Skip to content

[measurement only, do not merge] fork-tests.yml on v0.1.9 - #7

Closed
scuttletoby wants to merge 478 commits into
fork/ci-basefrom
fork/ci
Closed

scuttletoby wants to merge 478 commits into
fork/ci-basefrom
fork/ci

Conversation

@scuttletoby

Copy link
Copy Markdown
Owner

Temporary: runs #6's workflow against upstream v0.1.9 (what main becomes after the reset) to measure job times. Closed and its base branch deleted when done.

🤖 Generated with Claude Code

SunkenInTime and others added 30 commits November 11, 2026 23:19
…am (pingdotgg#34246)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Julius Marminge <julius0216@outlook.com>
Co-authored-by: Julius Marminge <julius0216@outlook.com>
…ingdotgg#34343)

Co-authored-by: Aaron Zingerle <aaron.zingerle@avoautomation.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Julius Marminge <julius0216@outlook.com>
juliusmarminge and others added 21 commits November 12, 2026 00:02
…hosts on (pingdotgg#34978)

Co-authored-by: Claude Fable 5.2 <noreply@anthropic.com>
Upstream's workflows are disabled in the fork, so fork pull requests ran
no checks. fork-tests.yml now runs upstream ci.yml's checks on
pull_request and push to main: lint (knip, generated GraphQL, vp check),
build + typecheck + desktop launch + built web boot, package tests, web
tests, 8 server shards, Rust, macOS mobile lint and release smoke.

It keeps the workflow_call / workflow_dispatch `ref` interface, so a
release run tests one commit with every Linux job and no path filter.

Upstream's composite actions and change detector are used as they are.
A new `drift` job fails, naming each job and step, when upstream's
ci.yml or release.yml test jobs change and the copy did not follow.
The Check job lists every job and the reason for every skip.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- fork-ci-result needs every job and fails on a skip without a reason;
  its summary lists each job, why it skipped, and job wall times.
- Secret scan (gitleaks, checksum-pinned) of the commits a pull request
  or push adds; workflow lint (actionlint) next to the drift check.
- Ubuntu 24.04 runners as upstream: ubuntu-latest (26.04) fails an
  apps/server test with its newer git.
- Test is split across two runners by test file count; vp's task cache
  is kept between runs for the typecheck and the server shards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
noreply and others added 6 commits November 12, 2026 11:24
- Test and Test Web run on two runners each. A package with 100+ test
  files (and Test Web's 548) runs a vitest --shard slice on every
  runner; the rest are placed whole by test file count.
- Script header comments fit upstream's 4-line comment rule; the jq
  program in fork-ci-result passes shellcheck.
- The Ubuntu 24.04 pin is about choosing OS upgrades, not git: the
  24.04 image now ships git 2.56 as well.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The workflows job runs each .github/scripts/fork-*.test.{sh,py,cjs} and
checks them against .github/fork-ci-tests.txt. A present test that is not
listed fails. A listed test that is missing fails once it has been in the
tested commit's history; before that it is a note in the job summary, so a
test whose pull request has not merged yet does not fail the run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fork: builds name the repository they update from (T3CODE_RELEASE_REPOSITORY)

A build made with T3CODE_RELEASE_REPOSITORY=<owner>/<repo> lists, downloads and
links releases only from that repository: the server's `t3 update`, the Update
button's pinned-runtime download, the desktop app's SSH installs, and the
desktop app's own electron-updater feed. Without the setting nothing changes
(upstream pingdotgg/t3code). A malformed value fails the build instead of
quietly falling back to upstream.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fork: a GitHub Actions build names the repository it runs in

Without T3CODE_RELEASE_REPOSITORY, an Actions build takes GITHUB_REPOSITORY, as
the desktop updater feed already does. Reusable workflows (release-desktop.yml
re-bundles the server for the CLI executable) do not pass the caller's env on,
so the explicit variable alone would let a fork's CLI archive name upstream.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fork: the server follows upstream's desktop update repository setting

Review round 1: a second setting (T3CODE_RELEASE_REPOSITORY) with the opposite
precedence let a build set only T3CODE_DESKTOP_UPDATE_REPOSITORY and ship a
desktop app on the fork's feed with a server that updates from upstream.

The server, CLI and desktop SSH installs now read upstream's own setting in
upstream's order (T3CODE_DESKTOP_UPDATE_REPOSITORY, then GITHUB_REPOSITORY),
so all three readers agree by construction, and the patch no longer touches
build-desktop-artifact.ts or the web config's repository line. The former
name is still accepted when it names the same repository and fails the build
otherwise. A test checks the server's value against the desktop updater feed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: t3code-fork <noreply@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
#2)

* fork: release workflow for v<upstream>-fork.N on GitHub-hosted runners

fork-release.yml builds a fork release from a commit: upstream's tests
(fork-tests.yml, the release.yml test jobs on hosted runners), the JS bundle
with this repository as the release repository, the Linux x64 server archive
and the desktop apps through upstream's release-desktop.yml, unsigned unless
signing secrets exist. Publishing is opt-in, makes a normal release marked
latest, and stays a draft until every file is uploaded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fork release: guards in a tested script, write token only where it publishes

- A version that already has a tag or a published release is refused before the
  draft is created and again right before it is published, so "Re-run failed
  jobs" cannot replace a live release's files.
- Leftover drafts are removed under pipefail and each removal is logged; a failed
  release listing fails the step instead of reading as "no drafts".
- Only released upstream code: refuses any commit between the base tag and the
  build that is on upstream's default branch, a base tag that is not the newest
  stable tag in the history (a stray tag on an old commit), and a base above
  upstream's latest release.
- Marked latest only when above every published fork release.
- The CLI archives (the `t3` executable bundles the server again) must name this
  repository, not only apps/server/dist.
- Actions pinned by commit; fail_on_unmatched_files; named signing secrets
  instead of secrets: inherit; persist-credentials: false. Files are collected
  in a read-only assemble job; the publish job holds the write token, runs no
  package code, and only its three release steps see the token.
- The workflow's `published` output used jobs.publish.result, which
  workflow_call outputs cannot read; it now comes from the publish step.

Tests: .github/scripts/fork-release.test.sh (local git repos, fake gh; also
run in preflight) and fork-release-workflow.test.py (workflow shape).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fork release: check only the server program, never publish below a published release

- check-archives reads only <stem>/t3 (t3.exe in the zip), not client/, and fails when the
  program is missing. The web client names this repository on every Actions build, so it
  passed while the server still named upstream.
- check-bundle (new) checks apps/server/dist without dist/client, for the same reason.
- resolve and publish refuse a version that is not above every published release on the
  server's stable channel: the server updater takes the newest-created release, so an older
  build published later would read as a downgrade. Published releases are always latest.
- Preflight runs fork-release-workflow.test.py too.
- The build sets T3CODE_DESKTOP_UPDATE_REPOSITORY (the name release-repository.ts reads); the
  former T3CODE_RELEASE_REPOSITORY is gone. The publish job takes its guard script from
  github.workflow_sha, not from the commit being built.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: t3code-fork <noreply@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The job list API needs it; a failed call now warns in the log instead of
failing silently.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
main now carries #1, #2 and a newer upstream. fork-tests.yml keeps this
branch's version (it replaces #2's copy) and ports what the drift check
listed: test-delta.test.cjs in the release checks, Vitest's module cache
on the server shards (saved only by pushes), and no test-cache report
upload. Web was already split in two; the built-client boot stays in the
Build job.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@scuttletoby

Copy link
Copy Markdown
Owner Author

Measurement done; fork/ci now merges main, so PR #6 measures itself.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.