forked from akai/readest
Huang Xin
4ff96800d2
* ci(security): pin android-emulator-runner action by commit SHA Scorecard Pinned-Dependencies flagged the two reactivecircus/android-emulator-runner@v2 usages in android-e2e.yml as third-party actions not pinned by hash (code-scanning alerts #116, #117). Pin both to the full commit SHA the v2 tag currently resolves to (e89f39f = v2.37.0), matching the @<sha> # <version> convention already used by every other action in this workflow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(pull-request): shard web unit tests and split out test_extensions The jsdom unit suite was ~115s of the 280s test_web_app job — the slowest check on every PR. Split it across two parallel shards with vitest --shard, and move the browser-extension + koplugin tests into a new test_extensions job. - test_web_app: matrix shard [1, 2] running `vitest run --shard=N/2`; Playwright + browser tests run on shard 1 only. - test_extensions: extension tests + browser-ext build run always; the koplugin Lua tests (and their ~45s LuaJIT/busted install) run only when apps/readest.koplugin/** changed, detected via dorny/paths-filter (pinned by SHA; needs pull-requests: read to list PR files). - package.json: add test:pr:web:unit so CI can append --shard; test:pr:web still runs the full sequence locally. Cuts the PR critical path from ~280s toward ~188s (now build_tauri_app). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(pull-request): isolate koplugin lint + LuaJIT install into test_extensions build_web_app was the slowest PR job and installed LuaJIT + ran the koplugin syntax check on every PR. Move all koplugin tooling into test_extensions, gated on apps/readest.koplugin/** like the koplugin Lua tests already are: - build_web_app drops the LuaJIT install. - test_extensions installs LuaJIT/busted and runs `pnpm lint:lua` + `pnpm test:lua` only when the koplugin sources changed. - `pnpm lint` is now web-only (tsgo + biome); `lint:lua` stays a standalone script that test_extensions (and local koplugin work) calls directly. This also drops koplugin lint from the pre-push hook. - verification rule updated to match. Most PRs now skip the koplugin toolchain entirely. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
319 lines
11 KiB
YAML
319 lines
11 KiB
YAML
name: PR checks
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
permissions:
|
|
contents: read
|
|
jobs:
|
|
rust_lint:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
RUSTFLAGS: '-C target-cpu=skylake'
|
|
SCCACHE_GHA_ENABLED: 'true'
|
|
RUSTC_WRAPPER: sccache
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
|
|
with:
|
|
submodules: 'true'
|
|
- name: setup sccache
|
|
uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
|
|
- name: Install minimal stable with clippy and rustfmt
|
|
uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
|
|
with:
|
|
toolchain: stable
|
|
override: true
|
|
components: rustfmt, clippy
|
|
- name: Cache apt packages
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
|
with:
|
|
path: /var/cache/apt/archives
|
|
key: apt-rust-lint-${{ runner.os }}
|
|
- name: Install system dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y pkg-config libfontconfig-dev libglib2.0-dev libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libsoup-3.0-dev
|
|
- name: Format check
|
|
working-directory: apps/readest-app/src-tauri
|
|
run: cargo fmt --check
|
|
- name: Clippy Check
|
|
working-directory: apps/readest-app/src-tauri
|
|
run: cargo clippy -p Readest --no-deps -- -D warnings
|
|
- name: Unit tests
|
|
working-directory: apps/readest-app/src-tauri
|
|
run: cargo test -p Readest --lib
|
|
|
|
build_web_app:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
|
|
with:
|
|
submodules: 'true'
|
|
|
|
- name: setup pnpm
|
|
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
|
|
|
|
- name: setup node
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
# Turbopack persists its build cache here (turbopackFileSystemCacheForBuild).
|
|
# The key is deterministic (no commit SHA) so every PR restores the same
|
|
# entry — in practice the one `main` last saved, which is the only cache
|
|
# sibling PRs can all see.
|
|
- name: cache Turbopack build cache
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
|
with:
|
|
path: apps/readest-app/.next/cache
|
|
key: turbo-build-web-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
turbo-build-web-${{ runner.os }}-
|
|
|
|
- name: install Dependencies
|
|
working-directory: apps/readest-app
|
|
run: |
|
|
pnpm install --frozen-lockfile --prefer-offline && pnpm setup-vendors
|
|
|
|
- name: run format check
|
|
run: |
|
|
pnpm format:check || (pnpm format && git diff && exit 1)
|
|
|
|
# pnpm lint here is web-only (tsgo + biome). The koplugin syntax check
|
|
# (lint:lua) runs in the test_extensions job, which installs LuaJIT only
|
|
# when the koplugin sources changed.
|
|
- name: run lint
|
|
working-directory: apps/readest-app
|
|
run: |
|
|
pnpm lint
|
|
|
|
- name: build the web app
|
|
working-directory: apps/readest-app
|
|
run: |
|
|
pnpm build-web && pnpm check:all
|
|
|
|
- name: cache playwright browsers
|
|
id: playwright-cache
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
|
with:
|
|
path: ~/.cache/ms-playwright
|
|
key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
|
|
|
|
- name: install playwright browsers
|
|
working-directory: apps/readest-app
|
|
run: |
|
|
if [ "${{ steps.playwright-cache.outputs.cache-hit }}" = 'true' ]; then
|
|
npx playwright install-deps chromium
|
|
else
|
|
npx playwright install --with-deps chromium
|
|
fi
|
|
|
|
- name: run web e2e tests
|
|
id: web_e2e
|
|
working-directory: apps/readest-app
|
|
run: pnpm test:e2e:web
|
|
|
|
- name: upload e2e report
|
|
if: ${{ failure() && steps.web_e2e.outcome == 'failure' }}
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: playwright-report
|
|
path: apps/readest-app/playwright-report/
|
|
retention-days: 7
|
|
|
|
# The jsdom unit suite is the slowest part of the PR checks, so it is split
|
|
# across two parallel shards (vitest --shard). The browser tests need
|
|
# Playwright and run only on shard 1; koplugin + browser-extension tests
|
|
# moved to the test_extensions job.
|
|
test_web_app:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
shard: [1, 2]
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
|
|
with:
|
|
submodules: 'true'
|
|
|
|
- name: setup pnpm
|
|
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
|
|
|
|
- name: setup node
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: install Dependencies
|
|
working-directory: apps/readest-app
|
|
run: |
|
|
pnpm install --frozen-lockfile --prefer-offline && pnpm setup-vendors
|
|
|
|
# Playwright is only needed by the browser tests, which run on shard 1.
|
|
- name: cache playwright browsers
|
|
if: matrix.shard == 1
|
|
id: playwright-cache
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
|
with:
|
|
path: ~/.cache/ms-playwright
|
|
key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
|
|
|
|
- name: install playwright browsers
|
|
if: matrix.shard == 1
|
|
working-directory: apps/readest-app
|
|
run: |
|
|
if [ "${{ steps.playwright-cache.outputs.cache-hit }}" = 'true' ]; then
|
|
npx playwright install-deps chromium
|
|
else
|
|
npx playwright install --with-deps chromium
|
|
fi
|
|
|
|
- name: run web unit tests (shard ${{ matrix.shard }}/2)
|
|
working-directory: apps/readest-app
|
|
run: pnpm test:pr:web:unit --shard=${{ matrix.shard }}/2
|
|
|
|
- name: run web browser tests
|
|
if: matrix.shard == 1
|
|
working-directory: apps/readest-app
|
|
run: pnpm test:browser
|
|
|
|
# Browser-extension tests + build always run. The koplugin lint + Lua tests
|
|
# (and the ~45s LuaJIT/busted install they need) only run when the koplugin
|
|
# sources changed, so most PRs skip that cost entirely.
|
|
test_extensions:
|
|
runs-on: ubuntu-latest
|
|
# pull-requests: read lets dorny/paths-filter list a PR's changed files
|
|
# via the REST API (the top-level grant is contents: read only).
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
|
|
with:
|
|
submodules: 'true'
|
|
|
|
- name: detect koplugin changes
|
|
id: changes
|
|
uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
|
|
with:
|
|
filters: |
|
|
koplugin:
|
|
- 'apps/readest.koplugin/**'
|
|
|
|
- name: setup pnpm
|
|
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
|
|
|
|
- name: setup node
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: install Dependencies
|
|
working-directory: apps/readest-app
|
|
run: |
|
|
pnpm install --frozen-lockfile --prefer-offline && pnpm setup-vendors
|
|
|
|
- name: run extension tests
|
|
working-directory: apps/readest-app
|
|
run: pnpm test:extension
|
|
|
|
- name: build browser extension
|
|
working-directory: apps/readest-app
|
|
run: pnpm build-browser-ext
|
|
|
|
- name: cache apt packages
|
|
if: steps.changes.outputs.koplugin == 'true'
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
|
with:
|
|
path: /var/cache/apt/archives
|
|
key: apt-test-koplugin-${{ runner.os }}
|
|
|
|
- name: install LuaJIT + busted (for koplugin lint + tests)
|
|
if: steps.changes.outputs.koplugin == 'true'
|
|
run: |
|
|
sudo apt-get update
|
|
# luajit — pnpm lint:lua + pnpm test:lua
|
|
# luarocks/libsqlite3-dev — required to build lsqlite3complete
|
|
sudo apt-get install -y luajit luarocks libsqlite3-dev
|
|
# Install busted + the SQLite binding the LibraryStore specs use,
|
|
# both pinned to Lua 5.1 (LuaJIT-compatible). System-wide install
|
|
# so `luarocks --lua-version=5.1 path` (sourced by
|
|
# scripts/test-koplugin.mjs) picks them up.
|
|
sudo luarocks --lua-version=5.1 install busted
|
|
sudo luarocks --lua-version=5.1 install lsqlite3complete
|
|
|
|
- name: lint koplugin
|
|
if: steps.changes.outputs.koplugin == 'true'
|
|
working-directory: apps/readest-app
|
|
run: pnpm lint:lua
|
|
|
|
- name: run koplugin tests
|
|
if: steps.changes.outputs.koplugin == 'true'
|
|
working-directory: apps/readest-app
|
|
run: pnpm test:lua
|
|
|
|
build_tauri_app:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
SCCACHE_GHA_ENABLED: 'true'
|
|
RUSTC_WRAPPER: sccache
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
|
|
with:
|
|
submodules: 'true'
|
|
|
|
- name: setup pnpm
|
|
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
|
|
|
|
- name: setup node
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
# The tauri tests run `next dev`, whose Turbopack cache lives in
|
|
# `.next/dev/cache` (a different path from the `next build` cache).
|
|
- name: cache Turbopack dev cache
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
|
with:
|
|
path: apps/readest-app/.next/dev/cache
|
|
key: turbo-dev-tauri-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
turbo-dev-tauri-${{ runner.os }}-
|
|
|
|
- name: install Dependencies
|
|
working-directory: apps/readest-app
|
|
run: |
|
|
pnpm install --frozen-lockfile --prefer-offline && pnpm setup-vendors
|
|
|
|
- name: setup sccache
|
|
uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
|
|
|
|
- name: install Rust toolchain
|
|
uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
|
|
with:
|
|
toolchain: stable
|
|
|
|
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
|
|
with:
|
|
key: tauri-cargo
|
|
cache-all-crates: 'true'
|
|
|
|
- name: Cache apt packages
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
|
with:
|
|
path: /var/cache/apt/archives
|
|
key: apt-tauri-${{ runner.os }}
|
|
- name: install system dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y pkg-config libfontconfig-dev libglib2.0-dev libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libsoup-3.0-dev xvfb
|
|
|
|
- name: run tauri tests
|
|
working-directory: apps/readest-app
|
|
run: xvfb-run pnpm test:pr:tauri
|