fix(conversations): stop the public shared endpoint leaking owner-internal fields #2954
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Desktop Swift CI | |
| on: | |
| push: | |
| branches: main | |
| pull_request: | |
| branches: main | |
| concurrency: | |
| group: desktop-swift-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| changes: | |
| name: Detect Desktop Swift Changes | |
| runs-on: ubuntu-latest | |
| outputs: | |
| diff_base: ${{ steps.changed.outputs.diff_base }} | |
| should_run: ${{ steps.changed.outputs.should_run }} | |
| should_release_compile: ${{ steps.changed.outputs.should_release_compile }} | |
| should_notification_release_regression: ${{ steps.changed.outputs.should_notification_release_regression }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Detect changed paths | |
| id: changed | |
| run: | | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| DIFF_BASE="${{ github.event.pull_request.base.sha }}" | |
| else | |
| DIFF_BASE="${{ github.event.before }}" | |
| fi | |
| if [ -z "$DIFF_BASE" ] || [[ "$DIFF_BASE" =~ ^0+$ ]]; then | |
| DIFF_BASE="$(git rev-parse HEAD^)" | |
| fi | |
| FILES=$(scripts/changed-files "$DIFF_BASE"...HEAD) | |
| echo "$FILES" | |
| echo "diff_base=$DIFF_BASE" >> "$GITHUB_OUTPUT" | |
| SHOULD_RUN=false | |
| if echo "$FILES" | grep -qE '^desktop/macos/Desktop/|^desktop/macos/test\.sh$|^desktop/macos/scripts/|^desktop/macos/tests/|^desktop/macos/e2e/flows/|^\.github/workflows/desktop-swift-ci\.yml$|^\.github/checks-manifest\.yaml$|^\.github/scripts/run_checks\.py$|^\.github/scripts/test_desktop_manifest_routes\.py$|^\.github/scripts/test_desktop_swift_ci_contract\.py$'; then | |
| SHOULD_RUN=true | |
| fi | |
| echo "should_run=$SHOULD_RUN" >> "$GITHUB_OUTPUT" | |
| DESKTOP_SWIFT=false | |
| if echo "$FILES" | grep -qE '^desktop/macos/Desktop/|^desktop/macos/test\.sh$|^desktop/macos/scripts/|^desktop/macos/tests/|^desktop/macos/e2e/flows/|^\.github/workflows/desktop-swift-ci\.yml$'; then | |
| DESKTOP_SWIFT=true | |
| fi | |
| PACKAGE_SWIFT=false | |
| if echo "$FILES" | grep -qx 'desktop/macos/Desktop/Package.swift'; then | |
| PACKAGE_SWIFT=true | |
| fi | |
| PACKAGE_RESOLVED=false | |
| if echo "$FILES" | grep -qx 'desktop/macos/Desktop/Package.resolved'; then | |
| PACKAGE_RESOLVED=true | |
| fi | |
| # Clean release compile: every main push that touches desktop Swift, | |
| # plus PRs that change the package manifest or lockfile (highest | |
| # release-risk: a dependency graph change can break release builds | |
| # even when the manifest source is unchanged). | |
| SHOULD_RELEASE_COMPILE=false | |
| if [ "$DESKTOP_SWIFT" = "true" ]; then | |
| if [ "${{ github.event_name }}" = "push" ] || [ "$PACKAGE_SWIFT" = "true" ] || [ "$PACKAGE_RESOLVED" = "true" ]; then | |
| SHOULD_RELEASE_COMPILE=true | |
| fi | |
| fi | |
| echo "should_release_compile=$SHOULD_RELEASE_COMPILE" >> "$GITHUB_OUTPUT" | |
| SHOULD_NOTIFICATION_RELEASE_REGRESSION=false | |
| if echo "$FILES" | grep -qE '^desktop/macos/Desktop/Sources/.*Notification.*[.]swift$|^desktop/macos/Desktop/Sources/AppState/AppState[+]Permissions[.]swift$|^desktop/macos/Desktop/Sources/OmiApp[.]swift$|^desktop/macos/Desktop/Sources/Providers/(ChatToolExecutor|DeviceProvider)[.]swift$|^desktop/macos/Desktop/Tests/.*Notification.*Tests[.]swift$'; then | |
| SHOULD_NOTIFICATION_RELEASE_REGRESSION=true | |
| fi | |
| echo "should_notification_release_regression=$SHOULD_NOTIFICATION_RELEASE_REGRESSION" >> "$GITHUB_OUTPUT" | |
| echo "desktop_swift=$DESKTOP_SWIFT package_swift=$PACKAGE_SWIFT package_resolved=$PACKAGE_RESOLVED should_run=$SHOULD_RUN should_release_compile=$SHOULD_RELEASE_COMPILE should_notification_release_regression=$SHOULD_NOTIFICATION_RELEASE_REGRESSION" | |
| # The Swift test suite and the macOS-only manifest checks have no runtime | |
| # dependency on one another. Keeping them in separate jobs puts their slow | |
| # paths on the critical path only once, instead of serializing both on a | |
| # single macOS runner. The small aggregate job below remains the stable | |
| # release-gate check name and fails unless both jobs succeed. | |
| desktop-swift-static: | |
| name: Desktop Swift Static Contracts | |
| needs: changes | |
| if: needs.changes.outputs.should_run == 'true' | |
| runs-on: macos-15 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Select and assert pinned Xcode 16.4 | |
| run: desktop/macos/scripts/run-swift-ci.sh --select-toolchain | |
| - name: Restore Swift formatter and linter tools | |
| id: swift-tools-cache | |
| uses: actions/cache/restore@v6 | |
| with: | |
| path: | | |
| ~/.cache/omi-swift-format | |
| ~/.cache/omi-swiftlint | |
| key: ${{ runner.os }}-desktop-swift-tools-xcode164-${{ hashFiles('desktop/macos/scripts/swift-format-wrapper.sh', 'desktop/macos/scripts/swiftlint-wrapper.sh') }} | |
