ci: add docker context guardrails for pre-commit and CI #384
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| jobs: | |
| # Formatting check - only needs to run once since cargo fmt is purely textual | |
| # (no compilation, so no platform-specific code paths like #[cfg(target_os)]) | |
| format: | |
| name: Format Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: "1.89" | |
| components: rustfmt | |
| - name: Check formatting | |
| run: cargo fmt --all -- --check | |
| marketplace-validate: | |
| name: Marketplace Packer Validate | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Assert Marketplace scripts | |
| run: | | |
| test -f infra/digitalocean/marketplace/90-cleanup.sh | |
| test -f infra/digitalocean/marketplace/99-img-check.sh | |
| - name: Setup Packer | |
| uses: hashicorp/setup-packer@v3 | |
| with: | |
| version: "1.10.0" | |
| - name: Packer init | |
| run: packer init infra/digitalocean/packer/opencode-marketplace.pkr.hcl | |
| - name: Packer fmt | |
| run: packer fmt -check infra/digitalocean/packer/opencode-marketplace.pkr.hcl | |
| - name: Packer validate | |
| run: packer validate -var-file=infra/digitalocean/packer/variables.pkr.hcl infra/digitalocean/packer/opencode-marketplace.pkr.hcl | |
| docker-context-guard: | |
| name: Docker Context Guard | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Ensure opencode placeholder path exists for Docker context | |
| run: mkdir -p packages/opencode | |
| - name: Build Docker target stage | |
| run: | | |
| DOCKER_BUILDKIT=1 docker build \ | |
| --file packages/core/src/docker/Dockerfile \ | |
| --target opencode-build \ | |
| --tag opencode-cloud-sandbox:ci-check \ | |
| . | |
| # Build, lint, and test on multiple platforms | |
| # Clippy/build/test must run on each platform because #[cfg(target_os)] causes | |
| # different code to compile (e.g., systemd.rs on Linux, launchd.rs on macOS) | |
| build: | |
| name: Build (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Verify opencode submodule pin is published | |
| run: ./scripts/check-opencode-submodule-published.sh | |
| - name: Install Linux system dependencies | |
| if: matrix.os == 'ubuntu-latest' | |
| run: | | |
| # Required by opencode-broker (libpam-sys links against -lpam). | |
| sudo apt-get update | |
| sudo apt-get install -y libpam0g-dev | |
| - name: Initialize opencode submodule | |
| run: | | |
| git submodule sync --recursive | |
| git -c url."https://github.com/".insteadOf=git@github.com: submodule update --init --recursive packages/opencode | |
| git submodule status --recursive | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: "1.89" | |
| components: clippy | |
| - name: Install just | |
| uses: extractions/setup-just@v3 | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: '20' | |
| cache: 'pnpm' | |
| - name: Install Bun | |
| uses: oven-sh/setup-bun@v2 | |
| - name: Rust cache | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Install Node dependencies | |
| run: just ci-node-install | |
| # Project checks should run via shared just targets. | |
| - name: Run CI checks | |
| run: just ci-checks | |
| - name: Record CLI parity SHA | |
| if: matrix.os == 'ubuntu-latest' | |
| run: git rev-parse HEAD > cli-parity.sha | |
| - name: Upload CLI parity artifacts | |
| if: matrix.os == 'ubuntu-latest' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: cli-parity-artifacts | |
| path: | | |
| target/debug/opencode-cloud | |
| packages/cli-node/dist | |
| cli-parity.sha | |
| # CLI Parity - ensures Node CLI can invoke all Rust CLI commands | |
| cli-parity: | |
| name: CLI Parity Tests | |
| runs-on: ubuntu-latest | |
| needs: [build] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install just | |
| uses: extractions/setup-just@v3 | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: '20' | |
| cache: 'pnpm' | |
| - name: Download CLI parity artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: cli-parity-artifacts | |
| - name: Verify artifact SHA | |
| run: | | |
| if [ -f cli-parity.sha ]; then | |
| echo "Artifact SHA: $(cat cli-parity.sha)" | |
| echo "Workflow SHA: $GITHUB_SHA" | |
| test "$(cat cli-parity.sha)" = "$GITHUB_SHA" | |
| fi | |
| - name: Ensure Rust binary executable | |
| run: chmod +x target/debug/opencode-cloud | |
| - name: Install Node dependencies (cli only) | |
| run: just ci-node-install-cli-only | |
| - name: Run CLI parity tests | |
| run: pnpm -C packages/cli-node test |