Repository navigation
Expand file tree
/
Copy path.cnb.yml
More file actions
252 lines (231 loc) · 9.76 KB
/
Copy path.cnb.yml
File metadata and controls
252 lines (231 loc) · 9.76 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
# CNB is a one-way mirror from GitHub. Keep this file source-controlled here;
# CNB-side edits will be overwritten by the GitHub -> CNB sync workflow.
.feishu_bridge_tests: &feishu_bri
10BC8
dge_tests
name: feishu bridge tests
runner:
tags: cnb:arch:amd64
cpus: 8
docker:
image: node:22-bookworm
stages:
- name: feishu bridge tests
script: |
set -eu
cd integrations/feishu-bridge
npm ci
npm run check
npm test
.rust_workspace_gates_stage: &rust_workspace_gates_stage
name: rust workspace gates
# The all-feature TUI test crate is large enough that concurrent rustc and
# clippy processes or disposable test debug metadata can exceed the shared
# CNB runner's memory. Keep the full gate surface, but serialize Cargo,
# omit test-only debug tables, and use the established workspace-test stack
# size so deep runtime API tests do not abort on the platform default.
timeout: 45m
script: |
set -eu
export CARGO_BUILD_JOBS=1
export CARGO_PROFILE_TEST_DEBUG=0
./scripts/release/check-versions.sh
./scripts/release/check-ohos-deps.sh
cargo fmt --all -- --check
cargo check --workspace --all-targets --locked
cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
# Use the shared test HOME boundary while retaining the real toolchain.
RUST_MIN_STACK=16777216 sh scripts/with-hermetic-test-home.sh cargo test --workspace --all-features --locked
# Parity gates as first-class steps so drift surfaces as a named failure,
# not a buried workspace-test entry. Mirrors release.yml's parity job.
sh scripts/with-hermetic-test-home.sh cargo test -p codewhale-protocol --test parity_protocol --locked
sh scripts/with-hermetic-test-home.sh cargo test -p codewhale-state --test parity_state --locked
.linux_rust_gates: &linux_rust_gates
name: linux rust gates
runner:
tags: cnb:arch:amd64
cpus: 16
docker:
image: rust:1.88-bookworm
# codewhale-cnb-bridge GitHub App credentials from the CNB KeyStore
# (codewhale.net/codewhale-ci-secrets, github-bridge.yml), injected as
# environment variables. Values are never printed.
# https://docs.cnb.cool/en/repo/secret.html
imports:
- https://cnb.cool/codewhale.net/codewhale-ci-secrets/-/blob/main/github-bridge.yml
stages:
- name: install linux dependencies
script: |
set -eu
apt-get update
apt-get install -y git libdbus-1-dev nodejs npm pkg-config
if command -v rustup >/dev/null 2>&1; then
rustup component add rustfmt clippy
fi
- *rust_workspace_gates_stage
- name: linux npm wrapper smoke
# Full LTO can link silently for longer than CNB's default 10-minute
# no-output window. Keep the production profile and give the job enough
# time to emit its version and wrapper receipts.
timeout: 45m
script: |
set -eu
# The release profile uses full LTO and one codegen unit. Bound Cargo's
# parallelism so the final links cannot exhaust a shared CNB runner.
cargo build --jobs 2 --release --locked -p codewhale-cli
cp target/release/codewhale target/release/codew
export PATH="$PWD/target/release:$PATH"
node scripts/release/npm-wrapper-smoke.js
./target/release/codewhale --version
./target/release/codew --version
# Shadow-parity bridge (ops design: CNB-PRIMARY-CI-DESIGN-20260830). Post one
# non-required "-cnb" Check Run on the exact GitHub SHA being built so the
# CNB verdict is visible on GitHub while GitHub Actions stays the canonical,
# required CI. endStages always run and cannot fail the pipeline, so a
# bridge outage never turns a green CNB build red (and vice versa: the CNB
# verdict is reported from CNB_PIPELINE_STATUS, not from this stage).
endStages:
- name: github shadow check run
script: |
set -eu
case "${CNB_PIPELINE_STATUS:-error}" in
success) conclusion="success" ;;
cancel) conclusion="cancelled" ;;
*) conclusion="failure" ;;
esac
node scripts/ci/cnb-github-checkrun.mjs \
--name "linux rust gates -cnb" \
--sha "${CNB_COMMIT}" \
--status completed \
--conclusion "${conclusion}" \
--details-url "${CNB_BUILD_WEB_URL:-https://cnb.cool/${CNB_REPO_SLUG}}" \
--summary "CNB pipeline '${CNB_PIPELINE_NAME:-linux rust gates}' finished with status ${CNB_PIPELINE_STATUS:-unknown} on ${CNB_BRANCH:-unknown branch} (${CNB_COMMIT}). Shadow lane per the CNB-primary CI design: GitHub Actions remains canonical and required; nothing is gated on this check."
