import { readFileSync } from 'node:fs' import { resolve } from 'node:path' import { runInNewContext } from 'node:vm' import * as yaml from 'js-yaml' import { describe, expect, it } from 'vitest' function evaluateRunsOn(selector: unknown, context: Record): unknown { if (typeof selector !== 'string') throw new TypeError('Runner selector must be a string') return runInNewContext(selector.trim().slice(3, -2), context, { timeout: 1000 }) } const root = resolve(import.meta.dirname, '..') const runnerPrivatePnpmDestination = /^\$\{\{ runner\.temp \}\}\/setup-pnpm-\$\{\{ github\.run_id \}\}-\$\{\{ github\.run_attempt \}\}$/ const nativeWindowsPnpmDestination = '${{ runner.temp }}/setup-pnpm-js-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}' describe('CI workflow', () => { it('keeps at most ten worker jobs active across PR workflows while Python runtime targets follow the SDK suite', () => { const ci = loadWorkflow('.github/workflows/ci.yml') const ciWindows = loadWorkflow('.github/workflows/ci-windows.yml') const ciPython = loadWorkflow('.github/workflows/ci-python.yml') const compatibility = workflowJob(ci, 'node-compat') const runtime = workflowJob(ciPython, 'python-runtime') if (!isRecord(ci.jobs) || !isRecord(ciWindows.jobs) || !isRecord(ciPython.jobs) || !isRecord(compatibility.strategy) || !isRecord(runtime.with)) { throw new TypeError('CI, CI Windows, and CI Python must define jobs, compatibility scheduling, and runtime inputs') } const compatibilityLimit = compatibility.strategy['max-parallel'] const targets = runtime.with.targets if (typeof compatibilityLimit !== 'number' || typeof targets !== 'string') { throw new TypeError('CI requires a numeric compatibility limit and explicit runtime targets') } expect(Number.isInteger(compatibilityLimit)).toBe(true) expect(compatibilityLimit).toBeGreaterThan(0) expect(compatibility.strategy).toMatchObject({ 'fail-fast': false, matrix: { include: [{ node: '24.9' }, { node: 26 }] }, }) expect(workflowJob(ci, 'all-checks-passed').needs).toContain('node-compat') const ordinaryJobs = Object.entries(ci.jobs) .filter(([name]) => !['node-compat', 'all-checks-passed'].includes(name)) for (const [name, job] of ordinaryJobs) { if (!isRecord(job)) throw new TypeError(`${name} must define a job`) expect(job).not.toHaveProperty('strategy') expect(job).not.toHaveProperty('uses') } // Python reports its own required verdict, so neither its jobs nor a // reusable workflow caller remain in the Linux or Windows workflow. expect(Object.keys(ci.jobs).filter(name => name.startsWith('python'))).toEqual([]) expect(Object.keys(ciWindows.jobs)).not.toContain('python-runtime') const pythonSdk = workflowJob(ciPython, 'python-sdk') expect(pythonSdk).not.toHaveProperty('strategy') expect(pythonSdk).not.toHaveProperty('uses') expect(runtime.needs).toBe('python-sdk') expect(runtime.strategy).toBeUndefined() expect(runtime.with).toMatchObject({ targets: 'node24-linux-x64,node24-win-x64' }) expect(runtime.uses).toBe('./.github/workflows/build-exe-for-python-sdk.yml') const windowsJobs = Object.entries(ciWindows.jobs) .filter(([name]) => name !== 'windows-checks-passed') for (const [name, job] of windowsJobs) { if (!isRecord(job)) throw new TypeError(`${name} must define a job`) expect(job).not.toHaveProperty('strategy') expect(job).not.toHaveProperty('uses') } const builder = loadWorkflow('.github/workflows/build-exe-for-python-sdk.yml') if (!isRecord(builder.jobs)) throw new TypeError('Python runtime builder must define jobs') expect(Object.keys(builder.jobs).sort()).toEqual(['build', 'plan', 'sdk-wheel']) const plan = workflowJob(builder, 'plan') const wheel = workflowJob(builder, 'sdk-wheel') const build = workflowJob(builder, 'build') expect(plan.needs).toBeUndefined() expect(plan.strategy).toBeUndefined() expect(plan.uses).toBeUndefined() expect(wheel.needs).toBe('plan') expect(wheel.strategy).toBeUndefined() expect(wheel.uses).toBeUndefined() expect(build.needs).toEqual(['plan', 'sdk-wheel']) expect(build.uses).toBeUndefined() if (!isRecord(build.strategy)) throw new TypeError('Python runtime build must define its target matrix') expect(build.strategy.matrix).toEqual({ include: '${{ fromJSON(needs.plan.outputs.matrix) }}' }) // Python's runtime targets start only after the SDK suite; Windows starts // immediately. Plan and wheel stages precede the two-target matrix. const windowsActive = windowsJobs.length const beforeSdk = ordinaryJobs.length + compatibilityLimit + windowsActive + 1 const afterSdk = ordinaryJobs.length + compatibilityLimit + windowsActive + Math.max(1, targets.split(',').length) expect(beforeSdk).toBeLessThanOrEqual(10) expect(afterSdk).toBeLessThanOrEqual(10) }) it('keeps the union of required PR verdicts equal to the pre-split blocking set', () => { const verdicts = [ ['ci.yml', 'all-checks-passed'], ['ci-windows.yml', 'windows-checks-passed'], ['ci-python.yml', 'python-checks-passed'], ] as const const blocking: string[] = [] for (const [file, name] of verdicts) { const workflow = loadWorkflow('.github/workflows/' + file) const verdict = workflowJob(workflow, name) if (!isRecord(workflow.jobs) || !Array.isArray(verdict.needs)) { throw new TypeError(`${file} must define jobs and the ${name} verdict needs`) } const jobs = workflow.jobs expect(verdict.needs.every(id => typeof id === 'string' && id in jobs)).toBe(true) blocking.push(...(verdict.needs as string[])) } // Splitting the workflows only moves jobs between verdicts; the blocking // set itself must stay identical, or branch protection would accept a // failure it rejected before the split. expect(blocking.sort()).toEqual([ 'node-24', 'node-24-bench', 'node-24-consumers', 'node-24-coverage', 'node-compat', 'python-runtime', 'python-sdk', 'windows-build', 'windows-native-tests', ]) }) it('retains aggregate diagnostics in required builds and protected publication', () => { for (const [file, name, command] of [ ['ci.yml', 'node-24-consumers', 'pnpm run check:ci:consumers'], ['ci-windows.yml', 'windows-build', 'pnpm run check:ci:windows-blocking'], ] as const) { const job = workflowJob(loadWorkflow('.github/workflows/' + file), name) expect(job.steps).toContainEqual(expect.objectContaining({ run: command })) } for (const [file, command] of [ ['release-publish.yml', 'pnpm run build:official'], ['release-vendor-publish.yml', 'pnpm run build:lib:host'], ] as const) { expect(workflowJob(loadWorkflow('.github/workflows/' + file), 'pack').steps) .toContainEqual(expect.objectContaining({ name: 'Build', run: command })) } const scripts = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')) as { scripts: Record } const hostSteps = scripts.scripts['build:lib:host']!.split(' && ') expect(hostSteps[0]).toBe('tsx scripts/compile-referenced-projects.ts host-libraries') expect(hostSteps).toContain('node --max-old-space-size=4096 ./node_modules/typescript/bin/tsc -p tsconfig.host.json') expect(hostSteps.at(-1)).toBe('pnpm --filter @deepseek-ai/dsh-desktop run bundle') expect(scripts.scripts['build:lib:client']).toContain('tsc -b tsconfig.client.json') expect(scripts.scripts.typecheck).toBe('tsx scripts/build.ts --scope typecheck') }) it('selects artifact builds only for PR release and API rehearsals', () => { const official = "${{ github.event_name == 'pull_request' && 'pnpm run build:artifacts --profile official' || 'pnpm run build:official' }}" const vendor = "${{ github.event_name == 'pull_request' && 'pnpm exec tsx scripts/compile-referenced-projects.ts host-libraries' || 'pnpm run build:lib:host' }}" for (const [file, jobName, expected] of [ ['release.yml', 'pack', official], ['release-vendor.yml', 'pack', vendor], ['e2e.yml', 'e2e', official], ] as const) { const job = workflowJob(loadWorkflow('.github/workflows/' + file), jobName) if (!Array.isArray(job.steps)) throw new TypeError(`${jobName} must define steps`) const step = job.steps.filter(isRecord).find(candidate => typeof candidate.run === 'string' && (candidate.run.includes('build:artifacts') || candidate.run.includes('host-libraries'))) expect(step?.run).toBe(expected) for (const event of ['pull_request', 'push', 'workflow_dispatch']) { const expression = expected.slice('${{ '.length, -' }}'.length) const selected: unknown = runInNewContext(expression, { github: { event_name: event } }, { timeout: 1000 }) expect(selected).toBe(event === 'pull_request' ? file === 'release-vendor.yml' ? 'pnpm exec tsx scripts/compile-referenced-projects.ts host-libraries' : 'pnpm run build:artifacts --profile official' : file === 'release-vendor.yml' ? 'pnpm run build:lib:host' : 'pnpm run build:official') } } }) it('selects PR artifact compilation inside the Python executable builder', () => { const job = workflowJob(loadWorkflow('.github/workflows/build-exe-for-python-sdk.yml'), 'build') if (!Array.isArray(job.steps)) throw new TypeError('Python runtime builder must define steps') const steps = job.steps.filter(isRecord) const execute = steps.find(step => step.name === 'Build single-exe') expect(steps.some(step => step.run === 'pnpm run build:artifacts')).toBe(false) expect(execute).toMatchObject({ env: { DSH_BUILD_CLIENT_PROFILE: 'official' }, }) if (typeof execute?.run !== 'string') throw new TypeError('Python executable builder must define a command') const expression = [...execute.run.matchAll(/\$\{\{ ([^{}]+) \}\}/g)] .map(match => match[1]).find(value => value?.startsWith('inputs.ci')) expect(expression).toBe("inputs.ci && github.event_name == 'pull_request' && '--build-artifacts' || ''") if (expression === undefined) throw new TypeError('Python executable builder must select its build mode') for (const ci of [false, true]) { for (const event of ['pull_request', 'push', 'workflow_dispatch']) { const context = { inputs: { ci }, github: { event_name: event } } const selected: unknown = runInNewContext(expression, context, { timeout: 1000 }) expect(selected).toBe(ci && event === 'pull_request' ? '--build-artifacts' : '') } } }) it('prepares confinement before Node compatibility smokes', () => { const job = workflowJob(loadWorkflow('.github/workflows/ci.yml'), 'node-compat') if (!Array.isArray(job.steps)) throw new TypeError('Node compatibility job must define steps') const steps = job.steps.filter(isRecord) const preparation = steps.findIndex(step => step.run === 'bash scripts/prepare-ci-bubblewrap.sh') const smoke = steps.findIndex(step => step.run === 'pnpm run check:node-compat') expect(preparation).toBeGreaterThanOrEqual(0) expect(smoke).toBeGreaterThan(preparation) expect(steps[preparation]).not.toHaveProperty('continue-on-error', true) }) it.each(['ci.yml', 'ci-master.yml', 'e2e.yml', 'release.yml', 'release-vendor.yml'])( '%s cancels superseded validation runs without crossing workflow or ref boundaries', (name) => { const workflow = loadWorkflow('.github/workflows/' + name) expect(workflow.concurrency).toEqual({ group: '${{ github.workflow }}-${{ github.ref }}', 'cancel-in-progress': true, }) }, ) it('cancels reusable CI builds without cancelling release-owned builds', () => { const workflow = loadWorkflow('.github/workflows/build-exe-for-python-sdk.yml') expect(workflow.concurrency).toEqual({ group: 'build-single-exe-${{ github.workflow }}-${{ github.ref }}', 'cancel-in-progress': '${{ !inputs.release }}', }) }) it('does not cancel protected publication or deployment transactions', () => { for (const name of ['release-publish.yml', 'release-vendor-publish.yml']) { const publish = workflowJob(loadWorkflow('.github/workflows/' + name), 'publish') expect(publish.concurrency).toMatchObject({ 'cancel-in-progress': false }) } for (const name of ['python-release.yml', 'node-addon-system-release.yml', 'docs-pages.yml']) { expect(loadWorkflow('.github/workflows/' + name).concurrency).toMatchObject({ 'cancel-in-progress': false }) } }) it('skips coverage-history uploads on cancellation but retains Wine cleanup', () => { const coverage = workflowJob(loadWorkflow('.github/workflows/ci-windows.yml'), 'windows-coverage') const wine = workflowJob(loadWorkflow('.github/workflows/ci-master.yml'), 'windows') expect(coverage.steps).toContainEqual(expect.objectContaining({ name: 'Save coverage duration history', if: '${{ !cancelled() }}', })) expect(wine.steps).toContainEqual(expect.objectContaining({ name: 'Shut down wineserver', if: 'always()' })) }) it.each([ ['node-24-coverage', 'ci.yml', 'Linux', 'LINUX', 'pnpm run check:ci:coverage'], ['windows-coverage', 'ci-windows.yml', 'Windows', 'WINDOWS', 'pnpm run check:ci:coverage'], ])('reuses %s coverage timings only within its platform and runner pool', (jobName, file, platform, variable, command) => { const job = workflowJob(loadWorkflow('.github/workflows/' + file), jobName) if (!Array.isArray(job.steps)) throw new TypeError(`${jobName} must define steps`) const steps = job.steps.filter(isRecord) const checkout = steps.findIndex(step => step.uses === 'actions/checkout@v7.0.1') const restore = steps.findIndex(step => step.name === 'Restore coverage duration history') const coverage = steps.findIndex(step => step.run === command) const save = steps.findIndex(step => step.name === 'Save coverage duration history') const prefix = `coverage-times-${platform}-\${{ runner.environment }}-\${{ vars.DSH_CI_FAILOVER_${variable} || 'enterprise' }}-` const key = prefix + '${{ github.run_id }}-${{ github.run_attempt }}' expect(checkout).toBeGreaterThanOrEqual(0) expect(restore).toBeGreaterThan(checkout) expect(coverage).toBeGreaterThan(restore) expect(save).toBeGreaterThan(coverage) expect(steps[restore]).toMatchObject({ uses: 'actions/cache/restore@v6.1.0', with: { path: '.coverage-times.json', key, 'restore-keys': `${prefix}\n` }, }) expect(steps[save]).toMatchObject({ uses: 'actions/cache/save@v6.1.0', if: '${{ !cancelled() }}', with: { path: '.coverage-times.json', key }, }) }) it('isolates every pnpm action setup destination per runner', () => { const files = ['.github/workflows/ci.yml', '.github/workflows/ci-windows.yml', '.github/workflows/ci-master.yml'] const setups: Array<{ jobName: string; step: unknown }> = [] for (const file of files) { const workflow: unknown = yaml.load(readFileSync(resolve(root, file), 'utf8')) if (!isRecord(workflow) || !isRecord(workflow.jobs)) throw new TypeError(`${file} must define jobs`) for (const [jobName, job] of Object.entries(workflow.jobs)) { if (!isRecord(job) || !Array.isArray(job.steps)) continue for (const step of job.steps) { if (!isRecord(step) || typeof step.uses !== 'string' || !step.uses.startsWith('pnpm/action-setup@')) continue setups.push({ jobName, step }) } } } expect(setups.length).toBeGreaterThan(0) for (const { jobName, step } of setups) { const stepDest = (step as { with?: { dest?: unknown } }).with?.dest if (jobName.startsWith('windows-')) { expect(stepDest, `${jobName} must use the native Windows pnpm destination`).toBe(nativeWindowsPnpmDestination) expect(step).not.toMatchObject({ with: { standalone: true } }) } else { expect(typeof stepDest, `${jobName} must use a runner-and-run-private pnpm destination`).toBe('string') expect(stepDest as string).toMatch(runnerPrivatePnpmDestination) } } }) it.each(['node-24', 'node-24-coverage', 'node-24-consumers'])( '%s keeps tool and fixture temporary files under runner cleanup', (jobName) => { const job = workflowJob(loadWorkflow('.github/workflows/ci.yml'), jobName) if (!Array.isArray(job.steps)) throw new TypeError(`${jobName} must define steps`) expect(job.steps[0]).toEqual({ name: 'Use runner-owned temporary storage', run: [ 'echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"', ...(jobName === 'node-24-consumers' ? ['echo "PLAYWRIGHT_BROWSERS_PATH=${RUNNER_TEMP%/*}/ms-playwright" >> "$GITHUB_ENV"'] : []), '', ].join('\n'), }) if (jobName === 'node-24-consumers') { const browserCache: unknown = job.steps.find(step => isRecord(step) && isRecord(step.with) && step.with.path === '${{ env.PLAYWRIGHT_BROWSERS_PATH }}') expect(browserCache).toMatchObject({ uses: 'actions/cache/restore@v6.1.0' }) } const store: unknown = job.steps.find(step => isRecord(step) && step.name === 'Configure pnpm store path') expect(store).toMatchObject({ run: [ 'store_root="$HOME/.local/share/pnpm/store"', 'echo "PNPM_CONFIG_STORE_DIR=$store_root" >> "$GITHUB_ENV"', 'store_path=$(PNPM_CONFIG_STORE_DIR="$store_root" pnpm store path --silent)', 'echo "path=$store_path" >> "$GITHUB_OUTPUT"', '', ].join('\n'), }) for (const step of job.steps) { if (isRecord(step) && isRecord(step.env)) { expect(step.env.TMPDIR).toBeUndefined() expect(step.env.npm_config_cache).toBeUndefined() } } }, ) it('isolates the python SDK exe pnpm setup destination per job', () => { const workflow: unknown = yaml.load(readFileSync(resolve(root, '.github/workflows/build-exe-for-python-sdk.yml'), 'utf8')) if (!isRecord(workflow) || !isRecord(workflow.jobs)) throw new TypeError('build-exe-for-python-sdk.yml must define jobs') const setups: Array<{ step: unknown }> = [] for (const job of Object.values(workflow.jobs)) { if (!isRecord(job) || !Array.isArray(job.steps)) continue for (const step of job.steps) { if (!isRecord(step) || typeof step.uses !== 'string' || !step.uses.startsWith('pnpm/action-setup@')) continue setups.push({ step }) } } expect(setups.length).toBeGreaterThan(0) for (const { step } of setups) { expect(step).toMatchObject({ with: { dest: nativeWindowsPnpmDestination }, }) } }) it('keeps split native Windows PR jobs with failover in their own workflow, plus a master-only standby', () => { const workflow = loadWorkflow('.github/workflows/ci.yml') const windowsWorkflow = loadWorkflow('.github/workflows/ci-windows.yml') const masterWorkflow = loadWorkflow('.github/workflows/ci-master.yml') if (!isRecord(workflow.jobs) || !isRecord(windowsWorkflow.jobs) || !isRecord(windowsWorkflow.jobs['windows-build']) || !isRecord(windowsWorkflow.jobs['windows-coverage']) || !isRecord(windowsWorkflow.jobs['windows-native-tests']) || !isRecord(windowsWorkflow.jobs['windows-checks-passed']) || !isRecord(workflow.jobs['node-24']) || !isRecord(workflow.jobs['node-24-coverage']) || !isRecord(workflow.jobs['node-24-bench']) || !isRecord(workflow.jobs['node-24-consumers']) || !isRecord(workflow.jobs['node-compat']) || !isRecord(workflow.jobs['all-checks-passed']) || !isRecord(masterWorkflow.jobs) || !isRecord(masterWorkflow.jobs['serial-windows'])) { throw new TypeError('CI workflow must define node-24, node-24-coverage, node-24-bench, node-24-consumers, node-compat, and all-checks-passed; CI Windows must define windows-build, windows-coverage, windows-native-tests, and windows-checks-passed; ci-master must define serial-windows') } const windowsBuild = windowsWorkflow.jobs['windows-build'] const windowsCoverage = windowsWorkflow.jobs['windows-coverage'] const windowsNativeTests = windowsWorkflow.jobs['windows-native-tests'] const windowsAggregate = windowsWorkflow.jobs['windows-checks-passed'] const serialWindows = masterWorkflow.jobs['serial-windows'] const node24 = workflow.jobs['node-24'] const node24Coverage = workflow.jobs['node-24-coverage'] const node24Bench = workflow.jobs['node-24-bench'] const node24Consumers = workflow.jobs['node-24-consumers'] const nodeCompat = workflow.jobs['node-compat'] const aggregate = workflow.jobs['all-checks-passed'] if (!Array.isArray(aggregate.needs) || !Array.isArray(windowsAggregate.needs)) { throw new TypeError('CI and CI Windows aggregates must define needs') } expect(Object.keys(workflow.jobs).filter(name => name.startsWith('windows'))).toEqual([]) // The split native jobs all resolve their pool through the Windows switch. for (const [jobName, job] of [['windows-build', windowsBuild], ['windows-coverage', windowsCoverage], ['windows-native-tests', windowsNativeTests]] as const) { expect(typeof job['runs-on']).toBe('string') expect(job['runs-on'], `${jobName} runs-on must use the Windows failover switch`).toContain('DSH_CI_FAILOVER_WINDOWS') expect(job['runs-on'], `${jobName} runs-on must not use the Linux failover switch`).not.toContain('DSH_CI_FAILOVER_LINUX') expect(job['runs-on']).toContain('self-hosted') expect(job['runs-on']).toContain('dsh-win-ci') expect(job['runs-on']).toContain('dsh-windows-2025-16core') const cores = jobName === 'windows-native-tests' ? 