache like
# the independent native Windows job; an empty input disables caching.
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
cache: ${{ matrix.platform == 'linux' && 'pnpm' || '' }}
@@ -467,15 +467,15 @@ jobs:
blacksmith: ''
workers: '2'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
# Unlike the larger-runner suite, both platforms cache the store here:
# the consolidated topology measures cache mechanics as workload.
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
cache: pnpm
.github/workflows/ci.yml
+57 -43
View File
@@ -61,22 +61,21 @@ jobs:
echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
# Fetch complete history so the archive gate can read the trusted PR base from a reused shallow checkout.
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
persist-credentials: false
# Redirect the Node compile cache (enabled by pnpm and TypeScript) off
# the root partition's /tmp before the first pnpm call in this lane —
# see .agents/notes/implemented/process/2026-08-28-ci-node-compile-cache-data-disk.md.
# the root partition's /tmp before the first pnpm call in this lane.
- name: Redirect Node compile cache to runner temp
run: echo "NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache" >> "$GITHUB_ENV"
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -91,7 +90,7 @@ jobs:
# Pull requests consume the default-branch cache but do not put cache
# compression and upload on the paid latency-critical path. Skipped
# under failover — see the coverage lane's identical rationale.
- uses: actions/cache/restore@v4
- uses: actions/cache/restore@v6.1.0
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
with:
path: ${{ steps.pnpm-store.outputs.path }}
@@ -138,21 +137,28 @@ jobs:
run: |
echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- name: Restore coverage duration history
uses: actions/cache/[email protected]
with:
path: .coverage-times.json
key: coverage-times-Linux-${{ runner.environment }}-${{ vars.DSH_CI_FAILOVER_LINUX || 'enterprise' }}-${{ github.run_id }}-${{ github.run_attempt }}
restore-keys: |
coverage-times-Linux-${{ runner.environment }}-${{ vars.DSH_CI_FAILOVER_LINUX || 'enterprise' }}-
# Redirect the Node compile cache (enabled by pnpm and TypeScript) off
# the root partition's /tmp before the first pnpm call in this lane —
# see .agents/notes/implemented/process/2026-08-28-ci-node-compile-cache-data-disk.md.
# the root partition's /tmp before the first pnpm call in this lane.
- name: Redirect Node compile cache to runner temp
run: echo "NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache" >> "$GITHUB_ENV"
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -166,7 +172,7 @@ jobs:
# Self-hosted runners reuse the shared persistent pnpm store.
# Hosted runners restore the remote cache into their ephemeral store.
- uses: actions/cache/restore@v4
- uses: actions/cache/restore@v6.1.0
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
with:
path: ${{ steps.pnpm-store.outputs.path }}
@@ -190,6 +196,13 @@ jobs:
- name: Run exhaustive coverage
run: pnpm run check:ci:coverage
- name: Save coverage duration history
if: ${{ !cancelled() }}
uses: actions/cache/[email protected]
with:
path: .coverage-times.json
key: coverage-times-Linux-${{ runner.environment }}-${{ vars.DSH_CI_FAILOVER_LINUX || 'enterprise' }}-${{ github.run_id }}-${{ github.run_attempt }}
node-24-bench:
if: github.event_name == 'pull_request'
runs-on: ubuntu-24.04
@@ -198,15 +211,15 @@ jobs:
# benchmark lane alone instead of joining a concurrent gate aggregate.
timeout-minutes: 20
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -218,7 +231,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- uses: actions/cache/restore@v4
- uses: actions/cache/restore@v6.1.0
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -264,21 +277,20 @@ jobs:
echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
echo "PLAYWRIGHT_BROWSERS_PATH=${RUNNER_TEMP%/*}/ms-playwright" >> "$GITHUB_ENV"
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
# Redirect the Node compile cache (enabled by pnpm and TypeScript) off
# the root partition's /tmp before the first pnpm call in this lane —
# see .agents/notes/implemented/process/2026-08-28-ci-node-compile-cache-data-disk.md.
# the root partition's /tmp before the first pnpm call in this lane.
- name: Redirect Node compile cache to runner temp
run: echo "NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache" >> "$GITHUB_ENV"
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -295,7 +307,7 @@ jobs:
# hosted cache keys, so each restore-keys fallback hits the matching archived
# entry until it evicts, after which the store is cold. Self-hosted runners
# reuse the shared persistent store instead of restoring the remote archive.
- uses: actions/cache/restore@v4
- uses: actions/cache/restore@v6.1.0
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
with:
path: ${{ steps.pnpm-store.outputs.path }}
@@ -304,7 +316,7 @@ jobs:
${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-
# Self-hosted runners retain their own browser cache between jobs.
- uses: actions/cache/restore@v4
- uses: actions/cache/restore@v6.1.0
if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
with:
path: ${{ env.PLAYWRIGHT_BROWSERS_PATH }}
@@ -386,6 +398,7 @@ jobs:
DSH_GATE_FAIL_FAST: '1'
strategy:
fail-fast: false
max-parallel: 1
matrix:
include:
- node: '22.19'
@@ -404,7 +417,7 @@ jobs:
runner: ubuntu-latest
gate_concurrency: '1'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
@@ -416,11 +429,11 @@ jobs:
echo "npm_config_devdir=$RUNNER_TEMP/node-gyp" >> "$GITHUB_ENV"
echo "PNPM_CONFIG_STORE_DIR=$HOME/.local/share/pnpm/store" >> "$GITHUB_ENV"
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
env:
# The runner overwrites RUNNER_* step env before starting JavaScript actions.
NODE_OPTIONS: ${{ runner.environment == 'self-hosted' && '--import=./scripts/ci-compatible-toolcache.mjs' || '' }}
@@ -461,7 +474,7 @@ jobs:
runs-on: ubuntu-latest
name: python 3.10 / keyless SDK
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
- uses: actions/[email protected]
with:
@@ -471,7 +484,7 @@ jobs:
- name: Install uv
run: python -m pip install uv==0.11.23
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: 24
@@ -486,6 +499,7 @@ jobs:
# Linux ARM64 and both macOS architectures run in ci-master.yml.
python-runtime:
if: github.event_name == 'pull_request'
needs: python-sdk
name: python runtime / release-shaped matrix
uses: ./.github/workflows/build-exe-for-python-sdk.yml
with:
@@ -514,7 +528,7 @@ jobs:
# A failing build or site aborts the sibling gate on the same runner.
DSH_GATE_FAIL_FAST: '1'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- name: Enable Developer Mode (symlink support)
@@ -522,10 +536,10 @@ jobs:
run: >-
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
/t REG_DWORD /f /v "AllowDevelopmentWithoutDevLicense" /d "1"
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-js-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
- name: Install (immutable)
@@ -582,7 +596,7 @@ jobs:
# multi-minute instrumented run.
DSH_GATE_FAIL_FAST: '1'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
# Checkout removes the gitignored duration history, so restore it from
@@ -592,24 +606,24 @@ jobs:
# entries are immutable, so the save key is unique per run and the
# restore matches the newest entry through the stable prefix.
- name: Restore coverage duration history
uses: actions/cache/restore@v4
uses: actions/cache/restore@v6.1.0
with:
path: .coverage-times.json
key: coverage-times-${{ github.run_id }}
key: coverage-times-Windows-${{ runner.environment }}-${{ vars.DSH_CI_FAILOVER_WINDOWS || 'enterprise' }}-${{ github.run_id }}-${{ github.run_attempt }}
restore-keys: |
coverage-times-
coverage-times-Windows-${{ runner.environment }}-${{ vars.DSH_CI_FAILOVER_WINDOWS || 'enterprise' }}-
- name: Enable Developer Mode (symlink support)
shell: pwsh
run: >-
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
/t REG_DWORD /f /v "AllowDevelopmentWithoutDevLicense" /d "1"
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-js-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
