| # Licensed to the Apache Software Foundation (ASF) under one |
| # or more contributor license agreements. See the NOTICE file |
| # distributed with this work for additional information |
| # regarding copyright ownership. The ASF licenses this file |
| # to you under the Apache License, Version 2.0 (the |
| # "License"); you may not use this file except in compliance |
| # with the License. You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, |
| # software distributed under the License is distributed on an |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| # KIND, either express or implied. See the License for the |
| # specific language governing permissions and limitations |
| # under the License. |
| |
| name: CLI package validation |
| |
| on: |
| pull_request: |
| paths: |
| - '.github/workflows/cli-package-validation.yml' |
| - '.github/workflows/runtime-host-peer-admission.yml' |
| - 'deny.toml' |
| - 'native/runtime-host-peer/**' |
| - 'package-lock.json' |
| - 'packages/cli/RUNTIME_HOST_PEER_*' |
| - 'packages/cli/src/cli-core.ts' |
| - 'packages/cli/src/runtime-host-cli.ts' |
| - 'packages/cli/src/runtime-host-peer-*' |
| - 'packages/cli/src/runtime-host-service-*' |
| - 'packages/runtime-host/package.json' |
| - 'packages/runtime-host/src/client/peer-client.ts' |
| - 'packages/runtime-host/src/peer-mesh/**' |
| - 'packages/runtime-host/src/server/peer-listener.ts' |
| - 'packages/runtime-host/src/transport/peer-native.ts' |
| - 'packages/storage/package.json' |
| - 'packages/storage/src/file-lifetime-owner.ts' |
| - 'packages/storage/src/native-file-lock.ts' |
| - 'scripts/generate-runtime-host-peer-*' |
| - 'scripts/release-cli-package.mjs' |
| - 'scripts/smoke-release-cli-package.mjs' |
| workflow_call: |
| inputs: |
| source_commit: |
| description: Exact product release commit to build; defaults to the triggering commit |
| required: false |
| type: string |
| default: '' |
| outputs: |
| release_candidate_artifact_id: |
| description: Immutable artifact produced by the build job |
| value: ${{ jobs.build.outputs.release_candidate_artifact_id }} |
| release_candidate_run_attempt: |
| description: Workflow attempt that built the immutable artifact |
| value: ${{ jobs.build.outputs.release_candidate_run_attempt }} |
| workflow_dispatch: |
| |
| permissions: |
| contents: read |
| |
| concurrency: |
| group: cli-package-validation-${{ github.workflow }}-${{ github.ref }} |
| |
| jobs: |
| peer-native: |
| name: Build direct-peer addon (${{ matrix.target }}) |
| runs-on: ${{ matrix.runner }} |
| timeout-minutes: 45 |
| strategy: |
| fail-fast: false |
| matrix: |
| include: |
| - runner: macos-15 |
| target: darwin-arm64 |
| rust_target: '' |
| - runner: ubuntu-24.04-arm |
| target: linux-arm64 |
| rust_target: aarch64-unknown-linux-gnu.2.28 |
| - runner: ubuntu-24.04 |
| target: linux-x64 |
| rust_target: x86_64-unknown-linux-gnu.2.28 |
| - runner: windows-2025 |
| target: win32-x64 |
| rust_target: '' |
| steps: |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| with: |
| ref: ${{ inputs.source_commit || github.sha }} |
| persist-credentials: false |
| - name: Update stable Rust |
| run: rustup update stable --no-self-update |
| - name: Install the Linux baseline linker |
| if: startsWith(matrix.target, 'linux-') |
| uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2 |
| with: |
| version: 0.16.0 |
| - name: Install cargo-zigbuild |
| if: startsWith(matrix.target, 'linux-') |
| uses: taiki-e/install-action@fcf5432d9f50d67e37ee6e29bdb7a224ff67b4a7 # v2 |
| with: |
| tool: cargo-zigbuild@0.23.2 |
| - name: Build the release addon |
| env: |
| MAKA_RUNTIME_HOST_PEER_CARGO_SUBCOMMAND: ${{ matrix.rust_target && 'zigbuild' || '' }} |
| MAKA_RUNTIME_HOST_PEER_CARGO_TARGET: ${{ matrix.rust_target }} |
| run: node native/runtime-host-peer/build.mjs |
| - name: Enforce the Linux glibc baseline |
| if: startsWith(matrix.target, 'linux-') |
| run: | |
| node - <<'NODE' |
| const { execFileSync } = require('node:child_process'); |
| const output = execFileSync('readelf', [ |
| '--version-info', |
| 'native/runtime-host-peer/target/release/maka_runtime_host_peer.node', |
| ], { encoding: 'utf8' }); |
| const versions = [...output.matchAll(/GLIBC_(\d+)\.(\d+)/g)].map((match) => [ |
| Number(match[1]), |
| Number(match[2]), |
| ]); |
| const newer = versions.find(([major, minor]) => major > 2 || (major === 2 && minor > 28)); |
| if (newer) throw new Error(`Direct-peer addon requires GLIBC_${newer.join('.')}`); |
| NODE |
| - name: Stage the platform addon |
| env: |
| PEER_TARGET: ${{ matrix.target }} |
| run: node -e "const fs=require('node:fs'),p=require('node:path'); const d=p.join('peer-prebuilds',process.env.PEER_TARGET); fs.mkdirSync(d,{recursive:true}); fs.copyFileSync(p.join('native','runtime-host-peer','target','release','maka_runtime_host_peer.node'),p.join(d,'maka_runtime_host_peer.node'))" |
| - name: Upload the platform addon |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
