Skip to content

Adopt just as the command surface: recipes are the exact commands, CI runs them #35

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lann merged 1 commit into from
Aug 10, 2026
Merged

Adopt just as the command surface: recipes are the exact commands, CI runs them #35

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 89 additions & 0 deletions .github/justfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,89 @@
# CI job bodies: each workflow job runs exactly one `gha::` recipe, so
# `just ci` is exactly CI and the workflow files carry no logic beyond
# environment setup (checkout, toolchains, caches). Step-level rationale
# lives on the root-justfile recipes these compose.

set working-directory := '..'

# Wrap one recipe in a GitHub Actions log group (plain passthrough
# locally).
[private]
_step recipe:
#!/usr/bin/env bash
set -euo pipefail
if [ "${GITHUB_ACTIONS:-}" = "true" ]; then
echo "::group::just {{recipe}}"
status=0
just {{recipe}} || status=$?
echo "::endgroup::"
if [ $status -ne 0 ]; then
echo "::error title=just {{recipe}} failed::exit status $status"
exit $status
fi
else
just {{recipe}}
fi

# Like _step, but failures are tolerated: the CI-side replacement for the
# workflow-level `continue-on-error` the collapsed steps used to carry. A
# failure surfaces as a ::warning annotation, never as a job failure.
[private]
_step-tolerated recipe:
#!/usr/bin/env bash
set -euo pipefail
if [ "${GITHUB_ACTIONS:-}" = "true" ]; then
echo "::group::just {{recipe}} (non-blocking)"
status=0
just {{recipe}} || status=$?
echo "::endgroup::"
if [ $status -ne 0 ]; then
echo "::warning title=just {{recipe}} (non-blocking)::exit status $status — tolerated; see the recipe's comment for why"
fi
else
just {{recipe}} || echo "just {{recipe}}: FAILED (tolerated in CI; see the recipe's comment)"
fi

# The required per-push/PR matrix job (ci.yml `core`).
core:
@just gha::_step build
@just gha::_step test-rust
@just gha::_step shim
@just gha::_step fixtures
@just gha::_step corpus
@just gha::_step shells
@just gha::_step test-runtime
@just gha::_step test-wasi-shims
@just gha::_step test-ct-runner
@just gha::_step test-bundle
@just gha::_step conformance
@just gha::_step sched-seeds
@just gha::_step test-ports
@just gha::_step-tolerated test-webrtc

# The post-merge browser job (ci.yml `browser`; gates the prerelease).
browser:
@just gha::_step shim
@just gha::_step corpus
@just gha::_step "browsers-install --with-deps"
@just gha::_step "browser-lane chromium"
@just gha::_step "browser-lane firefox"
@just gha::_step-tolerated "browsers-install-webkit --with-deps"
@just gha::_step-tolerated "browser-lane webkit"

# Never gates: the drivers themselves exit 0 on deviations, 2 on
# infrastructure failure.
# The findings-only canary lanes (canary.yml, x64 leg).
canary:
@just gha::_step shim
@just gha::_step corpus
@just gha::_step "shell-lane sm-nightly --json sm-results.json"
@just gha::_step "shell-lane jsc-trunk --json jsc-results.json"
@just gha::_step "deno-canary --json deno-canary-results.json"

# JSC trunk has no arm64 channel — the two lanes with arm64 coverage.
# The findings-only canary lanes (canary.yml, arm64 leg).
canary-arm:
@just gha::_step shim
@just gha::_step corpus
@just gha::_step "shell-lane sm-nightly --json sm-results.json"
@just gha::_step "deno-canary --json deno-canary-results.json"
47 changes: 6 additions & 41 deletions .github/workflows/canary.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ on:
env:
DENO_VERSION: "2.9.5"
WASM_TOOLS_VERSION: "1.247.0"
JUST_VERSION: "1.54.0"

jobs:
shell-canaries:
Expand All @@ -38,36 +39,18 @@ jobs:
- uses: Swatinem/rust-cache@v2
- uses: taiki-e/install-action@v2
with:
tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }}
tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }},just@${{ env.JUST_VERSION }}
- uses: denoland/setup-deno@v2
with:
deno-version: ${{ env.DENO_VERSION }}

- name: build the translator shim (wasm32)
run: cargo build -p translator-shim --target wasm32-unknown-unknown --release
- name: generate the conformance corpus
working-directory: harness
run: deno task gen

# Deliberately NO actions/cache for .shell-cache: trunk/nightly
# builds change daily by design (fetching fresh IS the lane's
# purpose), and a prefix-restored cache from a failed earlier run
# can resurrect a broken extraction that fetch.ts's existence
# check would then trust (bitten once: the first-run jsc layout
# bug would have been pinned in place by exactly that).

