feat(daemon): register externally-owned sessions in the ledger (Phase… #963
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| rust: | |
| name: Rust checks | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt, clippy | |
| - name: Install native link dependencies (Linux only) | |
| if: runner.os == 'Linux' | |
| run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libopenblas-dev | |
| # fmt/clippy only on Linux to keep Windows leg focused on build+test | |
| - name: Check formatting | |
| if: runner.os == 'Linux' | |
| run: cargo fmt --check | |
| - name: Clippy | |
| if: runner.os == 'Linux' | |
| run: cargo clippy --workspace --all-targets -- -D warnings | |
| - run: cargo test --workspace --locked | |
| secret-guard: | |
| name: Secret guard | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.x' | |
| - run: python scripts/check-secrets.py | |
| channels: | |
| name: Channels package | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: packages/channels/package-lock.json | |
| - run: npm ci | |
| working-directory: packages/channels | |
| - run: npm run build | |
| working-directory: packages/channels | |
| - run: npm test | |
| working-directory: packages/channels | |
| npm-onboarding-smoke: | |
| name: npm onboarding smoke (${{ matrix.npm-target }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: macos-26 | |
| npm-target: macos | |
| rust-target: aarch64-apple-darwin | |
| - os: ubuntu-latest | |
| npm-target: linux-x64 | |
| rust-target: x86_64-unknown-linux-gnu | |
| - os: windows-latest | |
| npm-target: windows | |
| rust-target: x86_64-pc-windows-msvc | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.rust-target }} | |
| - name: Install native link dependencies (Linux only) | |
| if: runner.os == 'Linux' | |
| run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libopenblas-dev | |
| - run: cargo build --release --target ${{ matrix.rust-target }} | |
| - run: node scripts/test-cli-prepublish.mjs --target=${{ matrix.npm-target }} --skip-build --skip-secrets-scan | |
| env: | |
| COVEN_NPM_DRY_RUN_VERSION: 999.0.0 | |
| engine-contract: | |
| name: engine contract | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: Install native link dependencies | |
| run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libopenblas-dev | |
| - name: Build coven | |
| run: cargo build -p coven-cli --locked | |
| - name: Install the pinned engine | |
| run: cargo run -p coven-cli --locked -- engine install | |
| - name: Run contract tests against the pinned engine | |
| run: | | |
| ENGINE="$HOME/.coven/engine/$(cat "$HOME/.coven/engine/current")/coven-code" | |
| echo "engine: $ENGINE" | |
| "$ENGINE" --version | |
| COVEN_ENGINE_BIN="$ENGINE" cargo test -p coven-cli --locked contract -- --nocapture | |
| cargo-deny: | |
| name: Dependency audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Commit-pinned (v2.0.20): a supply-chain gate must not itself depend on a | |
| # mutable action tag. Config lives in deny.toml at the repo root. | |
| - uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2.0.20 | |
| with: | |
| command: check advisories licenses bans sources |