From 8378d0e603bf02c17bbe37ca1fbdb819b35b2be6 Mon Sep 17 00:00:00 2001 From: Huaqing Xu Date: Sun, 6 Sep 2026 19:03:43 +0800 Subject: [PATCH 1/4] chore: slim CI gate to test+typecheck and drop redundant main push trigger --- .github/workflows/ci.yml | 27 +++++---------------------- CHANGELOG.md | 7 +++++++ 2 files changed, 12 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 91738be..a7a6b51 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,9 +1,6 @@ name: CI on: - push: - branches: - - main pull_request: workflow_dispatch: @@ -17,35 +14,21 @@ concurrency: jobs: validate: runs-on: ubuntu-latest - timeout-minutes: 45 + timeout-minutes: 20 steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: persist-credentials: false - - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 - with: - node-version: 22.19.0 - package-manager-cache: false - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: 1.3.12 - - name: Install extraction tools - run: sudo apt-get update && sudo apt-get install -y p7zip-full - - name: Install dependencies run: bun install --frozen-lockfile - - name: Build and test - run: bun run release:build - - - name: Pack and install-test - run: bun run release:pack + - name: Test + run: bun test - - name: Verify repository and npm metadata - run: | - npm pkg fix --dry-run --json - git diff --check - git diff --exit-code -- package.json zcode-runtime.lock.json + - name: Typecheck + run: bun run typecheck diff --git a/CHANGELOG.md b/CHANGELOG.md index 954c4d0..3ca1762 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,6 +21,13 @@ - 溯源与防回归评估：3.8.1-31 的去重方向（每个模型只显示一次、官方条目胜出）保持不变——修复不动 `withoutEnvSlotTwins()` 的取舍，只把「未登录时 env 槽是唯一可用路径」的事实从显示层（保留 env 独有条目）补到切换层（官方条目在运行时解析回 env 槽）；env 独有条目（无官方孪生）原样保留、原样可用；登录态（vault token 或官方槽 key）行为与 3.8.1-31 完全一致（原样走官方槽）；3.8.1-26 的「未登录时 env 文件是 model block 权威」语义不受影响——`/settings` 未登录保存写 env 槽引用，与 launcher 启动同步写的方向一致。 - 验证：`tsc --noEmit` 通过；identity 单测新增 7 用例（未登录回退、env 槽未声明该模型原样、无带 key env 槽原样、官方槽 key 原样、vault token 原样、跨 provider 独立判定、env 引用与无斜杠别名原样），selectors 单测新增 2 用例（current 标注以 env 槽形式匹配官方孪生：flat picker 与 provider 级联）；全量 `bun test` 746 pass / 0 fail（84 files）；TUI 冒烟 5 项全过（`build:tui` 重建后 vendor 内 `@zcode/tui` 副本按 `installLocalTui` 同步骤手动同步）。 +### 变更（CI 门禁精简，Hopper） + +- **PR 门禁 CI 从「完整发布构建」瘦身为「装依赖 + 全量测试 + typecheck」，并移除 push 到 main 的重复触发**（.github/workflows/ci.yml，由 Hopper（TestEngineerAgent）按 CI 维护职责调整）。 + - 为什么改：① 实测 dev 分支一次 CI 耗时 4 分 20 秒，其中 `release:build`（含 sync-runtime 从 GitHub 下载官方 runtime）占 3 分 56 秒（90%）——下载 runtime、打包安装测试是发布准备而非回归门禁必需，发布链 `publish.yml` 已有完整兜底；② PR 合并后 main 的 push 触发再跑一遍同内容属高度冗余（strict + enforce_admins 体系下 PR 门禁已逻辑蕴含 main 绿），且双跑使 flaky 测试的噪音概率翻倍（当日实证：冒烟测试 PR 绿 / main 红随机翻转，重跑即绿）。 + - 改了什么：validate job 只保留 checkout（SHA 固定）→ setup-bun → `bun install --frozen-lockfile` → `bun test` → `bun run typecheck` 五步；移除 setup-node、p7zip、`release:build`、`release:pack`、npm 元数据校验（归发布流程）；触发器移除 `on: push: branches: [main]`（保留 `pull_request` + `workflow_dispatch` 手动兜底）；timeout 45 → 20 分钟；job 名 `validate` 不变（分支保护 required check 引用不变）。 + - 验证：YAML 解析通过（bun + yaml）；本地 `tsc --noEmit` 通过；全量 `bun test` 由本 PR 的 CI 远端验证（精简后的门禁跑第一个全量）。 + ## 3.8.1-31 - 2026-09-06 ### 变更 From 638f04729e22dbfac4640f898ca808de2469206a Mon Sep 17 00:00:00 2001 From: Huaqing Xu Date: Sun, 6 Sep 2026 19:20:09 +0800 Subject: [PATCH 2/4] fix: restore setup-node for engines-pinned tests and sync workflow contract assertions --- .github/workflows/ci.yml | 5 +++++ test/release-workflows.test.ts | 22 ++++++++++++---------- 2 files changed, 17 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a7a6b51..734720a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,6 +20,11 @@ jobs: with: persist-credentials: false + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 + with: + node-version: 22.19.0 + package-manager-cache: false + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: 1.3.12 diff --git a/test/release-workflows.test.ts b/test/release-workflows.test.ts index f577fe0..bdee61c 100644 --- a/test/release-workflows.test.ts +++ b/test/release-workflows.test.ts @@ -54,17 +54,21 @@ function findAction(steps: WorkflowStep[], repository: string, sha: string): Wor describe("release workflows", () => { test("runs read-only CI with pinned actions and cancels superseded checks", async () => { + // 2026-09-06 gate slimming (Hopper): the gate runs install + full tests + + // typecheck only — release build/pack stays in the publish workflow, and + // the redundant push-to-main trigger was dropped (strict required checks + // already guarantee a green merge). setup-node stays: the engines-pinned + // Node is a test dependency (launcher/runtime integration tests). const { source, workflow } = await readWorkflow("ci.yml"); const job = workflow.jobs.validate!; const checkout = findAction(job.steps, "actions/checkout", actionShas.checkout); const setupNode = findAction(job.steps, "actions/setup-node", actionShas.setupNode); const setupBun = findAction(job.steps, "oven-sh/setup-bun", actionShas.setupBun); const install = job.steps.find((step) => step.name === "Install dependencies"); - const build = job.steps.find((step) => step.name === "Build and test"); - const pack = job.steps.find((step) => step.name === "Pack and install-test"); - const metadata = job.steps.find((step) => step.name === "Verify repository and npm metadata"); + const test = job.steps.find((step) => step.name === "Test"); + const typecheck = job.steps.find((step) => step.name === "Typecheck"); - expect(workflow.on).toHaveProperty("push"); + expect(workflow.on).not.toHaveProperty("push"); expect(workflow.on).toHaveProperty("pull_request"); expect(workflow.on).toHaveProperty("workflow_dispatch"); expect(workflow.permissions).toEqual({ contents: "read" }); @@ -72,20 +76,18 @@ describe("release workflows", () => { expect(workflow.concurrency?.group).toContain("github.ref"); expect(workflow.concurrency?.["cancel-in-progress"]).toBe(true); expect(job["runs-on"]).toBe("ubuntu-latest"); - expect(job["timeout-minutes"]).toBe(45); + expect(job["timeout-minutes"]).toBe(20); expect(checkout?.with?.["persist-credentials"]).toBe(false); expect(setupNode?.with?.["node-version"]).toBe("22.19.0"); expect(setupNode?.with?.["package-manager-cache"]).toBe(false); expect(setupBun).toBeDefined(); expect(install?.run).toBe("bun install --frozen-lockfile"); - expect(build?.run).toBe("bun run release:build"); - expect(pack?.run).toBe("bun run release:pack"); - expect(metadata?.run).toContain("npm pkg fix --dry-run --json"); - expect(metadata?.run).toContain("git diff --check"); - expect(metadata?.run).toContain("git diff --exit-code -- package.json zcode-runtime.lock.json"); + expect(test?.run).toBe("bun test"); + expect(typecheck?.run).toBe("bun run typecheck"); expect(source).not.toContain("NPM_TOKEN"); expect(source).not.toContain("npm publish"); expect(source).not.toContain("id-token: write"); + expect(source).not.toContain("release:build"); }); test("prepares release PRs only from the default branch with pinned actions", async () => { From 2d2a9e9176d4ec0a48a6867ba284a9de7eba6837 Mon Sep 17 00:00:00 2001 From: Huaqing Xu Date: Sun, 6 Sep 2026 19:31:13 +0800 Subject: [PATCH 3/4] fix: cache the vendored runtime for integration tests, downloading only on cache miss --- .github/workflows/ci.yml | 14 ++++++++++++++ test/release-workflows.test.ts | 10 ++++++++++ 2 files changed, 24 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 734720a..be33e15 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,6 +29,20 @@ jobs: with: bun-version: 1.3.12 + - name: Restore pinned runtime cache + id: runtime-cache + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + with: + path: vendor + key: zcode-runtime-linux-${{ hashFiles('zcode-runtime.lock.json', 'scripts/sync-runtime.ts') }} + + - name: Fetch pinned runtime + if: steps.runtime-cache.outputs.cache-hit != 'true' + run: | + sudo apt-get update && sudo apt-get install -y p7zip-full + bun install --frozen-lockfile + bun scripts/sync-runtime.ts --lock zcode-runtime.lock.json + - name: Install dependencies run: bun install --frozen-lockfile diff --git a/test/release-workflows.test.ts b/test/release-workflows.test.ts index bdee61c..78693dd 100644 --- a/test/release-workflows.test.ts +++ b/test/release-workflows.test.ts @@ -6,6 +6,7 @@ import { parse } from "yaml"; const root = resolve(import.meta.dir, ".."); const actionShas = { + cache: "0057852bfaa89a56745cba8c7296529d2fc39830", checkout: "df4cb1c069e1874edd31b4311f1884172cec0e10", downloadArtifact: "d3f86a106a0bac45b974a628896c90dbdf5c8093", setupBun: "0c5077e51419868618aeaa5fe8019c62421857d6", @@ -64,6 +65,8 @@ describe("release workflows", () => { const checkout = findAction(job.steps, "actions/checkout", actionShas.checkout); const setupNode = findAction(job.steps, "actions/setup-node", actionShas.setupNode); const setupBun = findAction(job.steps, "oven-sh/setup-bun", actionShas.setupBun); + const runtimeCache = findAction(job.steps, "actions/cache", actionShas.cache); + const fetchRuntime = job.steps.find((step) => step.name === "Fetch pinned runtime"); const install = job.steps.find((step) => step.name === "Install dependencies"); const test = job.steps.find((step) => step.name === "Test"); const typecheck = job.steps.find((step) => step.name === "Typecheck"); @@ -81,6 +84,13 @@ describe("release workflows", () => { expect(setupNode?.with?.["node-version"]).toBe("22.19.0"); expect(setupNode?.with?.["package-manager-cache"]).toBe(false); expect(setupBun).toBeDefined(); + // The launcher/runtime integration tests need the vendored runtime; it is + // cached by lock file + patch script hash and only downloaded on a miss. + expect(runtimeCache?.with?.path).toBe("vendor"); + expect(runtimeCache?.with?.key).toContain("zcode-runtime.lock.json"); + expect(runtimeCache?.with?.key).toContain("scripts/sync-runtime.ts"); + expect(fetchRuntime?.if).toContain("cache-hit != 'true'"); + expect(fetchRuntime?.run).toContain("bun scripts/sync-runtime.ts --lock zcode-runtime.lock.json"); expect(install?.run).toBe("bun install --frozen-lockfile"); expect(test?.run).toBe("bun test"); expect(typecheck?.run).toBe("bun run typecheck"); From aeeb5e51b14949adb31278fd0a7d708087d68c06 Mon Sep 17 00:00:00 2001 From: Huaqing Xu Date: Sun, 6 Sep 2026 19:37:43 +0800 Subject: [PATCH 4/4] fix: build the local tui package before syncing the pinned runtime --- .github/workflows/ci.yml | 1 + test/release-workflows.test.ts | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index be33e15..44f038e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,6 +41,7 @@ jobs: run: | sudo apt-get update && sudo apt-get install -y p7zip-full bun install --frozen-lockfile + bun run build:tui bun scripts/sync-runtime.ts --lock zcode-runtime.lock.json - name: Install dependencies diff --git a/test/release-workflows.test.ts b/test/release-workflows.test.ts index 78693dd..61bb544 100644 --- a/test/release-workflows.test.ts +++ b/test/release-workflows.test.ts @@ -90,6 +90,7 @@ describe("release workflows", () => { expect(runtimeCache?.with?.key).toContain("zcode-runtime.lock.json"); expect(runtimeCache?.with?.key).toContain("scripts/sync-runtime.ts"); expect(fetchRuntime?.if).toContain("cache-hit != 'true'"); + expect(fetchRuntime?.run).toContain("bun run build:tui"); expect(fetchRuntime?.run).toContain("bun scripts/sync-runtime.ts --lock zcode-runtime.lock.json"); expect(install?.run).toBe("bun install --frozen-lockfile"); expect(test?.run).toBe("bun test");