Skip to content

Commit be85528

Browse files
Bill LeoutsakosBill Leoutsakos
Bill Leoutsakos
authored and
Bill Leoutsakos
committed
ci: prepare Resource Manager formatting patch on GitHub
1 parent b0aa549 commit be85528

1 file changed

Lines changed: 17 additions & 360 deletions

File tree

‎.github/workflows/test-build.yml‎

Lines changed: 17 additions & 360 deletions
Original file line numberDiff line numberDiff line change
@@ -1,370 +1,27 @@
11
name: Test and Build
2-
32
on:
4-
workflow_call:
53
workflow_dispatch:
6-
74
permissions:
85
contents: read
9-
106
jobs:
11-
test-build:
12-
name: Lint and Test
13-
runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
14-
timeout-minutes: 15
15-
7+
format-patch:
8+
name: Prepare integration formatting patch
9+
runs-on: ubuntu-latest
10+
timeout-minutes: 10
1611
steps:
17-
# The diff-based audits below need a base commit to read, and the default
18-
# depth of 1 clones a single commit with no parent. They normally fetch
19-
# their base by SHA (see "Resolve base ref"), so this depth only covers the
20-
# `HEAD~1` fallback — but without it that fallback resolves to nothing.
21-
#
22-
# Worth stating because the failure was invisible for so long: the migration
23-
# audit read the resulting `git diff` failure as "no migrations changed" and
24-
# exited 0, so it had never actually run on a push build.
25-
- name: Checkout code
26-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
12+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
2713
with:
28-
fetch-depth: 2
29-
30-
- name: Setup Bun
31-
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
14+
fetch-depth: 3
15+
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
3216
with:
3317
bun-version: 1.4.1
34-
35-
- name: Setup Node
36-
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
37-
with:
38-
node-version: 24
39-
40-
# Cache keys are scoped by event name, and fork PRs get their own
41-
# namespace on top: untrusted fork runs must never share a cache with
42-
# push runs (whose caches feed production image builds) or with trusted
43-
# internal-PR runs.
44-
#
45-
# node_modules also keys on the lockfile hash: a sticky disk is a mutable
46-
# volume, and `bun install --frozen-lockfile` adds what the lockfile needs
47-
# without pruning what it dropped, so branches on different lockfiles were
48-
# contaminating each other (a stale @next/swc 16.2.6 outlived the 16.2.11
49-
# bump). The bun and Turbo caches are content/hash-addressed, so they stay
50-
# shared — that is what keeps a fresh node_modules disk cheap to fill.
51-
- name: Mount Bun cache
52-
uses: ./.github/actions/cache-mount
53-
with:
54-
provider: ${{ vars.CI_PROVIDER }}
55-
key: ${{ github.repository }}-bun-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
56-
path: ~/.bun/install/cache
57-
58-
- name: Mount node_modules
59-
uses: ./.github/actions/cache-mount
60-
with:
61-
provider: ${{ vars.CI_PROVIDER }}
62-
key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ hashFiles('bun.lock') }}
63-
path: ./node_modules
64-
65-
- name: Mount Turbo cache
66-
uses: ./.github/actions/cache-mount
67-
with:
68-
provider: ${{ vars.CI_PROVIDER }}
69-
key: ${{ github.repository }}-turbo-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
70-
path: ./.turbo
71-
72-
- name: Install dependencies
73-
run: bun install --frozen-lockfile --ignore-scripts
74-
75-
# Surfaces known CVEs in the dependency tree. Non-blocking until the
76-
# existing advisory backlog is triaged, then flip to a required gate by
77-
# removing continue-on-error.
78-
- name: Security audit
79-
run: bun audit
80-
continue-on-error: true
81-
82-
- name: Validate env flags
83-
run: |
84-
FILE="apps/sim/lib/core/config/env-flags.ts"
85-
ERRORS=""
86-
87-
echo "Checking for hardcoded boolean env flags..."
88-
89-
# Use perl for multiline matching to catch both:
90-
# export const isHosted = true
91-
# export const isHosted =
92-
# true
93-
HARDCODED=$(perl -0777 -ne 'while (/export const (is[A-Za-z]+)\s*=\s*\n?\s*(true|false)\b/g) { print " $1 = $2\n" }' "$FILE")
94-
95-
if [ -n "$HARDCODED" ]; then
96-
ERRORS="${ERRORS}\n❌ Env flags must not be hardcoded to boolean literals!\n\nFound hardcoded flags:\n${HARDCODED}\n\nEnv flags should derive their values from environment variables.\n"
97-
fi
98-
99-
echo "Checking env flag naming conventions..."
