OpenShell/.github/workflows/branch-checks.yml at main · kagent-dev/OpenShell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
name: Branch Checks

on:
  pull_request:

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"
  MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

permissions:
  contents: read
  packages: read

jobs:
  mise-lockfile:
    name: mise Lockfile
    runs-on: build-amd64
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v6

      - name: Mark workspace as safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Detect mise config changes
        id: changed
        uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11 # v42.1.0
        with:
          files: |
            mise.toml
            mise.lock

      - name: Verify mise.lock is in sync with mise.toml
        if: steps.changed.outputs.any_changed == 'true'
        run: |
          mise lock
          if ! git diff --exit-code mise.lock; then
            echo "::error::mise.lock is out of sync with mise.toml. Run 'mise lock' locally and commit the result." >&2
            exit 1
          fi

  license-headers:
    name: License Headers
    runs-on: build-amd64
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v6

      - name: Install tools
        run: mise install --locked

      - name: Check license headers
        run: mise run license:check

  rust:
    name: Rust (${{ matrix.runner }})
    strategy:
      fail-fast: false
      matrix:
        runner: [build-amd64, build-arm64]
    runs-on: ${{ matrix.runner }}
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v6

      - name: Install tools
        run: mise install --locked

      - name: Configure sccache remote cache
        if: vars.SCCACHE_MEMCACHED_ENDPOINT != ''
        run: echo "SCCACHE_MEMCACHED_ENDPOINT=${{ vars.SCCACHE_MEMCACHED_ENDPOINT }}" >> "$GITHUB_ENV"

      - name: Cache Rust target and registry
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          # Separate caches for clippy (check-like) vs test (full build)
          # so they don't thrash each other's artifacts
          shared-key: rust-checks-${{ matrix.runner }}
          # Cache the sccache directory too
          cache-directories: .cache/sccache

      - name: Format
        run: mise run rust:format:check

      - name: Lint
        run: mise run rust:lint

      - name: Test
        run: mise run test:rust

      - name: sccache stats
        if: always()
        run: mise x -- sccache --show-stats

  python:
    name: Python (${{ matrix.runner }})
    strategy:
      fail-fast: false
      matrix:
        runner: [build-amd64, build-arm64]
    runs-on: ${{ matrix.runner }}
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v6

      - name: Install tools
        run: mise install --locked

      - name: Install dependencies
        run: uv sync --frozen

      - name: Lint
        run: mise run python:lint

      - name: Test
        run: mise run test:python

  markdown:
    name: Markdown
    runs-on: build-amd64
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v6

      - name: Install tools
        run: mise install

      - name: Lint
        run: mise run markdown:lint