mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-18 23:09:36 +02:00
45afd2e9d7
The full-registry fuzz (AGENTS.md Rule 9) is #[ignore]d and no workflow ran it, so nothing enforced "must stay green". The new step reruns the Test step's nextest selection with --run-ignored only, filtered to the panic_hunt binary, so nothing rebuilds; the ci profile terminates it if it hangs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
437 lines
20 KiB
YAML
437 lines
20 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, ready_for_review]
|
|
workflow_dispatch:
|
|
inputs:
|
|
fuzz:
|
|
description: "Run the fuzz job"
|
|
type: boolean
|
|
default: false
|
|
fuzz_seconds:
|
|
description: "Seconds per fuzz target"
|
|
default: "600"
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
RUST_BACKTRACE: 1
|
|
# No test or fuzz run may print a page: the engine refuses to spool, and if something ever
|
|
# bypasses that, lp fails loudly on a printer that does not exist.
|
|
PHOTOCRAFT_NO_PRINT: "1"
|
|
LPDEST: photocraft-no-such-printer
|
|
# Debug and test builds keep line tables (file:line in panic backtraces) but drop the rest of the
|
|
# debug info: faster codegen and links, and a smaller target dir (the Linux test job ran out of
|
|
# disk with full debug info). The Windows test legs drop debuginfo entirely (see the test job).
|
|
CARGO_PROFILE_DEV_DEBUG: line-tables-only
|
|
|
|
# A newer push to a PR branch cancels its older run. Runs on main are never cancelled: a merge
|
|
# that lands while main's run is in progress waits for it, so every main state that gets a run is
|
|
# checked to the end. (Cancelling here left main unverified whenever merges came close together.)
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
# Which OSes the test job runs on. main, manual runs and PRs labelled `full-ci` get Linux and
|
|
# Windows. Other PRs get Linux, plus Windows when they touch code whose behaviour differs by
|
|
# platform: the app shell, UI, text and fonts, GPU, pen input, build scripts or the lockfile.
|
|
# macOS is tested only by release.yml.
|
|
platforms:
|
|
timeout-minutes: 10
|
|
name: select platforms
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
legs: ${{ steps.pick.outputs.legs }}
|
|
web: ${{ steps.pick.outputs.web }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- id: pick
|
|
env:
|
|
EVENT: ${{ github.event_name }}
|
|
BASE: ${{ github.event.pull_request.base.sha }}
|
|
FULL: ${{ contains(github.event.pull_request.labels.*.name, 'full-ci') }}
|
|
run: |
|
|
# No macOS on PRs or main: the org's 5 macOS slots are kept for release builds, and
|
|
# release.yml builds and tests macOS (a failing release is fixed and rebuilt).
|
|
# Windows tests run as two legs in parallel: the unit tests and the integration tests. As
|
|
# one job they took ~28 min on the Windows runner; the legs take ~13 and ~15. Splitting
|
|
# the integration tests over a third runner (nextest --partition) saved ~2 min of wall
|
|
# time but cost ~7 runner-minutes and one more Windows slot per PR.
|
|
linux='{"os":"ubuntu-latest","part":"all"}'
|
|
win() { printf '{"os":"windows-latest","part":"%s"}' "$1"; }
|
|
all="[$linux,$(win unit),$(win integration)]"
|
|
if [ "$EVENT" != pull_request ] || [ "$FULL" = true ]; then
|
|
echo "legs=$all" >> "$GITHUB_OUTPUT"