- name: fetch SpiderMonkey nightly
run: deno run -A tools/shell/fetch.ts sm-nightly
- name: SpiderMonkey nightly lane
run: deno run -A tools/shell/run-lane.ts sm-nightly --json sm-results.json

- name: fetch JSC trunk (x86_64)
run: deno run -A tools/shell/fetch.ts jsc-trunk
- name: JSC trunk lane
run: deno run -A tools/shell/run-lane.ts jsc-trunk --json jsc-results.json

- name: Deno canary probe (V8-trailing-edge substitute for a d8 lane)
run: deno run -A tools/shell/deno-canary.ts --json deno-canary-results.json
- run: just gha::canary

- name: upload results
if: always()
Expand Down Expand Up @@ -114,31 +97,13 @@ jobs:
- uses: Swatinem/rust-cache@v2
- uses: taiki-e/install-action@v2
with:
tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }}
tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }},just@${{ env.JUST_VERSION }}
- uses: denoland/setup-deno@v2
with:
deno-version: ${{ env.DENO_VERSION }}

- name: build the translator shim (wasm32)
run: cargo build -p translator-shim --target wasm32-unknown-unknown --release
- name: generate the conformance corpus
working-directory: harness
run: deno task gen

# Deliberately NO actions/cache for .shell-cache: trunk/nightly
# builds change daily by design (fetching fresh IS the lane's
# purpose), and a prefix-restored cache from a failed earlier run
# can resurrect a broken extraction that fetch.ts's existence
# check would then trust (bitten once: the first-run jsc layout
# bug would have been pinned in place by exactly that).

- name: fetch SpiderMonkey nightly
run: deno run -A tools/shell/fetch.ts sm-nightly
- name: SpiderMonkey nightly lane
run: deno run -A tools/shell/run-lane.ts sm-nightly --json sm-results.json

- name: Deno canary probe
run: deno run -A tools/shell/deno-canary.ts --json deno-canary-results.json
# Deliberately NO actions/cache for .shell-cache: see the x64 job.
- run: just gha::canary-arm

- name: upload results
if: always()
Expand Down
141 changes: 14 additions & 127 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ concurrency:
env:
DENO_VERSION: "2.9.5"
WASM_TOOLS_VERSION: "1.247.0"
JUST_VERSION: "1.54.0"

jobs:
core:
Expand All @@ -33,111 +34,17 @@ jobs:
- uses: Swatinem/rust-cache@v2
- uses: taiki-e/install-action@v2
with:
tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }}
tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }},just@${{ env.JUST_VERSION }}
- uses: denoland/setup-deno@v2
with:
deno-version: ${{ env.DENO_VERSION }}

# --- Rust suites -------------------------------------------------------
- name: cargo build (workspace)
run: cargo build --workspace
- name: cargo test (translator-shim, bindgen)
run: cargo test -p translator-shim -p bindgen
- name: build the translator shim (wasm32)
# Every Deno suite below loads this artifact; order matters.
run: cargo build -p translator-shim --target wasm32-unknown-unknown --release

# --- Guest fixtures + corpus --------------------------------------------
- name: build example guest components
# examples/guests/build/ is gitignored; the runtime e2e suites and
# ct-runner's fixture tests need it. wasmtime CLI is optional in
# build.sh (smoke run only when present) and deliberately not
# installed here.
run: ./examples/build.sh
- name: generate the conformance corpus
# Rehearsal finding: 20 runtime e2e tests self-skip when
# harness/generated is absent — generation must precede the runtime
# suite (318/0/3 with it; 298/0/23 without).
working-directory: harness
run: deno task gen

