Update Cargo.lock #286
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Desktop App | ||
|
Check failure on line 1 in .github/workflows/build.yml
|
||
| # Tests run on every push and PR (quick feedback), but the expensive | ||
| # 3-platform desktop build matrix only runs on manual trigger — | ||
| # `workflow_dispatch` from the Actions tab or `gh workflow run`. | ||
| # Pushes to main / staging no longer kick off a full cross-platform build. | ||
| on: | ||
| push: | ||
| branches: [main, staging] | ||
| pull_request: | ||
| branches: [main, staging] | ||
| workflow_dispatch: | ||
| env: | ||
| NODE_VERSION: "24" | ||
| PYTHON_VERSION: "3.12" | ||
| RUST_TOOLCHAIN: "stable" | ||
| jobs: | ||
| test: | ||
| name: Test (${{ matrix.os }}) | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - os: ubuntu-latest | ||
| shell: bash | ||
| venv-activate: source .venv/bin/activate | ||
| advisory: false | ||
| - os: macos-latest | ||
| shell: bash | ||
| venv-activate: source .venv/bin/activate | ||
| advisory: false | ||
| - os: windows-latest | ||
| shell: bash | ||
| venv-activate: source .venv/Scripts/activate | ||
| # Promoted from advisory to required in v0.8.0 Phase 4-5 once | ||
| # the cross-OS parity scripts (PowerShell update-* ports, | ||
| # cross-platform pre-build-check.mjs) shipped. Windows | ||
| # failures now block PRs the same way macOS / Ubuntu do. | ||
| advisory: false | ||
| runs-on: ${{ matrix.os }} | ||
| continue-on-error: ${{ matrix.advisory }} | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/setup-node@v6 | ||
| with: | ||
| node-version: ${{ env.NODE_VERSION }} | ||
| - uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: "3.12" | ||
| - uses: dtolnay/rust-toolchain@stable | ||
| - name: Linux system deps for Tauri | ||
| if: matrix.os == 'ubuntu-latest' | ||
| run: | | ||
| sudo apt-get update | ||
| sudo apt-get install -y \ | ||
| libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev \ | ||
| librsvg2-dev patchelf | ||
| - run: npm ci | ||
| - run: npx tsc --noEmit | ||
| - run: npm test -- --run --coverage | ||
| - name: cargo check | ||
| run: cargo check --manifest-path src-tauri/Cargo.toml --all-targets | ||
| - name: Python venv + install | ||
| shell: ${{ matrix.shell }} | ||
| run: | | ||
| python -m venv .venv | ||
| ${{ matrix.venv-activate }} | ||
| pip install --upgrade pip | ||
| # [images] brings torch+diffusers+accelerate+pillow+safetensors, which | ||
| # tests/test_video_runtime.py needs because probe() does a real | ||
| # ``import torch`` after the mocked _find_missing returns. Without | ||
| # torch installed, probe bails out with "PyTorch could not be | ||
| # imported cleanly" and every ``realGenerationAvailable == True`` | ||
| # assertion fails. | ||
| pip install -e ".[desktop,dev,images]" | ||
| - name: Python tests with coverage | ||
| shell: ${{ matrix.shell }} | ||
| run: | | ||
| ${{ matrix.venv-activate }} | ||
| python -m pytest tests/ -v --tb=short \ | ||
| --cov=backend_service --cov=cache_compression --cov=dflash \ | ||
| --cov-report=term --cov-report=json:coverage.json | ||
| - name: Coverage gate vs baseline | ||
| # Linux is the canonical baseline runner; macOS/Windows numbers | ||
| # may differ slightly because some platform-gated branches only | ||
| # execute on one OS (e.g. mlx imports on macOS only). | ||
| if: matrix.os == 'ubuntu-latest' | ||
| shell: bash | ||
| run: | | ||
| source .venv/bin/activate | ||
| python - <<'PY' | ||
| import json, sys | ||
| d = json.load(open('coverage.json')) | ||
| pct = d['totals']['percent_covered'] | ||
| floor = 60.0 | ||
| print(f"line coverage: {pct:.2f}% (floor {floor:.1f}%)") | ||
