clockworklabs · Kasama · Oct 13, 2025 · Oct 15, 2025 · Oct 24, 2025 · Oct 27, 2025
diff --git a/.cargo/config.toml b/.cargo/config.toml
@@ -3,6 +3,7 @@ rustflags = ["--cfg", "tokio_unstable"]
 
 [alias]
 bump-versions = "run -p upgrade-version --"
+ci = "run -p ci --"
 
 [target.x86_64-pc-windows-msvc]
 # Use a different linker. Otherwise, the build fails with some obscure linker error that

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -23,9 +23,11 @@
     strategy:
       matrix:
         include:
-          - { runner: spacetimedb-runner, smoketest_args: --docker }
-          - { runner: windows-latest, smoketest_args: --no-build-cli }
-        runner: [ spacetimedb-runner, windows-latest ]
+          - runner: spacetimedb-runner
+            smoketest_args: '--docker'
+          - runner: windows-latest
+            smoketest_args: '--no-build-cli'
+        runner: [spacetimedb-runner, windows-latest]
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Find Git ref
@@ -85,8 +87,8 @@
       - name: Install python deps
         run: python -m pip install psycopg2-binary xmltodict
       - name: Run smoketests
-        # Note: clear_database and replication only work in private
-        run: python -m smoketests ${{ matrix.smoketest_args }} -x clear_database replication
+        run: cargo ci smoketests -- ${{ matrix.smoketest_args }} -x clear_database replication
+
       - name: Stop containers (Linux)
         if: always() && runner.os == 'Linux'
         run: docker compose down
@@ -127,30 +129,88 @@
         with:
           run_install: true
 
-      - name: Create /stdb dir
-        run: |
-          sudo mkdir /stdb
-          sudo chmod 777 /stdb
-
       - name: Build typescript module sdk
         working-directory: crates/bindings-typescript
         run: pnpm build
 
       - name: Run cargo test
         #Note: Unreal tests will be run separately
-        run: cargo test --all -- --skip unreal
+        run: |
+          apt-get update
+          apt-get install -y acl curl ca-certificates
 
-      - name: Check that the test outputs are up-to-date
-        run: bash tools/check-diff.sh
+          REPO="$GITHUB_WORKSPACE"
+          # Let ue4 read/write the workspace & tool caches without changing ownership
+          for p in "$REPO" "${RUNNER_TEMP:-/__t}" "${RUNNER_TOOL_CACHE:-/__t}"; do
+            [ -d "$p" ] && setfacl -R -m u:ue4:rwX -m d:u:ue4:rwX "$p" || true
+          done
 
-      - name: Ensure C# autogen bindings are up-to-date
-        run: |
-          cargo run -p spacetimedb-codegen --example regen-csharp-moduledef
-          bash tools/check-diff.sh crates/bindings-csharp
+          # Rust tool caches live under the runner tool cache so they persist
+          export CARGO_HOME="${RUNNER_TOOL_CACHE:-/__t}/cargo"
+          export RUSTUP_HOME="${RUNNER_TOOL_CACHE:-/__t}/rustup"
+          mkdir -p "$CARGO_HOME" "$RUSTUP_HOME"
+          chown -R ue4:ue4 "$CARGO_HOME" "$RUSTUP_HOME"
+
+          # Make sure the UE build script is executable (and parents traversable)
+          UE_DIR="${UE_ROOT_PATH:-/home/ue4/UnrealEngine}"
+          chmod a+rx "$UE_DIR" "$UE_DIR/Engine" "$UE_DIR/Engine/Build" "$UE_DIR/Engine/Build/BatchFiles/Linux" || true
+          chmod a+rx "$UE_DIR/Engine/Build/BatchFiles/Linux/Build.sh" || true
+
+
+
+          # Make sure the UE build script is executable (and parents traversable)
+          UE_DIR="${UE_ROOT_PATH:-/home/ue4/UnrealEngine}"
+          chmod a+rx "$UE_DIR" "$UE_DIR/Engine" "$UE_DIR/Engine/Build" "$UE_DIR/Engine/Build/BatchFiles/Linux" || true
+          chmod a+rx "$UE_DIR/Engine/Build/BatchFiles/Linux/Build.sh" || true
 
