mirror of
https://github.com/Twigpine/node.git
synced 2026-11-10 05:01:48 -10:00
JATMNandClaude Opus 5.5
309fc8360d
* ci: run PR checks and CodeQL only for the surfaces a PR touches Every PR ran every PR Checks job on the whole workspace, and CodeQL default setup analyzed every language, including a ~13 min macOS Swift autobuild (55 min when it hung on main) for an 8-file macos-app/ that 4 of the last ~280 commits touched. scripts/ci-surfaces.sh maps a PR's changed paths to the jobs that validate them, and scopes cargo test / build --release to the touched crates plus their transitive reverse dependencies (derived from crates/*/Cargo.toml). Root Cargo.toml/Cargo.lock/.cargo, the CI wiring itself, and unknown crate dirs widen to the full suite. Push to main, merge_group, and the release flow's workflow_dispatch always run everything on the whole workspace. codeql.yml replaces default setup with the same scoping per language and a full analysis on push to main and weekly. It needs default setup disabled. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs: say which changes widen PR CI to the whole workspace ci-surfaces.sh has two widening tiers. A root Cargo.toml/Cargo.lock/.cargo change (or toolchain config, or an unknown crate dir) runs the Rust jobs on --workspace, while the other jobs still follow their own inputs. Only the CI wiring itself (pr-checks.yml, codeql.yml, ci-surfaces.sh) and non-PR events run every surface. AGENTS.md and the script header described both tiers as "everything" / "the full suite" and left "CI wiring" undefined, so an edit to, say, release.yml read as if it ran the full PR Checks suite; it runs none of those jobs and only CodeQL's Actions analysis. Comment and docs only; the mapper's output is unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]> * ci: test gitlawb-node when bootstrap-peers.json changes ci-surfaces.sh attributed Rust crates only by crates/<dir>/ paths, but gitlawb-node also compiles in the repo-root bootstrap-peers.json through include_str!. A PR that changed only that file therefore ran the Docker smoke (docker build + --version, which embeds the JSON without parsing it) and skipped cargo test, so embedded_seed_list_parses_successfully ("embedded bootstrap-peers.json must always parse") no longer guarded it. Add a path -> crate table for files outside crates/ that a crate compiles in, routed through the same check as crates/<dir>/ paths (an unknown crate still widens to --workspace). bootstrap-peers.json now yields rust=true with -p gitlawb-node and keeps its Docker trigger; every other mapper output is unchanged. The header also said anything the script cannot attribute precisely widens the run. That holds only inside the Rust surface; a path no surface lists (docs, README, infra/, other workflows) runs no PR Checks job, as AGENTS.md says. Reword it to the two tiers the script implements. Co-Authored-By: Claude Opus 5.5 <[email protected]> * ci: feed ci-surfaces NUL-delimited paths and pin its mapping in a test The mapper read newline-delimited `git diff --name-only` output. In that mode git C-quotes any path with non-ASCII, tab, double-quote or newline characters, so crates/gl/src/é.rs arrived as "crates/gl/src/\303\251.rs", matched no surface, and a PR whose only Rust change was such a file ran no Rust job (Café.swift likewise skipped Swift CodeQL). Newline-delimited input also cannot carry a path that contains a newline. Both workflows now pass `git diff -z` output and the mapper reads it with `read -r -d ''`; input that is not NUL-terminated is rejected (exit 2) instead of being misread. Mapping output for every ASCII path is unchanged (checked against the last 43 commit ranges). scripts/test-ci-surfaces.sh pins one must-not-skip case per surface row, the crate fan-out and widening rules, --all, the wiring rows, quoted names, and rejection of newline-delimited input. PR Checks runs it in the `changed surfaces` job before mapping, on every event, so a broken mapper turns the run red rather than silently narrowing it. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]>
101 lines
3.4 KiB
YAML
101 lines
3.4 KiB
YAML
name: CodeQL
|
|
|
|
# Advanced-setup replacement for CodeQL default setup. Default setup analyzes
|
|
# every detected language on every PR, including Swift (macos-app/), which
|
|
# autobuilds on a macOS runner for ~13 minutes per PR and has hung for 55 on
|
|
# main; that single job was the longest check on most PRs. Here a PR analyzes
|
|
# only the languages it touches (scripts/ci-surfaces.sh), while push to main
|
|
# and the weekly schedule analyze every language, so main's code-scanning
|
|
# baseline stays complete.
|
|
#
|
|
# Requires CodeQL default setup to be DISABLED (Settings -> Code security ->
|
|
# Code scanning): GitHub rejects advanced-setup uploads while it is enabled.
|
|
#
|
|
# A PR that skips a language may show "configuration not found" on the CodeQL
|
|
# check for that language; that is informational and expected.
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: "17 4 * * 1"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: codeql-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
changes:
|
|
name: changed languages
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
outputs:
|
|
codeql: ${{ steps.surfaces.outputs.codeql }}
|
|
matrix: ${{ steps.surfaces.outputs.codeql_matrix }}
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
persist-credentials: false
|
|
fetch-depth: 2
|
|
|
|
- name: Map changed paths to languages
|
|
id: surfaces
|
|
env:
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ "$EVENT_NAME" = "pull_request" ]; then
|
|
# -z: literal paths; plain --name-only C-quotes unusual names.
|
|
git diff -z --name-only --no-renames HEAD^1 HEAD > changed-paths
|
|
tr '\0' '\n' < changed-paths >&2
|
|
scripts/ci-surfaces.sh < changed-paths > surfaces.out
|
|
else
|
|
scripts/ci-surfaces.sh --all > surfaces.out
|
|
fi
|
|
cat surfaces.out
|
|
grep -E '^(codeql|codeql_matrix)=' surfaces.out >> "$GITHUB_OUTPUT"
|
|
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
needs: changes
|
|
if: needs.changes.outputs.codeql == 'true'
|
|
runs-on: ${{ matrix.runner }}
|
|
# Normal runs take <=14 min (Swift autobuild is the longest); cap a hung
|
|
# autobuild instead of letting it hold a runner for an hour.
|
|
timeout-minutes: 30
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
actions: read
|
|
packages: read
|
|
strategy:
|
|
fail-fast: false
|
|
matrix: ${{ fromJSON(needs.changes.outputs.matrix) }}
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: ${{ matrix.build-mode }}
|
|
|
|
- name: Autobuild
|
|
if: matrix.build-mode == 'autobuild'
|
|
uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
|
|
with:
|
|
category: "/language:${{ matrix.language }}"
|