|
|
echo "web=true" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
# The browser build (a fat-LTO wasm build) runs only when something it compiles or
|
|
# packages changed: the web app and its packaging, crate sources and manifests (the web
|
|
# build compiles nearly every crate), the workspace manifests and this workflow.
|
|
if git diff --name-only "$BASE" HEAD | grep -Eq '^(apps/photocraft-web(-boot)?/|packaging/web/|packaging/env\.sh$|crates/[^/]+/(src/|Cargo\.toml$|build\.rs$)|Cargo\.(toml|lock)$|rust-toolchain(\.toml)?$|\.github/workflows/ci\.yml$)'; then
|
|
echo "web=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "web=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
if git diff --name-only "$BASE" HEAD | grep -Eq '^(apps/|crates/(ui-egui|text|gpu|tablet|heif)/|Cargo\.lock$|(.*/)?build\.rs$|\.github/workflows/ci\.yml$)'; then
|
|
echo "legs=$all" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "legs=[$linux]" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
test:
|
|
timeout-minutes: 100
|
|
name: test (${{ matrix.os }}${{ matrix.part != 'all' && format(', {0}', matrix.part) || '' }})
|
|
needs: platforms
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include: ${{ fromJSON(needs.platforms.outputs.legs) }}
|
|
env:
|
|
# No debuginfo on Windows: writing PDBs for ~200 test binaries cost 2.2 of ~21 build minutes.
|
|
# A panic still names its file and line; only backtrace frames lose theirs (Linux keeps
|
|
# line-tables-only, so a backtrace with lines is one OS away).
|
|
CARGO_PROFILE_DEV_DEBUG: ${{ startsWith(matrix.os, 'windows') && '0' || 'line-tables-only' }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Unused toolchains in the image (Android SDK, .NET, GHC, CodeQL) are deleted in the
|
|
# background: the space is free before the craft-fonts build needs it, and nothing waits.
|
|
- name: Install Linux system dependencies (egui/winit/rfd)
|
|
if: runner.os == 'Linux'
|
|
run: |
|
|
nohup sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup \
|
|
/opt/hostedtoolcache/CodeQL </dev/null >/dev/null 2>&1 &
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends \
|
|
libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
|
|
libgl1-mesa-dev libgtk-3-dev
|
|
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: clippy, rustfmt
|
|
|
|
# Only main saves caches; PRs restore main's. Every PR used to save its own set (up to
|
|
# 3.8 GB), usable by that PR only, so the repo's 10 GB cache budget kept evicting main's.
|
|
# A failing test still saves: the cache holds compiled dependencies, not test results.
|
|
# The Windows legs share one key (same dependencies); the integration leg saves it,
|
|
# because it also runs Clippy and so leaves Clippy's dependency metadata in it.
|
|
- uses: Swatinem/rust-cache@v2
|
|
with:
|
|
save-if: ${{ github.ref == 'refs/heads/main' && (matrix.part == 'all' || matrix.part == 'integration') }}
|
|
cache-on-failure: true
|
|
|
|
# sccache caches the workspace crates' compiled libraries, which rust-cache leaves out:
|
|
# warm, each Windows leg built 4.5 min faster. Like rust-cache, only main writes (PRs read
|
|
# main's entries); a full set is ~90 MB, so it barely touches the 10 GB budget (#2688).
|
|
# Test executables can't be cached, so a PR still links its tests.
|
|
- name: Install sccache (Windows)
|
|
if: runner.os == 'Windows'
|
|
uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
|
|
with:
|
|
version: v0.18.0
|
|
|
|
- name: Use sccache (Windows)
|
|
if: runner.os == 'Windows'
|
|
env:
|
|
MAIN: ${{ github.ref == 'refs/heads/main' }}
|
|
run: |
|
|
echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
|
|
echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
|
|
if [ "$MAIN" != true ]; then echo "SCCACHE_GHA_RW_MODE=READ_ONLY" >> "$GITHUB_ENV"; fi
|
|
shell: bash
|
|
|
|
- name: Format
|
|
if: runner.os == 'Linux'
|
|
run: cargo fmt --all -- --check
|
|
|
|
# Keep formatting, strict Clippy, layering and scorecard checks ahead of tests.
|
|
- name: Clippy
|
|
if: matrix.part == 'all' || matrix.part == 'integration'
|
|
run: cargo clippy --workspace --all-targets --locked --features heif -- -D warnings
|
|
|
|
- name: Dependency layering
|
|
if: matrix.part == 'all' || matrix.part == 'integration'