100-
101-
# Check that all export const (except functions) start with 'is'
102-
# This finds exports like "export const someFlag" that don't start with "is" or "get"
103-
BAD_NAMES=$(grep -E "^export const [a-z]" "$FILE" | grep -vE "^export const (is|get)" | sed 's/export const \([a-zA-Z]*\).*/ \1/')
104-
105-
if [ -n "$BAD_NAMES" ]; then
106-
ERRORS="${ERRORS}\n❌ Env flags must use 'is' prefix for boolean flags!\n\nFound incorrectly named flags:\n${BAD_NAMES}\n\nExample: 'hostedMode' should be 'isHostedMode'\n"
107-
fi
108-
109-
if [ -n "$ERRORS" ]; then
110-
echo ""
111-
echo -e "$ERRORS"
112-
exit 1
113-
fi
114-
115-
echo "✅ All env flags are properly configured"
116-
117-
# One fetch for both base-ref audits, and no `|| true`: a swallowed fetch leaves
118-
# the base ref absent, which neither audit can tell apart from a branch that
119-
# changed nothing. The block-registry check at least degrades to a visible
120-
# `⚠ … skipping` line; the migration audit printed `✓ No new migrations to
121-
# check` and exited 0, clearing the only guard on production DDL.
122-
#
123-
# Depth stays at 1 — without a merge-base the migration audit diffs the two
124-
# tips, which under `--diff-filter=AM` is exactly the migrations new here.
125-
# Resolved once for both diff-based audits, and never with `|| true`: a
126-
# swallowed fetch leaves the base absent, which neither audit can tell apart
127-
# from a branch that changed nothing.
128-
#
129-
# On push the base is `github.event.before`, the tip the branch had before
130-
# this push — not `HEAD~1`, which names only the last commit and would let a
131-
# multi-commit push slip every earlier commit's migrations past the audit.
132-
# It is fetched by SHA at depth 1; the audits diff two tips and need no
133-
# common ancestry. An all-zero `before` means the branch is new and has no
134-
# predecessor to diff, so `HEAD~1` remains the fallback there.
135-
- name: Resolve base ref for diff-based audits
136-
id: audit_base
137-
run: |
138-
if [ "${{ github.event_name }}" = "pull_request" ]; then
139-
git fetch --depth=1 origin "${{ github.base_ref }}"
140-
echo "ref=origin/${{ github.base_ref }}" >> "$GITHUB_OUTPUT"
141-
elif [ -n "${{ github.event.before }}" ] &&
142-
[ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]; then
143-
git fetch --depth=1 origin "${{ github.event.before }}"
144-
echo "ref=${{ github.event.before }}" >> "$GITHUB_OUTPUT"
145-
else
146-
echo "ref=HEAD~1" >> "$GITHUB_OUTPUT"
147-
fi
148-
149-
- name: Check block registry invariants
150-
run: bun run apps/sim/scripts/check-block-registry.ts "${{ steps.audit_base.outputs.ref }}"
151-
152-
- name: Lint code
153-
run: bun run lint:check
154-
155-
# Every zero-argument `check:*` script, run concurrently. The list is derived in
156-
# scripts/run-audits.ts, which also writes the per-audit timing table to the job
157-
# summary and annotates failures. Audits needing a base ref stay separate below.
158-
- name: Repo audits
159-
run: bun run check:audits
160-
161-
- name: Verify docs manifest is in sync
162-
run: bun run docs-manifest:check
163-
164-
- name: Migration safety (zero-downtime) audit
165-
run: bun run check:migrations "${{ steps.audit_base.outputs.ref }}"
166-
167-
# Every workspace, not just realtime. packages/emcn, packages/utils,
168-
# apps/desktop and apps/docs had no type check in CI at all; apps/sim's
169-
# source was covered only as a side effect of `next build` in the separate
170-
# Build App job. Note this does NOT cover apps/sim's tests — its tsconfig
171-
# excludes *.test.ts(x), and including them today surfaces ~2.2k errors,
172-
# so that is its own cleanup rather than a gate to switch on here.
173-
- name: Type-check all workspaces
174-
run: bunx turbo run type-check
175-
176-
# cloud-review-tools.test.ts runs the real helper on the runner, which shells
177-
# out to rg. Blacksmith's image ships it, GitHub's doesn't.
178-
- name: Install ripgrep
179-
run: command -v rg || (sudo apt-get update && sudo apt-get install -y ripgrep)
180-
181-
# Runs the setup CLI's Bun tests plus each workspace's Vitest suite,
182-
# without `--coverage`. See the Codecov note below.
183-
#
184-
# apps/sim runs only its first shard here; `test-shard` below runs the
185-
# others. That suite is bound by the single Vite server thread that feeds
186-