# --- Pinned engine-shell lanes (required; issue #22 follow-up) ---------
# Per-push/PR SpiderMonkey + JSC coverage at fixed, sha256-verified
# pins (tools/shell/pins.json) — NOT the always-moving nightly/trunk
# channels, which stay findings-only canaries in canary.yml. Both are
# `required: true` overlays; a deviation here exits 1 and fails this
# job (tools/shell/run-lane.ts's `exp.required ? 1 : 0` tail).
- name: fetch SpiderMonkey pinned (Firefox 153.0 jsshell)
run: deno run -A tools/shell/fetch.ts sm-pinned
- name: SpiderMonkey pinned lane (required)
run: deno run -A tools/shell/run-lane.ts sm-pinned
- name: fetch JSC pinned (rev 318852@main, x64 only)
# No arm64 channel for jsc-built-products (or its repo-owned mirror
# of this exact rev) — fetch.ts refuses cleanly on other arches.
if: runner.arch == 'X64'
run: deno run -A tools/shell/fetch.ts jsc-pinned
- name: JSC pinned lane (required, x64 only)
if: runner.arch == 'X64'
run: deno run -A tools/shell/run-lane.ts jsc-pinned

# --- Deno suites -------------------------------------------------------
- name: runtime
working-directory: runtime
run: |
deno task check
deno task test
- name: wasi-shims
working-directory: wasi-shims
run: deno task test
- name: ct-runner
working-directory: ct-runner
run: deno task test
- name: release bundle (embedder artifact gate)
run: deno test -A tools/release-bundle/bundle_test.ts
- name: conformance (official CM suite, Deno lane)
working-directory: harness
run: deno task conformance

# --- Seeded scheduler runs (spec-allowed nondeterminism) ---------------
- name: runtime under DELTIC_SCHED_SEED=1
working-directory: runtime
run: deno task test
env:
DELTIC_SCHED_SEED: "1"
- name: runtime under DELTIC_SCHED_SEED=4242
working-directory: runtime
run: deno task test
env:
DELTIC_SCHED_SEED: "4242"
- name: conformance under DELTIC_SCHED_SEED=1
working-directory: harness
run: deno task conformance
env:
DELTIC_SCHED_SEED: "1"

# --- Ports (unit suites only; consumer conformance legs need the
# --- polymorph checkouts and are follow-up scope, issue #6) ------------
- name: ports/webcrypto
working-directory: ports/webcrypto
run: deno test --allow-read tests/
- name: ports/websocket
working-directory: ports/websocket
run: deno task test
- name: ports/webrtc
working-directory: ports/webrtc
# node-datachannel is a Node-API addon with linux prebuilds for both
# x64 and arm64 (arm64 proven on the dev box; see tools/probes).
# NON-BLOCKING for now: GH Actions runners give libdatachannel no
# usable ICE path for same-host loopback pairing — all
# connection-forming tests time out on BOTH arches while the addon
# loads and non-connection tests pass (first run: 1 passed /
# 8 timed-out). The dev-box lane remains the real gate; issue #21
# tracks the runner-networking fix (loopback candidates /
# bindAddress / werift).
continue-on-error: true
run: |
deno install --allow-scripts=npm:node-datachannel
deno test -A webrtc.test.ts
# The job body lives in the `gha` just module (one workflow job = one
# `gha::` recipe, so `just ci` is exactly CI); step-level rationale
# lives on the root-justfile recipes it composes. Suite order,
# arch-conditional lanes (jsc-pinned is x64-only) and the tolerated
# webrtc suite (issue #21) are all encoded there.
- run: just gha::core

browser:
runs-on: ubuntu-24.04
Expand All @@ -164,44 +71,24 @@ jobs:
- uses: Swatinem/rust-cache@v2
- uses: taiki-e/install-action@v2
with:
tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }}
tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }},just@${{ env.JUST_VERSION }}
- uses: denoland/setup-deno@v2
with:
deno-version: ${{ env.DENO_VERSION }}

- name: build the translator shim (wasm32)
run: cargo build -p translator-shim --target wasm32-unknown-unknown --release
- name: generate the conformance corpus
working-directory: harness
run: deno task gen