2 : 16 expect(evaluateRunsOn(job['runs-on'], { vars: { DSH_CI_FAILOVER_WINDOWS: 'blacksmith' } })) .toBe(`blacksmith-${cores}vcpu-windows-2025`) expect(job.if).toBe("github.event_name == 'pull_request'") } // windows-build runs the blocking build/site pair. expect(windowsBuild.name).toBe('windows node 24 / build & observational') const buildSteps = windowsBuild.steps as unknown[] const buildCommands = buildSteps.filter((step): step is Record & { run: string } => ( isRecord(step) && typeof step.run === 'string' )) expect(buildCommands.map(step => step.run)).toContain('pnpm run check:ci:windows-blocking') // Native Windows installs branch on the workspace filesystem: // clone (ReFS block clone) only on ReFS, plain install elsewhere. This // keeps the TS6231 store-path leak (see the Windows ReFS store note) out // of the self-hosted pool without forcing clone onto hosted NTFS, which // rejects copy-on-write. The branch must stay, or a hosted fallback would // fail installs with ERR_PNPM_LINKING_FAILED. for (const [jobName, job] of [['windows-build', windowsBuild], ['windows-coverage', windowsCoverage], ['windows-native-tests', windowsNativeTests]] as const) { const steps = job.steps as unknown[] const install = steps.find((step): step is Record & { run: string } => ( isRecord(step) && step.name === 'Install (immutable)' && typeof step.run === 'string' )) expect(install, `${jobName} must define the filesystem-branched install`).toBeDefined() expect(install!.run).toContain("$fs -eq 'ReFS'") expect(install!.run).toContain('--package-import-method=clone') expect(install!.run).toContain('corepack pnpm install') // The else branch must keep the plain hosted install as a distinct line // (not the corepack clone line, which contains the same substring); // dropping it or making both branches clone would force clone onto // NTFS, which rejects copy-on-write (ERR_PNPM_LINKING_FAILED). The // YAML folded block keeps the first statement on line 1 and folds the // rest with leading two-space indents. const installLines = install!.run.split('\n').map(line => line.trim()) expect(installLines).toContain('} else {') expect(installLines.some(line => line === 'pnpm install --frozen-lockfile'), `${jobName} else branch must keep the plain hosted install`).toBe(true) // The ReFS branch must not use the interpolated empty-flag form, which // passes a stray "" positional argument to pnpm. expect(install!.run).not.toContain('$cloneFlag') } expect(windowsCoverage.name).toBe('windows node 24 / coverage') expect(windowsCoverage.env).toMatchObject({ DSH_COVERAGE_PARTITIONS: "${{ vars.DSH_CI_FAILOVER_WINDOWS == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '4' || '' }}" }) const coverageSteps = windowsCoverage.steps as unknown[] const coverageCommands = coverageSteps.filter((step): step is Record & { run: string } => ( isRecord(step) && typeof step.run === 'string' )) expect(coverageCommands.map(step => step.run)).toContain('pnpm run check:ci:coverage') // Windows coverage runs zero-build like the Linux lane: workspace imports // resolve to src through the tsconfig paths map, and the lib-consuming // suites (webworker-packer image-loadable, webworker-runtime // transform-corpus, client ui-trajectory client-bundle) self-skip on // unbuilt checkouts. The regex catches a regression spelled as // 'corepack pnpm run build' or folded into a multi-line run block, which // an exact string match would miss. expect(coverageCommands.every(step => !/\bpnpm\s+run\s+build(?:\s|$)/.test(step.run))).toBe(true) // windows-native-tests runs the Windows-specific specs. expect(windowsNativeTests.name).toBe('windows node 24 / native tests') const nativeTestSteps = windowsNativeTests.steps as unknown[] const nativeTestCommands = nativeTestSteps.filter((step): step is Record & { run: string } => ( isRecord(step) && typeof step.run === 'string' )) const nativeTestCommand = nativeTestCommands.map(step => step.run).join('\n') expect(nativeTestCommand).toContain('--no-file-parallelism') expect(nativeTestCommand).toContain('--testTimeout 90000') expect(nativeTestCommand).toContain('tool-pwsh/tests/loader.spec.ts') expect(nativeTestCommand).toContain('workflow-ptc.spec.ts') expect(windowsWorkflow.jobs['windows-observational']).toBeUndefined() expect(windowsBuild['continue-on-error']).not.toBe(true) const observational = buildCommands.find(step => step.id === 'observational') expect(observational).toMatchObject({ run: 'pnpm run check:ci:windows-observational-ready', shell: 'pwsh', 'continue-on-error': true, 'timeout-minutes': 15, env: { DSH_GATE_FAIL_FAST: '', DSH_PUBLINT_CONCURRENCY: "${{ vars.DSH_CI_FAILOVER_WINDOWS == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '' }}", }, }) expect(observational?.if).toBeUndefined() expect(buildCommands.findIndex(step => step.id === 'observational')) .toBeGreaterThan(buildCommands.findIndex(step => step.run === 'pnpm run check:ci:windows-blocking')) const report = buildCommands.find(step => step.name === 'Report Windows observational failures') expect(report).toMatchObject({ 'continue-on-error': true, if: "steps.observational.outcome == 'failure'", shell: 'pwsh', }) expect(report?.run).toContain('::warning::') expect(report?.run).toContain('Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Encoding utf8 -Append') // serial-windows: master-only standby, self-hosted, non-blocking, lives in ci-master. expect(serialWindows.if).toBe("github.event_name == 'push' && github.ref == 'refs/heads/master'") expect(serialWindows['runs-on']).toEqual(['self-hosted', 'dsh-win-ci', 'windows']) expect(serialWindows.name).toBe('serial / windows (self-hosted standby)') // Its store must share the ReFS workspace volume for clone; the install // must carry the same filesystem branch as the PR jobs. const serialSteps = serialWindows.steps as unknown[] const serialStore = serialSteps.find((step): step is Record & { run: string } => ( isRecord(step) && step.name === 'Configure persistent pnpm store' && typeof step.run === 'string' )) expect(serialStore).toBeDefined() expect(serialStore!.run).toContain('[IO.Path]::GetPathRoot($env:GITHUB_WORKSPACE)') expect(serialStore!.run).toContain("'.pnpm-store'") const serialInstall = serialSteps.find((step): step is Record & { run: string } => ( isRecord(step) && step.name === 'Install (immutable)' && typeof step.run === 'string' )) expect(serialInstall).toBeDefined() expect(serialInstall!.run).toContain("$fs -eq 'ReFS'") expect(serialInstall!.run).toContain('--package-import-method=clone') expect(serialInstall!.run).toContain('corepack pnpm install') // Distinct else-branch line, as for the PR jobs: the corepack clone line // contains the plain-install substring too. expect(serialInstall!.run.split('\n').map(line => line.trim())).toContain('} else {') expect(serialInstall!.run.split('\n').map(line => line.trim())).toContain('pnpm install --frozen-lockfile') expect(serialInstall!.run).not.toContain('$cloneFlag') // The unsharded reference runs the whole coverage inventory at the same // per-test budget the PR coverage lane grants; the default 5000ms times // out load-sensitive store scans (e.g. gen-third-party-notices). const serialGate = serialSteps.find((step): step is Record & { env?: Record } => ( isRecord(step) && step.name === 'Run complete unsharded Windows gate inventory serially' )) expect(serialGate).toBeDefined() expect(serialGate!.env).toMatchObject({ DSH_COVERAGE_TEST_TIMEOUT_MS: '90000' }) expect(aggregate.needs).not.toContain('windows') // windows-coverage is temporarily non-blocking while Windows ACP // half-close tests are stabilized; observational stays out too. expect(windowsAggregate.needs).toEqual(['windows-build', 'windows-native-tests']) expect(windowsAggregate.name).toBe('windows checks passed') expect(windowsAggregate['runs-on']).toBe(aggregate['runs-on']) expect(windowsAggregate.if).toBe(aggregate.if) // The benchmark lane is a required verdict input and runs alone so its // wall-clock budgets never share a runner with a concurrent aggregate. expect(aggregate.needs).toContain('node-24-bench') expect(node24Bench.name).toBe('node 24 / benchmarks') expect(node24Bench.env).toBeUndefined() expect(node24Bench.steps).toContainEqual({ name: 'Install benchmark browser and hosted dependencies', run: 'pnpm --filter @deepseek-ai/dsh-benchmarks exec playwright install --with-deps chromium', }) expect(JSON.stringify(node24Bench.steps)).not.toContain('DSH_CI_FAILOVER_LINUX') expect(node24Bench.steps).toContainEqual({ name: 'Run performance benchmarks', env: { DSH_GATE_VERBOSE: '1' }, run: 'pnpm run check:ci:bench', }) expect(windowsAggregate.needs).not.toContain('serial-windows') // Linux failover is a separate switch: the three enterprise Linux workers // and the verdict job resolve their pool through DSH_CI_FAILOVER_LINUX, // never the Windows switch. for (const [jobName, job] of [['node-24', node24], ['node-24-coverage', node24Coverage], ['node-24-consumers', node24Consumers]] as const) { expect(typeof job['runs-on']).toBe('string') expect(job['runs-on'], `${jobName} runs-on must use the Linux failover switch`).toContain('DSH_CI_FAILOVER_LINUX') expect(job['runs-on'], `${jobName} runs-on must not use the Windows failover switch`).not.toContain('DSH_CI_FAILOVER_WINDOWS') expect(job['runs-on']).toContain('vm-backup') expect(evaluateRunsOn(job['runs-on'], { vars: { DSH_CI_FAILOVER_LINUX: 'blacksmith' } })) .toBe(`blacksmith-${jobName === 'node-24' ? 8 : 16}vcpu-ubuntu-2404`) } expect(aggregate['runs-on']).toContain('DSH_CI_FAILOVER_LINUX') expect(aggregate['runs-on']).not.toContain('DSH_CI_FAILOVER_WINDOWS') expect(aggregate['runs-on']).toContain('vm-backup') expect(aggregate['runs-on']).toContain('blacksmith-4vcpu-ubuntu-2404') // Evaluating the full selector, not just substring containment, proves the // blacksmith branch is standalone: it must not fall through to the // self-hosted pool when the two values are mutually exclusive. const selectors = { linux: node24['runs-on'] as string, linuxAggregate: aggregate['runs-on'] as string, windows: windowsBuild['runs-on'] as string, } const evaluate = (expression: string, vars: Record, login = 'maintainer'): unknown => { return evaluateRunsOn(expression, { vars, fromJSON: JSON.parse, github: { event: { pull_request: { user: { login } } } }, }) } for (const [name, selector, variable, pool, hosted] of [ ['linux gates', selectors.linux, 'DSH_CI_FAILOVER_LINUX', ['self-hosted', 'linux', 'x64', 'vm-backup'], 'dsh-ubuntu-24-04-16core'], ['linux aggregate', selectors.linuxAggregate, 'DSH_CI_FAILOVER_LINUX', ['self-hosted', 'linux', 'x64', 'vm-backup'], 'ubuntu-latest'], ['windows lanes', selectors.windows, 'DSH_CI_FAILOVER_WINDOWS', ['self-hosted', 'dsh-win-ci', 'windows'], 'dsh-windows-2025-16core'], ] as const) { expect(evaluate(selector, { [variable]: 'blacksmith' }), `${name} blacksmith value`).toMatch(/^blacksmith-/) expect(evaluate(selector, { [variable]: 'selfhosted' }), `${name} selfhosted value`).toEqual(pool) // The blacksmith branch must not capture the selfhosted pool, and the // dependabot exclusion applies to the pool, not to the blacksmith tier. expect(evaluate(selector, { [variable]: 'selfhosted' }, 'dependabot[bot]'), `${name} dependabot on selfhosted`).toBe(hosted) for (const mode of ['', 'hosted', 'unexpected']) { expect(evaluate(selector, { [variable]: mode }), `${name} default on ${mode}`).toBe(hosted) } } // The run-gates aggregate lanes stop at the first blocking gate failure so // a red aggregate does not keep burning runner time on the remaining // gates. Removing the flag silently reverts to running every independent // gate to completion. for (const [jobName, job] of [['node-24', node24], ['node-24-coverage', node24Coverage], ['node-24-consumers', node24Consumers], ['node-compat', nodeCompat]] as const) { expect(job.env, `${jobName} must enable fail-fast`).toMatchObject({ DSH_GATE_FAIL_FAST: '1' }) } // The native Windows lanes with run-gates aggregates fail fast for the // same reason: a failing gate aborts the sibling gate instead of waiting // out the multi-minute instrumented coverage run. expect(windowsBuild.env, 'windows-build must enable fail-fast').toMatchObject({ DSH_GATE_FAIL_FAST: '1' }) expect(windowsCoverage.env, 'windows-coverage must enable fail-fast').toMatchObject({ DSH_GATE_FAIL_FAST: '1' }) // The observational lane stays complete: it is continue-on-error by design // and exists to collect as much Windows-native evidence per run as // possible, so the first failure must not truncate the rest. expect(observational?.env).toMatchObject({ DSH_GATE_FAIL_FAST: '' }) }) it('runs the darwin unit parity inventory at the coverage lanes\' test budget', () => { const coverage = workflowJob(loadWorkflow('.github/workflows/ci.yml'), 'node-24-coverage') if (!isRecord(coverage.env) || typeof coverage.env.DSH_COVERAGE_TEST_TIMEOUT_MS !