[Docs] Explain review capacity for parallel tasks #4756
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| NODE_VERSION: 24.13.1 | |
| PNPM_VERSION: 10.29.3 | |
| jobs: | |
| changes: | |
| name: Detect worker image changes | |
| if: ${{ github.event_name != 'push' }} | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| outputs: | |
| worker_image_affected: ${{ steps.changed-paths.outputs.worker_image_affected }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Classify changed paths | |
| id: changed-paths | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| # Fail safe: when we cannot compute a reliable diff (manual dispatch, | |
| # force-push over a gone base, or an empty diff), build everything. | |
| emit_build_all() { | |
| echo "worker_image_affected=true" >> "$GITHUB_OUTPUT" | |
| } | |
| if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then | |
| emit_build_all | |
| exit 0 | |
| fi | |
| if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then | |
| base="${{ github.event.pull_request.base.sha }}" | |
| head="${{ github.event.pull_request.head.sha }}" | |
| changed_files="$(git diff --name-only "$base...$head")" | |
| else | |
| before="${{ github.event.before }}" | |
| if [ "$before" = "0000000000000000000000000000000000000000" ]; then | |
| changed_files="$(git diff-tree --no-commit-id --name-only -r "$GITHUB_SHA")" | |
| elif git cat-file -e "$before" 2>/dev/null; then | |
| changed_files="$(git diff --name-only "$before" "$GITHUB_SHA")" | |
| else | |
| # Force-pushed over the previous tip; the base is gone, so run everything. | |
| emit_build_all | |
| exit 0 | |
| fi | |
| fi | |
| if [ -z "$changed_files" ]; then | |
| emit_build_all | |
| exit 0 | |
| fi | |
| # worker_image_affected: the worker image (apps/worker/Dockerfile) | |
| # builds FROM ubuntu and copies only its installer plus the feature | |
| # demo render manifest from outside apps/worker. The app image, by | |
| # contrast, copies apps/worker (and packages the worker release), so a | |
| # worker-only change still rebuilds the app image. | |
| # | |
| # This is a closed allowlist: worker_image_affected starts false and | |
| # only the paths matched below flip it true, so an unrecognized path | |
| # does NOT trigger a worker build. If the worker image ever consumes a | |
| # new build-context input, add its path to the case below or the | |
| # worker build will be skipped for changes to it. The build-everything | |
| # fail-safe only covers the uncertain-diff cases handled by | |
| # emit_build_all above (manual dispatch, gone base, empty diff). | |
| worker_image_affected=false | |
| while IFS= read -r path; do | |
| case "$path" in | |
| apps/worker/*|.docker/sandbox/*|packages/cloud-agents/src/server/workflows/skills/standard/feature-demo/render/package.json|.dockerignore|.github/workflows/CI.yml) | |
| worker_image_affected=true | |
| ;; | |
| esac | |
| done <<< "$changed_files" | |
| echo "worker_image_affected=$worker_image_affected" >> "$GITHUB_OUTPUT" | |
| lint: | |
| name: Lint | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-environment | |
| with: | |
| enable-turbo-cache: 'true' | |
| frozen-lockfile: 'true' | |
| node-version: ${{ env.NODE_VERSION }} | |
| pnpm-version: ${{ env.PNPM_VERSION }} | |
| turbo-cache-scope: lint | |
| - name: Run lint workflow | |
| run: pnpm lint | |
| knip: | |
| name: Knip | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-environment | |
| with: | |
| frozen-lockfile: 'true' | |
| node-version: ${{ env.NODE_VERSION }} | |
| pnpm-version: ${{ env.PNPM_VERSION }} | |
| - name: Check unused dependencies and files | |
| run: pnpm knip | |
| check-types: | |
| name: Type Check | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-environment | |
| with: | |
| enable-turbo-cache: 'true' | |
| frozen-lockfile: 'true' | |
| node-version: ${{ env.NODE_VERSION }} | |
| pnpm-version: ${{ env.PNPM_VERSION }} | |
| turbo-cache-scope: check-types | |
| - name: Run type checker | |
| run: pnpm check-types | |
| test: | |
| name: Test | |
| # The web package runs its server and client suites concurrently; give | |
| # both pools enough CPU instead of making this the workflow's critical path. | |
| runs-on: blacksmith-8vcpu-ubuntu-2404 | |
| services: | |
| postgres: | |
| image: postgres:17.5@sha256:aadf2c0696f5ef357aa7a68da995137f0cf17bad0bf6e1f17de06ae5c769b302 | |
| env: | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: password | |
| POSTGRES_DB: test | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U postgres -d test" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| redis: | |
| image: redis:7@sha256:b2b95679e3b46fb51864949ed25ea976fc3a6bcc00a40a1bc00d568cb2822e50 | |
| ports: | |
| - 6379:6379 | |
| options: >- | |
| --health-cmd "redis-cli ping" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-environment | |
| with: | |
| enable-turbo-cache: 'true' | |
| frozen-lockfile: 'true' | |
| node-version: ${{ env.NODE_VERSION }} | |
| pnpm-version: ${{ env.PNPM_VERSION }} | |
| turbo-cache-scope: test | |
| - name: Setup database schema | |
| run: pnpm --filter @roomote/db db:push:test --force | |
| env: | |
| DATABASE_URL: postgres://postgres:password@localhost:5432/test | |
| - name: Run unit tests | |
| run: pnpm test:ci | |
| env: | |
| DATABASE_URL: postgres://postgres:password@localhost:5432/test | |
