mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-21 19:25:57 +00:00
courtmanr@gmail.com
8aeffc456d
The Build and Test workflow ran everything in one serial job — frontend lint/tests/build, the full go test -race sweep, and benchmarks — for a 37-55 minute wall clock on every push. The job now splits into parallel jobs: frontend (lint, unit tests, type-check, bundle build and size gate), backend tests sharded three ways with internal/api on its own shard since it alone takes ~10m under -race, script smoke tests with the backend build, and benchmarks with the existing baseline cache flow. Backend jobs satisfy the frontend embed with a stub index.html, which unit tests do not assert against; the real bundle is still built and size-gated by the frontend job and by release builds. Expected wall clock is roughly the slowest single job, 10-15 minutes. A new changes job skips the build/test jobs when a push touches only docs/ and Markdown, mirroring the path filters Core E2E already has. The gitleaks secret scan deliberately stays unconditional since this workflow is the only per-push scan and docs can leak secrets too. scripts/dev-prepush.sh runs the checks that most often turn main red, scoped to the outgoing commits: the canonical completion guard in CI mode, the registry snapshot tests when registry.json changed, the mutation registry audits, build plus tests for touched Go packages, and the frontend type-check. It exists because CI verdicts arrive well after the push; today's unclassified force-fail route would have failed it locally in about a minute. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
313 lines
11 KiB
YAML
313 lines
11 KiB
YAML
name: Build and Test
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- pulse/v6-release
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
- pulse/v6-release
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# Let the in-progress run finish (pushes land here every few minutes on a
|
|
# busy day, and cancelling would mean main never completes a verdict — four
|
|
# consecutive runs were cancelled on 2026-07-17 alone); queued runs collapse
|
|
# to the newest pending one, so intermediate pushes skip. Mirrors the Core
|
|
# E2E workflow's concurrency policy.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
secret-scan:
|
|
name: Secret Scan
|
|
runs-on: ubuntu-24.04
|
|
env:
|
|
GITLEAKS_VERSION: "8.30.1"
|
|
GITLEAKS_LINUX_X64_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Install gitleaks
|
|
run: |
|
|
set -euo pipefail
|
|
archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
|
|
url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}"
|
|
curl -fsSLo "/tmp/${archive}" "$url"
|
|
echo "${GITLEAKS_LINUX_X64_SHA256} /tmp/${archive}" | sha256sum -c -
|
|
tar -xzf "/tmp/${archive}" -C /tmp gitleaks
|
|
install /tmp/gitleaks /usr/local/bin/gitleaks
|
|
|
|
- name: Run gitleaks
|
|
run: |
|
|
set -euo pipefail
|
|
gitleaks detect \
|
|
--source . \
|
|
--log-opts=-1 \
|
|
--no-banner \
|
|
--redact \
|
|
--exit-code 2 \
|
|
--report-format sarif \
|
|
--report-path results.sarif
|
|
|
|
# The secret scan above runs on every push including docs-only ones — this
|
|
# workflow is the only per-push gitleaks pass, so it must not be path
|
|
# filtered away. The build/test jobs below are gated here instead: a push
|
|
# that touches only docs/ and Markdown skips them entirely. Detection fails
|
|
# open (code=true) whenever the base commit cannot be resolved.
|
|
changes:
|
|
name: Detect changed areas
|
|
runs-on: ubuntu-24.04
|
|
outputs:
|
|
code: ${{ steps.filter.outputs.code }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Classify changed files
|
|
id: filter
|
|
run: |
|
|
set -euo pipefail
|
|
if [ "${{ github.event_name }}" = "pull_request" ]; then
|
|
base="${{ github.event.pull_request.base.sha }}"
|
|
else
|
|
base="${{ github.event.before }}"
|
|
fi
|
|
if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ] || ! git cat-file -e "$base" 2>/dev/null; then
|
|
echo "Base commit unavailable; assuming code changed."
|
|
echo "code=true" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
changed=$(git diff --name-only "$base" "${{ github.sha }}")
|
|
printf 'Changed files:\n%s\n' "$changed"
|
|
# Note: -q must not be combined with -v here — BSD grep exits 1 for
|
|
# that combination even when inverted matches exist.
|
|
if printf '%s\n' "$changed" | grep -vE '^docs/|\.md$' >/dev/null; then
|
|
code=true
|
|
else
|
|
code=false
|
|
fi
|
|
echo "code=$code" >> "$GITHUB_OUTPUT"
|
|
|
|
frontend:
|
|
name: Frontend
|
|
needs: changes
|
|
if: needs.changes.outputs.code == 'true'
|
|
runs-on: ubuntu-24.04
|
|
env:
|
|
FRONTEND_DIR: frontend-modern
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version: '20'
|
|
cache: npm
|
|
cache-dependency-path: frontend-modern/package-lock.json
|
|
|
|
- name: Install frontend dependencies
|
|
working-directory: frontend-modern
|
|
run: npm ci
|
|
|
|
- name: Lint frontend
|
|
working-directory: frontend-modern
|
|
run: npm run lint
|
|
|
|
- name: Audit header composition
|
|
working-directory: frontend-modern
|
|
run: npm run lint:headers
|
|
|
|
- name: Check frontend copy-paste duplication
|
|
working-directory: frontend-modern
|
|
run: npm run lint:cpd
|
|
|
|
- name: Frontend unit tests
|
|
working-directory: frontend-modern
|
|
run: npm run test
|
|
|
|
- name: Type-check frontend
|
|
working-directory: frontend-modern
|
|
run: npm run type-check
|
|
|
|
- name: Build frontend bundle (with embed copy)
|
|
run: make frontend
|
|
|
|
- name: Check frontend bundle size budget
|
|
working-directory: frontend-modern
|
|
run: npm run check:bundlesize
|
|
|
|
backend:
|
|
name: Backend tests (${{ matrix.shard }})
|
|
needs: changes
|
|
if: needs.changes.outputs.code == 'true'