-      - name: C# bindings tests
-        working-directory: crates/bindings-csharp
-        run: dotnet test -warnaserror
+          # Run the build & tests as ue4 (who owns the UE tree)
+          sudo -E -H -u ue4 env \
+            HOME=/home/ue4 \
+            XDG_CONFIG_HOME=/home/ue4/.config \
+            CARGO_HOME="$CARGO_HOME" \
+            RUSTUP_HOME="$RUSTUP_HOME" \
+          mkdir -p "$CARGO_HOME" "$RUSTUP_HOME"
+          done
+          done
+
+          # Rust tool caches live under the runner tool cache so they persist
+          export CARGO_HOME="${RUNNER_TOOL_CACHE:-/__t}/cargo"
+          export RUSTUP_HOME="${RUNNER_TOOL_CACHE:-/__t}/rustup"
+          mkdir -p "$CARGO_HOME" "$RUSTUP_HOME"
+          chown -R ue4:ue4 "$CARGO_HOME" "$RUSTUP_HOME"
+
+          # Make sure the UE build script is executable (and parents traversable)
+          UE_DIR="${UE_ROOT_PATH:-/home/ue4/UnrealEngine}"
+          chmod a+rx "$UE_DIR" "$UE_DIR/Engine" "$UE_DIR/Engine/Build" "$UE_DIR/Engine/Build/BatchFiles/Linux" || true
+          chmod a+rx "$UE_DIR/Engine/Build/BatchFiles/Linux/Build.sh" || true
+
+          # Run the build & tests as ue4 (who owns the UE tree)
+          sudo -E -H -u ue4 env \
+            HOME=/home/ue4 \
+            XDG_CONFIG_HOME=/home/ue4/.config \
+            CARGO_HOME="$CARGO_HOME" \
+            RUSTUP_HOME="$RUSTUP_HOME" \
+            PATH="$CARGO_HOME/bin:$PATH" \
+            bash -lc '
+              set -euxo pipefail
+              # Install rustup for ue4 if needed (uses the shared caches)
+              if ! command -v cargo >/dev/null 2>&1; then
+            CARGO_HOME="$CARGO_HOME" \
+            RUSTUP_HOME="$RUSTUP_HOME" \
+            PATH="$CARGO_HOME/bin:$PATH" \
+            bash -lc '
+              set -euxo pipefail
+              # Install rustup for ue4 if needed (uses the shared caches)
+              if ! command -v cargo >/dev/null 2>&1; then
+                curl -sSf https://sh.rustup.rs | sh -s -- -y
+              fi
+              rustup show >/dev/null
+              git config --global --add safe.directory "$GITHUB_WORKSPACE" || true
+
+              cd "$GITHUB_WORKSPACE/sdks/unreal"
+              cargo --version
+              cargo test
+            '
 
   lints:
     name: Lints
@@ -166,30 +226,8 @@
         with:
           global-json-file: global.json
 
-      - name: Run cargo fmt
-        run: cargo fmt --all -- --check
-
-      - name: Run cargo clippy
-        run: cargo clippy --all --tests --benches -- -D warnings
-
-      - name: Run C# formatting check
-        working-directory: crates/bindings-csharp
-        run: |
-          dotnet tool restore
-          dotnet csharpier --check .
-
-      - name: Run `cargo doc` for bindings crate
-        # `bindings` is the only crate we care strongly about documenting,
-        # since we link to its docs.rs from our website.
-        # We won't pass `--no-deps`, though,
-        # since we want everything reachable through it to also work.
-        # This includes `sats` and `lib`.
-        working-directory: crates/bindings
-        env:
-          # Make `cargo doc` exit with error on warnings, most notably broken links
-          RUSTDOCFLAGS: '--deny warnings'
-        run: |
-          cargo doc
+      - name: Run ci lint
+        run: cargo ci lint
 
   wasm_bindings:
     name: Build and test wasm bindings
@@ -201,20 +239,7 @@
       - run: echo ::add-matcher::.github/workflows/rust_matcher.json
 