== 'string') { throw new TypeError('node-24-coverage must grant DSH_COVERAGE_TEST_TIMEOUT_MS') } const unitDarwin = workflowJob(loadWorkflow('.github/workflows/sandbox.yml'), 'unit-darwin') if (!Array.isArray(unitDarwin.steps)) throw new TypeError('unit-darwin job must define steps') const unit = unitDarwin.steps.filter(isRecord).find(step => step.name === 'Unit tests (darwin parity)') // The whole unit inventory on a shared macos-latest runner pays the same // scheduling delay the coverage lanes absorb; the ci-unit aggregate is the // `pnpm run test` path that consumes the variable, and the value is the // coverage lane's so the two budget classes cannot drift apart. expect(unit).toMatchObject({ run: 'pnpm run check:ci:unit', env: { DSH_COVERAGE_TEST_TIMEOUT_MS: coverage.env.DSH_COVERAGE_TEST_TIMEOUT_MS }, }) }) it('gates standalone keyless blacksmith jobs and benchmark tiers on the failover variables', () => { const expectedFilenames = workflowJob(loadWorkflow('.github/workflows/expected-filenames.yml'), 'expected-filenames') const sandbox = workflowJob(loadWorkflow('.github/workflows/sandbox.yml'), 'sandbox-e2e') expect(expectedFilenames['runs-on']).toContain('DSH_CI_FAILOVER_LINUX') expect(expectedFilenames['runs-on']).toContain("== 'blacksmith'") expect(expectedFilenames['runs-on']).toContain('blacksmith-4vcpu-ubuntu-2404') expect(expectedFilenames['runs-on']).toContain("'ubuntu-latest'") expect(sandbox['runs-on']).toContain("matrix.runner == 'bwrap'") expect(sandbox['runs-on']).toContain('DSH_CI_FAILOVER_LINUX') expect(sandbox['runs-on']).toContain('blacksmith-4vcpu-ubuntu-2404') for (const name of ['larger-runner-benchmark', 'consolidated-runner-benchmark'] as const) { const benchmark = workflowJob(loadWorkflow('.github/workflows/ci-master.yml'), name) if (!isRecord(benchmark.strategy) || !isRecord(benchmark.strategy.matrix) || !Array.isArray(benchmark.strategy.matrix.include)) { throw new TypeError(`${name} must define a matrix include list`) } expect(benchmark['runs-on']).toContain('matrix.blacksmith') expect(benchmark['runs-on']).toContain('DSH_CI_FAILOVER_LINUX') expect(benchmark['runs-on']).toContain('DSH_CI_FAILOVER_WINDOWS') for (const row of benchmark.strategy.matrix.include as Array>) { expect(typeof row.blacksmith, `${name} ${row.cores}-core row must declare a blacksmith label`).toBe('string') if (row.cores === '64' || row.cores === '96') { expect(row.blacksmith, `${name} ${row.cores}-core row has no Blacksmith tier`).toBe('') } else { expect(row.blacksmith).toContain(`blacksmith-${row.cores}vcpu`) } } } }) it('runs required benchmarks on standard hosted Linux independently of failover', () => { const workflow = loadWorkflow('.github/workflows/ci.yml') const benchmark = workflowJob(workflow, 'node-24-bench') const aggregate = workflowJob(workflow, 'all-checks-passed') expect(benchmark['runs-on']).toBe('ubuntu-24.04') expect(benchmark.if).toBe("github.event_name == 'pull_request'") expect(benchmark.needs).toBeUndefined() expect(benchmark['continue-on-error']).toBeUndefined() expect(benchmark.env).toBeUndefined() expect(aggregate.needs).toContain('node-24-bench') }) it('always restores the hosted benchmark pnpm cache', () => { const benchmark = workflowJob(loadWorkflow('.github/workflows/ci.yml'), 'node-24-bench') if (!Array.isArray(benchmark.steps)) throw new TypeError('benchmark job must define steps') const caches = benchmark.steps.filter(step => isRecord(step) && step.uses === 'actions/cache/restore@v6.1.0') expect(caches).toHaveLength(1) expect(caches[0]).not.toHaveProperty('if') expect(caches[0]).toMatchObject({ with: { path: '${{ steps.pnpm-store.outputs.path }}', key: "${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}", }, }) }) it('bounds the complete benchmark job to twenty minutes', () => { const benchmark = workflowJob(loadWorkflow('.github/workflows/ci.yml'), 'node-24-bench') expect(benchmark['timeout-minutes']).toBe(20) expect(benchmark.steps).toContainEqual({ name: 'Run performance benchmarks', env: { DSH_GATE_VERBOSE: '1' }, run: 'pnpm run check:ci:bench', }) }) it('publishes the scaled benchmark report even when a budget fails', () => { const benchmark = workflowJob(loadWorkflow('.github/workflows/ci.yml'), 'node-24-bench') if (!Array.isArray(benchmark.steps)) throw new TypeError('benchmark job must define steps') expect(benchmark.steps).toContainEqual({ name: 'Upload scaled benchmark report', if: '${{ !cancelled() }}', uses: 'actions/upload-artifact@v7.0.1', with: { name: 'benchmark-report', path: 'benchmarks/.dsh-report/', 'include-hidden-files': true, 'if-no-files-found': 'warn', 'retention-days': 7, }, }) const uploadIndex = benchmark.steps.findIndex(step => isRecord(step) && step.name === 'Upload scaled benchmark report') const benchmarkIndex = benchmark.steps.findIndex(step => isRecord(step) && step.name === 'Run performance benchmarks') expect(uploadIndex).toBeGreaterThan(benchmarkIndex) }) it('splits the Wine Host TypeScript compile and retains its heap budget', () => { const wineGates = readFileSync(resolve(root, 'scripts/wine-windows-gates.sh'), 'utf8') const references = wineGates.indexOf( 'wine_node "$scratch/logs/host-references.log" --import tsx/esm scripts/compile-referenced-projects.ts host', ) const aggregate = wineGates.indexOf( 'wine_node "$scratch/logs/host-tsc.log" --max-old-space-size=4096 "$tsc_js" -p tsconfig.host.json --pretty false', ) const metadata = wineGates.indexOf('wine_node "$scratch/logs/host-typert.log" --import tsx/esm scripts/generate-typert.ts') expect(metadata).toBeGreaterThan(-1) expect(references).toBeGreaterThan(metadata) expect(aggregate).toBeGreaterThan(references) expect(wineGates).not.toContain('-b tsconfig.host.json') }) it('cancels superseded master runs without changing the post-merge job inventory', () => { const workflow = loadWorkflow('.github/workflows/ci-master.yml') const prWorkflow = loadWorkflow('.github/workflows/ci.yml') if (!isRecord(workflow.jobs) || !isRecord(workflow.concurrency)) { throw new TypeError('ci-master workflow must define jobs and a workflow-level concurrency block') } if (!isRecord(prWorkflow.jobs)) { throw new TypeError('ci workflow must define jobs') } expect(workflow.concurrency).toEqual({ group: '${{ github.workflow }}-${{ github.ref }}', 'cancel-in-progress': true, }) expect(prWorkflow.concurrency).toEqual(workflow.concurrency) // The exact event sets are what keep master-only jobs out of the PR check // panel: ci-master triggers only on push(master) + workflow_dispatch and // never on pull_request; ci.yml is exactly pull_request-only. Assert the // full sets so losing the wrong event, or gaining an extra one, fails. if (!isRecord(workflow.on) || !isRecord(prWorkflow.on)) { throw new TypeError('both CI workflows must define on') } expect(Object.keys(workflow.on).sort()).toEqual(['push', 'workflow_dispatch']) expect(Object.keys(prWorkflow.on)).toEqual(['pull_request']) const windowsWorkflow = loadWorkflow('.github/workflows/ci-windows.yml') if (!isRecord(windowsWorkflow.on)) throw new TypeError('CI Windows workflow must define on') expect(Object.keys(windowsWorkflow.on)).toEqual(['pull_request']) expect(windowsWorkflow.concurrency).toEqual(workflow.concurrency) // Duplicated env must not drift: a Node bump on one lane only would run // Linux and Windows against different versions. expect(windowsWorkflow.env).toEqual(prWorkflow.env) const pythonWorkflow = loadWorkflow('.github/workflows/ci-python.yml') if (!isRecord(pythonWorkflow.on)) throw new TypeError('CI Python workflow must define on') expect(Object.keys(pythonWorkflow.on)).toEqual(['pull_request']) expect(pythonWorkflow.concurrency).toEqual(workflow.concurrency) expect(pythonWorkflow.env).toEqual(prWorkflow.env) // Drills share the parent run’s supersession policy. for (const name of ['serial-linux-selfhosted', 'serial-windows']) { const job = workflow.jobs[name] if (!isRecord(job)) throw new TypeError(`${name} must be defined`) expect(job.concurrency).toBeUndefined() // Standby drills remain post-merge work, but share run cancellation. expect(job.if).toBe("github.event_name == 'push' && github.ref == 'refs/heads/master'") } // Pin the post-merge runtime, Wine, and standby inventory. const NOT_PUSH_REACHABLE = new Set([ "github.event_name == 'workflow_dispatch' && inputs.suite == 'larger-runner-benchmark'", "github.event_name == 'workflow_dispatch' && inputs.suite == 'consolidated-runner-benchmark'", "github.event_name == 'workflow_dispatch' && inputs.suite == 'ssh-helper'", ]) const pushReachable = Object.entries(workflow.jobs) .filter(([, job]) => { if (!isRecord(job)) return false if (job.if === undefined) return true // unconditional: runs on every event if (job.if === false) return false // `if: false` parses as a boolean if (typeof job.if !