Merge branch 'master' into fix/csharp-escape-keywords-4529

Author: rekhoff

.github/workflows/check-merge-labels.yml

@@ -2,17 +2,21 @@ name: Check merge labels
 
 on:
   pull_request:
-    types: [labeled, unlabeled]
+    types: [opened, reopened, synchronize, labeled, unlabeled]
   merge_group:
+
 permissions: read-all
 
 jobs:
   label_checks:
+    name: Check merge labels
     runs-on: ubuntu-latest
     steps:
-      - id: manually_blocked
-        if: |
-          contains(github.event.pull_request.labels.*.name, 'do not merge')
+      - if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'do not merge')
         run: |
           echo "This is labeled \"Do not merge\"."
           exit 1
+
+      # If we're in a merge queue, the PR has already passed checks these checks before being added to the queue.
+      - if: github.event_name == 'merge_group'
+        run: echo "Merge group run; skipping merge-label checks."

.github/workflows/ci.yml

@@ -178,132 +178,6 @@ jobs:
               exit 1
           }
 
-  smoketests-python:
-    needs: [lints]
-    name: Smoketests (Python Legacy) (${{matrix.name}})
-    strategy:
-      matrix:
-        include:
-          - name: Linux
-            runner: spacetimedb-new-runner-2
-            smoketest_args: --docker
-          - name: Windows
-            runner: windows-latest
-            smoketest_args: --no-build-cli
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 120
-    env:
-      CARGO_TARGET_DIR: ${{ github.workspace }}/target
-    steps:
-      - name: Find Git ref
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        shell: bash
-        run: |
-          PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
-          if test -n "${PR_NUMBER}"; then
-            GIT_REF="$( gh pr view --repo clockworklabs/SpacetimeDB $PR_NUMBER --json headRefName --jq .headRefName )"
-          else
-            GIT_REF="${{ github.ref }}"
-          fi
-          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"
-      - name: Checkout sources
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ env.GIT_REF }}
-      - uses: dsherret/rust-toolchain-file@v1
-      - name: Set default rust toolchain
-        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: ${{ github.workspace }}
-          shared-key: spacetimedb
-          cache-on-failure: false
-          cache-all-crates: true
-          cache-workspace-crates: true
-          prefix-key: v1
-
-      # This step shouldn't be needed, but somehow we end up with caches that are missing librusty_v8.a.
-      # ChatGPT suspects that this could be due to different build invocations using the same target dir,
-      # and this makes sense to me because we only see it in this job where we mix `cargo build -p` with
-      # `cargo build --manifest-path` (which apparently build different dependency trees).
-      # However, we've been unable to fix it so... /shrug
-      - name: Check v8 outputs
-        shell: bash
-        run: |
-          find "${CARGO_TARGET_DIR}"/ -type f | grep '[/_]v8' || true
-          if ! [ -f "${CARGO_TARGET_DIR}"/debug/gn_out/obj/librusty_v8.a ]; then
-            echo "Could not find v8 output file librusty_v8.a; rebuilding manually."
-            cargo clean -p v8 || true
-            cargo build -p v8
-          fi
-
-      - uses: actions/setup-dotnet@v4
-        with:
-          global-json-file: global.json
-
-      - name: Override NuGet packages
-        shell: bash
-        run: |
-          dotnet pack -c Release crates/bindings-csharp/BSATN.Runtime
-          dotnet pack -c Release crates/bindings-csharp/Runtime
-          cd sdks/csharp
-          ./tools~/write-nuget-config.sh ../..
-
-      # nodejs and pnpm are required for the typescript quickstart smoketest
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - uses: pnpm/action-setup@v4
-        with:
-          run_install: true
-
-      - name: Install psql (Windows)
-        if: runner.os == 'Windows'
-        run: choco install psql -y --no-progress
-        shell: powershell
-
-      - name: Build crates
-        run: cargo build -p spacetimedb-cli -p spacetimedb-standalone -p spacetimedb-update
-
-      - name: Build and start database (Linux)
-        if: runner.os == 'Linux'
-        run: |
-          # Our .dockerignore omits `target`, which our CI Dockerfile needs.
-          rm .dockerignore
-          docker compose -f .github/docker-compose.yml up -d
-
-      - name: Build and start database (Windows)
-        if: runner.os == 'Windows'
-        run: |
-          # Fail properly if any individual command fails
-          $ErrorActionPreference = 'Stop'
-          $PSNativeCommandUseErrorActionPreference = $true
-
-          Start-Process target/debug/spacetimedb-cli.exe -ArgumentList 'start --pg-port 5432'
-          cd modules
-          # the sdk-manifests on windows-latest are messed up, so we need to update them
-          dotnet workload config --update-mode manifests
-          dotnet workload update
-
-      - uses: actions/setup-python@v5
-        with: { python-version: "3.12" }
-        if: runner.os == 'Windows'
-
-      - name: Install python deps
-        run: python -m pip install -r smoketests/requirements.txt
-
-      - name: Run Python smoketests
-        # Note: clear_database and replication only work in private
-        run: python -m smoketests ${{ matrix.smoketest_args }} -x clear_database replication teams
-
-      - name: Stop containers (Linux)
-        if: always() && runner.os == 'Linux'
-        run: docker compose -f .github/docker-compose.yml down
-
   test:
     needs: [lints]
     name: Test Suite

.github/workflows/package.yml

@@ -11,7 +11,6 @@ permissions:
 
 jobs:
   build-cli:
-    if: ${{ !(startsWith(github.ref, 'refs/tags/') && matrix.target == 'x86_64-pc-windows-msvc') }}
     strategy:
       fail-fast: false
       matrix:
@@ -51,81 +50,45 @@ jobs:
       - name: Install rust target
         run: rustup target add ${{ matrix.target }}
 
-      - name: Compile
-        run: |
-          cargo build --release --target ${{ matrix.target }} -p spacetimedb-cli -p spacetimedb-standalone -p spacetimedb-update
-
-      - name: Package (unix)
-        if: ${{ runner.os != 'Windows' }}
-        shell: bash
-        run: |
-          mkdir build
-          cd target/${{matrix.target}}/release
-          cp spacetimedb-update ../../../build/spacetimedb-update-${{matrix.target}}
-          tar -czf ../../../build/spacetime-${{matrix.target}}.tar.gz spacetimedb-{cli,standalone}
-
-      - name: Package (windows)
+      - name: Add signtool.exe to PATH
         if: ${{ runner.os == 'Windows' }}
-        shell: bash
+        shell: pwsh
         run: |
-          mkdir build
-          cd target/${{matrix.target}}/release
-          cp spacetimedb-update.exe ../../../build/spacetimedb-update-${{matrix.target}}.exe
-          7z a ../../../build/spacetime-${{matrix.target}}.zip spacetimedb-cli.exe spacetimedb-standalone.exe
-
-      - name: Extract branch name
-        shell: bash
-        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
-        id: extract_branch
-
-      - name: Upload to DO Spaces
-        uses: shallwefootball/s3-upload-action@master
-        with:
-          aws_key_id: ${{ secrets.AWS_KEY_ID }}
-          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY}}
-          aws_bucket: ${{ vars.AWS_BUCKET }}
-          source_dir: build
-          endpoint: https://nyc3.digitaloceanspaces.com
-          destination_dir: ${{ steps.extract_branch.outputs.branch }}
-
-  build-cli-windows-signed:
-    if: ${{ startsWith(github.ref, 'refs/tags/') }}
-    name: Build and sign CLI for x86_64 Windows
-    runs-on: [self-hosted, windows, signing]
-    environment: codesign
-    concurrency:
-      group: codesign-${{ github.ref }}
-      cancel-in-progress: false
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Install Rust
-        uses: dsherret/rust-toolchain-file@v1
+          $root = "${env:ProgramFiles(x86)}\Windows Kits\10\bin"
+          $signtool = Get-ChildItem $root -Recurse -Filter signtool.exe -ErrorAction SilentlyContinue |
+            Where-Object { $_.FullName -match '\\x64\\signtool\.exe$' } |
+            Sort-Object FullName -Descending |
+            Select-Object -First 1
 
-      - name: Install rust target
-        run: rustup target add x86_64-pc-windows-msvc
+          if (-not $signtool) { throw "signtool.exe not found under $root" }
 
-      - name: Compile
-        run: |
-          cargo build --release --target x86_64-pc-windows-msvc -p spacetimedb-cli -p spacetimedb-standalone -p spacetimedb-update
+          "Found: $($signtool.FullName)"
+          $dir = Split-Path $signtool.FullName
+          Add-Content -Path $env:GITHUB_PATH -Value $dir
 
-      - name: Write certificate file
+      - name: Write certificate file for signing
+        if: ${{ runner.os == 'Windows' }}
         shell: powershell
         env:
           DIGICERT_CERT_B64: ${{ secrets.DIGICERT_CERT_B64 }}
         run: |
-          [IO.File]::WriteAllBytes("digicert.crt", [Convert]::FromBase64String($env:DIGICERT_CERT_B64))
+          [IO.File]::WriteAllBytes("digicert.pfx", [Convert]::FromBase64String($env:DIGICERT_CERT_B64))
 
-      - name: Sign binaries
+      - name: Compile
+        run: |
+          cargo build --release --target ${{ matrix.target }} -p spacetimedb-cli -p spacetimedb-standalone -p spacetimedb-update
+
+      - name: Sign binaries for Windows
+        # Disabled for now since the current flow isn't working.
+        if: false
+        #if: ${{ runner.os == 'Windows' }}
         shell: powershell
         env:
           DIGICERT_KEYPAIR_ALIAS: ${{ secrets.DIGICERT_KEYPAIR_ALIAS }}
         run: |
           $ErrorActionPreference = 'Stop'
           $targetDir = Join-Path $env:GITHUB_WORKSPACE 'target\x86_64-pc-windows-msvc\release'
-          $certFile = Join-Path $env:GITHUB_WORKSPACE 'digicert.crt'
+          $certFile = Join-Path $env:GITHUB_WORKSPACE 'digicert.pfx'
 
           $signtool = Get-Command signtool.exe -ErrorAction Stop
 
@@ -136,32 +99,31 @@ jobs:
           )
 
           foreach ($file in $files) {
-            & $signtool.Path sign /csp "DigiCert Signing Manager KSP" /kc $env:DIGICERT_KEYPAIR_ALIAS /f $certFile /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 $file
+            & $signtool.Path sign /f $certFile /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 $file
             & $signtool.Path verify /v /pa $file
           }
 
-      - name: Package (windows)
-        shell: powershell
+      - name: Package (unix)
+        if: ${{ runner.os != 'Windows' }}
+        shell: bash
         run: |
-          $ErrorActionPreference = 'Stop'
-          New-Item -ItemType Directory -Force -Path build | Out-Null
-          $releaseDir = Join-Path $env:GITHUB_WORKSPACE 'target\x86_64-pc-windows-msvc\release'
+          mkdir build
+          cd target/${{matrix.target}}/release
+          cp spacetimedb-update ../../../build/spacetimedb-update-${{matrix.target}}
+          tar -czf ../../../build/spacetime-${{matrix.target}}.tar.gz spacetimedb-{cli,standalone}
 
-          Copy-Item (Join-Path $releaseDir 'spacetimedb-update.exe') (Join-Path $env:GITHUB_WORKSPACE 'build\spacetimedb-update-x86_64-pc-windows-msvc.exe')
-          Compress-Archive -Force -Path @(
-            (Join-Path $releaseDir 'spacetimedb-cli.exe'),
-            (Join-Path $releaseDir 'spacetimedb-standalone.exe')
-          ) -DestinationPath (Join-Path $env:GITHUB_WORKSPACE 'build\spacetime-x86_64-pc-windows-msvc.zip')
+      - name: Package (windows)
+        if: ${{ runner.os == 'Windows' }}
+        shell: bash
+        run: |
+          mkdir build
+          cd target/${{matrix.target}}/release
+          cp spacetimedb-update.exe ../../../build/spacetimedb-update-${{matrix.target}}.exe
+          7z a ../../../build/spacetime-${{matrix.target}}.zip spacetimedb-cli.exe spacetimedb-standalone.exe
 
       - name: Extract branch name
-        shell: powershell
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $branch = $env:GITHUB_HEAD_REF
-          if ([string]::IsNullOrEmpty($branch)) {
-            $branch = $env:GITHUB_REF -replace '^refs/heads/', ''
-          }
-          "branch=$branch" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
+        shell: bash
+        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
         id: extract_branch
 
       - name: Upload to DO Spaces