From 7194d47856577ae10d51c607e964928c60f232ba Mon Sep 17 00:00:00 2001 From: hellno Date: Mon, 8 Jun 2026 21:30:49 +0200 Subject: [PATCH] ci: right-size the cross-platform matrix + fix disk/Foundry failures main's CI is red on infra, not code: the linux job OOMs the stock 14GB runner on the heavy gpui+Helios+Railgun tree (cache-save 'No space left'), and the macOS Foundry install hits a GitHub-API 403 rate-limit. - quick: fail-fast `cargo fmt` gate before the two heavy runners spin up. - linux: free ~20GB first, then full workspace build+clippy+test (incl. anvil via Foundry, now token-authenticated to avoid the 403). Tests run here, once. - macos: build the shipping binaries (app + signerd) + lint the macOS-only objc2 tray path. No redundant tests, no Foundry (headless logic is OS-independent and tested on linux; this also drops the 403 flake from the 10x-billed runner). - cargo-deny stays a non-blocking supply-chain job. Disk reclaim verified (turned the linux run green); macOS no longer installs Foundry. --- .github/workflows/ci.yml | 97 +++++++++++++++++++++++++--------------- 1 file changed, 60 insertions(+), 37 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f2f75d2..172659e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,14 +1,23 @@ name: CI -# Builds + tests the Deckard workspace on macOS *and* Linux so cross-platform stays honest. -# (GPUI renders with Metal on macOS and Vulkan via wgpu on Linux.) +# Right-sized cross-platform CI for the Deckard virtual workspace. # -# COST: free. Standard GitHub-hosted runners (macos-latest, ubuntu-latest) are -# free + unlimited on PUBLIC repos — the macOS 10x multiplier only burns quota -# on PRIVATE repos. If you ever make this repo private, gate the `macos` job to -# tags to avoid eating your minutes, e.g. add to that job: -# if: github.event_name == 'pull_request' || startsWith(github.ref, 'refs/tags/v') -# (Don't switch to "*-large" runners — those are billed even on public repos.) +# Why this shape: the GPUI app renders with Metal on macOS and wgpu/Vulkan on Linux, and the tray is +# OS-specific (objc2 on macOS, GTK/appindicator on Linux) — THAT is what genuinely needs both OSes. +# The headless crates (deckard-core / -contract / -signerd) are OS-independent, so we TEST them once +# (Linux) and only BUILD + lint the app's macOS-specific path on macOS. Testing the same crypto/wire +# logic twice buys nothing. +# +# quick (fmt, ~1 min) ──┬── linux : full build + clippy + test --workspace (+ anvil/Foundry) +# ├── macos : build the shipping binaries + lint the macOS-only tray path +# └── cargo-deny : supply-chain gate (non-blocking) +# +# The `quick` gate fails cheap on the most common trivial mistake (unformatted code) before the two +# heavy runners ever spin up. +# +# COST: free on PUBLIC repos (the macOS 10x multiplier only bills PRIVATE repos). If you make this +# repo private, add to the macos job: `if: github.event_name == 'pull_request' || startsWith(github.ref, 'refs/tags/v')`. +# Don't switch to "*-large" runners — those are billed even on public repos. on: push: @@ -22,37 +31,33 @@ env: CARGO_TERM_COLOR: always jobs: - macos: - runs-on: macos-latest + # Fail-fast gate: formatting is OS-independent, so check it once, fast, before the heavy builds. + quick: + runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - # No toolchain version here on purpose: rust-toolchain.toml is the single - # source of truth. rustup (preinstalled on GitHub runners) auto-installs the - # pinned version and its clippy/rustfmt components on the first cargo call. - - uses: Swatinem/rust-cache@v2 - # Foundry gives the integration tests a local `anvil` to broadcast against - # (deckard-signerd's anvil-fork lane). The daemon tests skip gracefully if it's absent, - # but CI installs it so the broadcast path is actually exercised. - - uses: foundry-rs/foundry-toolchain@v1 - # --locked everywhere: reproducibility lives in the committed Cargo.lock (it pins the exact - # git gpui/helios/railgun commits). --locked fails CI if the lock is stale, keeping it committed. - - run: cargo build --locked --workspace - - run: cargo build --locked -p deckard-app --features tray - - run: cargo test --locked --workspace - - run: cargo clippy --locked --workspace --all-targets -- -D warnings - - run: cargo clippy --locked -p deckard-app --all-targets --features tray -- -D warnings + # rustup (preinstalled) auto-installs the rust-toolchain.toml-pinned version + rustfmt on the + # first cargo call. No build needed — `cargo fmt` only parses, so this is ~1 min. + - run: cargo fmt --all --check + # The full logic gate. Everything OS-independent (all crates' clippy + tests) runs here, once. linux: + needs: quick runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - # No toolchain version here on purpose: rust-toolchain.toml is the single - # source of truth. rustup (preinstalled on GitHub runners) auto-installs the - # pinned version and its clippy/rustfmt components on the first cargo call. - uses: Swatinem/rust-cache@v2 - # System libraries GPUI needs on Linux (X11 + Wayland + Vulkan + fonts), - # plus GTK/appindicator + libxdo for the optional tray feature - # (tray-icon/muda link against libxdo for menu event injection). + # The dep tree (gpui + Helios/revm/bls + the Railgun ZK tree) overflows the stock ubuntu + # runner's ~14 GB and OOMs the build / cache-save. Reclaim ~20 GB of preinstalled toolchains we + # never use, first. (macOS runners have the headroom, so this is Linux-only.) + - name: Free up disk space + run: | + sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc \ + /opt/hostedtoolcache/CodeQL /usr/local/share/boost || true + sudo docker image prune --all --force >/dev/null 2>&1 || true + df -h / + # System libraries GPUI needs on Linux (X11 + Wayland + Vulkan + fonts), plus GTK/appindicator + # + libxdo for the optional tray feature (tray-icon/muda link against libxdo). - name: Install system dependencies run: | sudo apt-get update @@ -64,21 +69,39 @@ jobs: libfontconfig1-dev libfreetype6-dev \ libssl-dev \ libgtk-3-dev libayatana-appindicator3-dev libxdo-dev - # Foundry (anvil) for the deckard-signerd broadcast integration tests. + # Foundry (anvil) for the deckard-signerd broadcast integration tests. Pass GITHUB_TOKEN so the + # release-tag fetch is authenticated — the unauthenticated path hits a 403 API rate-limit. - uses: foundry-rs/foundry-toolchain@v1 - # Formatting is OS-independent, so gate it once on the cheaper Linux runner. - - run: cargo fmt --all --check + with: + token: ${{ github.token }} + # --locked everywhere: reproducibility lives in the committed Cargo.lock (exact git pins). - run: cargo build --locked --workspace - run: cargo build --locked -p deckard-app --features tray - run: cargo test --locked --workspace - run: cargo clippy --locked --workspace --all-targets -- -D warnings - run: cargo clippy --locked -p deckard-app --all-targets --features tray -- -D warnings - # Supply-chain gate (advisories / licenses / bans / sources). Config: deny.toml. - # Lands NON-BLOCKING (continue-on-error): promote to a required check after one green run AND - # after seeding deny.toml [licenses].allow from a local `cargo deny check licenses`. + # Cross-platform compile proof. The app (Metal renderer) + the macOS-only objc2 tray are the only + # things that genuinely need macOS coverage, and that's a compile/link concern, not a logic one + # (logic is tested on Linux). So we build the two shipping binaries and lint the macOS-only tray + # path — no redundant tests, and no Foundry (the anvil tests run on Linux; this also removes the + # GitHub-API 403 flake from the 10x-billed runner). + macos: + needs: quick + runs-on: macos-latest + steps: + - uses: actions/checkout@v4 + - uses: Swatinem/rust-cache@v2 + - run: cargo build --locked -p deckard-app -p deckard-signerd + - run: cargo build --locked -p deckard-app --features tray + - run: cargo clippy --locked -p deckard-app --all-targets --features tray -- -D warnings + + # Supply-chain gate (advisories / licenses / bans / sources). Config: deny.toml. NON-BLOCKING + # (continue-on-error) until the license allow-list is seeded from a local `cargo deny check + # licenses` and the unmaintained-transitive advisories are triaged — then drop continue-on-error. # Rationale: docs/AGENTIC-ENGINEERING.md §4. cargo-deny: + needs: quick runs-on: ubuntu-latest continue-on-error: true steps: