Release 1.44.0 — Quick wins (roadmap 60)

.github/workflows/battery.yml

@@ -49,25 +49,25 @@ jobs:
       E2E_NO_PERF_OFFER: '1'
       MODE: quick
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           path: core
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           repository: ${{ fromJSON(inputs.refs).scenes.repo }}
           ref: ${{ fromJSON(inputs.refs).scenes.ref }}
           path: scenes
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           repository: ${{ fromJSON(inputs.refs).modules.repo }}
           ref: ${{ fromJSON(inputs.refs).modules.ref }}
           path: modules
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           repository: ${{ fromJSON(inputs.refs).packs.repo }}
           ref: ${{ fromJSON(inputs.refs).packs.ref }}
           path: packs
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version-file: core/.nvmrc
           cache: npm
@@ -81,7 +81,7 @@ jobs:
           # the module zips the game suites install (MODULES_REPO)
           (cd modules && npm ci --no-audit --no-fund && node scripts/pack.cjs --all --force)
       # confirm: what the required shards left red (or unrun), from their artifacts
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         if: inputs.set == 'confirm'
         with:
           pattern: battery-required-*
@@ -99,7 +99,7 @@ jobs:
                  POOL_TPSCENE=$S/examples/pool-party/scene.tpscene
           node scripts/ci/battery.cjs run --set ${{ inputs.set }} ${{ inputs.set == 'confirm' && '--from "$W/prev"' || '' }} --shard ${{ matrix.shard }} --of ${{ matrix.of }} --serve --port 5173 \
             --deadline ${{ inputs.deadline }} --out "$W/battery-out"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: battery-${{ inputs.set }}-${{ matrix.shard }}

.github/workflows/ci.yml

@@ -5,11 +5,11 @@
 # enforced by whoever remembered to run it, and a broken main was discovered at release
 # time. Everything below is what a maintainer already does by hand.
 #
-# WHY e2e-smoke IS NOT REQUIRED YET: it renders WebGL through SwiftShader on a GPU-less
-# runner, and this project's own notes measure ~4.5 fps there plus a documented family of
-# timing-sensitive suites. Blocking every PR on that before it has been observed green on
-# GitHub would train people to ignore a red tick, which is worse than not having it. It
-# reports, it does not gate, and the comment below says when to flip it.
+# e2e-smoke GATES since test-health-1 (feat/60). It renders WebGL through SwiftShader on a
+# GPU-less runner (~4.5 fps), so it was report-only until it had been seen green on GitHub:
+# the runner step now really fails (it used to `|| echo` every red away), a failed suite runs
+# once more (green on the retry = flaky, reported), and a known flake is entered in
+# tests/e2e/quarantine.json with an owner and a review date instead of blocking every PR.
 #
 # Two-peer suites stay a MANUAL gate: they meet on the self-hosted signaling box, which a
 # public runner cannot reach and should not be pointed at.
@@ -33,8 +33,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: npm
@@ -57,8 +57,8 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: npm
@@ -92,8 +92,8 @@ jobs:
   scene-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: npm
@@ -103,12 +103,12 @@ jobs:
         run: |
           echo "scenes=$(node -p "require('./perf/budgets.json').scenes.ref")" >> "$GITHUB_OUTPUT"
           echo "scenes_repo=$(node -p "require('./perf/budgets.json').scenes.repo")" >> "$GITHUB_OUTPUT"
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           repository: ${{ steps.refs.outputs.scenes_repo }}
           ref: ${{ steps.refs.outputs.scenes }}
           path: .perf-deps/scenes
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           repository: theprototype-app/packs
           path: .perf-deps/packs
@@ -123,7 +123,7 @@ jobs:
   supply-chain:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: SBOM (syft, SPDX JSON)
         uses: anchore/sbom-action@v0.24.3
         with:
@@ -145,8 +145,8 @@ jobs:
   unit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: npm
@@ -156,12 +156,10 @@ jobs:
   e2e-smoke:
     if: ${{ !inputs.battery }}
     runs-on: ubuntu-latest
-    # NOT a gate yet — see the header. Flip this to false once it has been green on a few
-    # PRs in a row; until then a red here is a signal to read, not a block.
-    continue-on-error: true
+    # a gate — see the header (green on GitHub for bc453ae8 and e77ca3f7 before the flip)
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: npm
@@ -186,14 +184,20 @@ jobs:
           # Deliberately NOT added: net-stress and signaling-reconnect are multi-peer and
           # meet on the self-hosted signaling box, which a public runner cannot reach and
           # should not be pointed at (see the header) — they stay a manual gate.
-          for s in net-backoff net-mesh wire-hardening runtime-resilience diagnostics mesh-budget script-guard dispose approval-timeout; do
-            echo "::group::$s"
-            npm run e2e -- "$s" || echo "SUITE FAILED: $s"
-            echo "::endgroup::"
-          done
+          # test-health-1: through the battery runner, so a red is a red (the old loop's
+          # `|| echo SUITE FAILED` could never fail the step), a failed suite runs once more
+          # (green on the retry = flaky, reported) and tests/e2e/quarantine.json applies.
+          node scripts/ci/battery.cjs run --only net-backoff,net-mesh,wire-hardening,runtime-resilience,diagnostics,mesh-budget,script-guard,dispose,approval-timeout --port 5173 --out /tmp/smoke
       - name: dev server log on failure
         if: failure()
         run: tail -40 /tmp/dev.log
+      - name: suite logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: e2e-smoke-logs
+          path: /tmp/smoke/logs
+          if-no-files-found: ignore
 
   # 53-reader (A4): THE ACCESSIBILITY GATE. axe-core over the main surfaces (editor shell, object
   # list, Inspector, Settings, Asset Browser on recorded fixtures, phone shell) FAILS on serious and
@@ -204,8 +208,8 @@ jobs:
     if: ${{ !inputs.battery }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: npm
@@ -229,14 +233,21 @@ jobs:
           npm run e2e -- a11y-axe a11y-reader || rc=$?
           [ -f /tmp/axe/axe-after.md ] && cat /tmp/axe/axe-after.md >> "$GITHUB_STEP_SUMMARY"
           exit $rc
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: axe-report
           path: /tmp/axe
       - name: dev server log on failure
         if: failure()
         run: tail -40 /tmp/dev.log
+      - name: suite logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: e2e-smoke-logs
+          path: /tmp/smoke/logs
+          if-no-files-found: ignore
 
   # 38 (NOTES-38 #18): THE TOKEN SCREENSHOT DIFF. /kit renders every redesign primitive in every
   # state; this job shoots it in the dark, light and custom themes on the PR's BASE ref and on its
@@ -248,10 +259,10 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: npm
@@ -284,7 +295,7 @@ jobs:
           node tests/e2e/tools/kit-diff.cjs diff /tmp/kit/base /tmp/kit/head /tmp/kit/diff; rc=$?
           cat /tmp/kit/diff/report.md >> "$GITHUB_STEP_SUMMARY"
           exit $rc
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always() && steps.base.outputs.has_kit == '1'
         with:
           name: kit-diff