- name: cache playwright browsers
uses: actions/cache@v4
with:
# run-lane.ts pins playwright@1.62.1 and a REPO-LOCAL browser cache
# (PLAYWRIGHT_BROWSERS_PATH=$PWD/.browser-cache) — cache that path,
# not ~/.cache/ms-playwright (rehearsal finding).
# not ~/.cache/ms-playwright (rehearsal finding). The recipe's
# install step below restores into it.
path: .browser-cache
key: playwright-1.62.1-${{ runner.os }}-${{ runner.arch }}
- name: install browsers (chromium, firefox)
run: PLAYWRIGHT_BROWSERS_PATH=$PWD/.browser-cache deno run -A npm:playwright@1.62.1 install --with-deps chromium firefox

- name: chromium lane (required — expects exact Deno-lane parity)
run: deno run -A tools/browser/run-lane.ts chromium
- name: firefox lane (required — JSPI pref set by the driver)
run: deno run -A tools/browser/run-lane.ts firefox

# WebKit is best-effort per docs/architecture.md §3/§12 (issue #11): the
# lane's expectation overlay
# encodes JSC's missing multi-memory; GH's ubuntu-24.04 matches the ABI
# playwright's WebKit wants, so no library staging should be needed —
# but the lane stays non-blocking until it has a track record.
- name: install webkit (best-effort)
continue-on-error: true
run: PLAYWRIGHT_BROWSERS_PATH=$PWD/.browser-cache deno run -A npm:playwright@1.62.1 install --with-deps webkit
- name: webkit lane (best-effort)
continue-on-error: true
run: deno run -A tools/browser/run-lane.ts webkit
# shim + corpus + browser install (--with-deps) + the chromium/firefox
# required lanes + the best-effort webkit lane, per the recipes.
- run: just gha::browser

# Every GREEN main ref update ships a prerelease (issue #16's interim
# scheme): tag pre-<shorthash>, shim artifacts + SHA256SUMS. Gated on this
Expand Down
35 changes: 9 additions & 26 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,9 @@ jobs:
- uses: dtolnay/rust-toolchain@stable
with:
targets: wasm32-unknown-unknown
- uses: taiki-e/install-action@v2
with:
tool: just@1.54.0
- uses: denoland/setup-deno@v2
with:
deno-version: "2.9.5"
Expand All @@ -48,32 +51,12 @@ jobs:
env:
GH_TOKEN: ${{ github.token }}

- name: build translator shim (release)
run: |
cargo build -p translator-shim --target wasm32-unknown-unknown --release
cp target/wasm32-unknown-unknown/release/translator_shim.wasm deltic-translator-shim.wasm

- name: build translator shim (size-tuned)
# Flags exactly as documented in crates/translator-shim/README.md
# (reproduces the published size figures without editing the
# workspace manifest).
run: |
cargo build -p translator-shim --release --target wasm32-unknown-unknown \
--config 'profile.release.opt-level="z"' \
--config profile.release.lto=true \
--config profile.release.codegen-units=1 \
--config 'profile.release.panic="abort"' \
--config 'profile.release.strip=true'
cp target/wasm32-unknown-unknown/release/translator_shim.wasm deltic-translator-shim-min.wasm

- name: build embedder bundle
# The consumer-facing platform-neutral ES module (browser pages/
# workers + plain Node): tools/release-bundle/entry.ts, gated by
# tools/release-bundle/bundle_test.ts in the core matrix.
run: deno run -A tools/release-bundle/build.ts --out deltic-embedder.mjs

- name: checksums
run: sha256sum deltic-translator-shim.wasm deltic-translator-shim-min.wasm deltic-embedder.mjs > SHA256SUMS
- name: build the release artifacts
# `just release-artifacts` (root justfile): the standard shim, the
# size-tuned shim (flags per crates/translator-shim/README.md), the
# embedder bundle (tools/release-bundle/entry.ts, gated by
# bundle_test.ts in the core matrix), and SHA256SUMS.
run: just release-artifacts

- name: create prerelease
run: |
Expand Down
Loading
Loading