.linux_release_preflight: &linux_release_preflight
name: linux release preflight
runner:
tags: cnb:arch:amd64
cpus: 16
docker:
image: rust:1.88-bookworm
stages:
- name: install release dependencies
script: |
set -eu
apt-get update
apt-get install -y curl git libdbus-1-dev nodejs npm pkg-config
if command -v rustup >/dev/null 2>&1; then
rustup component add rustfmt clippy
fi
- *rust_workspace_gates_stage
- name: crate publish dry-run
script: |
set -eu
./scripts/release/publish-crates.sh dry-run
- name: release binary smoke
# Full LTO can link silently for longer than CNB's default 10-minute
# no-output window. Keep the production profile and give the job enough
# time to emit its version and wrapper receipts.
timeout: 45m
script: |
set -eu
# Keep the production release profile intact while avoiding a burst of
# concurrent rustc/linker processes on the shared release runner.
cargo build --jobs 2 --release --locked -p codewhale-cli
cp target/release/codewhale target/release/codew
export PATH="$PWD/target/release:$PATH"
node scripts/release/npm-wrapper-smoke.js
./target/release/codewhale --version
./target/release/codew --version
main:
push:
- *feishu_bridge_tests
- *linux_rust_gates
"(fix/*|rebrand/*)":
push:
- *linux_rust_gates
"work/v*":
push:
- *feishu_bridge_tests
- *linux_release_preflight
$:
tag_push:
- docker:
image: rust:1.88-bookworm
stages:
- name: build linux x64 release assets (static)
# The static full-LTO link can also outlive CNB's default no-output
# window. Do not weaken the release profile to keep the runner alive.
timeout: 45m
script: |
set -eu
apt-get update
apt-get install -y git musl-tools nodejs pkg-config
rustup target add x86_64-unknown-linux-musl
./scripts/release/check-versions.sh --require-dated-release
./scripts/release/check-ohos-deps.sh
checkout_sha="$(git rev-parse 'HEAD^{commit}')"
commit_sha="${CNB_COMMIT:-${checkout_sha}}"
if [ "$commit_sha" != "$checkout_sha" ]; then
echo "ERROR: CNB_COMMIT ${commit_sha} does not match checkout ${checkout_sha}" >&2
exit 1
fi
export CODEWHALE_BUILD_SHA="$commit_sha"
cargo build --jobs 2 --release --locked \
--target x86_64-unknown-linux-musl \
-p codewhale-cli # single binary
mkdir -p target/cnb-release
BIN_DIR="target/x86_64-unknown-linux-musl/release"
cp "$BIN_DIR/codewhale" target/cnb-release/codewhale-linux-x64
cp "$BIN_DIR/codewhale" target/cnb-release/codew-linux-x64
cp "$BIN_DIR/codewhale" target/cnb-release/codewhale-tui-linux-x64
strip \
target/cnb-release/codewhale-linux-x64 \
target/cnb-release/codew-linux-x64 \
target/cnb-release/codewhale-tui-linux-x64 \
|| true
(
cd target/cnb-release
sha256sum \
codewhale-linux-x64 \
codew-linux-x64 \
codewhale-tui-linux-x64 \
> codewhale-artifacts-sha256.txt
)
tag_name="${CNB_BRANCH:-}"
if [ -z "$tag_name" ]; then
tag_name="$(git describe --tags --exact-match 2>/dev/null || true)"
fi
version="${tag_name#v}"
cargo_version="$(grep -E '^version = "' Cargo.toml | head -n1 | sed -E 's/^version = "([^"]+)".*/\1/')"
if [ -n "$tag_name" ] && [ "$version" != "$cargo_version" ]; then
echo "ERROR: tag ${tag_name} does not match Cargo.toml version ${cargo_version}" >&2
exit 1
fi
{
echo "# ${tag_name:-CNB release}"
echo
awk -v version="${version}" '
index($0, "## [" version "]") == 1 { in_section = 1; next }
in_section && /^## \[/ { exit }
in_section { print }
' CHANGELOG.md
echo
echo "Built by CNB from ${commit_sha}."
echo
echo "Assets:"
echo "- codewhale-linux-x64"
echo "- codew-linux-x64"
echo "- codewhale-tui-linux-x64 (v0.9.4 compatibility alias)"
echo "- codewhale-artifacts-sha256.txt"
} > target/cnb-release/CNB_RELEASE.md
- name: create cnb release
type: git:release
options:
descriptionFromFile: target/cnb-release/CNB_RELEASE.md
latest: true
- name: upload linux x64 release assets
image: cnbcool/attachments:latest
settings:
attachments:
- target/cnb-release/codewhale-linux-x64
- target/cnb-release/codew-linux-x64
- target/cnb-release/codewhale-tui-linux-x64
- target/cnb-release/codewhale-artifacts-sha256.txt