| if pct + 0.01 < floor: | ||
| sys.exit(f"coverage regression: {pct:.2f}% < {floor:.1f}%") | ||
| PY | ||
| build: | ||
| # Only run the expensive desktop bundle matrix on manual dispatch. | ||
| # Pushes and PRs stop at the `test` job above. | ||
| if: github.event_name == 'workflow_dispatch' | ||
| needs: test | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - os: macos-latest | ||
| platform: darwin | ||
| arch: aarch64 | ||
| bundle_targets: app,dmg | ||
| - os: ubuntu-22.04 | ||
| platform: linux | ||
| arch: x86_64 | ||
| bundle_targets: deb,appimage | ||
| - os: windows-latest | ||
| platform: windows | ||
| arch: x86_64 | ||
| bundle_targets: msi,nsis | ||
| runs-on: ${{ matrix.os }} | ||
| name: Build (${{ matrix.os }}) | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| submodules: true | ||
| # ── Linux system dependencies ────────────────────────────── | ||
| - name: Install Linux system dependencies | ||
| if: matrix.platform == 'linux' | ||
| run: | | ||
| sudo apt-get update | ||
| sudo apt-get install -y \ | ||
| libgtk-3-dev \ | ||
| libwebkit2gtk-4.1-dev \ | ||
| libappindicator3-dev \ | ||
| librsvg2-dev \ | ||
| patchelf | ||
| # ── Node.js ──────────────────────────────────────────────── | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v6 | ||
| with: | ||
| node-version: ${{ env.NODE_VERSION }} | ||
| cache: npm | ||
| cache-dependency-path: package-lock.json | ||
| - name: Install npm dependencies | ||
| run: npm ci | ||
| # ── Rust ─────────────────────────────────────────────────── | ||
| - name: Setup Rust | ||
| uses: dtolnay/rust-toolchain@stable | ||
| - name: Cache Cargo | ||
| uses: actions/cache@v5 | ||
| with: | ||
| path: | | ||
| ~/.cargo/registry | ||
| ~/.cargo/git | ||
| src-tauri/target | ||
| key: cargo-${{ matrix.os }}-${{ hashFiles('src-tauri/Cargo.lock') }} | ||
| restore-keys: cargo-${{ matrix.os }}- | ||
| # ── Python + venv ────────────────────────────────────────── | ||
| - name: Setup Python | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: ${{ env.PYTHON_VERSION }} | ||
| # See release.yml for the full explanation — cert must be in the | ||
| # keychain before beforeBundleCommand runs so stage-runtime.mjs can | ||
| # sign the embedded Python runtime for notarization. | ||
| - name: Import Apple certificate (macOS) | ||
| if: matrix.platform == 'darwin' | ||
| env: | ||
| CSC_LINK: ${{ secrets.CSC_LINK }} | ||
| CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }} | ||
| run: | | ||
| set -euo pipefail | ||
| KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db" | ||
| KEYCHAIN_PASSWORD="$(openssl rand -base64 20)" | ||
| echo "$CSC_LINK" | base64 --decode > "$RUNNER_TEMP/certificate.p12" | ||
| security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" | ||
| security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH" | ||
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" | ||
| security import "$RUNNER_TEMP/certificate.p12" \ | ||
| -P "$CSC_KEY_PASSWORD" \ | ||
| -A -t cert -f pkcs12 \ | ||
| -k "$KEYCHAIN_PATH" | ||
| security set-key-partition-list \ | ||
| -S apple-tool:,apple: \ | ||
| -k "$KEYCHAIN_PASSWORD" \ | ||
| "$KEYCHAIN_PATH" | ||
| security list-keychain -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | xargs) | ||
| IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" | grep 'Developer ID Application' | head -1 | awk -F'"' '{print $2}')" | ||
| if [ -z "$IDENTITY" ]; then | ||
| echo "::error::No Developer ID Application identity found in keychain" | ||
| security find-identity -v -p codesigning "$KEYCHAIN_PATH" || true | ||
| exit 1 | ||
| fi | ||
| echo "Resolved signing identity: $IDENTITY" | ||
