Local Studio v2.0.1 full convergence and release gate #1234
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [dev, main] | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: "0 0 * * 0" | |
| concurrency: | |
| group: ci-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| gates: | |
| if: github.event_name != 'schedule' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 22.19.0 | |
| - name: Fetch origin heads | |
| run: git fetch origin '+refs/heads/*:refs/remotes/origin/*' | |
| - name: Fetch pull head | |
| if: github.event_name == 'pull_request' | |
| run: >- | |
| git fetch origin '+refs/pull/${{ github.event.pull_request.number }}/head:refs/remotes/pull/${{ github.event.pull_request.number }}/head' | |
| - name: Commit lint (pull request) | |
| if: github.event_name == 'pull_request' | |
| run: >- | |
| node scripts/project.mjs commit-lint --mode=ci | |
| --head ${{ github.event.pull_request.head.sha }} | |
| --base ${{ github.event.pull_request.base.sha }} | |
| --head-ref ${{ github.event.pull_request.head.ref }} | |
| --same-repo ${{ github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name }} | |
| - name: Commit lint (push) | |
| if: github.event_name == 'push' | |
| run: >- | |
| node scripts/project.mjs commit-lint --mode=ci | |
| --head ${{ github.sha }} | |
| --base ${{ github.event.before }} | |
| --head-ref ${{ github.ref_name }} | |
| --same-repo true | |
| - name: Shared-contract duplication gate | |
| run: node scripts/project.mjs validate-contracts | |
| - name: Barrel/dir sibling structure gate | |
| run: node scripts/project.mjs validate-structure | |
| controller: | |
| if: github.event_name != 'schedule' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Install dependencies | |
| working-directory: ./controller | |
| run: bun install --frozen-lockfile | |
| - name: Type check | |
| working-directory: ./controller | |
| run: bun run typecheck | |
| - name: Lint | |
| working-directory: ./controller | |
| run: bun run lint | |
| - name: Cleanup checks | |
| working-directory: ./controller | |
| run: bun run check | |
| agent-runtime: | |
| if: github.event_name != 'schedule' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Install dependencies | |
| working-directory: ./services/agent-runtime | |
| run: bun install --frozen-lockfile | |
| - name: Install shared contract dependencies | |
| working-directory: ./shared | |
| run: bun install --frozen-lockfile | |
| - name: Build | |
| working-directory: ./services/agent-runtime | |
| run: bun run check | |
| frontend: | |
| if: github.event_name != 'schedule' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 22.19.0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Install repository dependencies | |
| run: npm run setup | |
| - name: Production quality gate | |
| working-directory: ./frontend | |
| run: npm run check:quality | |
| desktop-package: | |
| if: github.event_name != 'schedule' | |
| runs-on: macos-15 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 22.19.0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Install repository dependencies | |
| run: npm run setup | |
| - name: Build unsigned package | |
| env: | |
| CSC_IDENTITY_AUTO_DISCOVERY: "false" | |
| run: >- | |
| npm --prefix frontend run desktop:pack -- | |
| --config.mac.identity=null | |
| --config.mac.hardenedRuntime=false | |
| --config.extraMetadata.localStudioCommit=${{ github.sha }} | |
| - name: Archive exact-main package | |
| run: >- | |
| ditto -c -k --keepParent | |
| "frontend/dist-desktop/mac-arm64/Local Studio.app" | |
| "local-studio-${{ github.sha }}-arm64.zip" | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: local-studio-${{ github.sha }}-arm64 | |
| path: local-studio-${{ github.sha }}-arm64.zip | |
| if-no-files-found: error | |
| retention-days: 7 | |
| trufflehog: | |
| name: Secret Scanning (TruffleHog) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run TruffleHog | |
| uses: trufflesecurity/trufflehog@v3.96.0 | |
| with: | |
| path: ./ | |
| base: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }} | |
| head: HEAD | |
| extra_args: --only-verified --json | |
| codeql: | |
| name: CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: github/codeql-action/init@v4 | |
| with: | |
| languages: javascript, typescript | |
| - uses: github/codeql-action/autobuild@v4 | |
| - uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:javascript-typescript" | |
| dependency-review: | |
| name: Dependency Review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/dependency-review-action@v5 | |
| with: | |
| fail-on-severity: moderate | |
| deny-licenses: GPL-3.0, AGPL-3.0 |