bowenliang123
f50f33d58b
The matrix skipped itself on every PR: pr-checks.yml never fetched the baseline tags and never set DSH_REPO, so skipReasons() always reported a missing checkout and describe.skipIf dropped the whole per-baseline block — the registry apply, the wire keys, the checkpoint JSON gate, cold restore and every client seam probe. Only the release workflow fetched them, so the compatibility proof compatibility.md claims for "every pnpm test" was a no-op until a tag was cut. Both workflows now fetch the tags and export DSH_REPO, and a skip under CI fails the run instead of hiding behind green: a missing prerequisite there is a broken gate, not an absent one. The two test runs collapse into one, which also brings the lint gate the release workflow had and PRs did not. The matrix's own vocabulary guard compared a hand-copied constant against hand-copied baseline lists, so it could never see a drift in the fold — and had drifted: approval/asked, approval/decided and session/end-seed are folded but declared by no baseline. It now reads the fold's case labels out of src/host/fold.ts, so a new fold case cannot go unprobed, and the history probe pins the `records` envelope historyPage's rowsOf rejects without, not just the remote's service name.
81 lines
2.7 KiB
YAML
81 lines
2.7 KiB
YAML
name: Publish to npm
|
|
|
|
# Fires on a release tag (v*) push. Publishing uses npm Trusted Publishing
|
|
# (OIDC), so no long-lived token is needed — the npm-side trusted publisher
|
|
# must be configured with this exact workflow filename.
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions:
|
|
id-token: write # Required for OIDC
|
|
contents: read
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Check the DeeSeek Harness plugin
|
|
# `next` = the newest published generation (0.2.0-rc.2), whose npm
|
|
# dependency closure is complete; `latest` still serves the other
|
|
# supported line (0.1.7-rc.2).
|
|
uses: bowenliang123/dsh-plugin-checker@v1
|
|
|
|
# No `packageManager` field in this plugin's package.json, so both
|
|
# workflows pin the version explicitly.
|
|
- uses: pnpm/action-setup@v6
|
|
with:
|
|
version: latest
|
|
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: '24'
|
|
registry-url: 'https://registry.npmjs.org'
|
|
package-manager-cache: false # never use caching in release builds
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build
|
|
run: pnpm run build
|
|
|
|
- name: Lint
|
|
run: pnpm run lint
|
|
|
|
# The `compat` vitest project inside `pnpm test` stages the REAL harness
|
|
# sources at every supported baseline tag (tests/baselines.ts is the
|
|
# source of truth — keep this fetch list in step when a baseline is
|
|
# added) and runs the built plugin through them; it skips silently
|
|
# without the tags, so this fetch sits BEFORE Test. Only the tags are
|
|
# fetched, so the clone stays shallow.
|
|
- name: Fetch the dsh baseline tags
|
|
run: |
|
|
mkdir -p .tmp/dsh-repo
|
|
cd .tmp/dsh-repo
|
|
git init -q
|
|
git remote add origin https://github.com/deepseek-ai/deepseek-harness.git
|
|
git fetch --depth 1 -q origin \
|
|
refs/tags/dsh-v0.1.7-rc.2:refs/tags/dsh-v0.1.7-rc.2 \
|
|
refs/tags/dsh-v0.2.0-rc.2:refs/tags/dsh-v0.2.0-rc.2
|
|
|
|
- name: Test
|
|
run: DSH_REPO="$PWD/.tmp/dsh-repo" pnpm test
|
|
|
|
- name: Verify version matches the tag
|
|
run: |
|
|
TAG="${{ github.ref_name }}"
|
|
VER="v$(node -p "require('./package.json').version")"
|
|
if [ "$TAG" != "$VER" ]; then
|
|
echo "::error::tag $TAG does not match package version $VER"
|
|
exit 1
|
|
fi
|
|
|
|
# Trusted publishing (OIDC) — no NODE_AUTH_TOKEN required; npm >= 11.5.1
|
|
# exchanges the Actions OIDC token for a short-lived publish credential
|
|
# and attaches provenance automatically.
|
|
- name: Publish to npm
|
|
run: npm publish
|