Edison Jwa
5c8c6df16b
Constraint: SRS-118 and SRS-119 require a Linux release package and an Android release AAB, and the current workspace also needs the sibling oboe-rs checkout for Cargo manifest loading. Rejected: Keep release packaging as ad-hoc local knowledge | CI and contributors would still miss the required artifacts and hit the missing oboe-rs prerequisite. Confidence: medium Scope-risk: moderate Directive: If the oboe-rs fork path changes or is vendored, update the helper scripts and workflow checkout steps together. Tested: bash -n tools/build-linux-deb.sh tools/build-android-aab.sh; python3 YAML parse for .github/workflows/ci.yml, .github/workflows/bench-advisory.yml, .github/workflows/bench-baseline-update.yml; git diff --check Not-tested: End-to-end flutter build linux --release; end-to-end flutter build appbundle --release; GitHub Actions runtime execution
190 lines
6.9 KiB
YAML
190 lines
6.9 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
|
|
jobs:
|
|
rust:
|
|
name: cargo check + cargo test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Checkout oboe-rs fork
|
|
run: git clone --depth 1 https://github.com/edisonjwa/oboe-rs.git ../oboe-rs
|
|
- name: System deps (cpal / Opus / SQLite)
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y \
|
|
libasound2-dev libpulse-dev pkg-config \
|
|
libopus-dev
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: cargo check --workspace
|
|
run: cargo check --workspace --locked
|
|
- name: cargo test --workspace
|
|
env:
|
|
# Storage tests must not hit the real OS keyring on CI:
|
|
# there is no D-Bus session available and the call would
|
|
# block. The runtime code carries the same toggle for
|
|
# headless / sandboxed environments.
|
|
CHANORA_DISABLE_KEYRING: "1"
|
|
run: cargo test --workspace --locked --no-fail-fast
|
|
- name: cargo clippy
|
|
run: cargo clippy --workspace --all-targets -- -D warnings
|
|
continue-on-error: true
|
|
|
|
supply-chain:
|
|
name: cargo deny (licenses + advisories + bans + sources)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Checkout oboe-rs fork
|
|
run: git clone --depth 1 https://github.com/edisonjwa/oboe-rs.git ../oboe-rs
|
|
- uses: EmbarkStudios/cargo-deny-action@v2
|
|
with:
|
|
command: check
|
|
# `licenses` enforces the DEC-020 license posture; the
|
|
# other three are minimal supply-chain hygiene per
|
|
# `docs/governance/legal-review-readiness.md` §5.
|
|
arguments: --workspace --all-features
|
|
|
|
license-inventory:
|
|
name: cargo about (license inventory)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Checkout oboe-rs fork
|
|
run: git clone --depth 1 https://github.com/edisonjwa/oboe-rs.git ../oboe-rs
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: Install cargo-about
|
|
run: cargo install --locked --features cli cargo-about
|
|
- name: Regenerate inventory and compare
|
|
# Build the inventory in a temp file and diff against the
|
|
# committed copy. CI fails when the committed inventory is
|
|
# stale, forcing contributors to run the tool locally
|
|
# before opening a PR that touches the dependency tree.
|
|
run: |
|
|
cargo about generate --output-file /tmp/license-inventory.md about-md.hbs
|
|
diff docs/security/license-inventory.md /tmp/license-inventory.md \
|
|
|| { echo "::error::docs/security/license-inventory.md is stale; regenerate with 'cargo about generate --output-file docs/security/license-inventory.md about-md.hbs'"; exit 1; }
|
|
|
|
flutter-license-inventory:
|
|
name: flutter license inventory
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: stable
|
|
- name: flutter pub get
|
|
working-directory: apps/chanora_flutter
|
|
run: flutter pub get
|
|
- name: Regenerate Flutter license inventory and compare
|
|
env:
|
|
# Resolved by the wrapper from $HOME/sdks/flutter when
|
|
# not set; CI's subosito/flutter-action puts flutter on
|
|
# PATH but exports the SDK root under FLUTTER_ROOT.
|
|
FLUTTER_ROOT: ${{ env.FLUTTER_ROOT }}
|
|
run: |
|
|
./tools/dump_flutter_licenses.sh
|
|
if ! git diff --quiet docs/security/flutter-license-inventory.md; then
|
|
echo "::error::docs/security/flutter-license-inventory.md is stale; regenerate with 'tools/dump_flutter_licenses.sh'"
|
|
git --no-pager diff docs/security/flutter-license-inventory.md | head -40
|
|
exit 1
|
|
fi
|
|
|
|
flutter:
|
|
name: flutter analyze
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: stable
|
|
- name: flutter pub get
|
|
working-directory: apps/chanora_flutter
|
|
run: flutter pub get
|
|
- name: flutter analyze
|
|
working-directory: apps/chanora_flutter
|
|
run: flutter analyze
|
|
- name: flutter test (unit only)
|
|
working-directory: apps/chanora_flutter
|
|
run: flutter test --exclude-tags e2e
|
|
|
|
flutter-ios-release-build:
|
|
name: flutter iOS unsigned release build
|
|
runs-on: macos-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Checkout oboe-rs fork
|
|
run: git clone --depth 1 https://github.com/edisonjwa/oboe-rs.git ../oboe-rs
|
|
- uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: stable
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: flutter pub get
|
|
working-directory: apps/chanora_flutter
|
|
run: flutter pub get
|
|
- name: flutter build ios --no-codesign
|
|
working-directory: apps/chanora_flutter
|
|
run: flutter build ios --release --no-codesign
|
|
|
|
flutter-linux-release-package:
|
|
name: flutter Linux release package (.deb)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Checkout oboe-rs fork
|
|
run: git clone --depth 1 https://github.com/edisonjwa/oboe-rs.git ../oboe-rs
|
|
- name: System deps (Flutter Linux + audio + packaging)
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y \
|
|
clang cmake ninja-build pkg-config libgtk-3-dev liblzma-dev \
|
|
libasound2-dev libpulse-dev libopus-dev libsdl2-dev
|
|
- uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: stable
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: Build Linux .deb package
|
|
run: ./tools/build-linux-deb.sh
|
|
- name: Upload Linux package artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: chanora-linux-deb
|
|
path: dist/linux/*.deb
|
|
|
|
flutter-android-release-aab:
|
|
name: flutter Android release AAB
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Checkout oboe-rs fork
|
|
run: git clone --depth 1 https://github.com/edisonjwa/oboe-rs.git ../oboe-rs
|
|
- uses: actions/setup-java@v4
|
|
with:
|
|
distribution: temurin
|
|
java-version: '17'
|
|
- uses: android-actions/setup-android@v3
|
|
- uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: stable
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: aarch64-linux-android,x86_64-linux-android
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: Install cargo-ndk
|
|
run: cargo install --locked cargo-ndk
|
|
- name: Build Android release AAB
|
|
run: ./tools/build-android-aab.sh
|
|
- name: Upload Android bundle artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: chanora-android-aab
|
|
path: dist/android/*.aab
|