| REDIS_URL: redis://localhost:6379 | |
| - name: Run release script unit tests | |
| run: pnpm test:release-scripts | |
| backup-restore: | |
| name: Fresh-host Backup Restore | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Verify a failed image pull preserves deployment metadata | |
| run: bash deploy/host/tests/upgrade-failed-pull.sh | |
| - name: Restore an encrypted bundle onto empty volumes | |
| run: bash deploy/host/tests/backup-restore.integration.sh | |
| upgrade-compatibility: | |
| name: Upgrade Compatibility | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-environment | |
| with: | |
| frozen-lockfile: 'true' | |
| node-version: ${{ env.NODE_VERSION }} | |
| pnpm-version: ${{ env.PNPM_VERSION }} | |
| # Boots the previous published release from GHCR, applies this branch's | |
| # migrations to it, and requires the previous release to stay healthy on | |
| # the candidate schema (the expand/contract policy in deploy/README.md). | |
| # | |
| # develop-based runs validate against the continuously published | |
| # `develop` channel. main-based runs (promote PRs) validate against the | |
| # previous published *release* rather than the raw `main` channel alias: | |
| # before the first release ships there is no usable baseline at all, and | |
| # the gate skips instead of booting a known-incompatible image. | |
| - name: Resolve upgrade baseline | |
| id: baseline | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BASE_CHANNEL: ${{ github.base_ref || github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| baseline="$BASE_CHANNEL" | |
| if [ "$baseline" = 'main' ]; then | |
| # gh prints the 404 error body to stdout; only trust the output | |
| # when the call succeeds. | |
| if ! baseline="$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq .tag_name 2>/dev/null)"; then | |
| baseline='' | |
| fi | |
| # v0.0.1 predates the release pipeline and has no images. | |
| if [ "$baseline" = 'v0.0.1' ]; then | |
| baseline='' | |
| fi | |
| case "$baseline" in | |
| '' | v[0-9]*) ;; | |
| *) | |
| echo "Ignoring unexpected baseline '$baseline'; skipping upgrade validation." >&2 | |
| baseline='' | |
| ;; | |
| esac | |
| fi | |
| echo "channel=$baseline" >> "$GITHUB_OUTPUT" | |
| - name: Apply candidate migrations to the previous release | |
| env: | |
| BASELINE_CHANNEL: ${{ steps.baseline.outputs.channel }} | |
| run: bash deploy/ci/upgrade-compatibility.sh | |
| docker-build-app: | |
| name: Docker Build (${{ matrix.app }}, ${{ matrix.arch }}) | |
| # Branch pushes already trigger Publish GHCR Images, which builds both | |
| # architectures from the same commit. Keep one representative pre-merge | |
| # build here instead of duplicating the full publish matrix after merge. | |
| if: ${{ github.event_name != 'push' }} | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - app: app | |
| dockerfile: .docker/app/Dockerfile | |
| target: runtime-app | |
| arch: amd64 | |
| runner: blacksmith-4vcpu-ubuntu-2404 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Validate production Compose security contract | |
| if: matrix.arch == 'amd64' | |
| run: deploy/scripts/validate-compose-security.sh | |
| - name: Set up Docker builder | |
| uses: useblacksmith/setup-docker-builder@47a5d0102cc44712a17a633c2599f755008cc40e # v1 | |
| - name: Build ${{ matrix.app }} Dockerfile (${{ matrix.arch }}) | |
| uses: useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2 | |
| with: | |
| context: . | |
| file: ${{ matrix.dockerfile }} | |
| target: ${{ matrix.target }} | |
| platforms: linux/${{ matrix.arch }} | |
| push: false | |
| build-args: R_APP_ENV=development | |
| # The worker image builds FROM ubuntu and copies no monorepo source, so it is | |
| # skipped unless its own Dockerfile or build context changed (see the | |
| # worker_image_affected classifier). The app image copies apps/worker and | |
| # packages the worker release, so worker-only changes still rebuild the app | |
| # image above. Publish GHCR Images remains the full multi-architecture | |
| # validation for every branch push. | |
| docker-build-worker: | |
| name: Docker Build (${{ matrix.app }}, ${{ matrix.arch }}) | |
| needs: changes | |
| if: ${{ needs.changes.outputs.worker_image_affected == 'true' && github.event_name != 'push' }} | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - app: worker | |
| dockerfile: apps/worker/Dockerfile | |
| target: runtime | |
| arch: amd64 | |
| runner: blacksmith-4vcpu-ubuntu-2404 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Set up Docker builder | |
| uses: useblacksmith/setup-docker-builder@47a5d0102cc44712a17a633c2599f755008cc40e # v1 | |
| - name: Build ${{ matrix.app }} Dockerfile (${{ matrix.arch }}) | |
| uses: useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2 | |
| with: | |
| context: . | |
| file: ${{ matrix.dockerfile }} | |
| target: ${{ matrix.target }} | |
| platforms: linux/${{ matrix.arch }} | |
| push: false | |
| build-args: R_APP_ENV=development | |
| deployment-config: | |
| name: Deployment artifacts | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-environment | |
| with: | |
| frozen-lockfile: 'true' | |
| node-version: ${{ env.NODE_VERSION }} | |
| pnpm-version: ${{ env.PNPM_VERSION }} | |
| - name: Validate Compose, installers, and platform templates | |
| run: pnpm deployment:validate |