chore(release): Harden agent npm and desktop release pipelines #9745
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Run unit and integration tests | |
| on: | |
| pull_request: | |
| concurrency: | |
| group: test-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| changes: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: read | |
| outputs: | |
| code: ${{ steps.filter.outputs.code }} | |
| workflow: ${{ steps.filter.outputs.workflow }} | |
| steps: | |
| - name: Detect relevant changes | |
| id: filter | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| with: | |
| predicate-quantifier: every | |
| filters: | | |
| # Wider excludes than code-quality.yml, which keeps .github/scripts | |
| # and .vscode/.claude in scope because Biome lints them. | |
| code: | |
| - "!**/*.md" | |
| - "!docs/**" | |
| - "!.github/**" | |
| - "!.vscode/**" | |
| - "!.claude/**" | |
| - "!.husky/**" | |
| - "!LICENSE" | |
| - "!.gitignore" | |
| - "!.env.example" | |
| workflow: | |
| - ".github/workflows/test.yml" | |
| unit-test: | |
| needs: changes | |
| # Fail closed: if change detection itself failed, run instead of skipping. | |
| if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.code == 'true' || needs.changes.outputs.workflow == 'true') }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: "pnpm" | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Rebuild native modules for Node | |
| run: node scripts/rebuild-better-sqlite3-node.mjs | |
| - name: Build dependencies | |
| run: pnpm --filter @posthog/electron-trpc build | |
| - name: Run tests | |
| run: pnpm test | |
| - name: Upload test results to Trunk | |
| # Run even when tests fail so flaky/failed results are still reported, | |
| # but never let an upload problem fail the job. | |
| if: ${{ !cancelled() }} | |
| continue-on-error: true | |
| uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2 | |
| with: | |
| # Scope to each package root. A bare **/junit.xml glob descends into | |
| # node_modules, where pnpm symlinks workspace packages, and uploads | |
| # every report many times over. | |
| junit-paths: "apps/*/junit.xml,packages/*/junit.xml" | |
| org-slug: posthog-inc | |
| token: ${{ secrets.TRUNK_API_TOKEN }} | |
| integration-test: | |
| needs: changes | |
| # Fail closed: if change detection itself failed, run instead of skipping. | |
| if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.code == 'true' || needs.changes.outputs.workflow == 'true') }} | |
| runs-on: macos-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: "pnpm" | |
| - name: Cache Playwright browsers | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| id: playwright-cache | |
| with: | |
| path: ~/Library/Caches/ms-playwright | |
| key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }} | |
| restore-keys: | | |
| playwright-${{ runner.os }}- | |
| - name: Cache Electron binary | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/Library/Caches/electron | |
| key: electron-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }} | |
| restore-keys: | | |
| electron-${{ runner.os }}- | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Rebuild better-sqlite3 for Electron | |
| run: node scripts/rebuild-better-sqlite3-electron.mjs | |
| - name: Build packages | |
| run: | | |
| pnpm --filter @posthog/electron-trpc build & | |
| pnpm --filter @posthog/platform build & | |
| pnpm --filter @posthog/shared build | |
| pnpm --filter @posthog/git build | |
| pnpm --filter @posthog/enricher build | |
| pnpm --filter agent build & | |
| wait | |
| - name: Package Electron app | |
| run: pnpm --filter code run package | |
| env: | |
| NODE_OPTIONS: "--max-old-space-size=6144" | |
| - name: Install Playwright | |
| if: steps.playwright-cache.outputs.cache-hit != 'true' | |
| run: pnpm --filter code exec playwright install --with-deps chromium | |
| - name: Run E2E smoke tests | |
| run: pnpm --filter code run test:e2e | |
| env: | |
| CI: true | |
| - name: Upload test results to Trunk | |
| # Run even when E2E tests fail so flaky/failed results are still | |
| # reported, but never let an upload problem fail the job. | |
| if: ${{ !cancelled() }} | |
| continue-on-error: true | |
| uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2 | |
| with: | |
| junit-paths: "apps/code/tests/e2e/junit.xml" | |
| org-slug: posthog-inc | |
| token: ${{ secrets.TRUNK_API_TOKEN }} | |
| - name: Upload Playwright report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: failure() | |
| with: | |
| name: playwright-report | |
| path: apps/code/playwright-report/ | |
| retention-days: 7 |