From c2c1097457dd3a7294dc7b93fa13f506779a551e Mon Sep 17 00:00:00 2001 From: Steven Enamakel Date: Sat, 2 May 2026 13:35:42 -0700 Subject: [PATCH 1/2] ci: pull pnpm into CI image, drop redundant setup steps Adds pnpm@10.10.0 (via corepack) to .github/Dockerfile and migrates non-release workflows to run inside the ghcr.io/tinyhumansai/openhuman_ci image so they no longer re-install Node, pnpm, cmake, or the ALSA/X11 dev libs that whisper-rs and the Tauri shell already need. Migrated to the container: - test.yml (unit-tests; rust jobs drop redundant cmake/X11 install) - typecheck.yml (typecheck job; rust-quality drops cmake) - coverage.yml (frontend-coverage; rust jobs drop cmake/X11) - build.yml (drops pnpm/node setup + cmake) - pr-quality.yml (checklist-guard, coverage-matrix) - weekly-code-review.yml Each containerized pnpm job caches ~/.local/share/pnpm/store keyed by pnpm-lock.yaml so we keep the install speedup that setup-node's cache: pnpm previously gave us. Untouched per scope: release-*.yml, build-desktop.yml, build-windows.yml (release/build paths), installer-smoke.yml (purpose-built clean-OS test), e2e-agent-review.yml (disabled), markdown-link-check (lychee action), coverage-gate (needs Python 3.12 + diff-cover). --- .github/Dockerfile | 7 ++++--- .github/workflows/build.yml | 24 ++++++++++-------------- .github/workflows/coverage.yml | 21 +++++++++------------ .github/workflows/pr-quality.yml | 16 ++++++---------- .github/workflows/test.yml | 23 +++++++++-------------- .github/workflows/typecheck.yml | 20 +++++++++----------- .github/workflows/weekly-code-review.yml | 20 +++++++++----------- 7 files changed, 56 insertions(+), 75 deletions(-) diff --git a/.github/Dockerfile b/.github/Dockerfile index 2a03d86d753..541f17dad25 100644 --- a/.github/Dockerfile +++ b/.github/Dockerfile @@ -48,10 +48,11 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- \ -c rustfmt -c clippy \ -t x86_64-unknown-linux-gnu -# Node.js 24.x + yarn +# Node.js 24.x + pnpm (project's package manager — pinned in package.json) RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \ && apt-get install -y --no-install-recommends nodejs \ - && npm install -g yarn + && corepack enable \ + && corepack prepare pnpm@10.10.0 --activate # Install ALSA, X11, input, and E2E automation dependencies RUN apt-get update && apt-get install -y --no-install-recommends \ @@ -88,4 +89,4 @@ COPY e2e/docker-entrypoint.sh /docker-entrypoint.sh RUN chmod +x /docker-entrypoint.sh # Verify installs -RUN rustc --version && cargo --version && node --version && yarn --version && mold --version && sccache --version && which tauri-driver && cargo tauri --version +RUN rustc --version && cargo --version && node --version && pnpm --version && mold --version && sccache --version && which tauri-driver && cargo tauri --version diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1b963e8e6c7..ce24a0c50a7 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -44,23 +44,19 @@ jobs: restore-keys: | cef-ubuntu-22.04- - # Note: the vendored CEF-aware tauri-cli is pre-installed in the - # ghcr.io/tinyhumansai/openhuman_ci image (see .github/Dockerfile), - # so `cargo tauri build` below resolves to the fork without any - # per-run compile step. - - name: Setup pnpm - uses: pnpm/action-setup@v4 - with: - cache: true - - name: Setup Node.js 24.x - uses: actions/setup-node@v4 + # Note: the vendored CEF-aware tauri-cli, Node 24, and pnpm are all + # pre-installed in the ghcr.io/tinyhumansai/openhuman_ci image (see + # .github/Dockerfile), so `cargo tauri build` below resolves to the + # fork without any per-run compile step. + - name: Cache pnpm store + uses: actions/cache@v4 with: - node-version: 24.x + path: ~/.local/share/pnpm/store + key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }} + restore-keys: | + pnpm-store-${{ runner.os }}- - name: Install dependencies run: pnpm install --frozen-lockfile - - name: Install cmake (for whisper-rs) - run: apt-get update && apt-get install -y --no-install-recommends cmake && - rm -rf /var/lib/apt/lists/* # Core is linked into the Tauri binary as a path dep — no separate # sidecar build / stage step needed. - name: Build Tauri app (CEF default) diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 5ee06c69167..0a86243beba 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -15,20 +15,21 @@ concurrency: jobs: frontend-coverage: name: Frontend Coverage (Vitest) - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 + container: + image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0 steps: - name: Checkout code uses: actions/checkout@v4 with: fetch-depth: 1 - - name: Setup pnpm - uses: pnpm/action-setup@v4 - with: - cache: true - - name: Setup Node.js 24.x - uses: actions/setup-node@v4 + - name: Cache pnpm store + uses: actions/cache@v4 with: - node-version: 24.x + path: ~/.local/share/pnpm/store + key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }} + restore-keys: | + pnpm-store-${{ runner.os }}- - name: Install dependencies run: pnpm install --frozen-lockfile - name: Run Vitest with coverage @@ -74,8 +75,6 @@ jobs: workspaces: . -> target cache-on-failure: true key: core-coverage - - name: Install system dependencies (cmake, ALSA, X11) - run: apt-get update && apt-get install -y --no-install-recommends cmake libasound2-dev libxdo-dev libxtst-dev libx11-dev libevdev-dev && rm -rf /var/lib/apt/lists/* - name: Install cargo-llvm-cov uses: taiki-e/install-action@cargo-llvm-cov - name: Run cargo llvm-cov for openhuman core @@ -116,8 +115,6 @@ jobs: key: cef-ubuntu-22.04-${{ hashFiles('app/src-tauri/Cargo.toml') }} restore-keys: | cef-ubuntu-22.04- - - name: Install system dependencies (cmake, ALSA, X11) - run: apt-get update && apt-get install -y --no-install-recommends cmake libasound2-dev libxdo-dev libxtst-dev libx11-dev libevdev-dev && rm -rf /var/lib/apt/lists/* - name: Install cargo-llvm-cov uses: taiki-e/install-action@cargo-llvm-cov - name: Run cargo llvm-cov for Tauri shell diff --git a/.github/workflows/pr-quality.yml b/.github/workflows/pr-quality.yml index c805cf91210..d7aa4c6c7f2 100644 --- a/.github/workflows/pr-quality.yml +++ b/.github/workflows/pr-quality.yml @@ -15,7 +15,9 @@ jobs: # blocking merges. Flip to hard-fail once the false-positive rate is stable. checklist-guard: name: PR Submission Checklist - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 + container: + image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0 continue-on-error: true if: ${{ !contains(github.event.pull_request.labels.*.name, 'docs') && !contains(github.event.pull_request.labels.*.name, 'chore') }} steps: @@ -23,17 +25,15 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 1 - - name: Setup Node.js 24.x - uses: actions/setup-node@v4 - with: - node-version: 24.x - name: Verify Submission Checklist env: PR_BODY: ${{ github.event.pull_request.body }} run: node scripts/check-pr-checklist.mjs coverage-matrix: name: Coverage Matrix Sync - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 + container: + image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0 continue-on-error: true if: ${{ !contains(github.event.pull_request.labels.*.name, 'docs') && !contains(github.event.pull_request.labels.*.name, 'chore') }} steps: @@ -41,10 +41,6 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 1 - - name: Setup Node.js 24.x - uses: actions/setup-node@v4 - with: - node-version: 24.x - name: Verify Coverage Matrix run: node scripts/check-coverage-matrix.mjs markdown-link-check: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 67deab7b61b..ed86f53f1c5 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -22,20 +22,21 @@ concurrency: jobs: unit-tests: name: Frontend Unit Tests - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 + container: + image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0 steps: - name: Checkout code uses: actions/checkout@v4 with: fetch-depth: 1 - - name: Setup pnpm - uses: pnpm/action-setup@v4 - with: - cache: true - - name: Setup Node.js 24.x - uses: actions/setup-node@v4 + - name: Cache pnpm store + uses: actions/cache@v4 with: - node-version: 24.x + path: ~/.local/share/pnpm/store + key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }} + restore-keys: | + pnpm-store-${{ runner.os }}- - name: Install dependencies run: pnpm install --frozen-lockfile - name: Run tests with coverage @@ -78,9 +79,6 @@ jobs: cache-on-failure: true key: core - - name: Install system dependencies (cmake, ALSA, X11) - run: apt-get update && apt-get install -y --no-install-recommends cmake libasound2-dev libxdo-dev libxtst-dev libx11-dev libevdev-dev && rm -rf /var/lib/apt/lists/* - - name: Install sccache uses: mozilla-actions/sccache-action@v0.0.9 @@ -124,9 +122,6 @@ jobs: key: cef-ubuntu-22.04-${{ hashFiles('app/src-tauri/Cargo.toml') }} restore-keys: | cef-ubuntu-22.04- - - name: Install system dependencies (cmake, ALSA, X11) - run: apt-get update && apt-get install -y --no-install-recommends cmake libasound2-dev - libxdo-dev libxtst-dev libx11-dev libevdev-dev && rm -rf /var/lib/apt/lists/* - name: Install sccache uses: mozilla-actions/sccache-action@v0.0.9 diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml index eced03f8f7d..3c3f95c1b05 100644 --- a/.github/workflows/typecheck.yml +++ b/.github/workflows/typecheck.yml @@ -14,20 +14,21 @@ concurrency: jobs: typecheck: name: Type Check TypeScript - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 + container: + image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0 steps: - name: Checkout code uses: actions/checkout@v4 with: fetch-depth: 1 - - name: Setup pnpm - uses: pnpm/action-setup@v4 - with: - cache: true - - name: Setup Node.js 24.x - uses: actions/setup-node@v4 + - name: Cache pnpm store + uses: actions/cache@v4 with: - node-version: 24.x + path: ~/.local/share/pnpm/store + key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }} + restore-keys: | + pnpm-store-${{ runner.os }}- - name: Install dependencies run: pnpm install --frozen-lockfile - name: Type check TypeScript files @@ -58,9 +59,6 @@ jobs: workspaces: | . -> target cache-on-failure: true - - name: Install cmake (for whisper-rs) - run: apt-get update && apt-get install -y --no-install-recommends cmake && - rm -rf /var/lib/apt/lists/* - name: Check formatting (cargo fmt) run: cargo fmt --all -- --check - name: Run clippy (core crate) diff --git a/.github/workflows/weekly-code-review.yml b/.github/workflows/weekly-code-review.yml index 58938570183..8d60ff2dacb 100644 --- a/.github/workflows/weekly-code-review.yml +++ b/.github/workflows/weekly-code-review.yml @@ -25,7 +25,9 @@ concurrency: jobs: weekly-review: name: Aggregate weekly signals - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 + container: + image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0 timeout-minutes: 30 steps: - name: Checkout repository @@ -33,21 +35,17 @@ jobs: with: fetch-depth: 1 - - name: Enable Corepack (for pnpm) - run: corepack enable - - - name: Setup Node.js 24.x - uses: actions/setup-node@v4 + - name: Cache pnpm store + uses: actions/cache@v4 with: - node-version: 24.x - cache: "pnpm" + path: ~/.local/share/pnpm/store + key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }} + restore-keys: | + pnpm-store-${{ runner.os }}- - name: Install JS dependencies run: pnpm install --frozen-lockfile - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@1.93.0 - - name: Cache cargo-audit binary id: cache-cargo-audit uses: actions/cache@v4 From 51c9e5f7de6875bba997728ac59b780440f3ef8b Mon Sep 17 00:00:00 2001 From: Steven Enamakel Date: Sat, 2 May 2026 13:44:20 -0700 Subject: [PATCH 2/2] ci: fix cargo-audit cache path for container CARGO_HOME The CI image sets CARGO_HOME=/usr/local/cargo, so `cargo install cargo-audit` writes the binary there, not in $HOME/.cargo/bin. Point the actions/cache path at /usr/local/cargo/bin/cargo-audit so the restore actually finds the cached binary instead of a guaranteed miss. Spotted by CodeRabbit on #1107. --- .github/workflows/weekly-code-review.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/weekly-code-review.yml b/.github/workflows/weekly-code-review.yml index 8d60ff2dacb..cb7af330052 100644 --- a/.github/workflows/weekly-code-review.yml +++ b/.github/workflows/weekly-code-review.yml @@ -50,7 +50,9 @@ jobs: id: cache-cargo-audit uses: actions/cache@v4 with: - path: ~/.cargo/bin/cargo-audit + # Image sets CARGO_HOME=/usr/local/cargo, so cargo install drops the + # binary there — not in $HOME/.cargo/bin. + path: /usr/local/cargo/bin/cargo-audit key: cargo-audit-${{ runner.os }}-v1 - name: Install cargo-audit