mirror of
https://github.com/openclaw/clawhub.git
synced 2026-08-14 00:47:57 +00:00
Gio Della-Libera
348851eeb9
Adds conventional harness profiles, package-root BOOTSTRAP.md, strict OpenClaw validation, portable path hardening, and an official upstream contract pin.
295 lines
8.2 KiB
YAML
295 lines
8.2 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: ci-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.sha }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
VITE_CONVEX_URL: https://example.invalid
|
|
|
|
jobs:
|
|
pr-gates:
|
|
name: pr-gates
|
|
runs-on: blacksmith-8vcpu-ubuntu-2404
|
|
timeout-minutes: 45
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: ./.github/actions/setup-bun
|
|
|
|
- name: Static checks
|
|
run: bun run ci:static
|
|
|
|
- name: Unit coverage
|
|
run: bun run ci:unit
|
|
|
|
- name: Package checks
|
|
run: bun run ci:packages
|
|
|
|
- name: Typecheck and build
|
|
run: bun run ci:types-build
|
|
|
|
- name: HTTP e2e
|
|
run: bun run ci:e2e-http
|
|
|
|
claws-openclaw-contract:
|
|
name: claws-openclaw-contract
|
|
runs-on: blacksmith-8vcpu-ubuntu-2404
|
|
timeout-minutes: 25
|
|
env:
|
|
OPENCLAW_CONTRACT_REPOSITORY: openclaw/openclaw
|
|
OPENCLAW_CONTRACT_SHA: 7422222788c4b75581c0370e0614be9e635ec3cd
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7.0.1
|
|
|
|
- uses: ./.github/actions/setup-bun
|
|
|
|
- name: Check out the pinned OpenClaw contract source
|
|
uses: actions/checkout@v7.0.1
|
|
with:
|
|
repository: ${{ env.OPENCLAW_CONTRACT_REPOSITORY }}
|
|
ref: ${{ env.OPENCLAW_CONTRACT_SHA }}
|
|
path: .artifacts/openclaw-contract
|
|
|
|
- name: Set up OpenClaw Node.js
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: 24.15.0
|
|
|
|
- name: Install pinned OpenClaw dependencies
|
|
working-directory: .artifacts/openclaw-contract
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile
|
|
|
|
- name: Run ClawHub to OpenClaw contract proof
|
|
env:
|
|
OPENCLAW_CLAWS_CHECKOUT: ${{ github.workspace }}/.artifacts/openclaw-contract
|
|
run: bunx vitest run scripts/claws-feed-openclaw-e2e.test.ts --maxWorkers=1
|
|
|
|
static:
|
|
name: static
|
|
runs-on: ubuntu-latest
|
|
needs: pr-gates
|
|
if: ${{ always() }}
|
|
timeout-minutes: 5
|
|
|
|
steps:
|
|
- name: Mirror pr-gates result
|
|
env:
|
|
PR_GATES_RESULT: ${{ needs.pr-gates.result }}
|
|
run: |
|
|
test "$PR_GATES_RESULT" = "success"
|
|
|
|
unit:
|
|
name: unit
|
|
runs-on: ubuntu-latest
|
|
needs: pr-gates
|
|
if: ${{ always() }}
|
|
timeout-minutes: 5
|
|
|
|
steps:
|
|
- name: Mirror pr-gates result
|
|
env:
|
|
PR_GATES_RESULT: ${{ needs.pr-gates.result }}
|
|
run: |
|
|
test "$PR_GATES_RESULT" = "success"
|
|
|
|
packages:
|
|
name: packages
|
|
runs-on: ubuntu-latest
|
|
needs: pr-gates
|
|
if: ${{ always() }}
|
|
timeout-minutes: 5
|
|
|
|
steps:
|
|
- name: Mirror pr-gates result
|
|
env:
|
|
PR_GATES_RESULT: ${{ needs.pr-gates.result }}
|
|
run: |
|
|
test "$PR_GATES_RESULT" = "success"
|
|
|
|
types-build:
|
|
name: types-build
|
|
runs-on: ubuntu-latest
|
|
needs: pr-gates
|
|
if: ${{ always() }}
|
|
timeout-minutes: 5
|
|
|
|
steps:
|
|
- name: Mirror pr-gates result
|
|
env:
|
|
PR_GATES_RESULT: ${{ needs.pr-gates.result }}
|
|
run: |
|
|
test "$PR_GATES_RESULT" = "success"
|
|
|
|
e2e-http:
|
|
name: e2e-http
|
|
runs-on: ubuntu-latest
|
|
needs: pr-gates
|
|
if: ${{ always() }}
|
|
timeout-minutes: 5
|
|
|
|
steps:
|
|
- name: Mirror pr-gates result
|
|
env:
|
|
PR_GATES_RESULT: ${{ needs.pr-gates.result }}
|
|
run: |
|
|
test "$PR_GATES_RESULT" = "success"
|
|
|
|
playwright-smoke:
|
|
name: playwright-smoke
|
|
runs-on: blacksmith-8vcpu-ubuntu-2404
|
|
timeout-minutes: 25
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7.0.1
|
|
|
|
- uses: ./.github/actions/setup-bun
|
|
|
|
- name: Cache Playwright browsers
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: ~/.cache/ms-playwright