| with: |
| name: runtime-host-peer-${{ matrix.target }} |
| path: peer-prebuilds |
| if-no-files-found: error |
| retention-days: 1 |
| |
| build: |
| name: Build immutable tarball |
| needs: peer-native |
| runs-on: ubuntu-24.04 |
| timeout-minutes: 45 |
| outputs: |
| release_candidate_artifact_id: ${{ steps.release-candidate.outputs.artifact-id }} |
| release_candidate_run_attempt: ${{ github.run_attempt }} |
| steps: |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| with: |
| ref: ${{ inputs.source_commit || github.sha }} |
| persist-credentials: false |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 |
| with: |
| node-version: '22.19.0' |
| cache: npm |
| - name: Select the release npm toolchain |
| run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')" |
| - name: Install cargo-deny |
| uses: taiki-e/install-action@fcf5432d9f50d67e37ee6e29bdb7a224ff67b4a7 # v2 |
| with: |
| tool: cargo-deny@0.20.2 |
| - name: Download direct-peer addons |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 |
| with: |
| pattern: runtime-host-peer-* |
| path: ${{ runner.temp }}/runtime-host-peer-prebuilds |
| merge-multiple: true |
| - name: Build the release tarball once |
| env: |
| MAKA_RUNTIME_HOST_PEER_PREBUILDS: ${{ runner.temp }}/runtime-host-peer-prebuilds |
| run: npm run release:cli:pack |
| - name: Upload the immutable release candidate |
| id: release-candidate |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
| with: |
| name: cli-release-candidate-${{ github.run_attempt }} |
| path: | |
| packages/cli/release/*.tgz |
| packages/cli/release/*.tgz.sha256 |
| packages/cli/release/*.tgz.files.json |
| if-no-files-found: error |
| retention-days: 7 |
| |
| smoke: |
| name: Validate installed CLI ${{ matrix.name }} |
| needs: build |
| runs-on: ${{ matrix.runner }} |
| timeout-minutes: 45 |
| strategy: |
| fail-fast: false |
| matrix: |
| include: |
| - name: Linux x64 / Node 22.19 |
| runner: ubuntu-24.04 |
| node: '22.19.0' |
| platform: linux |
| arch: x64 |
| - name: Linux x64 / Node 24 |
| runner: ubuntu-24.04 |
| node: '24' |
| platform: linux |
| arch: x64 |
| - name: Linux arm64 / Node 24 |
| runner: ubuntu-24.04-arm |
| node: '24' |
| platform: linux |
| arch: arm64 |
| - name: macOS arm64 / Node 24 |
| runner: macos-15 |
| node: '24' |
| platform: darwin |
| arch: arm64 |
| - name: Windows x64 / Node 24 |
| runner: windows-2025 |
| node: '24' |
| platform: win32 |
| arch: x64 |
| steps: |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| with: |
| ref: ${{ inputs.source_commit || github.sha }} |
| persist-credentials: false |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 |
| with: |
| node-version: ${{ matrix.node }} |
| - name: Select the release npm toolchain |
| run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')" |
| - name: Assert the runner architecture |
| env: |
| EXPECTED_PLATFORM: ${{ matrix.platform }} |
| EXPECTED_ARCH: ${{ matrix.arch }} |
| run: | |
| node -e "if (process.platform !== process.env.EXPECTED_PLATFORM || process.arch !== process.env.EXPECTED_ARCH) throw new Error('Expected ' + process.env.EXPECTED_PLATFORM + '/' + process.env.EXPECTED_ARCH + ', found ' + process.platform + '/' + process.arch)" |
| - name: Download the release candidate |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 |
| with: |
| artifact-ids: ${{ needs.build.outputs.release_candidate_artifact_id }} |
| path: packages/cli/release |
| - name: Validate the installed tarball |
| run: node scripts/smoke-release-cli-package.mjs |
| |
| eval: |
| name: Validate installed CLI Eval |
| if: github.event_name != 'pull_request' |
| needs: build |
| runs-on: ubuntu-24.04 |
| timeout-minutes: 45 |
| steps: |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| with: |
| ref: ${{ inputs.source_commit || github.sha }} |
| persist-credentials: false |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 |
| with: |
| node-version: '24' |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 |
| with: |
| python-version: '3.12' |
| - name: Select the release npm toolchain |
| run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')" |
| - name: Install pinned Eval frameworks |
| run: | |
| python -m venv "$RUNNER_TEMP/maka-harbor" |
| "$RUNNER_TEMP/maka-harbor/bin/python" -m pip install --disable-pip-version-check 'harbor==0.20.0' |
| python -m venv "$RUNNER_TEMP/maka-pier" |
| "$RUNNER_TEMP/maka-pier/bin/python" -m pip install --disable-pip-version-check 'datacurve-pier==0.3.0' |
| echo "MAKA_RELEASE_HARBOR_PYTHON=$RUNNER_TEMP/maka-harbor/bin/python" >> "$GITHUB_ENV" |
| echo "MAKA_RELEASE_PIER_PYTHON=$RUNNER_TEMP/maka-pier/bin/python" >> "$GITHUB_ENV" |
| - name: Download the release candidate |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 |
| with: |
| artifact-ids: ${{ needs.build.outputs.release_candidate_artifact_id }} |
| path: packages/cli/release |
| - name: Validate real Harbor and Pier cells |
| run: npm run release:cli:eval |