# Node 24 still awaits the cppgc Realm-lifetime backport (#66168).
# 26.10.0 contains nodejs/node#65778; an exact version prevents a
# runner cache from selecting an older Node 26 with the same crash.
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: '26.10.0'
- name: Install (immutable)
@@ -638,10 +652,10 @@ jobs:
# measured durations remain useful even when a partition failed. The
# per-run key keeps every save a fresh immutable cache entry.
if: ${{ !cancelled() }}
uses: actions/cache/save@v4
uses: actions/cache/save@v6.1.0
with:
path: .coverage-times.json
key: coverage-times-${{ github.run_id }}
key: coverage-times-Windows-${{ runner.environment }}-${{ vars.DSH_CI_FAILOVER_WINDOWS || 'enterprise' }}-${{ github.run_id }}-${{ github.run_attempt }}
windows-native-tests:
if: github.event_name == 'pull_request'
@@ -654,7 +668,7 @@ jobs:
name: windows node 24 / native tests
timeout-minutes: 60
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- name: Enable Developer Mode (symlink support)
@@ -662,10 +676,10 @@ jobs:
run: >-
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
/t REG_DWORD /f /v "AllowDevelopmentWithoutDevLicense" /d "1"
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-js-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
- name: Install (immutable)
@@ -689,7 +703,7 @@ jobs:
--testTimeout 90000
packages/shell/tool-pwsh/tests/loader.spec.ts
packages/workflow/workflow-ptc/tests/workflow-ptc.spec.ts
packages/workflow/tool-ralph/tests/integration.spec.ts
packages/experimental/tool-ralph/tests/integration.spec.ts
packages/subprocess/subprocess-local/tests/process-exit.spec.ts
# Single stable required check for branch protection: require "all checks
.github/workflows/docs-pages.yml
+3 -3
View File
@@ -41,14 +41,14 @@ jobs:
pages: read
steps:
# Complete history: the release scripts read tags.
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
persist-credentials: false
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
cache: pnpm
.github/workflows/e2e.yml
+4 -4
View File
@@ -67,11 +67,11 @@ jobs:
# and retry 2; 45m still bounds retry storms against a slow API.
timeout-minutes: 45
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: 24
cache: pnpm
@@ -107,7 +107,7 @@ jobs:
# the built artifact under plain Node, resolving plugins through real package
# exports — the shape a real consumer runs. That requires a prior build.
- name: Build (lib for the e2e example bins)
run: pnpm run build:official
run: ${{ github.event_name == 'pull_request' && 'pnpm run build --artifacts-only --profile official' || 'pnpm run build:official' }}
- name: Prepare Office runtime
run: pnpm run prepare:primary-runtime --target linux-x64 --output .cache/e2e-office
.github/workflows/expected-filenames.yml
+1 -1
View File
@@ -22,7 +22,7 @@ jobs:
${{ vars.DSH_CI_FAILOVER_LINUX == 'blacksmith' && 'blacksmith-4vcpu-ubuntu-2404'
|| 'ubuntu-latest' }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
- name: Check tracked filenames
run: scripts/check-expected-filenames.sh
.github/workflows/node-addon-system-release.yml
+13 -13
View File
@@ -32,7 +32,7 @@ jobs:
outputs:
prebuilds: ${{ steps.matrix.outputs.prebuilds }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7.0.1
- id: matrix
run: echo "prebuilds=$(node ./scripts/github-matrix.mjs release-prebuild)" >> "$GITHUB_OUTPUT"
@@ -45,13 +45,13 @@ jobs:
fail-fast: false
matrix: ${{ fromJson(needs.matrix.outputs.prebuilds) }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7.0.1
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
package_json_file: package.json
- uses: actions/setup-node@v4
- uses: actions/setup-node@v7.0.0
with:
node-version: 24
cache: pnpm
@@ -80,7 +80,7 @@ jobs:
pnpm test:packaging
- name: Upload prebuild artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7.0.1
with:
name: ${{ matrix.artifact }}
path: native/system/${{ matrix.dir }}/bin/**
@@ -92,13 +92,13 @@ jobs:
needs: build-prebuilds
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7.0.1
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
package_json_file: package.json
- uses: actions/setup-node@v4
- uses: actions/setup-node@v7.0.0
with:
node-version: 24
cache: pnpm
@@ -116,7 +116,7 @@ jobs:
RELEASE_PUBLISH: ${{ inputs.publish }}
- name: Download prebuild artifacts
uses: actions/download-artifact@v4
uses: actions/download-artifact@v8.0.1
with:
pattern: prebuild-*
path: native/system/.release/prebuild-artifacts
@@ -138,7 +138,7 @@ jobs:
NALR_REQUIRE_LANDLOCK: 1
- name: Upload npm tarballs
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7.0.1
with:
name: npm-tarballs
path: native/system/dist/npm/*
@@ -157,17 +157,17 @@ jobs:
steps:
# The publish script is the only repository file this job needs, and it
# imports nothing outside Node's builtins, so there is no install step.
- uses: actions/checkout@v4
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: actions/setup-node@v4
- uses: actions/setup-node@v7.0.0
with:
node-version: 24
registry-url: https://registry.npmjs.org
- name: Download npm tarballs
uses: actions/download-artifact@v4
uses: actions/download-artifact@v8.0.1
with:
name: npm-tarballs
path: native/system/dist/npm
.github/workflows/node-addon-system.yml
+9 -7
View File
@@ -48,7 +48,7 @@ jobs:
outputs:
ci: ${{ steps.matrix.outputs.ci }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7.0.1
- id: matrix
run: echo "ci=$(node ./scripts/github-matrix.mjs ci)" >> "$GITHUB_OUTPUT"
@@ -61,13 +61,15 @@ jobs:
fail-fast: false
matrix: ${{ fromJson(needs.matrix.outputs.ci) }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7.0.1
- uses: pnpm/action-setup@v4
# pnpm v11 ships no darwin-x64 standalone binary, and the pnpm/action-setup
# v6 self-update path needs one; this job stays on the v5 npm-install line.
- uses: pnpm/[email protected]
with:
package_json_file: package.json
- uses: actions/setup-node@v4
- uses: actions/setup-node@v7.0.0
with:
node-version: 24
cache: pnpm
@@ -125,7 +127,7 @@ jobs:
node:24-alpine
node --test ./test/flock.test.js ./test/package-matrix.test.js
- uses: actions/setup-node@v4
- uses: actions/setup-node@v7.0.0
with:
node-version: 20
@@ -139,7 +141,7 @@ jobs:
node:20-alpine
node --test ./test/flock.test.js ./test/package-matrix.test.js
- uses: actions/setup-node@v4
- uses: actions/setup-node@v7.0.0
with:
node-version: 22
@@ -153,7 +155,7 @@ jobs:
node:22-alpine
node --test ./test/flock.test.js ./test/package-matrix.test.js
- uses: actions/setup-node@v4
- uses: actions/setup-node@v7.0.0
with:
node-version: 26
.github/workflows/pi-ai-provider-e2e.yml
+3 -3
View File
@@ -30,11 +30,11 @@ jobs:
name: Azure OpenAI Responses + Anthropic Messages
timeout-minutes: 20
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: 24
cache: pnpm
.github/workflows/python-release.yml
+7 -7
View File
@@ -40,7 +40,7 @@ jobs:
matrix:
python: ['3.10', '3.14']
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
@@ -48,7 +48,7 @@ jobs:
with:
python-version: ${{ matrix.python }}
- uses: actions/download-artifact@v8
- uses: actions/download-artifact@v8.0.1
with:
pattern: deepseek_harness_*
path: dist
@@ -83,7 +83,7 @@ jobs:
outputs:
version: ${{ steps.version.outputs.version }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
@@ -134,7 +134,7 @@ jobs:
}
fi
- uses: actions/download-artifact@v8
- uses: actions/download-artifact@v8.0.1
with:
pattern: deepseek_harness_*
path: dist
@@ -175,7 +175,7 @@ jobs:
sha256sum *.whl | sort -k2 > SHA256SUMS
cat SHA256SUMS
- uses: actions/upload-artifact@v7
- uses: actions/upload-artifact@v7.0.1
with:
name: python-release-${{ steps.version.outputs.version }}
path: dist/*
@@ -193,7 +193,7 @@ jobs:
contents: read
id-token: write
steps:
- uses: actions/download-artifact@v8
- uses: actions/download-artifact@v8.0.1
with:
name: python-release-${{ needs.validate.outputs.version }}
path: dist
@@ -228,7 +228,7 @@ jobs:
contents: read
id-token: write
steps:
- uses: actions/download-artifact@v8
- uses: actions/download-artifact@v8.0.1
with:
name: python-release-${{ needs.validate.outputs.version }}
path: dist
.github/workflows/release-publish.yml
+9 -9
View File
@@ -21,16 +21,16 @@ jobs:
runs-on: ubuntu-24.04
steps:
# Complete history: the release scripts read tags.
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
persist-credentials: false
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -42,7 +42,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- uses: actions/cache/restore@v4
- uses: actions/cache/restore@v6.1.0
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -82,7 +82,7 @@ jobs:
- name: Verify packed install
run: pnpm run release:verify-packed-install --family dsh --from dist/npm --from dist/npm-vendor --from dist/npm-landlock
- uses: actions/upload-artifact@v4
- uses: actions/upload-artifact@v7.0.1
with:
name: dsh-npm-tarballs
path: dist/npm/*
@@ -104,15 +104,15 @@ jobs:
steps:
# Checkout and install carry the release scripts only. There is no build
# step: publication uploads the bytes the pack job produced.
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
registry-url: https://registry.npmjs.org
@@ -120,7 +120,7 @@ jobs:
- name: Install (immutable, no package scripts)
run: pnpm install --frozen-lockfile --ignore-scripts
- uses: actions/download-artifact@v4
- uses: actions/download-artifact@v8.0.1
with:
name: dsh-npm-tarballs
path: dist/npm
.github/workflows/release-vendor-publish.yml
+22 -10
View File
@@ -7,6 +7,12 @@ name: Release publish (vendor)
on:
workflow_dispatch:
inputs:
dist-tag:
description: Optional unused npm channel. Leave empty for latest (stable) or next (prerelease).
required: false
type: string
default: ''
permissions:
contents: read
@@ -21,16 +27,16 @@ jobs:
runs-on: ubuntu-24.04
steps:
# Complete history: the release scripts read tags.
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
persist-credentials: false
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
@@ -42,7 +48,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- uses: actions/cache/restore@v4
- uses: actions/cache/restore@v6.1.0
with:
path: ${{ steps.pnpm-store.outputs.path }}
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -68,7 +74,7 @@ jobs:
- name: Verify packed install
run: pnpm run release:verify-packed-install --family vendor --from dist/npm-vendor
- uses: actions/upload-artifact@v4
- uses: actions/upload-artifact@v7.0.1
with:
name: vendor-npm-tarballs
path: dist/npm-vendor/*
@@ -87,15 +93,15 @@ jobs:
contents: read
steps:
# Checkout and install carry the release scripts only; no build step.
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
registry-url: https://registry.npmjs.org
@@ -103,7 +109,7 @@ jobs:
- name: Install (immutable, no package scripts)
run: pnpm install --frozen-lockfile --ignore-scripts
- uses: actions/download-artifact@v4
- uses: actions/download-artifact@v8.0.1
with:
name: vendor-npm-tarballs
path: dist/npm-vendor
@@ -111,4 +117,10 @@ jobs:
- name: Publish tarballs
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: pnpm run release:publish --family vendor --from dist/npm-vendor
RELEASE_DIST_TAG: ${{ inputs.dist-tag }}
run: |
args=()
if [[ -n "$RELEASE_DIST_TAG" ]]; then
args+=(--dist-tag "$RELEASE_DIST_TAG")
fi
pnpm run release:publish --family vendor --from dist/npm-vendor "${args[@]}"
.github/workflows/release-vendor.yml
+6 -6
View File
@@ -43,7 +43,7 @@ jobs:
|| 'ubuntu-24.04' }}
steps:
# Complete history: the release scripts read tags.
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
persist-credentials: false
@@ -55,11 +55,11 @@ jobs:
echo "npm_config_devdir=${{ runner.temp }}/node-gyp" >> "$GITHUB_ENV"
echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
package-manager-cache: false
@@ -72,7 +72,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- uses: actions/cache/restore@v4
- uses: actions/cache/restore@v6.1.0
if: runner.environment == 'github-hosted'
with:
path: ${{ steps.pnpm-store.outputs.path }}
@@ -89,7 +89,7 @@ jobs:
# The vendored packages publish their own sources and build outputs; the
# host build produces what their manifests select.
- name: Build
run: pnpm run build:lib:host
run: ${{ github.event_name == 'pull_request' && 'pnpm exec tsx scripts/compile-referenced-projects.ts host-libraries' || 'pnpm run build:lib:host' }}
# Concurrency here is rehearsal-only: the credentialed publish workflows
# invoke release:pack without the flag and keep the strictly serial path.
@@ -99,7 +99,7 @@ jobs:
- name: Verify packed install
run: pnpm run release:verify-packed-install --family vendor --from dist/npm-vendor
- uses: actions/upload-artifact@v4
- uses: actions/upload-artifact@v7.0.1
with:
name: vendor-npm-tarballs
path: dist/npm-vendor/*
.github/workflows/release.yml
+10 -10
View File
@@ -41,7 +41,7 @@ jobs:
&& fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
|| 'ubuntu-24.04' }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
clean: true
@@ -52,11 +52,11 @@ jobs:
echo "npm_config_devdir=${{ runner.temp }}/node-gyp" >> "$GITHUB_ENV"
echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
package-manager-cache: false
@@ -69,7 +69,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- uses: actions/cache/restore@v4
- uses: actions/cache/restore@v6.1.0
if: runner.environment == 'github-hosted'
with:
path: ${{ steps.pnpm-store.outputs.path }}
@@ -102,7 +102,7 @@ jobs:
|| 'ubuntu-24.04' }}
steps:
# Complete history: the release scripts read tags.
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
persist-credentials: false
@@ -114,11 +114,11 @@ jobs:
echo "npm_config_devdir=${{ runner.temp }}/node-gyp" >> "$GITHUB_ENV"
echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
with:
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: ${{ env.PRIMARY_NODE_VERSION }}
package-manager-cache: false
@@ -131,7 +131,7 @@ jobs:
store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)
echo "path=$store_path" >> "$GITHUB_OUTPUT"
- uses: actions/cache/restore@v4
- uses: actions/cache/restore@v6.1.0
if: runner.environment == 'github-hosted'
with:
path: ${{ steps.pnpm-store.outputs.path }}
@@ -146,7 +146,7 @@ jobs:
run: pnpm run release:verify --family dsh
- name: Build
run: pnpm run build:official
run: ${{ github.event_name == 'pull_request' && 'pnpm run build --artifacts-only --profile official' || 'pnpm run build:official' }}
# Concurrency here is rehearsal-only: the credentialed publish workflows
# invoke release:pack without the flag and keep the strictly serial path.
@@ -172,7 +172,7 @@ jobs:
- name: Verify packed install
run: pnpm run release:verify-packed-install --family dsh --from dist/npm --from dist/npm-vendor --from dist/npm-landlock
- uses: actions/upload-artifact@v4
- uses: actions/upload-artifact@v7.0.1
with:
name: dsh-npm-tarballs
path: dist/npm/*
.github/workflows/sandbox.yml
+6 -6
View File
@@ -66,11 +66,11 @@ jobs:
|| matrix.os }}
timeout-minutes: 20
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: 24
@@ -146,11 +146,11 @@ jobs:
runs-on: macos-latest
timeout-minutes: 60
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7.0.1
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v5.0.0
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7.0.0
with:
node-version: 24