|
|
key: ${{ runner.os }}-playwright-${{ hashFiles('bun.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-playwright-
|
|
|
|
- name: Install Playwright browsers
|
|
run: bunx playwright install chromium
|
|
|
|
- name: Browser e2e
|
|
run: bun run ci:playwright-smoke
|
|
|
|
- name: Upload Playwright report
|
|
if: ${{ !cancelled() }}
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: playwright-report
|
|
path: playwright-report/
|
|
if-no-files-found: ignore
|
|
|
|
playwright-local-auth-shard:
|
|
name: playwright-local-auth / ${{ matrix.name }}
|
|
runs-on: blacksmith-16vcpu-ubuntu-2404
|
|
timeout-minutes: 30
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 8
|
|
matrix:
|
|
include:
|
|
- name: account-cleanup
|
|
specs: |
|
|
e2e/local-auth/delete-account-resources.pw.test.ts
|
|
e2e/local-auth/delete-org-resources.pw.test.ts
|
|
- name: profile-context
|
|
specs: |
|
|
e2e/local-auth/header-profile-link.pw.test.ts
|
|
e2e/local-auth/manage-context-proof.pw.test.ts
|
|
e2e/local-auth/publisher-github-profile.pw.test.ts
|
|
- name: moderation-malicious
|
|
specs: e2e/local-auth/malicious-skill-ban-flow.pw.test.ts
|
|
- name: star-sync
|
|
specs: e2e/local-auth/skill-star-sync.pw.test.ts
|
|
- name: inspector-version
|
|
specs: |
|
|
e2e/local-auth/plugin-inspector-findings.pw.test.ts
|
|
e2e/local-auth/version-delete.pw.test.ts
|
|
- name: publish-generated-card
|
|
specs: e2e/local-auth/publish-skill-lifecycle.pw.test.ts
|
|
grep: publishing a skill queues scan
|
|
- name: publish-new-version
|
|
specs: e2e/local-auth/publish-skill-lifecycle.pw.test.ts
|
|
grep: skill publishers can create a skill
|
|
- name: old-cli-publish
|
|
specs: e2e/local-auth/old-cli-publish-compat.pw.test.ts
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7.0.1
|
|
|
|
- uses: ./.github/actions/setup-bun
|
|
|
|
- name: Cache Playwright browsers
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: ~/.cache/ms-playwright
|
|
key: ${{ runner.os }}-playwright-${{ hashFiles('bun.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-playwright-
|
|
|
|
- name: Install Playwright browsers
|
|
run: bunx playwright install chromium
|
|
|
|
- name: Local-auth browser e2e
|
|
env:
|
|
PLAYWRIGHT_GREP: ${{ matrix.grep || '' }}
|
|
PLAYWRIGHT_SPECS: ${{ matrix.specs }}
|
|
run: |
|
|
set -euo pipefail
|
|
pressure_phase=before
|
|
report_runner_pressure() {
|
|
echo "::group::Local-auth runner pressure ($pressure_phase)"
|
|
date --utc --iso-8601=seconds
|
|
printf 'logical_cpus='
|
|
nproc
|
|
printf 'loadavg='
|
|
cat /proc/loadavg
|
|
if [[ -r /sys/fs/cgroup/cpu.stat ]]; then
|
|
cat /sys/fs/cgroup/cpu.stat
|
|
fi
|
|
if [[ -r /proc/pressure/memory ]]; then
|
|
cat /proc/pressure/memory
|
|
fi
|
|
free -h || true
|
|
echo "::endgroup::"
|
|
}
|
|
report_runner_pressure
|
|
pressure_phase=after
|
|
trap report_runner_pressure EXIT
|
|
|
|
mapfile -t specs < <(printf '%s\n' "$PLAYWRIGHT_SPECS" | sed '/^[[:space:]]*$/d')
|
|
args=(--project=chromium "${specs[@]}")
|
|
if [[ -n "$PLAYWRIGHT_GREP" ]]; then
|
|
args+=(--grep "$PLAYWRIGHT_GREP")
|
|
fi
|
|
bun run test:pw:local-auth -- "${args[@]}"
|
|
|
|
- name: Upload Playwright report
|
|
if: ${{ !cancelled() }}
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: playwright-local-auth-report-${{ matrix.name }}
|
|
path: playwright-report/
|
|
if-no-files-found: ignore
|
|
|
|
playwright-local-auth:
|
|
name: playwright-local-auth
|
|
runs-on: ubuntu-latest
|
|
needs: playwright-local-auth-shard
|
|
if: ${{ always() }}
|
|
timeout-minutes: 5
|
|
|
|
steps:
|
|
- name: Check local-auth shards
|
|
env:
|
|
LOCAL_AUTH_RESULT: ${{ needs.playwright-local-auth-shard.result }}
|
|
run: |
|
|
if [[ "$LOCAL_AUTH_RESULT" != "success" ]]; then
|
|
echo "playwright-local-auth shards finished with result: $LOCAL_AUTH_RESULT"
|
|
exit 1
|
|
fi
|
|
echo "playwright-local-auth shards passed."
|