mirror of
https://github.com/Heretek-AI/GDevelop-Heretek.git
synced 2026-10-12 02:02:42 +00:00
fix(ci): share libGD.js build artifact; remove custom CodeQL workflow
CI on the second push of PR #5 had three issues: 1. newIDE/app Jest - 'Cannot find module libGD.js-for-tests-only from src/setupTests.js'. The Jest setup pulls in a pre-built C++ core, but the test job had no way to provision it. Solved by sharing the build output as a GitHub Actions artifact and running 'node scripts/import-libGD.js' in the test job (which copies the local build into node_modules/libGD.js-for-tests-only). 2. GDevelop.js Jest - the emscripten-core/setup-emsdk@v4 action refused to install version '3.1.21' (the version upstream uses): 'No tool or SDK found by name 3.1.21'. The emscripten-core consolidation no longer ships the 3.x line as tagged releases. Solved by replacing the action with a manual clone of the original juj/emsdk fork and installing 3.1.21 from there, exactly as the upstream CircleCI does. 3. CodeQL - 'CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled'. The repo already has GitHub's default CodeQL setup enabled (the same scanner that produced the 56 findings being remediated). My advanced config workflow conflicts with it, so the SARIF upload is rejected. Removed .github/workflows/codeql.yml; the default setup continues to scan weekly + on push. Restructured ci.yml so the Emscripten build runs once in a dedicated 'build-libgd' job (~5-10 min cold) and uploads Binaries/embuild/GDevelop.js/ as an artifact. test-newide-app and test-gdevelopjs both depend on it and download the artifact, so the heavy build doesn't run twice. Also fixed a pre-existing lint failure: src/AI/CustomAIClient.spec.js had two unused imports (DEFAULT_LOCAL_AI_SETTINGS, customAddMessageToAiRequest) left over from a prior code-review iteration. Lint runs with --max-warnings=0 so these blocked the lint job. Removed them. Other job still failing on this push (not in scope): - Build Storybook: needs BUILD_STORYBOOK_AWS_ACCESS_KEY_ID secret which isn't configured in this fork's repo settings. Verified locally: python3 -c 'import yaml; yaml.safe_load(open(".github/workflows/ci.yml"))' npm run lint (no warnings after cleanup) npm test (CustomAIClient.spec.js: 21 passed)
This commit is contained in:
Claude
+87
-42
@@ -2,8 +2,10 @@
|
||||
#
|
||||
# What this runs:
|
||||
# 1. Lockfile security guard (scripts/security/check-lockfiles.js).
|
||||
# 2. Jest test suites in newIDE/app and GDevelop.js.
|
||||
# 3. Lint + Flow type checks for newIDE/app.
|
||||
# 2. libGD.js (Emscripten) build, once, then shared via artifact.
|
||||
# 3. Jest test suites in newIDE/app and GDevelop.js, both consuming the
|
||||
# build output.
|
||||
# 4. Lint + Flow type checks for newIDE/app.
|
||||
#
|
||||
# Karma/Mocha tests for GDJS and SharedLibs/TileMapHelper require a
|
||||
# headless browser and are run in the dedicated CI jobs in
|
||||
@@ -18,6 +20,8 @@ on:
|
||||
branches: [master]
|
||||
|
||||
# Read-only token: checkout + report test results.
|
||||
# `actions/upload-artifact` and `download-artifact` are still available
|
||||
# with `contents: read` because they use the OIDC token, not the GITHUB_TOKEN.
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
@@ -38,31 +42,11 @@ jobs:
|
||||
- name: Run guard
|
||||
run: node scripts/security/check-lockfiles.js
|
||||
|
||||
test-newide-app:
|
||||
name: newIDE/app (Jest)
|
||||
runs-on: ubuntu-latest
|
||||
needs: lockfile-guard
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: "20"
|
||||
cache: "npm"
|
||||
cache-dependency-path: newIDE/app/package-lock.json
|
||||
- name: Install
|
||||
working-directory: newIDE/app
|
||||
run: npm ci --no-audit --no-fund --ignore-scripts
|
||||
- name: Audit production dependencies
|
||||
working-directory: newIDE/app
|
||||
run: npm audit --omit=dev --audit-level=high
|
||||
- name: Test
|
||||
working-directory: newIDE/app
|
||||
env:
|
||||
CI: "true"
|
||||
run: npm test -- --watchAll=false --ci
|
||||
|
||||
test-gdevelopjs:
|
||||
name: GDevelop.js (Jest)
|
||||
build-libgd:
|
||||
name: Build libGD.js (Emscripten)
|
||||
# Slow step (~5–10 min on cold cache). Builds the C++ core via
|
||||
# grunt + emcmake + emmake and uploads the output so the two test
|
||||
# jobs can consume it without each doing the build themselves.
|
||||
runs-on: ubuntu-latest
|
||||
needs: lockfile-guard
|
||||
steps:
|
||||
@@ -73,28 +57,89 @@ jobs:
|
||||
cache: "npm"