== 'string') return true // unrecognized shape: surface it return !NOT_PUSH_REACHABLE.has(job.if.trim()) }) .map(([name]) => name) .sort() expect(pushReachable).toEqual(['python-runtime', 'serial-linux-selfhosted', 'serial-windows', 'windows']) // Manual benchmarks retain their bounded fan-out. for (const name of ['larger-runner-benchmark', 'consolidated-runner-benchmark']) { const job = workflow.jobs[name] if (!isRecord(job) || !isRecord(job.strategy)) { throw new TypeError(`${name} must define a matrix strategy`) } expect(job.strategy['max-parallel']).toBe(12) expect(job['timeout-minutes']).toBe(15) } }) it('redirects the Node compile cache to the data-volume runner temp before the first pnpm call', () => { const prWorkflow = loadWorkflow('.github/workflows/ci.yml') const masterWorkflow = loadWorkflow('.github/workflows/ci-master.yml') const redirectLanes = [ [prWorkflow, 'node-24'], [prWorkflow, 'node-24-coverage'], [prWorkflow, 'node-24-consumers'], [masterWorkflow, 'serial-linux-selfhosted'], ] as const for (const [workflow, jobKey] of redirectLanes) { const job = workflowJob(workflow, jobKey) if (!Array.isArray(job.steps)) throw new TypeError(`${jobKey} must define steps`) const redirectStepIndex = job.steps.findIndex((step): step is Record & { run: string } => ( isRecord(step) && typeof step.run === 'string' && step.run.includes('NODE_COMPILE_CACHE=${{ runner.temp }}/node-compile-cache') && step.run.includes('"$GITHUB_ENV"') )) // Removing this injection would send every pnpm call in the lane (setup, // store-path probe, install, and the gate) back to the root partition's // /tmp; rationale in // .github/workflows/ci.yml. expect(redirectStepIndex, `${jobKey} must inject NODE_COMPILE_CACHE into GITHUB_ENV`).toBeGreaterThan(-1) const pnpmSetupIndex = job.steps.findIndex((step): step is Record & { uses: string } => ( isRecord(step) && typeof step.uses === 'string' && step.uses.includes('pnpm/action-setup') )) expect(pnpmSetupIndex, `${jobKey} must run pnpm/action-setup`).toBeGreaterThan(-1) expect(redirectStepIndex, `${jobKey} must redirect before pnpm/action-setup runs pnpm`).toBeLessThan(pnpmSetupIndex) } }) it('keeps supported LSP source under native Windows coverage', () => { const config = readFileSync(resolve(root, 'vitest.config.ts'), 'utf8') expect(config).not.toContain('packages/lsp/lsp-stdio/src/connection.ts') expect(config).not.toContain('packages/lsp/lsp-stdio/src/index.ts') expect(config).not.toContain('packages/lsp/lsp-stdio/src/instance.ts') }) it('requires release-shaped Python runtime validation on Linux and Windows x64 in CI Python', () => { const workflow = loadWorkflow('.github/workflows/ci-python.yml') const pythonRuntime = workflowJob(workflow, 'python-runtime') const aggregate = workflowJob(workflow, 'python-checks-passed') if (!Array.isArray(aggregate.needs)) { throw new TypeError('CI Python aggregate must define required job dependencies') } expect(pythonRuntime).toMatchObject({ if: "github.event_name == 'pull_request'", name: 'python runtime / release-shaped matrix', uses: './.github/workflows/build-exe-for-python-sdk.yml', with: { targets: 'node24-linux-x64,node24-win-x64', ci: true }, secrets: { DEEPSEEK_API_KEY_EXTERNAL: '${{ secrets.DEEPSEEK_API_KEY_EXTERNAL }}', }, }) expect(aggregate.needs).toEqual(['python-sdk', 'python-runtime']) for (const file of ['ci.yml', 'ci-windows.yml']) { const other = loadWorkflow('.github/workflows/' + file) if (!isRecord(other.jobs)) throw new TypeError(`${file} must define jobs`) expect(other.jobs).not.toHaveProperty('python-runtime') } }) it('builds SSH executables only for explicit manual or release requests', () => { const ci = loadWorkflow('.github/workflows/ci.yml') if (!isRecord(ci.jobs)) throw new Error('PR CI must define jobs') expect(Object.values(ci.jobs)).not.toContainEqual(expect.objectContaining({ uses: './.github/workflows/build-exe-for-ssh-helper.yml' })) expect(workflowJob(ci, 'all-checks-passed').needs).not.toContain('ssh-helper') const master = workflowJob(loadWorkflow('.github/workflows/ci-master.yml'), 'ssh-helper') if (typeof master.if !== 'string') throw new Error('SSH manual caller must define its trigger condition') for (const [event, suite, expected] of [ ['push', 'ssh-helper', false], ['pull_request', 'ssh-helper', false], ['workflow_dispatch', 'larger-runner-benchmark', false], ['workflow_dispatch', 'ssh-helper', true], ] as const) { expect(runInNewContext(master.if, { github: { event_name: event, ref: 'refs/heads/master' }, inputs: { suite } }, { timeout: 1000 })).toBe(expected) } expect(master.with).toEqual({ targets: 'node24-linux-x64,node24-linux-arm64,node24-macos-arm64,node24-macos-x64' }) const workflow = loadWorkflow('.github/workflows/build-exe-for-ssh-helper.yml') if (!isRecord(workflow.on)) throw new Error('SSH builder must define triggers') expect(Object.keys(workflow.on).sort()).toEqual(['workflow_call', 'workflow_dispatch']) }) it('requires SSH helper acceptance before uploading artifacts or publishing', () => { const workflow = loadWorkflow('.github/workflows/build-exe-for-ssh-helper.yml') const build = workflowJob(workflow, 'build') if (!Array.isArray(build.steps)) throw new Error('SSH build must define its verification steps') const steps = build.steps.filter(isRecord) const artifact = steps.findIndex(step => String(step.run).includes('scripts/verify-ssh-helper-artifact.ts')) const transport = steps.findIndex(step => String(step.run).includes('scripts/verify-ssh-helper-ssh.ts')) const landlock = steps.findIndex(step => String(step.run).includes('--backend=landlock-run')) const upload = steps.findIndex(step => String(step.uses).startsWith('actions/upload-artifact@')) expect(artifact).toBeGreaterThan(-1) expect(landlock).toBeGreaterThan(artifact) expect(transport).toBeGreaterThan(artifact) expect(upload).toBeGreaterThan(transport) for (const index of [artifact, transport, landlock, upload]) expect(steps[index]).not.toHaveProperty('continue-on-error', true) const publish = loadWorkflow('.github/workflows/publish-ssh-helper.yml') expect(publish.permissions).toEqual({ contents: 'read' }) expect(workflowJob(publish, 'build')).toMatchObject({ needs: 'validate', with: { release: true } }) const verify = workflowJob(publish, 'verify') expect(verify.needs).toEqual(['validate', 'build']) expect(verify).not.toHaveProperty('if') expect(verify).not.toHaveProperty('permissions') if (!Array.isArray(verify.steps)) throw new Error('Release verification must define steps') const verification = verify.steps.findIndex(step => isRecord(step) && String(step.run).includes('scripts/ssh-helper/release.ts')) const checksums = verify.steps.findIndex(step => isRecord(step) && String(step.uses).startsWith('actions/upload-artifact@')) expect(verification).toBeGreaterThan(-1) expect(checksums).toBeGreaterThan(verification) expect(verify.steps[verification]).not.toHaveProperty('continue-on-error', true) const publication = workflowJob(publish, 'publish') expect(publication).toMatchObject({ if: 'inputs.publish', needs: ['validate', 'verify'], permissions: { contents: 'write' } }) for (const requested of [false, true]) { expect(runInNewContext(String(publication.if), { inputs: { publish: requested } }, { timeout: 1000 })).toBe(requested) } }) it('validates any ref by default but refuses publication without the matching SSH release tag', () => { const workflow = loadWorkflow('.github/workflows/publish-ssh-helper.yml') if (!isRecord(workflow.on)) throw new Error('SSH release must define triggers') expect(Object.keys(workflow.on)).toEqual(['workflow_dispatch']) expect(workflowEvent(workflow, 'workflow_dispatch').inputs).toMatchObject({ publish: { type: 'boolean', default: false } }) const validate = workflowJob(workflow, 'validate') expect(validate.steps).toContainEqual(expect.objectContaining({ id: 'source', env: { PUBLISH: '${{ inputs.publish }}' } })) const source = nodeStepSource(validate, 'source') const evaluate = (publish: boolean, type: string, name: string): string => { let output = '' runInNewContext(source, { process: { env: { PUBLISH: String(publish), GITHUB_REF_TYPE: type, GITHUB_REF_NAME: name, GITHUB_OUTPUT: 'output' } }, readFileSync: () => JSON.stringify({ version: '1.2.3' }), execFileSync: () => `${'a'.repeat(40)}\n`, appendFileSync: (_path: string, text: string) => { output += text }, }, { timeout: 1000 }) return output } const expected = `version=1.2.3\ncommit=${'a'.repeat(40)}\n` expect(evaluate(false, 'branch', 'worktree/helper')).toBe(expected) expect(evaluate(false, 'tag', 'arbitrary-tag')).toBe(expected) expect(evaluate(true, 'tag', 'dsh-v1.2.3')).toBe(expected) for (const [type, name] of [['branch', 'dsh-v1.2.3'], ['tag', 'dsh-v1.2.2'], ['tag', 'python-v1.2.3']] as const) { expect(() => evaluate(true, type, name)).toThrow('Publication requires the matching dsh-v tag') } }) it('validates the SSH native matrix before allocating runners', () => { const plan = workflowJob(loadWorkflow('.github/workflows/build-exe-for-ssh-helper.yml'), 'plan') const source = nodeStepSource(plan, 'targets') const evaluate = (requested: string): unknown => { let output = '' runInNewContext(source, { process: { env: { REQUESTED_TARGETS: requested, GITHUB_OUTPUT: 'output' } }, appendFileSync: (_path: string, text: string) => { output += text }, }, { timeout: 1000 }) return JSON.parse(output.slice('matrix='.length)) } expect(evaluate('')).toHaveLength(4) expect(evaluate('node24-linux-arm64')).toEqual([{ target: 'node24-linux-arm64', runner: 'ubuntu-24.04-arm' }]) for (const invalid of ['node24-linux-arm64,node24-linux-arm64', 'node24-win-x64', 'node24-linux-x64,', ' ']) { expect(() => evaluate(invalid)).toThrow('Invalid or duplicate') } }) it('keeps every Vitest project process-isolated on native Windows', () => { const config = readFileSync(resolve(root, 'vitest.config.ts'), 'utf8') expect(config).not.toContain("pool: process.platform === 'win32' ? 'threads' : 'forks'") expect(config.match(/pool: 'forks'/g)).toHaveLength(2) }) it('applies the lane test budget inside every Vitest project', () => { // Each inline project spreads coverageTestTimeoutOptions, the only route // for DSH_COVERAGE_TEST_TIMEOUT_MS into projects; the behavior itself is // pinned by scripts/lane-test-budget.spec.ts. const config = readFileSync(resolve(root, 'vitest.config.ts'), 'utf8') expect(config).toContain('const laneTestBudget = coverageTestTimeoutOptions(process.env[COVERAGE_TEST_TIMEOUT_ENV])') expect(config.match(/^ {10}\.\.\.laneTestBudget,$/gm)).toHaveLength(2) }) }) describe('Runtime and LLM e2e Blacksmith routing', () => { it('routes DeepSeek e2e only through the Linux Blacksmith switch', () => { const job = workflowJob(loadWorkflow('.github/workflows/e2e.yml'), 'e2e') for (const mode of ['', 'selfhosted', 'unexpected', 'blacksmith']) { expect(evaluateRunsOn(job['runs-on'], { vars: { DSH_CI_FAILOVER_LINUX: mode, DSH_CI_FAILOVER_WINDOWS: 'blacksmith' } })) .toBe(mode === 'blacksmith' ? 