|
|
run: cargo xtask layers
|
|
|
|
# docs/scorecard.md must match its sources (checklists, budgets, baseline, corpus floors,
|
|
# prefs audit). Static: it reads committed files only, no benchmarks run here.
|
|
- name: Scorecard up to date
|
|
if: runner.os == 'Linux'
|
|
run: cargo xtask scorecard --check
|
|
|
|
# nextest runs the test binaries in parallel (cargo test runs them one at a time), with the
|
|
# GPU tests capped by the `gpu` group in .config/nextest.toml (#2204).
|
|
- uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
|
|
with:
|
|
tool: cargo-nextest@0.9.146
|
|
|
|
# `--features heif`: official builds open HEIC photos via the optional photocraft-heif crate.
|
|
# `--lib --bins --tests` leaves out the examples, which cargo test would build and link but
|
|
# never run (Clippy's `--all-targets` still checks they compile). nextest skips doctests, so
|
|
# they get their own step.
|
|
#
|
|
# On Windows the unit leg runs `--lib --bins` and the integration leg `--test '*'` (every
|
|
# integration-test target); the feature selection stays the same, so both legs share the
|
|
# dependency cache. The `ci` profile fails fast and terminates hung tests
|
|
# (.config/nextest.toml); assertion failures are not retried.
|
|
- name: Test
|
|
env:
|
|
PART: ${{ matrix.part }}
|
|
run: |
|
|
case "$PART" in
|
|
unit) targets=(--lib --bins) ;;
|
|
integration) targets=(--test '*') ;;
|
|
*) targets=(--lib --bins --tests) ;;
|
|
esac
|
|
cargo nextest run --profile ci --workspace --locked --features heif "${targets[@]}"
|
|
shell: bash
|
|
|
|
# Every command against adversarial params must return Err, never panic or hang (AGENTS.md
|
|
# Rule 9). It is `#[ignore]`d (slow), so Test skips it. Same packages, features and targets as
|
|
# Test, so nothing rebuilds: `--test panic_hunt` would drop the other crates' dev-dependency
|
|
# features and recompile the whole graph. The `ci` profile terminates it if it hangs.
|
|
- name: Panic hunt
|
|
if: runner.os == 'Linux'
|
|
run: >-
|
|
cargo nextest run --profile ci --workspace --locked --features heif --lib --bins --tests
|
|
--run-ignored only -E 'binary_id(photocraft-engine::panic_hunt)'
|
|
|
|
- name: Doctests
|
|
if: matrix.part == 'all' || matrix.part == 'unit'
|
|
run: cargo test --workspace --locked --features heif --doc
|
|
|
|
# The Windows tests used to be one job named `test (windows-latest)`; they're now legs named
|
|
# `test (windows-latest, unit)` and `test (windows-latest, integration)`. This job keeps the old
|
|
# name reporting, so a required status check on it (none today) would keep working. It fails
|
|
# unless the whole test matrix and both Linux variants passed. `needs` reports one result
|
|
# for all matrix legs; when a PR runs no Windows legs it still checks every Linux result.
|
|
windows-gate:
|
|
timeout-minutes: 5
|
|
name: test (windows-latest)
|
|
needs: [platforms, test, test-variants]
|
|
if: ${{ !cancelled() }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- env:
|
|
PLATFORMS: ${{ needs.platforms.result }}
|
|
TEST: ${{ needs.test.result }}
|
|
VARIANTS: ${{ needs.test-variants.result }}
|
|
run: |
|
|
echo "platforms: $PLATFORMS, test: $TEST, variants: $VARIANTS"
|
|
[ "$PLATFORMS" = success ] && [ "$TEST" = success ] && [ "$VARIANTS" = success ]