       - name: Run bindgen tests
-        run: cargo test -p spacetimedb-codegen
-
-      # Make sure the `Cargo.lock` file reflects the latest available versions.
-      # This is what users would end up with on a fresh module, so we want to
-      # catch any compile errors arising from a different transitive closure
-      # of dependencies than what is in the workspace lock file.
-      #
-      # For context see also: https://github.com/clockworklabs/SpacetimeDB/pull/2714
-      - name: Update dependencies
-        run: cargo update
-
-      - name: Build module-test
-        run: cargo run -p spacetimedb-cli -- build --project-path modules/module-test
-
+        run: cargo ci wasm-bindings
 
   publish_checks:
     name: Check that packages are publishable
@@ -267,19 +292,9 @@
         run: sudo apt install -y libssl-dev
 
       - name: Build spacetimedb-update
-        run: cargo build --features github-token-auth --target ${{ matrix.target }} -p spacetimedb-update
-
-      - name: Run self-install
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        shell: bash
-        run: |
-          ROOT_DIR="$(mktemp -d)"
-          # NOTE(bfops): We need the `github-token-auth` feature because we otherwise tend to get ratelimited when we try to fetch `/releases/latest`.
-          # My best guess is that, on the GitHub runners, the "anonymous" ratelimit is shared by *all* users of that runner (I think this because it
-          # happens very frequently on the `macos-runner`, but we haven't seen it on any others).
-          cargo run --features github-token-auth --target ${{ matrix.target }} -p spacetimedb-update -- self-install --root-dir="${ROOT_DIR}" --yes
-          "${ROOT_DIR}"/spacetime --root-dir="${ROOT_DIR}" help
+        run: cargo ci update-flow --target=${{ matrix.target }} --github-token-auth
 
   unreal_engine_tests:
     name: Unreal Engine Tests
@@ -301,26 +316,26 @@
       # without this (reassigning env vars and stuff), but was unable to get it to work and it felt like an uphill battle.
       options: --user 0:0
     steps:
-# Uncomment this before merging so that it will run properly if run manually through the GH actions flow. It was playing weird with rolled back
-# commits though.
-#      - name: Find Git ref
-#        env:
-#          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-#        shell: bash
-#        run: |
-#          PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
-#          if test -n "${PR_NUMBER}"; then
-#            GIT_REF="$( gh pr view --repo clockworklabs/SpacetimeDB $PR_NUMBER --json headRefName --jq .headRefName )"
-#          else
-#            GIT_REF="${{ github.ref }}"
-#          fi
-#          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"
+      # Uncomment this before merging so that it will run properly if run manually through the GH actions flow. It was playing weird with rolled back
+      # commits though.
+      #      - name: Find Git ref
+      #        env:
+      #          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      #        shell: bash
+      #        run: |
+      #          PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
+      #          if test -n "${PR_NUMBER}"; then
+      #            GIT_REF="$( gh pr view --repo clockworklabs/SpacetimeDB $PR_NUMBER --json headRefName --jq .headRefName )"
+      #          else
+      #            GIT_REF="${{ github.ref }}"
+      #          fi
+      #          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"
       - name: Checkout sources
         uses: actions/checkout@v4
         with:
           ref: ${{ env.GIT_REF }}
       - uses: dsherret/rust-toolchain-file@v1
-      - name: Run Unreal Engine tests
+      - name: Install unreal engine test dependencies
         working-directory: sdks/unreal
         env:
           UE_ROOT_PATH: /home/ue4/UnrealEngine
@@ -329,45 +344,41 @@
           apt-get update
           apt-get install -y acl curl ca-certificates
 
