hack/.github/workflows/ci.yml at main · hack-dance/hack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
name: CI

on:
  push:
    tags-ignore:
      - "v*"
  pull_request:

jobs:
  secret-scan:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install Gitleaks
        id: gitleaks
        uses: gacts/gitleaks@v1
        with:
          version: 8.30.1
          run: 'false'
      - name: Scan checked-out commit history
        env:
          GITLEAKS_BIN: ${{ steps.gitleaks.outputs.gitleaks-bin }}
        run: |
          "$GITLEAKS_BIN" git . \
            --config .gitleaks.toml \
            --redact \
            --log-opts='--full-history --diff-filter=tuxdb HEAD' \
            --report-format sarif \
            --report-path "$RUNNER_TEMP/gitleaks.sarif"

  runtime-images:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: "1.3.9"
      - name: Setup Blacksmith Builder
        uses: useblacksmith/setup-docker-builder@v1
      - name: Install dependencies
        run: bun install
      - name: Build full runtime image
        run: |
          bun run scripts/build-node-runtime-image.ts \
            --variant node-runtime \
            --platform linux/amd64 \
            --tag hack-runtime-ci:full
      - name: Smoke full runtime image
        run: |
          docker run --rm --entrypoint hack hack-runtime-ci:full --help >/tmp/hack-full-help.txt
          grep -q "hack" /tmp/hack-full-help.txt
      - name: Build slim runtime image
        run: |
          bun run scripts/build-node-runtime-image.ts \
            --variant slim \
            --platform linux/amd64 \
            --tag hack-runtime-ci:slim
      - name: Smoke slim runtime image defaults
        run: |
          docker run --rm --entrypoint sh hack-runtime-ci:slim -lc 'command -v bun >/dev/null && command -v hack >/dev/null && test "${HACK_EXECUTION_MODE}" = "codex" && test "${HACK_DAEMON_DISABLE_DOCKER_EVENTS}" = "1" && hack --help >/tmp/hack-help.txt && grep -q "Usage:" /tmp/hack-help.txt'
      - name: Smoke slim runtime mounted-project env flow
        run: bash scripts/portable-container-smoke.sh hack-runtime-ci:slim linux/amd64

  docker-e2e:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: "1.3.9"
      - name: Install tmux
        run: sudo apt-get update && sudo apt-get install --yes tmux
      - name: Install dependencies
        run: bun install
      - name: Create isolated Hack network
        run: docker network create --subnet 172.30.0.0/16 hack-dev
      - name: Run local and Docker E2E
        run: HACK_E2E_REQUIRE_DOCKER=1 HACK_E2E_REQUIRE_TMUX=1 bun run test:e2e:local:docker
      - name: Smoke container resource metadata without optional fields
        run: |
          probe_id=$(docker create --network none --read-only alpine:3.20 true)
          trap 'docker rm -f "$probe_id" >/dev/null' EXIT
          bun scripts/inspect-container-resources.ts --container "$probe_id" > "$RUNNER_TEMP/resource-probe.json"
          bun -e 'const r = await Bun.stdin.json(); if (r.probeStatus !== "not_running" || r.container.healthcheckIntervalNs !== null || r.container.writableLayerBytes !== null) throw new Error("Invalid optional resource metadata");' < "$RUNNER_TEMP/resource-probe.json"
          bun scripts/inspect-container-resources.ts --container "$probe_id" --storage > "$RUNNER_TEMP/resource-probe.json"
          bun -e 'const r = await Bun.stdin.json(); if (typeof r.container.writableLayerBytes !== "number") throw new Error("Missing writable-layer accounting");' < "$RUNNER_TEMP/resource-probe.json"

  test:
    runs-on: blacksmith-6vcpu-macos-15
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: "1.3.9"
      - name: Install dependencies
        run: bun install
      - name: Typecheck (Turbo)
        run: bun run turbo:typecheck
      - name: Privacy check
        run: bun run privacy:check
      - name: Quality checks (Turbo)
        run: bun run turbo:check
      - name: Tests (Turbo)
        run: bun run turbo:test
      - name: Build CLI
        run: bun run build
      - name: Build release smoke (no tests)
        run: bun run build:release --skip-tests --no-clean --out=dist/release-ci

  linux-process-lifetime:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: "1.3.9"
      - name: Require native regression tools
        run: |
          command -v python3
          command -v lsof
      - name: Install dependencies
        run: bun install --frozen-lockfile
      - name: Run process and terminal regressions
        run: bun test tests/daemon-command.test.ts tests/daemon-orphan.test.ts tests/host-exec-lifetime.test.ts tests/host-exec-tty.test.ts tests/shell-observation.test.ts