|
||||
cache-dependency-path: GDevelop.js/package-lock.json
|
||||
- name: Install Emscripten SDK
|
||||
# GDevelop.js tests require a compiled libGD.js at
|
||||
# Binaries/embuild/GDevelop.js/libGD.js. The build uses Emscripten
|
||||
# via grunt + cmake. The 3.1.21 version matches upstream CircleCI.
|
||||
uses: emscripten-core/setup-emsdk@v4
|
||||
# We install 3.1.21 from the original juj/emsdk fork (the version
|
||||
# upstream CircleCI uses). The emscripten-core consolidation no
|
||||
# longer ships the 3.x line as tagged releases.
|
||||
run: |
|
||||
git clone https://github.com/juj/emsdk.git /tmp/emsdk
|
||||
cd /tmp/emsdk
|
||||
./emsdk install 3.1.21
|
||||
./emsdk activate 3.1.21
|
||||
shell: bash
|
||||
- name: Install GDevelop.js deps
|
||||
working-directory: GDevelop.js
|
||||
run: npm ci --no-audit --no-fund
|
||||
- name: Build libGD.js
|
||||
# Source emsdk env so emcmake/emmake/cmake are on PATH.
|
||||
working-directory: GDevelop.js
|
||||
run: |
|
||||
source /tmp/emsdk/emsdk_env.sh
|
||||
npm run build
|
||||
- name: Upload build artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
version: 3.1.21
|
||||
name: libgd-build
|
||||
path: Binaries/embuild/GDevelop.js/
|
||||
if-no-files-found: error
|
||||
retention-days: 1
|
||||
|
||||
test-newide-app:
|
||||
name: newIDE/app (Jest)
|
||||
runs-on: ubuntu-latest
|
||||
needs: build-libgd
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: "20"
|
||||
cache: "npm"
|
||||
cache-dependency-path: newIDE/app/package-lock.json
|
||||
- name: Download libGD.js build
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: libgd-build
|
||||
path: Binaries/embuild/GDevelop.js/
|
||||
- name: Install
|
||||
working-directory: newIDE/app
|
||||
run: npm ci --no-audit --no-fund --ignore-scripts
|
||||
- name: Audit production dependencies
|
||||
working-directory: newIDE/app
|
||||
run: npm audit --omit=dev --audit-level=high
|
||||
- name: Copy libGD.js into newIDE/app
|
||||
# `node scripts/import-libGD.js` would try to download from S3 when
|
||||
# a local build isn't on disk; with the build artifact now
|
||||
# restored, it takes the local-build branch and copies the file
|
||||
# into node_modules/libGD.js-for-tests-only for the Jest setup.
|
||||
working-directory: newIDE/app
|
||||
run: node scripts/import-libGD.js
|
||||
- name: Test
|
||||
working-directory: newIDE/app
|
||||
env:
|
||||
CI: "true"
|
||||
run: npm test -- --watchAll=false --ci
|
||||
|
||||
test-gdevelopjs:
|
||||
name: GDevelop.js (Jest)
|
||||
runs-on: ubuntu-latest
|
||||
needs: build-libgd
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: "20"
|
||||
cache: "npm"
|
||||
cache-dependency-path: GDevelop.js/package-lock.json
|
||||
- name: Download libGD.js build
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: libgd-build
|
||||
path: Binaries/embuild/GDevelop.js/
|
||||
- name: Install
|
||||
working-directory: GDevelop.js
|
||||
env:
|
||||
# `--ignore-scripts` would skip the post-install patch-package +
|
||||
# the auto-generated libGD.js rebind; we need both.
|
||||
ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: "true"
|
||||
run: npm ci --no-audit --no-fund
|
||||
- name: Audit production dependencies
|
||||
working-directory: GDevelop.js
|
||||
run: npm audit --omit=dev --audit-level=high
|
||||
- name: Build libGD.js (Emscripten)
|
||||
# Slow step (~5–10 min on cold cache). Builds the C++ core via
|
||||
# grunt + emcmake + emmake and drops libGD.js into the path the
|
||||
# tests require at the top of every test file.
|
||||
working-directory: GDevelop.js
|
||||
run: npm run build
|
||||
- name: Test
|
||||
working-directory: GDevelop.js
|
||||
env:
|
||||
|
||||
@@ -1,49 +0,0 @@
|
||||
# CodeQL static analysis for JS/TS.
|
||||
#
|
||||
# Runs on every push to master, every PR, and weekly (Monday 06:00 UTC).
|
||||
# The default CodeQL config (security-and-quality) covers the rules that
|
||||
# produced the 56 findings this fork is currently remediating.
|
||||
#
|
||||
# Findings appear under the repo's Security tab → Code scanning. Dismiss
|
||||
# false positives in the GitHub UI; real bugs need an issue / PR.
|
||||
|
||||
name: "CodeQL"
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
pull_request:
|
||||
branches: [master]
|
||||
schedule:
|
||||
- cron: "0 6 * * 1"
|
||||
|
||||
permissions:
|
||||
# CodeQL needs to read the source tree; SARIF upload needs security-events:write.
|
||||
contents: read
|
||||
security-events: write
|
||||
|
||||
jobs:
|
||||
analyze:
|
||||
name: Analyze (${{ matrix.language }})
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- language: javascript-typescript
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@v3
|
||||
with:
|
||||
languages: ${{ matrix.language }}
|
||||
queries: security-and-quality
|
||||
config-file: .github/codeql-config.yml
|
||||
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@v3
|
||||
with:
|
||||
category: "/language:${{ matrix.language }}"
|
||||
@@ -10,12 +10,10 @@ import {
|
||||
transformGDevelopMessagesToOpenAi,
|
||||
parseAssistantMessage,
|
||||
DEFAULT_CUSTOM_AI_CONFIG,
|
||||
DEFAULT_LOCAL_AI_SETTINGS,
|
||||
GDEVELOP_OPENAI_TOOLS,
|
||||
LOCAL_BYOK_USER_ID,
|
||||
_resetCustomAiClientForTesting,
|
||||
customCreateAiRequest,
|
||||
customAddMessageToAiRequest,
|
||||
customGetAiRequest,
|
||||
customGetAiRequests,
|
||||
customGetAiRequestStatuses,
|
||||
|
||||
Reference in New Issue
Block a user