'blacksmith-4vcpu-ubuntu-2404' : 'ubuntu-latest') } }) it('keeps native release and dispatch builders hosted while routing x64 CI by platform', () => { const workflow = loadWorkflow('.github/workflows/build-exe-for-python-sdk.yml') const build = workflowJob(workflow, 'build') for (const [target, runner, variable, blacksmith, releaseRunner] of [ ['node24-linux-x64', 'ubuntu-latest', 'DSH_CI_FAILOVER_LINUX', 'blacksmith-2vcpu-ubuntu-2404', 'ubuntu-latest'], ['node24-win-x64', 'windows-2025', 'DSH_CI_FAILOVER_WINDOWS', 'blacksmith-2vcpu-windows-2025', 'windows-2025'], ['node24-linux-arm64', 'ubuntu-24.04-arm', 'DSH_CI_FAILOVER_LINUX', 'ubuntu-24.04-arm', 'ubuntu-24.04-arm'], ['node24-macos-arm64', 'macos-latest', 'DSH_CI_FAILOVER_LINUX', 'macos-latest', 'macos-15-xlarge'], ['node24-macos-x64', 'macos-15-intel', 'DSH_CI_FAILOVER_LINUX', 'macos-15-intel', 'macos-15-large'], ] as const) { for (const ci of [false, true]) { for (const release of [false, true]) { for (const mode of ['', 'selfhosted', 'unexpected', 'blacksmith']) { const vars = { DSH_CI_FAILOVER_LINUX: 'blacksmith', DSH_CI_FAILOVER_WINDOWS: 'blacksmith', [variable]: mode } expect(evaluateRunsOn(build['runs-on'], { inputs: { ci, release }, vars, matrix: { target, runner } }), `${target} ci=${ci} release=${release} mode=${mode}`) .toBe(release ? releaseRunner : ci && mode === 'blacksmith' ? blacksmith : runner) } } } } }) it.each(['plan', 'sdk-wheel'])('routes runtime %s only for non-release CI', (name) => { const job = workflowJob(loadWorkflow('.github/workflows/build-exe-for-python-sdk.yml'), name) for (const ci of [false, true]) { for (const release of [false, true]) { for (const mode of ['', 'selfhosted', 'unexpected', 'blacksmith']) { expect(evaluateRunsOn(job['runs-on'], { inputs: { ci, release }, vars: { DSH_CI_FAILOVER_LINUX: mode } })) .toBe(ci && !release && mode === 'blacksmith' ? 'blacksmith-4vcpu-ubuntu-2404' : 'ubuntu-latest') } } } }) }) describe('bubblewrap preparation script', () => { it('pins bubblewrap to a recorded Launchpad build and excludes Ubuntu pool downloads', () => { const script = readFileSync(resolve(root, 'scripts/prepare-ci-bubblewrap.sh'), 'utf8') const url = /^readonly BUBBLEWRAP_URL="([^"]+)"$/mu.exec(script)?.[1] expect(url).toMatch( /^https:\/\/launchpad\.net\/ubuntu\/\+source\/bubblewrap\/[^/]+\/\+build\/\d+\/\+files\/bubblewrap_[^/]+_amd64\.deb$/u, ) // Ubuntu removes superseded versions from its live package pool. expect(script).not.toMatch(/https?:\/\/[^/'"\s]+\/ubuntu(?:-ports)?\/pool\//u) }) }) describe('DeepSeek e2e workflow', () => { it('prepares bubblewrap from the pinned payload without a package transaction', () => { const workflow = loadWorkflow('.github/workflows/e2e.yml') const e2e = workflowJob(workflow, 'e2e') if (!Array.isArray(e2e.steps)) throw new TypeError('DeepSeek e2e workflow must define steps') const steps = e2e.steps.filter(isRecord) expect(steps.find(step => step.name === 'Prepare bubblewrap (unrestrict userns)')).toMatchObject({ run: 'bash scripts/prepare-ci-bubblewrap.sh', }) expect(JSON.stringify(steps)).not.toContain('apt-get') }) it('bounds profile subprocess fan-out to the tested e2e default', () => { const workflow = loadWorkflow('.github/workflows/e2e.yml') const e2e = workflowJob(workflow, 'e2e') if (!Array.isArray(e2e.steps)) throw new TypeError('DeepSeek e2e workflow must define steps') const step = e2e.steps.filter(isRecord).find(candidate => candidate.name === 'E2E tests (real DeepSeek API)') expect(step).toMatchObject({ env: { DSH_E2E_MAX_WORKERS: 4 } }) }) }) describe('Python release workflows', () => { it('keeps complete wheel validation separate from protected public publication', () => { const workflow = loadWorkflow('.github/workflows/python-release.yml') const dispatch = workflowEvent(workflow, 'workflow_dispatch') const build = workflowJob(workflow, 'build') const pythonCompat = workflowJob(workflow, 'python-compat') const validate = workflowJob(workflow, 'validate') const publishRuntime = workflowJob(workflow, 'publish-runtime') const publishSdk = workflowJob(workflow, 'publish-sdk') if (!isRecord(dispatch.inputs) || !isRecord(dispatch.inputs.publish) || !Array.isArray(pythonCompat.steps) || !Array.isArray(validate.steps) || !Array.isArray(publishRuntime.steps) || !Array.isArray(publishSdk.steps)) { throw new TypeError('Python release workflow must define publish input and release steps') } expect(dispatch.inputs.publish).toMatchObject({ type: 'boolean', default: false }) if (!isRecord(workflow.on)) throw new TypeError('python-release workflow must define on') expect(Object.keys(workflow.on)).toEqual(['workflow_dispatch']) expect(build).toMatchObject({ uses: './.github/workflows/build-exe-for-python-sdk.yml', with: { targets: 'node24-linux-x64,node24-linux-arm64,node24-macos-arm64,node24-macos-x64,node24-win-x64', release: true, }, }) expect(pythonCompat.strategy).toMatchObject({ matrix: { python: ['3.10', '3.14'] } }) const pythonCompatSteps = JSON.stringify(pythonCompat.steps) expect(pythonCompatSteps).toContain('dist/deepseek_harness_sdk-$VERSION-py3-none-any.whl') expect(pythonCompatSteps).toContain('dist/deepseek_harness_runtime_bin-$VERSION-py3-none-manylinux_2_28_x86_64.whl') expect(pythonCompatSteps).not.toContain('--find-links') const validateSteps = JSON.stringify(validate.steps) const authorize = validate.steps.filter(isRecord).find(step => step.name === 'Authorize publication request') if (!isRecord(authorize) || typeof authorize.run !== 'string') { throw new TypeError('Python release validation must authorize publication requests') } expect(validateSteps).toContain('PUBLIC_PYPI_RELEASE_ENABLED') expect(authorize).toMatchObject({ env: { PYPI_PUBLISHER_REPOSITORY: '${{ vars.PYPI_PUBLISHER_REPOSITORY }}', REPOSITORY: '${{ github.repository }}', }, }) expect(authorize.run).toContain('[ "$REPOSITORY" = "$PYPI_PUBLISHER_REPOSITORY" ]') expect(validateSteps).toContain('100000000') expect(publishRuntime).toMatchObject({ if: "github.event_name == 'workflow_dispatch' && inputs.publish", needs: 'validate', environment: 'pypi-runtime', permissions: { contents: 'read', 'id-token': 'write' }, }) expect(publishSdk).toMatchObject({ if: "github.event_name == 'workflow_dispatch' && inputs.publish", needs: ['validate', 'publish-runtime'], environment: 'pypi', permissions: { contents: 'read', 'id-token': 'write' }, }) const runtimeSteps = publishRuntime.steps.filter(isRecord) const sdkSteps = publishSdk.steps.filter(isRecord) const runtimePublish = runtimeSteps.find(step => step.name === 'Publish runtime wheels') const sdkPublish = sdkSteps.find(step => step.name === 'Publish SDK wheel') const runtimeHashes = runtimeSteps.find(step => step.name === 'Verify release artifact hashes') const sdkHashes = sdkSteps.find(step => step.name === 'Verify release artifact hashes') expect([...runtimeSteps, ...sdkSteps].some( step => typeof step.uses === 'string' && step.uses.startsWith('actions/checkout@'), )).toBe(false) expect([...runtimeSteps, ...sdkSteps].filter( step => step.uses === 'pypa/gh-action-pypi-publish@release/v1', )).toHaveLength(2) expect(runtimePublish).toMatchObject({ with: { 'packages-dir': 'dist/runtime/', attestations: false }, }) expect(sdkPublish).toMatchObject({ with: { 'packages-dir': 'dist/sdk/', attestations: false }, }) expect(runtimeHashes).toMatchObject({ run: 'cd dist && sha256sum -c SHA256SUMS' }) expect(sdkHashes).toMatchObject({ run: 'cd dist && sha256sum -c SHA256SUMS' }) }) it('exposes the native wheel builder to the release caller with normalized versions', () => { const workflow = loadWorkflow('.github/workflows/build-exe-for-python-sdk.yml') expect(Object.keys(workflow.on as Record).sort()).toEqual(['workflow_call', 'workflow_dispatch']) const call = workflowEvent(workflow, 'workflow_call') const plan = workflowJob(workflow, 'plan') const build = workflowJob(workflow, 'build') if (!isRecord(call.inputs) || !isRecord(call.secrets) || !Array.isArray(plan.steps) || !Array.isArray(build.steps)) { throw new TypeError('Python wheel builder must define workflow_call inputs and plan steps') } const buildSteps: unknown[] = build.steps const manylinuxAddon = buildSteps.find(step => isRecord(step) && step.name === 'Rebuild Linux node-pty against manylinux 2.28') const macosCheck = buildSteps.find(step => isRecord(step) && step.name === 'Check macOS payload architecture and deployment target') const manylinuxSmoke = buildSteps.find(step => isRecord(step) && step.name === 'Run wheel in a manylinux 2.28 container') const cleanVenvPosix = buildSteps.find(step => isRecord(step) && step.name === 'Install local SDK and runtime wheels into a clean venv (POSIX)') const cleanVenvWindows = buildSteps.find(step => isRecord(step) && step.name === 'Install local SDK and runtime wheels into a clean venv (Windows)') const installedKeylessPosix = buildSteps.find(step => isRecord(step) && step.name === 'Run installed-wheel keyless black-box tests (POSIX)') const installedKeylessWindows = buildSteps.find(step => isRecord(step) && step.name === 'Run installed-wheel keyless black-box tests (Windows)') const realApiPreflightPosix = buildSteps.find(step => isRecord(step) && step.name === 'Preflight installed-wheel real API test (POSIX)') const realApiPreflightWindows = buildSteps.find(step => isRecord(step) && step.name === 'Preflight installed-wheel real API test (Windows)') const installedRealApiPosix = buildSteps.find(step => isRecord(step) && step.name === 'Run installed-wheel real API black-box test (POSIX)') const installedRealApiWindows = buildSteps.find(step => isRecord(step) && step.name === 'Run installed-wheel real API black-box test (Windows)') if (!isRecord(macosCheck) || typeof macosCheck.run !== 'string' || !isRecord(cleanVenvPosix) || !isRecord(cleanVenvWindows) || !isRecord(installedKeylessPosix) || !isRecord(installedKeylessWindows) || !isRecord(realApiPreflightPosix) || !isRecord(realApiPreflightWindows) || !isRecord(installedRealApiPosix) || !isRecord(installedRealApiWindows)) { throw new TypeError('Python wheel builder must define native POSIX and Windows installed-wheel steps') } expect(call.inputs).toHaveProperty('targets') expect(call.inputs).toMatchObject({ ci: { type: 'boolean', default: false }, release: { type: 'boolean', default: false }, }) expect(call.secrets).toMatchObject({ DEEPSEEK_API_KEY_EXTERNAL: { required: false }, }) expect(workflow.concurrency).toMatchObject({ group: 'build-single-exe-${{ github.workflow }}-${{ github.ref }}', }) expect(build.defaults).toBeUndefined() expect(plan.if).toContain('inputs.ci') expect(plan.if).toContain('inputs.release') expect(JSON.stringify(plan.steps)).toContain('pep440_version') const workflowJson = JSON.stringify(workflow) expect(workflowJson).toContain('macosx_14_0_arm64') expect(workflowJson).toContain('macosx_14_0_x86_64') expect(workflowJson).toContain('node24-macos-x64') expect(workflowJson).toContain('macos-15-intel') expect(workflowJson).toContain('win_amd64') expect(workflowJson).toContain('node24-win-x64') expect(workflowJson).toContain('windows-2025') expect(workflowJson).toContain('dist-python/$SDK_WHEEL') expect(workflowJson).toContain('dist-python/$RUNTIME_WHEEL') expect(workflowJson).toContain('/work/dist-python/$SDK_WHEEL') expect(workflowJson).toContain('/work/dist-python/$RUNTIME_WHEEL') expect(workflowJson).not.toContain('--find-links dist-python') expect(workflowJson).not.toContain('--find-links /work/dist-python') expect(workflowJson).not.toContain('cygpath') expect(manylinuxAddon).toMatchObject({ if: "runner.os == 