|
|
runs-on: ubuntu-24.04
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
# internal/api is by far the slowest package under -race (~10m), so it
|
|
# gets a dedicated shard; every other package splits across the rest.
|
|
shard: [api, rest-0, rest-1]
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
# The internal/api package embeds frontend-modern/dist. Unit tests do
|
|
# not assert on real bundle content, so a stub file satisfies the embed
|
|
# without the ~5 minute frontend build; the real bundle is built and
|
|
# size-gated by the frontend job, and release artifacts always build it.
|
|
- name: Provide frontend embed stub
|
|
run: |
|
|
mkdir -p internal/api/frontend-modern/dist
|
|
[ -f internal/api/frontend-modern/dist/index.html ] || \
|
|
printf '<!doctype html><title>ci embed stub</title>\n' > internal/api/frontend-modern/dist/index.html
|
|
|
|
- name: Go unit tests (shard ${{ matrix.shard }})
|
|
env:
|
|
PULSE_DATA_DIR: /tmp/pulse-test-data
|
|
# internal/api alone takes ~10m under -race on a fast machine; CI
|
|
# runners need the larger per-binary budget. Remaining packages are
|
|
# split deterministically by list position.
|
|
run: |
|
|
set -euo pipefail
|
|
case "${{ matrix.shard }}" in
|
|
api) pkgs="./internal/api" ;;
|
|
rest-0) pkgs=$(go list ./... | grep -v '/internal/api$' | awk 'NR % 2 == 0') ;;
|
|
rest-1) pkgs=$(go list ./... | grep -v '/internal/api$' | awk 'NR % 2 == 1') ;;
|
|
*) echo "unknown shard ${{ matrix.shard }}" >&2; exit 1 ;;
|
|
esac
|
|
if [ -z "$pkgs" ]; then
|
|
echo "shard resolved to an empty package list" >&2
|
|
exit 1
|
|
fi
|
|
printf 'Packages in this shard:\n%s\n' "$pkgs"
|
|
go test -race -timeout 25m $pkgs
|
|
|
|
scripts-and-build:
|
|
name: Script smoke tests & backend build
|
|
needs: changes
|
|
if: needs.changes.outputs.code == 'true'
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Provide frontend embed stub
|
|
run: |
|
|
mkdir -p internal/api/frontend-modern/dist
|
|
[ -f internal/api/frontend-modern/dist/index.html ] || \
|
|
printf '<!doctype html><title>ci embed stub</title>\n' > internal/api/frontend-modern/dist/index.html
|
|
|
|
- name: Script smoke tests
|
|
run: scripts/tests/run.sh
|
|
|
|
- name: Build Pulse backend
|
|
run: go build ./cmd/pulse
|
|
|
|
benchmarks:
|
|
name: Benchmarks
|
|
needs: changes
|
|
if: needs.changes.outputs.code == 'true'
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Provide frontend embed stub
|
|
run: |
|
|
mkdir -p internal/api/frontend-modern/dist
|
|
[ -f internal/api/frontend-modern/dist/index.html ] || \
|
|
printf '<!doctype html><title>ci embed stub</title>\n' > internal/api/frontend-modern/dist/index.html
|
|
|
|
- name: Go benchmarks
|
|
timeout-minutes: 20
|
|
env:
|
|
PULSE_DATA_DIR: /tmp/pulse-bench-data
|
|
run: |
|
|
set -o pipefail
|
|
go test -bench=. -benchmem -count=5 -run=^$ -benchtime=100ms -timeout=5m \
|
|
./pkg/metrics/ \
|
|
./pkg/auth/ \
|
|
./internal/api/ \
|
|
./internal/monitoring/ \
|
|
./internal/unifiedresources/ \
|
|
./internal/dockeragent/ \
|
|
./cmd/pulse-agent/ \
|
|
./internal/hostagent/ \
|
|
./internal/hostmetrics/ \
|
|
| tee bench-results.txt
|
|
|
|
- name: Upload benchmark results
|
|
if: always()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: bench-results
|
|
path: bench-results.txt
|
|
retention-days: 7
|
|
|
|
- name: Install benchstat
|
|
run: go install golang.org/x/perf/cmd/benchstat@v0.0.0-20260211190930-8161c38c6cdc
|
|
|
|
- name: Save benchmark baseline (main branch)
|
|
if: github.ref == 'refs/heads/main'
|
|
run: cp bench-results.txt bench-baseline.txt
|
|
|
|
- name: Cache benchmark baseline (main branch)
|
|
if: github.ref == 'refs/heads/main'
|
|
uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
|
|
with:
|
|
path: bench-baseline.txt
|
|
key: go-bench-baseline-${{ github.sha }}
|
|
|
|
- name: Restore benchmark baseline (PRs)
|
|
if: github.event_name == 'pull_request'
|
|
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
|
|
with:
|
|
path: bench-baseline.txt
|
|
key: go-bench-baseline-
|
|
restore-keys: go-bench-baseline-
|
|
|
|
- name: Compare benchmarks against baseline
|
|
if: github.event_name == 'pull_request'
|
|
run: |
|
|
set -eo pipefail
|
|
if [ ! -f bench-baseline.txt ]; then
|
|
echo "No benchmark baseline found (first PR against main?). Skipping comparison."
|
|
exit 0
|
|
fi
|
|
echo "=== Benchmark comparison (baseline vs current) ==="
|
|
benchstat bench-baseline.txt bench-results.txt | tee bench-comparison.txt
|
|
echo ""
|
|
bash scripts/check-bench-regression.sh bench-comparison.txt
|