3.7 KiB
AGENTS.md — GitHub Actions
Run jobs on Windows runners (windows-* labels) under native pwsh. Native Windows pull-request jobs live in ci-windows.yml and Python pull-request jobs in ci-python.yml, so each PR workflow can be re-run independently; their checks feed the required windows checks passed and python checks passed verdicts, as Linux jobs in ci.yml feed all checks passed; Wine runs Windows Node on hosted Linux only in ci-master.yml. Python runtime CI checks Linux/Windows x64 on pull requests and Linux ARM64 plus both macOS architectures on master pushes; releases retain all five targets (platform policy). ci.yml, ci-windows.yml, and ci-python.yml are pull-request-only. Master-only platform checks, Linux/Windows self-hosted standbys, and manual runner benchmarks live in ci-master.yml, which listens to master pushes and workflow_dispatch, not pull_request; separating workflow triggers keeps master-only jobs out of PR check panels. The master standbys validate the self-hosted failover targets; preserve the existing per-platform switches (values selfhosted for the in-house standbys and blacksmith for Blacksmith's hosted runners) and the Dependabot hosted fallback under the selfhosted values (failover runbook, blacksmith failover leg note).
The manual Windows packaging workflow uses the dedicated self-hosted Windows x64 label dsh-win-package-trial under native pwsh; preserve this routing separately from the automatic CI lanes.
The merge checks run from three workflows named Policy, which run on pull_request_target so their definitions come from master, and call the deepseek-harness-check action directly: pr-check-on-head-branch.yml on pull-request updates gives Policy / Master Change and Policy / Pre-Merge Check, pr-check-after-approve.yml on pull-request updates and submitted or dismissed reviews gives Policy / Approve Check and Policy / Reviewer Evaluate, and pr-check-on-base-branch.yml on master pushes re-runs the head-branch checks as Policy / Recheck. Branch rules require those check names, so keep the job names and the workflow name. Each check reads its mode from a repository variable: MERGE_POLICY_MASTER_DIFF, MERGE_POLICY_PRE_MERGE, MERGE_POLICY_HEAD_DIFF, and MERGE_POLICY_REVIEW, each off (skip), report (run without failing the job), or block (fail the job); a missing value or an unknown one counts as report. Policy / Pre-Merge Check merges the commit Policy / Master Change reports, so it runs only after that job and stays off while MERGE_POLICY_MASTER_DIFF is off; a merge it cannot do and a build that fails both follow its own mode, so report warns and skips the build while block fails the job. Policy / Pre-Merge Check runs scripts/pre-merge-check.ts under plain Node and knows nothing else about the merged tree: that script checks the released manifests against the root version, installs, and builds the Host and Client contracts, so change it in one pull request together with the build it orchestrates.
The manual Desktop publication workflow selects a successful package run and attempt, then routes each retained build through DESKTOP_PUBLISH_RUNNERS to its original machine's unique label. Keep Windows run steps on native PowerShell and Mac run steps on the default POSIX shell; shared entrypoints are Node scripts. Test and production jobs use separate desktop-test and desktop-production approval Environments after a credential-free preparation job.