'Linux'" }) expect(JSON.stringify(manylinuxAddon)).toContain('manylinux_2_28_x86_64') expect(JSON.stringify(manylinuxAddon)).toContain('manylinux_2_28_aarch64') expect(JSON.stringify(manylinuxAddon)).toContain('npm_config_build_from_source=true pnpm --config.verifyDepsBeforeRun=false run install') expect(JSON.stringify(manylinuxAddon)).toContain('pnpm_setup_root') expect(JSON.stringify(manylinuxAddon)).toContain('$pnpm_setup_root:$pnpm_setup_root:ro') expect(JSON.stringify(manylinuxAddon)).toContain('node-pty-glibc-versions.txt') expect(JSON.stringify(manylinuxAddon)).toContain('le 2.28') expect(macosCheck).toMatchObject({ if: "runner.os == 'macOS'" }) expect(macosCheck.run).toContain('scripts/check-macos-deployment-target.py') expect(macosCheck.run).toContain('lipo "$payload" -verify_arch') expect(macosCheck.run).toContain('$EXE-rg') expect(macosCheck.run).toContain('$EXE-spawn-helper') expect(JSON.stringify(installedKeylessPosix)).toContain('--scenario all') expect(JSON.stringify(installedKeylessPosix)).toContain('env -u PYTHONPATH') expect(JSON.stringify(installedKeylessWindows)).toContain('--scenario all --installed-wheel') expect(installedKeylessWindows).toMatchObject({ if: "runner.os == 'Windows'", shell: 'pwsh' }) expect(cleanVenvWindows).toMatchObject({ if: "runner.os == 'Windows'", shell: 'pwsh' }) expect(JSON.stringify(cleanVenvWindows)).toContain('Scripts\\\\python.exe') expect(realApiPreflightPosix).toMatchObject({ env: { DEEPSEEK_API_KEY: '${{ secrets.DEEPSEEK_API_KEY_EXTERNAL }}' }, }) expect(String(realApiPreflightPosix.if)).toContain('inputs.ci') expect(String(realApiPreflightPosix.if)).toContain('head.repo.fork') expect(String(realApiPreflightPosix.if)).toContain('dependabot[bot]') expect(realApiPreflightWindows).toMatchObject({ shell: 'pwsh' }) for (const step of [installedRealApiPosix, installedRealApiWindows]) { expect(step).toMatchObject({ env: { DEEPSEEK_API_KEY: '${{ secrets.DEEPSEEK_API_KEY_EXTERNAL }}', DEEPSEEK_BASE_URL: 'https://api.deepseek.com/anthropic', }, }) } expect(JSON.stringify(installedRealApiPosix)).toContain('--scenario sdk-live') expect(JSON.stringify(installedRealApiPosix)).toContain('-u DSH_RUNTIME_MODE') expect(installedRealApiWindows).toMatchObject({ shell: 'pwsh' }) expect(JSON.stringify(installedRealApiWindows)).toContain('--scenario sdk-live --installed-wheel') expect(manylinuxSmoke).toMatchObject({ if: "runner.os == 'Linux'" }) expect(JSON.stringify(manylinuxSmoke)).toContain('-e DSH_TELEMETRY_DISABLED') }) it('uses the shared macOS deployment-target check in GitLab', () => { const workflow = loadWorkflow('.gitlab-ci.yml') const runtimeWheel = workflow['.runtime-wheel'] if (!isRecord(runtimeWheel) || !Array.isArray(runtimeWheel.script)) { throw new TypeError('GitLab CI must define the runtime wheel script') } const runtimeScript: unknown[] = runtimeWheel.script const macosCheck = runtimeScript.find( step => typeof step === 'string' && step.includes('${PLATFORM#macos-}'), ) if (typeof macosCheck !== 'string') { throw new TypeError('GitLab CI must check the macOS deployment target') } expect(macosCheck).toContain('scripts/check-macos-deployment-target.py') expect(macosCheck).toContain('lipo "$payload" -verify_arch') expect(macosCheck).toContain('"$EXE" "$EXE-rg" "$EXE-spawn-helper"') }) it('builds the macOS x64 wheel on the matching GitLab runner', () => { const workflow = loadWorkflow('.gitlab-ci.yml') const macosX64 = workflow['runtime-macos-x64'] const publish = workflow['publish-python'] if (!isRecord(macosX64) || !isRecord(publish) || !Array.isArray(publish.needs)) { throw new TypeError('GitLab CI must define the macOS x64 runtime and publication jobs') } expect(macosX64.tags).toEqual(['macos-x64']) expect(macosX64.variables).toMatchObject({ PKG_TARGET: 'node24-macos-x64', PLATFORM: 'macos-x64' }) expect(publish.needs).toContainEqual({ job: 'runtime-macos-x64', artifacts: true }) expect(JSON.stringify(publish.script)).toContain('macosx_14_0_x86_64.whl') }) it('builds and black-box tests the Windows x64 wheel in GitLab', () => { const workflow = loadWorkflow('.gitlab-ci.yml') const windows = workflow['runtime-windows-x64'] const publish = workflow['publish-python'] if (!isRecord(windows) || !Array.isArray(windows.before_script) || !Array.isArray(windows.script) || !isRecord(publish) || !Array.isArray(publish.needs)) { throw new TypeError('GitLab CI must define the Windows runtime and aggregate publication jobs') } expect(windows.tags).toEqual(['windows-x64']) expect(windows.variables).toMatchObject({ PKG_TARGET: 'node24-win-x64', PLATFORM: 'win-x64' }) expect(JSON.stringify(windows.before_script)).toContain('.ci-python\\\\Scripts') expect(JSON.stringify(windows.before_script)).toContain('[IO.Path]::PathSeparator') expect(JSON.stringify(windows.script)).toContain('win_amd64.whl') expect(JSON.stringify(windows.script)).toContain('--scenario all --installed-wheel') expect(publish.needs).toContainEqual({ job: 'runtime-windows-x64', artifacts: true }) }) }) describe('Weighted approval workflow', () => { it('publishes from the trusted default branch after pull request and review updates', () => { const publisher = loadWorkflow('.github/workflows/weighted-approval.yml') const reviewEvent = loadWorkflow('.github/workflows/weighted-approval-review-event.yml') const pullRequest = workflowEvent(publisher, 'pull_request_target') const workflowRun = workflowEvent(publisher, 'workflow_run') const review = workflowEvent(reviewEvent, 'pull_request_review') const job = workflowJob(publisher, 'publish-status') const recordJob = workflowJob(reviewEvent, 'record-review-event') if (!isRecord(publisher.on)) throw new TypeError('weighted-approval workflow must define events') if (!isRecord(reviewEvent.on)) throw new TypeError('weighted-approval review event workflow must define events') if (!Array.isArray(job.steps)) throw new TypeError('weighted-approval job must define steps') if (!Array.isArray(recordJob.steps)) throw new TypeError('weighted-approval review event job must define steps') const steps = job.steps.filter(isRecord) const checkout = steps.find(step => step.name === 'Check out trusted approval policy') const publish = steps.find(step => step.name === 'Publish weighted approval status') const recordSteps = recordJob.steps.filter(isRecord) const record = recordSteps.find(step => step.name === 'Record review event') expect(publisher.name).toBe('weighted-approval') expect(Object.keys(publisher.on)).toEqual(['pull_request_target', 'issue_comment', 'workflow_run']) expect(workflowEvent(publisher, 'issue_comment').types).toEqual(['created', 'edited', 'deleted']) expect(pullRequest.types).toEqual(['opened', 'synchronize', 'reopened', 'ready_for_review', 'converted_to_draft', 'edited']) expect(workflowRun).toEqual({ workflows: ['weighted-approval-review-event'], types: ['completed'] }) expect(reviewEvent.name).toBe('weighted-approval-review-event') expect(reviewEvent['run-name']).toBe('weighted-approval-review-event:${{ github.event.pull_request.number }}') expect(Object.keys(reviewEvent.on)).toEqual(['pull_request_review']) expect(review.types).toEqual(['submitted', 'edited', 'dismissed']) expect(reviewEvent.permissions).toEqual({}) expect(publisher.permissions).toEqual({ checks: 'write', contents: 'read', 'pull-requests': 'write', statuses: 'write', }) expect(publisher.concurrency).toEqual({ group: "weighted-approval-${{ (github.event.pull_request.number || github.event.issue.number) && format('weighted-approval-review-event:{0}', github.event.pull_request.number || github.event.issue.number) || github.event.workflow_run.display_title }}", 'cancel-in-progress': false, }) expect(job).toMatchObject({ if: "(github.event_name != 'pull_request_target' || github.event.pull_request.state == 'open') && " + "(github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success') && " + "(github.event_name != 'issue_comment' || (github.event.issue.pull_request && github.event.issue.state == 'open' &&\n" + " (contains(github.event.comment.body, '/delegate') || contains(github.event.changes.body.from, '/delegate'))))", name: 'weighted approval publisher', 'runs-on': 'ubuntu-latest', 'timeout-minutes': 5, }) expect(checkout).toMatchObject({ uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1', with: { ref: '${{ github.event.repository.default_branch }}', 'persist-credentials': false, }, }) const token = steps.find(step => step.id === 'decision-token') expect(token).toMatchObject({ 'continue-on-error': true, uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1', with: { 'client-id': '${{ vars.DSH_APPROVAL_APP_CLIENT_ID }}', 'private-key': '${{ secrets.DSH_APPROVAL_APP_PRIVATE_KEY }}', owner: 'deepseek-harness', repositories: 'deepseek-harness', 'permission-checks': 'write', }, }) const tokenIndex = steps.indexOf(token!) expect(tokenIndex).toBeGreaterThan(steps.indexOf(checkout!)) expect(tokenIndex).toBeLessThan(steps.findIndex(step => step.id === 'revoke')) for (const step of steps.filter(step => typeof step.run === 'string' && step.run.startsWith('node .github/review-ownership/check-approval.mjs'))) { expect(step.env).toMatchObject({ DECISION_TOKEN: '${{ steps.decision-token.outputs.token }}', DECISION_APP_SLUG: '${{ vars.DSH_APPROVAL_APP_SLUG }}', }) } const setupIndex = steps.findIndex(step => typeof step.uses === 'string' && step.uses.startsWith('actions/setup-python@')) expect(steps[setupIndex]?.if).toBe("steps.revoke.outputs.active == 'true'") expect(steps[setupIndex]?.uses).toBe('actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1') const revokeIndex = steps.findIndex(step => step.id === 'revoke') expect(revokeIndex).toBeGreaterThan(steps.indexOf(checkout!)) expect(revokeIndex).toBeLessThan(setupIndex) expect(steps[revokeIndex]?.run).toBe('node .github/review-ownership/check-approval.mjs pending') expect(steps.at(-1)).toMatchObject({ if: "failure() && steps.revoke.outputs.active == 'true'", run: 'node .github/review-ownership/check-approval.mjs error', }) const pythonJob = workflowJob(loadWorkflow('.github/workflows/ci-python.yml'), 'python-sdk') expect(pythonJob.steps).toContainEqual({ name: 'Test production blame scoring', run: "uv run --python 3.10 --with-requirements .github/review-ownership/requirements.txt python -m unittest discover -s .github/review-ownership -p 'test_*.py'", }) expect(steps.find(step => step.name === 'Install production lexer')).toMatchObject({ if: "steps.revoke.outputs.active == 'true'", run: 'python3 -m pip install -r .github/review-ownership/requirements.txt', }) expect(publish).toMatchObject({ if: "steps.revoke.outputs.active == 'true'", env: { GITHUB_TOKEN: '${{ github.token }}', GITHUB_RUN_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}', }, run: 'node .github/review-ownership/check-approval.mjs', }) expect(recordJob).toMatchObject({ if: "github.event.pull_request.state == 'open'", name: 'record weighted approval review event', 'runs-on': 'ubuntu-latest', 'timeout-minutes': 2, }) expect(record).toBeDefined() expect(record?.run).toBe("echo 'Recorded a weighted approval review event.'") expect(recordSteps).toHaveLength(1) expect(JSON.stringify(publisher)).not.toContain('github.event.pull_request.head') expect(JSON.stringify(publisher).match(/secrets\.[A-Za-z0-9_]+/gu)).toEqual(['secrets.DSH_APPROVAL_APP_PRIVATE_KEY']) expect(JSON.stringify(reviewEvent)).not.toContain('github.token') expect(JSON.stringify(reviewEvent)).not.toContain('secrets.') }) }) describe('Issue lifecycle workflow', () => { it('allocates lifecycle runners only for events that can change the board', () => { const lifecycle = loadWorkflow('.github/workflows/issue-lifecycle.yml') const policy = loadWorkflow('.github/workflows/issue-policy.yml') const lifecycleJob = workflowJob(lifecycle, 'lifecycle') if (!Array.isArray(lifecycleJob.steps)) throw new TypeError('Issue lifecycle job must define steps') expect(lifecycle.on).toHaveProperty('pull_request') expect(lifecycle.on).toHaveProperty('pull_request_review') expect(lifecycleJob.if).toContain("github.event.review.state == 'changes_requested'") expect(lifecycleJob.if).toContain('github.event.changes.body != null') // Keep the subscription-type gates: issue-lifecycle does not re-subscribe // ready_for_review (issue-policy owns that) and only reacts to submitted // review events. const lifecyclePullRequest = workflowEvent(lifecycle, 'pull_request') const lifecycleReview = workflowEvent(lifecycle, 'pull_request_review') expect(lifecyclePullRequest.types).toContain('opened') expect(lifecyclePullRequest.types).not.toContain('ready_for_review') expect(lifecyclePullRequest.types).toContain('review_requested') expect(lifecycleReview.types).toEqual(['submitted']) expect(lifecyclePullRequest.types).not.toContain('synchronize') expect(lifecyclePullRequest.types).not.toContain('labeled') expect(lifecyclePullRequest.types).not.toContain('unlabeled') const issueEvents = workflowEvent(lifecycle, 'issues') expect(issueEvents.types).not.toContain('assigned') expect(issueEvents.types).not.toContain('unassigned') expect(issueEvents.types).toContain('typed') expect(issueEvents.types).toContain('untyped') const steps = lifecycleJob.steps.filter(isRecord) const tokenStep = steps.find(s => s.name === 'Create project token') const handleStep = steps.find(s => s.name === 'Handle repository event') expect(tokenStep?.if).toBeUndefined() expect(handleStep?.if).toBeUndefined() // issue-policy owns PR validation; it is read-only and a real gate. const policyPullRequest = workflowEvent(policy, 'pull_request') expect(policyPullRequest.types).toContain('ready_for_review') }) it('mints Project credentials only after preflight and always revalidates current metadata', () => { const policy = loadWorkflow('.github/workflows/issue-policy.yml') const policyJob = workflowJob(policy, 'policy') if (!Array.isArray(policyJob.steps)) throw new TypeError('Issue policy job must define steps') const steps = policyJob.steps.filter(isRecord) const tokenStep = steps.find(step => step.name === 'Create Project read token') const validateStep = steps.find(step => step.name === 'Validate pull request') const preflightStep = steps.find(step => step.id === 'preflight') expect(preflightStep).toMatchObject({ shell: 'bash' }) expect(preflightStep?.run).toContain('if [ -f .github/issue-management/selective-preflight.json ]; then') expect(preflightStep?.run).toContain('node .github/issue-management/policy.mjs pr-preflight') expect(preflightStep?.if).toBeUndefined() expect(policyJob.if).toBeUndefined() expect(validateStep?.if).toBe("${{ steps.preflight.outputs.legacy-automated != 'true' }}") expect(tokenStep).toMatchObject({ id: 'app-token', if: "${{ steps.preflight.outputs.needs-project == 'true' }}", uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1', with: { 'client-id': '${{ vars.DSH_ISSUE_APP_CLIENT_ID }}', 'private-key': '${{ secrets.DSH_ISSUE_APP_PRIVATE_KEY }}', owner: 'deepseek-harness', repositories: 'deepseek-harness', 'permission-issues': 'read', 'permission-organization-projects': 'read', }, }) expect(validateStep).toMatchObject({ env: { GITHUB_TOKEN: '${{ github.token }}', PROJECT_TOKEN: '${{ steps.app-token.outputs.token }}', }, }) }) }) describe('npm release workflows', () => { it('passes the optional vendor channel as a quoted argument while preserving default publication', () => { const workflow = loadWorkflow('.github/workflows/release-vendor-publish.yml') expect(workflow.on).toMatchObject({ workflow_dispatch: { inputs: { 'dist-tag': { required: false, type: 'string', default: '', }, }, }, }) const publish = workflowJob(workflow, 'publish') expect(publish.steps).toContainEqual({ name: 'Publish tarballs', env: { NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}', RELEASE_DIST_TAG: '${{ inputs.dist-tag }}', }, run: [ 'args=()', 'if [[ -n "$RELEASE_DIST_TAG" ]]; then', ' args+=(--dist-tag "$RELEASE_DIST_TAG")', 'fi', 'pnpm run release:publish --family vendor --from dist/npm-vendor "${args[@]}"', '', ].join('\n'), }) }) it('keeps publication dispatch-only and pack in the PR workflow', () => { // pack stays in the PR/master release workflows so a PR proves the set packs. for (const file of ['release.yml', 'release-vendor.yml']) { const workflow = loadWorkflow(`.github/workflows/${file}`) if (!isRecord(workflow.jobs)) throw new TypeError(`${file} must define jobs`) expect(Object.keys(workflow.jobs).sort()).toEqual(file === 'release.yml' ? ['dependencies', 'pack'] : ['pack']) } // publication is workflow_dispatch-only (never a PR check) and keeps the // npm-publish environment plus the shared dist-tag group. for (const file of ['release-publish.yml', 'release-vendor-publish.yml']) { const workflow = loadWorkflow(`.github/workflows/${file}`) if (!isRecord(workflow.on) || !isRecord(workflow.jobs)) throw new TypeError(`${file} must define on and jobs`) expect(Object.keys(workflow.on)).toEqual(['workflow_dispatch']) const publish = workflow.jobs.publish if (!isRecord(publish)) throw new TypeError(`${file} must define a publish job`) expect(publish.environment).toBe('npm-publish') expect(publish.concurrency).toMatchObject({ group: 'Release-publish' }) } }) it('runs dependency policy and npm layout checks in the DSH release workflow', () => { const workflow = loadWorkflow('.github/workflows/release.yml') const dependencies = workflowJob(workflow, 'dependencies') if (!isRecord(workflow.on) || !Array.isArray(dependencies.steps)) { throw new TypeError('DSH release workflow must define triggers and dependency steps') } const commands = dependencies.steps.flatMap(step => isRecord(step) && typeof step.run === 'string' ? [step.run] : []) expect(Object.keys(workflow.on).sort()).toEqual(['pull_request', 'push', 'workflow_dispatch']) expect(commands).toContain('pnpm run verify-package-dependencies') expect(commands).toContain('pnpm run verify-npm-install-layout') }) }) describe('Documentation site publication', () => { it('keeps Pages deployment dispatch-only from a dsh-v* tag', () => { const workflow = loadWorkflow('.github/workflows/docs-pages.yml') const build = workflowJob(workflow, 'build') const deploy = workflowJob(workflow, 'deploy') if (!isRecord(workflow.on) || !isRecord(workflow.env) || !Array.isArray(build.steps)) { throw new TypeError('Documentation deployment must define on, env, and build steps') } // The site presents a released snapshot: a merge must never publish it, and // publication must never appear as a PR check. expect(Object.keys(workflow.on)).toEqual(['workflow_dispatch']) // RELEASE_PUBLISH makes release:verify reject every ref that is not a dsh-v* // tag naming this tree's version, so the site and the npm sequence share one // definition of a released version. const steps = build.steps.filter(isRecord) const verify = steps.find(step => step.name === 'Verify release version') const checkout = steps.find( step => typeof step.uses === 'string' && step.uses.startsWith('actions/checkout@'), ) expect(verify).toMatchObject({ env: { RELEASE_PUBLISH: 'true' }, run: 'pnpm run release:verify --family dsh', }) // Complete history: the release scripts read tags. expect(checkout).toMatchObject({ with: { 'fetch-depth': 0 } }) // Projected source links stay on the public repository's master. That // repository advances only to each release commit, so its master never // carries unreleased work, while it retains only the most recent tags: // following the dispatched tag would leave every source link on a deploy // from an older tag unresolvable. expect(workflow.env.DOCS_REPOSITORY_REF).toBe('master') // The environment owns the deployment tag policy and the required reviewers. expect(deploy.environment).toMatchObject({ name: 'github-pages' }) }) }) describe('Git hooks', () => { it('leaves frozen Agent Note sidecars to the archive verifier', () => { const lefthook = loadWorkflow('lefthook.yml') for (const hookName of ['pre-commit', 'pre-merge-commit']) { const hook = lefthook[hookName] if (!isRecord(hook) || !Array.isArray(hook.jobs)) { throw new TypeError(`lefthook must define ${hookName} jobs`) } const pairing: unknown = hook.jobs.find( (job: unknown) => isRecord(job) && job.name === 'translation pairing (staged records)', ) expect(pairing).toMatchObject({ exclude: ['.agents/notes/archived/**'] }) } }) }) function loadWorkflow(path: string): Record { const workflow: unknown = yaml.load(readFileSync(resolve(root, path), 'utf8')) if (!isRecord(workflow)) throw new TypeError(`${path} must define a workflow`) return workflow } function nodeStepSource(job: Record, id: string): string { if (!Array.isArray(job.steps)) throw new Error('Node workflow job must define steps') const step: unknown = job.steps.find(value => isRecord(value) && value.id === id) if (!isRecord(step) || typeof step.run !== 'string') throw new Error(`Missing Node workflow step: ${id}`) const source = step.run.split("<<'JS'\n")[1]?.split('\nJS')[0]?.replace(/^import .*;\n/gm, '') if (source === undefined) throw new Error(`Workflow step ${id} must contain an executable Node script`) return source } function workflowEvent(workflow: Record, event: string): Record { if (!isRecord(workflow.on) || !isRecord(workflow.on[event])) { throw new TypeError(`workflow must define the ${event} event`) } return workflow.on[event] } function workflowJob(workflow: Record, job: string): Record { if (!isRecord(workflow.jobs) || !isRecord(workflow.jobs[job])) { throw new TypeError(`workflow must define the ${job} job`) } return workflow.jobs[job] } function isRecord(value: unknown): value is Record { return typeof value === 'object' && value !== null && !Array.isArray(value) }