|
|
|
|
# The two other builds of the Linux tests, in parallel with the test job instead of after it (they
|
|
# added ~10 min to its critical path). Each restores the test job's cache (`shared-key: test` is
|
|
# that job's key) and saves none: the dependencies are the same, and the 10 GB cache budget is
|
|
# tight (#2688).
|
|
test-variants:
|
|
timeout-minutes: 100
|
|
name: test (${{ matrix.variant }})
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
variant: [without heif, with craft-fonts]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install Linux system dependencies (egui/winit/rfd)
|
|
run: |
|
|
nohup sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup \
|
|
/opt/hostedtoolcache/CodeQL </dev/null >/dev/null 2>&1 &
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends \
|
|
libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
|
|
libgl1-mesa-dev libgtk-3-dev
|
|
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
|
|
- uses: Swatinem/rust-cache@v2
|
|
with:
|
|
shared-key: test
|
|
save-if: false
|
|
|
|
- uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
|
|
with:
|
|
tool: cargo-nextest@0.9.146
|
|
|
|
# The same codecs without the optional decoder: HEIC must stay a clear "not in this build"
|
|
# error for distributors who leave it out.
|
|
- name: Test without heif
|
|
if: matrix.variant == 'without heif'
|
|
run: cargo nextest run -p photocraft-heif -p photocraft-codecs -p photocraft-io --locked --profile ci
|
|
|
|
# The tests built with the optional craft-fonts input (crates/text/build.rs), so the Japanese
|
|
# font tests that skip without it run. Keep the test job's exact `--workspace --features heif
|
|
# --lib --bins --tests`, so the restored dependencies match and only the workspace rebuilds.
|
|
# Filter execution to the three crates that read the optional font input (#6127).
|
|
- name: Check out craft-fonts
|
|
if: matrix.variant == 'with craft-fonts'
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
repository: storytold/craft-fonts
|
|
ref: abb83316d96aa59c1cf64784289e378fe9fa5695
|
|
path: craft-fonts
|
|
|
|
- name: Test with craft-fonts
|
|
if: matrix.variant == 'with craft-fonts'
|
|
env:
|
|
CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
|
|
CRAFT_FONTS_REQUIRED: "1"
|
|
run: >-
|
|
cargo nextest run --profile ci --workspace --locked --features heif --lib --bins --tests
|
|
-E 'package(photocraft-text) | package(photocraft-io) | package(photocraft-ui-egui)'
|
|
|
|
corpus:
|
|
timeout-minutes: 30
|
|
# Real-file corpus tests (cargo feature `corpus`), on every PR and on main. The corpora are
|
|
# pinned in xtask/src/corpus_pins.rs and sha256-verified (xtask/*.sha256) after both a cache
|
|
# restore and a download; a missing corpus fails the tests. The cache key changes only when a
|
|
# pin or manifest does, so normally this restores in seconds (fork PRs read the base cache).
|
|
name: corpus tests
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
# test-corpus builds with --release, but here without the release profile's thin LTO and
|
|
# single codegen unit: they ran LTO over the dependency graph for each of the ~95 corpus test
|
|
# binaries, so building took 23.5 of the job's 37 minutes while the tests ran for 1.5.
|
|
# Turning them off builds 2.7x faster; the code under test is the same.
|
|
CARGO_PROFILE_RELEASE_LTO: "false"
|
|
CARGO_PROFILE_RELEASE_CODEGEN_UNITS: "16"
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
with:
|
|
key: corpus
|
|
save-if: ${{ github.ref == 'refs/heads/main' }}
|
|
cache-on-failure: true
|
|
- name: Restore test corpora
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: corpus/
|
|
key: corpus-${{ hashFiles('xtask/src/corpus_pins.rs', 'xtask/*.sha256') }}
|
|
- name: Fetch and verify corpora
|
|
run: cargo xtask corpus --all
|
|
- name: Corpus tests
|
|
run: cargo xtask test-corpus
|
|
|
|
wasm:
|
|
timeout-minutes: 30
|
|
name: wasm32 check
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: wasm32-unknown-unknown
|
|
- uses: Swatinem/rust-cache@v2
|
|
with:
|
|
key: wasm32
|
|
save-if: ${{ github.ref == 'refs/heads/main' }}
|
|
cache-on-failure: true
|
|
- name: Check wasm-safe crates
|
|
run: cargo xtask wasm
|
|
|
|
web:
|
|
timeout-minutes: 60
|
|
name: web build and wasm size gate
|
|
# PRs run it only when web-relevant files change (see `platforms`); main always does.
|
|
needs: platforms
|
|
if: needs.platforms.outputs.web == 'true'
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
# Match release.yml so PR results reflect what would actually ship.
|
|
TRUNK_VERSION: 0.21.14
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: wasm32-unknown-unknown
|
|
- uses: Swatinem/rust-cache@v2
|
|
with:
|
|
key: ci-web
|
|
save-if: ${{ github.ref == 'refs/heads/main' }}
|
|
cache-on-failure: true
|
|
- name: Install trunk
|
|
run: |
|
|
curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
|
|
| tar -xz -C "$HOME/.cargo/bin" trunk
|
|
trunk --version
|
|
# package.sh runs Trunk's release builds, validates relative URLs, cuts the wasm into
|
|
# parts, checks the 24 MiB per-file limit and exercises the packaging step release.yml uses.
|
|
- name: Build and verify browser release
|
|
run: packaging/web/package.sh
|
|
- name: Report wasm size
|
|
if: success()
|
|
run: |
|
|
{
|
|
echo "### Browser WebAssembly size"
|
|
echo
|
|
echo "| File | Bytes | MiB | Limit |"
|
|
echo "| --- | ---: | ---: | ---: |"
|
|
row() { echo "| $1 | $2 | $(awk -v n="$2" 'BEGIN { printf "%.2f", n / 1048576 }') | $3 |"; }
|
|
# The app's wasm as built; it ships gzipped in parts, so only the download grows with it.
|
|
for wasm in dist/web/*.wasm; do
|
|
[ -f "$wasm" ] || continue
|
|
row "$(basename "$wasm")" "$(wc -c < "$wasm" | tr -d ' ')" "none"
|
|
done
|
|
# What a host sees: the largest file of the packaged site.
|
|
largest=$(find target/web-package -type f -printf '%s %f\n' | sort -n | tail -1)
|
|
row "largest file in the site: ${largest#* }" "${largest%% *}" "24 MiB"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
fuzz:
|
|
timeout-minutes: 60
|
|
name: fuzz (${{ matrix.target.crate }}/${{ matrix.target.name }})
|
|
# Placeholder: manual trigger only until a nightly schedule is enabled.
|
|
if: github.event_name == 'workflow_dispatch' && inputs.fuzz
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
target:
|
|
- { crate: psd, name: parse }
|
|
- { crate: psd, name: descriptor }
|
|
- { crate: psd, name: image_source_data }
|
|
- { crate: psd, name: grd }
|
|
- { crate: psd, name: ase }
|
|
- { crate: psd, name: aco }
|
|
- { crate: psd, name: patterns }
|
|
- { crate: psd, name: filter_effects }
|
|
- { crate: psd, name: metadata }
|
|
- { crate: psd, name: tagged }
|
|
- { crate: psd, name: resources }
|
|
- { crate: codecs, name: decode_any }
|
|
- { crate: codecs, name: decode_png }
|
|
- { crate: codecs, name: decode_jpeg }
|
|
- { crate: codecs, name: decode_tiff }
|
|
- { crate: codecs, name: decode_exr }
|
|
- { crate: codecs, name: decode_heif }
|
|
- { crate: affinity, name: preview }
|
|
- { crate: affinity, name: import_preview, args: "--features io" }
|
|
- { crate: format, name: load }
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@nightly
|
|
- uses: Swatinem/rust-cache@v2
|
|
with:
|
|
workspaces: crates/${{ matrix.target.crate }}/fuzz
|
|
- name: Install cargo-fuzz
|
|
run: cargo install cargo-fuzz --locked
|
|
- name: Fuzz
|
|
working-directory: crates/${{ matrix.target.crate }}
|
|
run: cargo fuzz run ${{ matrix.target.name }} ${{ matrix.target.args }} -- -max_total_time=${{ inputs.fuzz_seconds }}
|
|
- name: Upload crash artifacts
|
|
if: failure()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: fuzz-${{ matrix.target.crate }}-${{ matrix.target.name }}
|
|
path: crates/${{ matrix.target.crate }}/fuzz/artifacts
|