perf(trampoline): raw Win32 rewrite shrinks vp-shim to 14KB #264
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish preview build | |
| # BUILD WORKFLOW. Builds a labeled PR and packs its packages into a workflow | |
| # artifact. It holds no secrets and no OIDC permission, so it is safe to run | |
| # for a pull request from a fork. | |
| # | |
| # Despite the name, it publishes nothing. Publishing happens in | |
| # publish-preview-register.yml, which triggers when this workflow completes and | |
| # runs from the default branch. The split exists because GitHub denies fork | |
| # pull_request runs both secrets and `id-token`, so a fork PR cannot | |
| # authenticate to the bridge from here at all. | |
| # | |
| # The `preview-build` label check below is a convenience gate that saves build | |
| # minutes. It is NOT the security boundary: on pull_request events GitHub runs | |
| # the workflow file from the merge ref, so a PR author can edit this file and | |
| # delete the check. publish-preview-register.yml re-establishes authorization | |
| # from the API. | |
| # | |
| # NOTE: the workflow NAME above is what publish-preview-register.yml matches on. | |
| # Renaming it silently stops preview publishing. | |
| # | |
| # Registered builds: https://registry-bridge.viteplus.dev/-/refs | |
| permissions: {} | |
| on: | |
| pull_request: | |
| types: [labeled] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| prepare: | |
| if: >- | |
| github.repository == 'voidzero-dev/vite-plus' && | |
| github.event.label.name == 'preview-build' | |
| name: Compute snapshot version | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| version: ${{ steps.version.outputs.version }} | |
| steps: | |
| # Use the exact version the registry bridge serves (0.0.0-commit.<head-sha>, | |
| # the same head SHA publish-preview-register.yml registers), so the built | |
| # Rust binary and JS | |
| # dist carry the version that actually gets installed: CARGO_PKG_VERSION and | |
| # cliPkg.version both equal it, instead of the build-time release placeholder. | |
| # `napi pre-publish` reuses this for consistent optionalDependencies entries. | |
| - name: Compute version | |
| id: version | |
| run: echo "version=0.0.0-commit.${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT" | |
| build-rust: | |
| name: Build bindings and binaries | |
| if: >- | |
| github.repository == 'voidzero-dev/vite-plus' && | |
| github.event.label.name == 'preview-build' | |
| needs: prepare | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/reusable-release-build.yml | |
| with: | |
| version: ${{ needs.prepare.outputs.version }} | |
| cache-key: pkg-pr-new | |
| publish: | |
| if: >- | |
| github.repository == 'voidzero-dev/vite-plus' && | |
| github.event.label.name == 'preview-build' | |
| name: Pack preview packages | |
| runs-on: ubuntu-latest | |
| needs: | |
| - prepare | |
| - build-rust | |
| # Read-only, and deliberately no `id-token`. Everything that needs a write | |
| # permission (the sticky comment, the Docker image) moved to the trusted | |
| # workflow, because fork pull_request runs are denied those permissions | |
| # anyway. | |
| permissions: | |
| contents: read | |
| env: | |
| VERSION: ${{ needs.prepare.outputs.version }} | |
| steps: | |
| - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2 | |
| - uses: ./.github/actions/clone | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version-file: .node-version | |
| package-manager-cache: false | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install | |
| - name: Download cli dist | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: packages/cli/dist | |
| pattern: cli | |
| merge-multiple: true | |
| - name: Download cli docs | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: packages/cli/docs | |
| pattern: cli-docs | |
| merge-multiple: true | |
| - name: Download cli binding | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: packages/cli/artifacts | |
| pattern: vite-plus-native-* | |
| - name: Download core dist | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: packages/core/dist | |
| pattern: core | |
| merge-multiple: true | |
| - name: Download prompts dist | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: packages/prompts/dist | |
| pattern: prompts | |
| merge-multiple: true | |
| - uses: ./.github/actions/download-rolldown-binaries | |
| with: | |
| github-token: ${{ github.token }} | |
| target: x86_64-unknown-linux-gnu | |
| upload: 'false' | |
| - name: Download Rust CLI binaries | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: rust-cli-artifacts | |
| pattern: vp-global-cli-* | |
| # Stops short of `npm publish` and leaves packages/cli/{npm,cli-npm}/* | |
| # on disk for the bridge action to pack. | |
| - name: Prepare native addon and CLI binary packages | |
| run: node ./packages/cli/publish-native-addons.ts --mode pkg-pr-new | |
| # Pack the locally built package directories (the two preview packages | |
| # and every platform binary) into a workflow artifact. `mode: pack` runs | |
| # `pnpm pack` and nothing else: no network, no credentials. The trusted | |
| # workflow validates every archive, rewrites and re-packs it under the commit | |
| # version, and uploads it. | |
| # | |
| # Runs for fork PRs too. That is the point of the split: the old | |
| # same-repo gate here existed only because fork runs cannot read the | |
| # admin token secret. | |
| - name: Pack packages for the registry bridge | |
| uses: voidzero-dev/pkg-pr-registry-bridge@4ca2c31c250c7137ae191bf01a8bb106d30aa106 # main | |
| with: | |
| mode: pack | |
| # The PR head commit, not the merge commit github.sha. Advisory here; | |
| # the publishing workflow re-derives it from workflow_run.head_sha. | |
| sha: ${{ github.event.pull_request.head.sha }} | |
| output-dir: bridge-packages | |
| # The locally built directories to pack. Listed here rather than left | |
| # to the action's default, so the published set is reviewable in this | |
| # repo and does not move when the action does. | |
| packages: | | |
| packages/cli/npm/* | |
| packages/cli/cli-npm/* | |
| packages/cli | |
| packages/core | |
| packages/prompts | |
| - name: Upload packed packages | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bridge-packages | |
| path: bridge-packages | |
| # A silently empty artifact would make the publishing workflow fail with a | |
| # confusing "no packed tarballs" instead of failing here. | |
| if-no-files-found: error | |
| # Must outlive the approval wait, not just the run. The publishing | |
| # publish job is gated on a required-reviewer environment, and GitHub | |
| # keeps a pending deployment open far longer than a day, so a | |
| # retention of 1 would let the artifact expire out from under an | |
| # approval given the next morning. | |
| retention-days: 7 | |
| # The payload is already-gzipped .tgz files, so re-deflating them costs | |
| # time for no size gain. | |
| compression-level: 0 |