# every worker — wall time is flat from 4 to 13 workers — so a bigger
187-
# runner buys nothing and each extra runner takes a proportional slice.
188-
- name: Run tests
189-
env:
190-
NODE_OPTIONS: '--no-warnings --max-old-space-size=8192'
191-
NEXT_PUBLIC_APP_URL: 'https://www.sim.ai'
192-
DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/simstudio'
193-
ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000' # dummy key for CI only
194-
TURBO_CACHE_DIR: .turbo
195-
SIM_TEST_SHARD: 1/3
196-
run: bun run test
197-
198-
- name: Check schema and migrations are in sync
199-
working-directory: packages/db
200-
run: |
201-
bunx drizzle-kit generate --config=./drizzle.config.ts
202-
if [ -n "$(git status --porcelain ./migrations)" ]; then
203-
echo "❌ Schema and migrations are out of sync!"
204-
echo "Run 'cd packages/db && bunx drizzle-kit generate' and commit the new migrations."
205-
git status --porcelain ./migrations
206-
git diff ./migrations
207-
exit 1
208-
fi
209-
echo "✅ Schema and migrations are in sync"
210-
211-
# The remaining shards of apps/sim's Vitest suite. Everything else — lint,
212-
# the audits, type-check, the other workspaces' suites — lives in
213-
# `test-build` with shard 1; these jobs exist only because that suite cannot
214-
# go faster on one machine (see the "Run tests" note there). Three shards
215-
# put each runner at roughly the fixed cost of checkout + install. The Turbo
216-
# cache disk gets its own key so the shards' entries do not evict each other.
217-
test-shard:
218-
name: Test (shard ${{ matrix.shard }})
219-
runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
220-
timeout-minutes: 15
221-
strategy:
222-
fail-fast: false
223-
matrix:
224-
shard: [2, 3]
225-
226-
steps:
227-
- name: Checkout code
228-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
229-
230-
- name: Setup Bun
231-
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
232-
with:
233-
bun-version: 1.4.1
234-
235-
- name: Setup Node
236-
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
237-
with:
238-
node-version: 24
239-
240-
- name: Mount Bun cache
241-
uses: ./.github/actions/cache-mount
242-
with:
243-
provider: ${{ vars.CI_PROVIDER }}
244-
key: ${{ github.repository }}-bun-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
245-
path: ~/.bun/install/cache
246-
247-
- name: Mount node_modules
248-
uses: ./.github/actions/cache-mount
249-
with:
250-
provider: ${{ vars.CI_PROVIDER }}
251-
key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ hashFiles('bun.lock') }}
252-
path: ./node_modules
253-
254-
- name: Mount Turbo cache
255-
uses: ./.github/actions/cache-mount
256-
with:
257-
provider: ${{ vars.CI_PROVIDER }}
258-
key: ${{ github.repository }}-turbo-cache-shard-${{ matrix.shard }}-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
259-
path: ./.turbo
260-
261-
- name: Install dependencies
262-
run: bun install --frozen-lockfile --ignore-scripts
263-
264-
- name: Install ripgrep
265-
run: command -v rg || (sudo apt-get update && sudo apt-get install -y ripgrep)
266-
267-
- name: Run tests (apps/sim shard ${{ matrix.shard }}/3)
268-
env:
269-
NODE_OPTIONS: '--no-warnings --max-old-space-size=8192'
270-
NEXT_PUBLIC_APP_URL: 'https://www.sim.ai'
271-
DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/simstudio'
272-
ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000' # dummy key for CI only
273-
TURBO_CACHE_DIR: .turbo
274-
SIM_TEST_SHARD: ${{ matrix.shard }}/3
275-
run: bunx turbo run test --filter=@sim/app
276-
277-
# Next.js production build, in parallel with lint + tests. Sticky disks are
278-
# cloned from the last committed snapshot per job and committed last-writer-
279-
# wins, so concurrent mounts are safe. The bun/node_modules disks are shared
280-
# with test-build (the lockfile-hashed key means they only ever share when the
281-
# dependency tree really is identical, so LWW loss is harmless), but the Turbo
282-
# cache gets its own key: with a shared key, only the last committer's new
283-
# entries survive each run, so the test and build Turbo entries would evict
284-
# each other nondeterministically.
285-
#
286-
# Runner is sized for the COLD-cache build, which is what OOM-killed the 8vcpu
287-
# tier (23 kills / 1074 runs at 98% of its 30.4 GB): warm peaks ~12 GB, cold
288-
# peaked 51 GB. NODE_OPTIONS' --max-old-space-size caps only Node's JS heap,
289-
# not the native Turbopack workers that dominate, so it cannot prevent this.
290-
build:
291-
name: Build App
292-
runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-16vcpu-ubuntu-2404' || 'linux-x64-8-core' }}
293-
# Build durations crossed 15 minutes as the app grew (10m02 on Jul 29 AM,
294-
# 14m44 after the folders/desktop/library merges, then two straight
295-
# timeouts) — GitHub reports a job timeout as "cancelled". 25 keeps
296-
# headroom without masking a genuine hang.
297-
timeout-minutes: 25
298-
299-
steps:
300-
- name: Checkout code
301-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
302-
303-
- name: Setup Bun
304-
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
305-
with:
306-
bun-version: 1.4.1
307-
308-
- name: Setup Node
309-
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
310-
with:
311-
node-version: 24
312-
313-
- name: Mount Bun cache
314-
uses: ./.github/actions/cache-mount
315-
with:
316-
provider: ${{ vars.CI_PROVIDER }}
317-
key: ${{ github.repository }}-bun-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
318-
path: ~/.bun/install/cache
319-
320-
- name: Mount node_modules
321-
uses: ./.github/actions/cache-mount
322-
with:
323-
provider: ${{ vars.CI_PROVIDER }}
324-
key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ hashFiles('bun.lock') }}
325-
path: ./node_modules
326-
327-
- name: Mount Turbo cache
328-
uses: ./.github/actions/cache-mount
329-
with:
330-
provider: ${{ vars.CI_PROVIDER }}
331-
key: ${{ github.repository }}-turbo-cache-build-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
332-
path: ./.turbo
333-
334-
# No `.next/cache` mount: the Turbopack persistent build cache is off. A
335-
# controlled A/B on one branch (PR #6078) with a byte-identical module graph
336-
# measured compile at 113s with the cache off, 162s cold with it on, and
337-
# 360s warm — the cache made the same build 3.2x slower, and it grew
338-
# 5.1 GB -> 12 GB across two runs of an unchanged tree, so a disk degrades
339-
# the more it is used. Mounting a disk nothing reads would only cost storage.
340-
341-
# Running out of RAM kills the whole VM and surfaces only as "the runner
342-
# has received a shutdown signal" — no mention of memory, ~12 min in. Warn
343-
# with the real numbers so that failure is a one-line diagnosis instead of
344-
# a mystery. Warn, never fail: a warm build peaks ~12 GB and a partial one
345-
# ~28 GB, so a 32 GB runner still completes plenty of builds, and the
346-
# GitHub fallback is the break-glass path — degrading it to a guaranteed
347-
# failure would be worse than the risk this flags.
348-
- name: Check runner memory headroom
349-
run: |
350-
TOTAL_GB=$(awk '/MemTotal/ {printf "%d", $2/1048576}' /proc/meminfo)
351-
echo "Runner memory: ${TOTAL_GB} GB"
352-
if [ "$TOTAL_GB" -lt 40 ]; then
353-
echo "::warning::Runner has ${TOTAL_GB} GB. A cold-cache build peaks ~51 GB, so this run may be OOM-killed (reported only as 'the runner has received a shutdown signal'). Warm/partial builds should still fit."
354-
fi
355-
356-
- name: Install dependencies
357-
run: bun install --frozen-lockfile --ignore-scripts
358-
359-
- name: Build application
360-
env:
361-
NODE_OPTIONS: '--no-warnings --max-old-space-size=8192'
362-
NEXT_PUBLIC_APP_URL: 'https://www.sim.ai'
363-
DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/simstudio'
364-
STRIPE_SECRET_KEY: 'dummy_key_for_ci_only'
365-
STRIPE_WEBHOOK_SECRET: 'dummy_secret_for_ci_only'
366-
RESEND_API_KEY: 'dummy_key_for_ci_only'
367-
AWS_REGION: 'us-west-2'
368-
ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000' # dummy key for CI only
369-
TURBO_CACHE_DIR: .turbo
370-
run: bunx turbo run build --filter=@sim/app
18+
- run: bun install --frozen-lockfile --ignore-scripts
19+
- name: Format integration sources on GitHub
20+
run: git diff --name-only -z HEAD~2 HEAD~1 -- '*.ts' '*.tsx' '*.json' | xargs -0 bunx biome check --write --linter-enabled=false
21+
- name: Export formatting patch
22+
run: git diff --binary > /tmp/oci-resource-manager-format.patch
23+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
24+
with:
25+
name: oci-resource-manager-format
26+
path: /tmp/oci-resource-manager-format.patch
27+
retention-days: 1

0 commit comments

Comments
 (0)