| restore-keys: | | |
| ${{ runner.os }}-desktop-swift-tools-xcode164- | |
| - name: Install uv for manifest checks | |
| uses: astral-sh/setup-uv@ecd24dd710f2fb0dca1693a67af11fc4a5c5ec84 | |
| - name: Run macOS-scoped manifest checks | |
| run: | | |
| python3 .github/scripts/run_checks.py --lane ci --platform macos --base "${{ needs.changes.outputs.diff_base }}" --skip-pr-body-checks | |
| - name: Save Swift formatter and linter tools after checks | |
| if: ${{ always() && steps.swift-tools-cache.outputs.cache-hit != 'true' }} | |
| uses: actions/cache/save@v6 | |
| with: | |
| path: | | |
| ~/.cache/omi-swift-format | |
| ~/.cache/omi-swiftlint | |
| key: ${{ runner.os }}-desktop-swift-tools-xcode164-${{ hashFiles('desktop/macos/scripts/swift-format-wrapper.sh', 'desktop/macos/scripts/swiftlint-wrapper.sh') }} | |
| desktop-swift-tests: | |
| name: Desktop Swift Test Suites | |
| needs: changes | |
| if: needs.changes.outputs.should_run == 'true' | |
| runs-on: macos-15 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| - name: Select and assert pinned Xcode 16.4 | |
| run: desktop/macos/scripts/run-swift-ci.sh --select-toolchain | |
| - name: Restore SwiftPM build products | |
| id: swiftpm-cache | |
| uses: actions/cache/restore@v6 | |
| with: | |
| path: | | |
| ~/Library/Caches/org.swift.swiftpm | |
| desktop/macos/Desktop/.build | |
| key: ${{ runner.os }}-desktop-swift-build-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }} | |
| restore-keys: | | |
| ${{ runner.os }}-desktop-swift-build-xcode164- | |
| - name: Install Swift system dependencies | |
| run: brew install actionlint pkg-config webp | |
| - name: Desktop launcher script tests | |
| working-directory: desktop/macos | |
| run: | | |
| # Discovery, not a hardcoded list — a new tests/test-*.sh runs here | |
| # automatically, mirroring swift-test-suites.sh's auto-discovery. | |
| for t in tests/test-*.sh; do | |
| echo "== $t" | |
| bash "$t" | |
| done | |
| # Debug build+test only on the PR critical path. Release compile is a | |
| # separate job (main push, or PRs that touch Package.swift) so we do not | |
| # pay for a second configuration that tests never consume. | |
| - name: Test desktop Swift app | |
| working-directory: desktop/macos | |
| env: | |
| OMI_SWIFT_TEST_SUITE_WORKERS: "4" | |
| run: ./scripts/run-swift-ci.sh --test | |
| # This is part of the already-required Desktop Swift Build & Tests check, | |
| # so the release planner cannot tag notification-boundary changes until | |
| # the pinned release compiler has exercised the callback handoff. | |
| - name: Test UserNotifications callback regression in release mode | |
| if: needs.changes.outputs.should_notification_release_regression == 'true' | |
| working-directory: desktop/macos | |
| run: ./scripts/run-swift-ci.sh --release-notification-regression | |
| # SwiftPM validates cached incremental state before using it. Saving after | |
| # a failed test command makes the next diagnostic run reuse completed | |
| # dependency and module work instead of recompiling the same test bundle. | |
| - name: Save SwiftPM build products after test attempt | |
| if: ${{ always() && steps.swiftpm-cache.outputs.cache-hit != 'true' }} | |
| uses: actions/cache/save@v6 | |
| with: | |
| path: | | |
| ~/Library/Caches/org.swift.swiftpm | |
| desktop/macos/Desktop/.build | |
| key: ${{ runner.os }}-desktop-swift-build-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }} | |
| desktop-swift: | |
| # Keep this name stable: desktop release planning requires this exact | |
| # check to pass for the source SHA that will be tagged. | |
| name: Desktop Swift Build & Tests | |
| needs: [changes, desktop-swift-static, desktop-swift-tests] | |
| if: ${{ always() && needs.changes.outputs.should_run == 'true' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Require static contracts and Swift tests | |
| env: | |
| STATIC_RESULT: ${{ needs.desktop-swift-static.result }} | |
| TEST_RESULT: ${{ needs.desktop-swift-tests.result }} | |
| run: | | |
| test "$STATIC_RESULT" = success | |
| test "$TEST_RESULT" = success | |
| desktop-swift-release-compile: | |
| name: Desktop Swift Release Compile | |
| needs: changes | |
| if: needs.changes.outputs.should_release_compile == 'true' | |
| runs-on: macos-15 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| - name: Select and assert pinned Xcode 16.4 | |
| run: desktop/macos/scripts/run-swift-ci.sh --select-toolchain | |
| - name: Install Swift system dependencies | |
| run: brew install pkg-config webp | |
| - name: Clean release compile | |
| working-directory: desktop/macos | |
| run: ./scripts/run-swift-ci.sh --release-compile |