-          REPO="$GITHUB_WORKSPACE"
-          # Let ue4 read/write the workspace & tool caches without changing ownership
-          for p in "$REPO" "${RUNNER_TEMP:-/__t}" "${RUNNER_TOOL_CACHE:-/__t}"; do
-            [ -d "$p" ] && setfacl -R -m u:ue4:rwX -m d:u:ue4:rwX "$p" || true
-          done
+      - name: Run Unreal Engine tests
+        working-directory: sdks/unreal
+        env:
+          UE_ROOT_PATH: /home/ue4/UnrealEngine
+        run: |
+          cargo ci unreal-tests
 
-          # Rust tool caches live under the runner tool cache so they persist
-          export CARGO_HOME="${RUNNER_TOOL_CACHE:-/__t}/cargo"
-          export RUSTUP_HOME="${RUNNER_TOOL_CACHE:-/__t}/rustup"
-          mkdir -p "$CARGO_HOME" "$RUSTUP_HOME"
-          chown -R ue4:ue4 "$CARGO_HOME" "$RUSTUP_HOME"
+  ci_command_docs:
+    name: Check CI command docs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Find Git ref
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
+          if test -n "${PR_NUMBER}"; then
+            GIT_REF="$( gh pr view --repo clockworklabs/SpacetimeDB $PR_NUMBER --json headRefName --jq .headRefName )"
+          else
+            GIT_REF="${{ github.ref }}"
+          fi
+          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"
 
-          # Make sure the UE build script is executable (and parents traversable)
-          UE_DIR="${UE_ROOT_PATH:-/home/ue4/UnrealEngine}"
-          chmod a+rx "$UE_DIR" "$UE_DIR/Engine" "$UE_DIR/Engine/Build" "$UE_DIR/Engine/Build/BatchFiles/Linux" || true
-          chmod a+rx "$UE_DIR/Engine/Build/BatchFiles/Linux/Build.sh" || true
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.GIT_REF }}
 
-          # Run the build & tests as ue4 (who owns the UE tree)
-          sudo -E -H -u ue4 env \
-            HOME=/home/ue4 \
-            XDG_CONFIG_HOME=/home/ue4/.config \
-            CARGO_HOME="$CARGO_HOME" \
-            RUSTUP_HOME="$RUSTUP_HOME" \
-            PATH="$CARGO_HOME/bin:$PATH" \
-            bash -lc '
-              set -euxo pipefail
-              # Install rustup for ue4 if needed (uses the shared caches)
-              if ! command -v cargo >/dev/null 2>&1; then
-                curl -sSf https://sh.rustup.rs | sh -s -- -y
-              fi
-              rustup show >/dev/null
-              git config --global --add safe.directory "$GITHUB_WORKSPACE" || true
+      - uses: dsherret/rust-toolchain-file@v1
 
-              cd "$GITHUB_WORKSPACE/sdks/unreal"
-              cargo --version
-              cargo test
-            '
+      - name: Check for docs change
+        run: cargo ci self-docs --check
 
   cli_docs:
     name: Check CLI docs
    permissions: read-all
    runs-on: ubuntu-latest
@@ -416,12 +427,4 @@
 
       - name: Check for docs change
         run: |
-          cargo run --features markdown-docs -p spacetimedb-cli > docs/docs/cli-reference.md
-          pnpm format
-          git status
-          if git diff --exit-code HEAD; then
-            echo "No docs changes detected"
-          else
-            echo "It looks like the CLI docs have changed:"
-            exit 1
-          fi
+          cargo ci cli-docs
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -46,6 +46,7 @@ members = [
   "sdks/rust/tests/test-client",
   "sdks/rust/tests/test-counter",
   "sdks/rust/tests/connect_disconnect_client",
+  "tools/ci",
   "tools/upgrade-version",
   "tools/license-check",
   "crates/bindings-typescript/test-app/server",

diff --git a/tools/ci/Cargo.toml b/tools/ci/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "ci"
+version = "0.1.0"
+edition.workspace = true
+
+[dependencies]
+log.workspace = true
+anyhow.workspace = true
+chrono = { workspace = true, features=["clock"] }
+clap.workspace = true
+regex.workspace = true
+duct.workspace = true