astrea/.github/workflows/ci.yml at main · ghzhost/astrea · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  build-lint-test:
    name: Lint, typecheck, test, build (web)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: apps/web/package-lock.json

      - working-directory: apps/web
        run: npm ci --legacy-peer-deps

      - name: Lint (Biome)
        working-directory: apps/web
        run: npm run lint

      - name: Typecheck
        working-directory: apps/web
        run: npm run typecheck

      - name: Test (Vitest)
        working-directory: apps/web
        run: npm run test

      - name: Build
        working-directory: apps/web
        run: npm run build

  graphify-drift-check:
    name: Knowledge graph in sync (code)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: apps/web/package-lock.json

      # postinstall runs `prisma generate`, producing apps/web/src/generated/prisma.
      # graphify indexes that output, so it must exist before the rebuild below -
      # without it this job would flag drift that's just the generated client missing.
      - working-directory: apps/web
        run: npm ci --legacy-peer-deps

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      # Pinned - an unpinned install drifts to whatever's latest on PyPI, and a
      # version bump (different manifest-parsing behavior, etc.) can silently
      # desync CI's rebuild from what contributors run locally. Bump deliberately
      # and re-run `graphify update .` locally with the new version when needed.
      - name: Install graphify
        run: pip install graphifyy==0.9.45

      # Code-only rebuild - no LLM, no API key. Doc/paper/image changes aren't
      # covered here; see CONTRIBUTING.md ("Keeping the knowledge graph updated").
      #
      # Both env vars are required for a reproducible rebuild - confirmed by
      # testing locally: PYTHONHASHSEED alone still produced a different graph
      # on every run (parallel AST workers finish in a random order, which
      # feeds Louvain clustering non-deterministically); pinning workers to 1
      # made back-to-back reruns byte-identical. Without both, this job would
      # flag unrelated PRs as "stale" at random.
      - name: Rebuild code graph
        env:
          PYTHONHASHSEED: "0"
          GRAPHIFY_MAX_WORKERS: "1"
        run: graphify update .

      # Scoped to the actual graph output + the content-hash-keyed AST cache.
      # graphify-out/manifest.json and cache/stat-index.json store wall-clock
      # mtimes for the local incremental-update cache - those never match
      # between any two checkouts (confirmed: they were the only diff left
      # after fixing the real content drift), so comparing them here would
      # fail every run regardless of whether the graph itself is stale.
      - name: Fail if graphify-out/ is stale
        run: |
          if ! git diff --quiet -- graphify-out/graph.json graphify-out/graph.html graphify-out/GRAPH_REPORT.md graphify-out/cache/ast/; then
            echo "::error::graphify-out/ is out of sync with the code in this PR."
            echo "Run 'graphify update .' locally, review the diff, and commit graphify-out/."
            echo "Or download the 'graphify-out-rebuilt' artifact from this run and commit that instead."
            git diff --stat -- graphify-out/graph.json graphify-out/graph.html graphify-out/GRAPH_REPORT.md graphify-out/cache/ast/
            exit 1
          fi

      - name: Upload rebuilt graph (only runs if the check above failed)
        if: failure()
        uses: actions/upload-artifact@v5
        with:
          name: graphify-out-rebuilt
          path: graphify-out/
          retention-days: 7

  commitlint:
    name: Commit messages (Conventional Commits)
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: apps/web/package-lock.json

      - working-directory: apps/web
        run: npm ci --legacy-peer-deps

      - uses: wagoid/commitlint-github-action@v6