| echo "APPLE_SIGNING_IDENTITY=$IDENTITY" >> "$GITHUB_ENV" | ||
| echo "CHAOSENGINE_APPLE_SIGNING_IDENTITY=$IDENTITY" >> "$GITHUB_ENV" | ||
| rm -f "$RUNNER_TEMP/certificate.p12" | ||
| - name: Create Python venv (macOS) | ||
| if: matrix.platform == 'darwin' | ||
| run: | | ||
| python -m venv .venv | ||
| .venv/bin/pip install --upgrade pip | ||
| .venv/bin/pip install mlx mlx-lm gguf fastapi psutil uvicorn "pypdf>=6.10.2" python-multipart huggingface_hub | ||
| - name: Create Python venv (Linux) | ||
| if: matrix.platform == 'linux' | ||
| run: | | ||
| python -m venv .venv | ||
| .venv/bin/pip install --upgrade pip | ||
| .venv/bin/pip install fastapi psutil uvicorn "pypdf>=6.10.2" python-multipart huggingface_hub | ||
| - name: Create Python venv (Windows) | ||
| if: matrix.platform == 'windows' | ||
| run: | | ||
| python -m venv .venv | ||
| .venv\Scripts\pip install --upgrade pip | ||
| .venv\Scripts\pip install fastapi psutil uvicorn "pypdf>=6.10.2" python-multipart huggingface_hub | ||
| # ── Configure runtime staging ────────────────────────────── | ||
| - name: Set Python embed path (Unix) | ||
| if: matrix.platform != 'windows' | ||
| run: echo "CHAOSENGINE_EMBED_PYTHON_BIN=${{ github.workspace }}/.venv/bin/python3" >> $GITHUB_ENV | ||
| - name: Set Python embed path (Windows) | ||
| if: matrix.platform == 'windows' | ||
| run: echo "CHAOSENGINE_EMBED_PYTHON_BIN=${{ github.workspace }}\.venv\Scripts\python.exe" >> $env:GITHUB_ENV | ||
| # Use dev mode staging to skip llama.cpp binary requirement. | ||
| # To enable llama.cpp, build the binaries and set CHAOSENGINE_LLAMA_BIN_DIR. | ||
| - name: Override bundle command to dev mode staging | ||
| shell: bash | ||
| run: | | ||
| node -e " | ||
| const fs = require('fs'); | ||
| const conf = JSON.parse(fs.readFileSync('src-tauri/tauri.conf.json', 'utf8')); | ||
| conf.build.beforeBundleCommand = 'npm run stage:runtime'; | ||
| fs.writeFileSync('src-tauri/tauri.conf.json', JSON.stringify(conf, null, 2) + '\n'); | ||
| " | ||
| # ── Build ────────────────────────────────────────────────── | ||
| - name: Build Tauri app (macOS, signed) | ||
| if: matrix.platform == 'darwin' | ||
| env: | ||
| APPLE_ID: ${{ secrets.APPLE_ID }} | ||
| APPLE_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | ||
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | ||
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | ||
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | ||
| run: npx tauri build --bundles ${{ matrix.bundle_targets }} --ci | ||
| - name: Build Tauri app (Linux / Windows) | ||
| if: matrix.platform != 'darwin' | ||
| env: | ||
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | ||
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | ||
| run: npx tauri build --bundles ${{ matrix.bundle_targets }} | ||
| # ── Upload artifacts ─────────────────────────────────────── | ||
| - name: Upload macOS artifacts | ||
| if: matrix.platform == 'darwin' | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: ChaosEngineAI-macos | ||
| path: | | ||
| src-tauri/target/release/bundle/macos/*.app | ||
| src-tauri/target/release/bundle/dmg/*.dmg | ||
| - name: Upload Linux artifacts | ||
| if: matrix.platform == 'linux' | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: ChaosEngineAI-linux | ||
| path: | | ||
| src-tauri/target/release/bundle/deb/*.deb | ||
| src-tauri/target/release/bundle/appimage/*.AppImage | ||
| - name: Upload Windows artifacts | ||
| if: matrix.platform == 'windows' | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: ChaosEngineAI-windows | ||
| path: | | ||
| src-tauri/target/release/bundle/msi/*.msi | ||
| src-tauri/target/release/bundle/nsis/*.exe | ||
