Skip to content

ci: validate releases in the same environment as CI #246

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oratis merged 1 commit into from
Aug 8, 2026
+24 −2
Merged

ci: validate releases in the same environment as CI #246

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 21 additions & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,30 @@ jobs:
node-version: '22'
cache: 'pnpm'
- run: pnpm install --frozen-lockfile

# The release gate must validate in the same environment as CI. Without
# this, `pnpm test` here runs against a weaker box than ci.yml uses, so a
# green CI stops predicting a green release — which is exactly how the
# first v0.3.0 tag failed: the deny-all-net fallback test spawns `bwrap`,
# and this runner had no bubblewrap installed.
# Kept byte-for-byte in step with the "Install sandbox tools" step in
# ci.yml; change both together.
- name: Install sandbox tools
run: |
sudo apt-get update
sudo apt-get install -y bubblewrap slirp4netns curl
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
sudo sysctl -w net.ipv4.ip_unprivileged_port_start=53 || true

- run: pnpm typecheck
- run: pnpm lint
- run: pnpm format:check
- run: pnpm test
- name: Test
# Matches ci.yml: opts in the selective-allowlist integration test, which
# self-skips when bwrap/slirp4netns are absent.
env:
DC_SANDBOX_NET_TEST: '1'
run: pnpm test
- run: pnpm docs:check
- run: pnpm release:check

Expand Down
4 changes: 3 additions & 1 deletion docs/RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,9 @@ git push origin v0.1.3

The `release.yml` workflow fires on any `v*` tag push. Its validation and publication graph is:

1. **validate** — typecheck, lint, format, tests, docs, `pnpm release:check`, and the Playwright
1. **validate** — installs the same sandbox tooling `ci.yml` does (bubblewrap + slirp4netns; the
deny-all-net fallback test spawns `bwrap`), then typecheck, lint, format, tests, docs,
`pnpm release:check`, and the Playwright
desktop protocol journey. The release gate starts the real bundled app-server twice and verifies
protocol capabilities, thread persistence, thin-client boundaries, bundle budgets, and timing.
2. **publish-cli** — bumps `apps/cli/package.json` to the tag version,
Expand Down
Loading