agent_vscode
433252bdb1
The shared @docmost/token-estimate package (main: ./dist/index.js, dist/ gitignored) was never built in the CI jobs that bypass nx, so develop CI went red: - test.yml `test` (pnpm -r test): client vitest failed to resolve the import. - develop.yml `e2e-server` (direct jest e2e): server history-budget.ts hit TS2307 Cannot find module '@docmost/token-estimate'. The nx-driven jobs (build, e2e-mcp) stayed green via dependsOn: ^build. - test.yml: add "Build token-estimate" step to the `test` job. - develop.yml: add "Build token-estimate" step to the `e2e-server` job. - Dockerfile: ship packages/token-estimate/dist + package.json into the installer stage — apps/server depends on it (workspace:*) and imports it at runtime, so the prod image would otherwise crash with ERR_MODULE_NOT_FOUND (masked so far because publish/smoke never ran). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
229 lines
10 KiB
YAML
229 lines
10 KiB
YAML
name: Test
|
|
|
|
# NO `paths:` filter on purpose (issue #447). The tool-spec REGISTRY is split
|
|
# across two packages that MUST stay in sync: the specs live in `packages/mcp`
|
|
# but the parity/tier guard tests that read them live in the `apps/server` jest
|
|
# suite. A PR touching only `packages/mcp/**` must therefore still run the SERVER
|
|
# suite (and vice-versa), or an in-app wiring break slips through green and only
|
|
# surfaces on develop after merge. The `test` job below runs BOTH suites via
|
|
# `pnpm -r test` on every PR; the dedicated `mcp-server-parity` job makes that
|
|
# cross-package gate explicit and fast. Do not add a `paths:` filter here.
|
|
on:
|
|
pull_request:
|
|
workflow_call:
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: test-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
# Guard against a long-lived branch adding a migration whose timestamped
|
|
# filename sorts BEFORE migrations already applied on the target branch (and
|
|
# thus in prod). The Kysely startup migrator rejects that as "corrupted
|
|
# migrations" and crash-loops the app on boot (incident #361). This gate fails
|
|
# the PR so the migration is renamed to a current timestamp before merge.
|
|
# Runs for pull_request (diff against the base branch) AND for push (#476
|
|
# retrospective: a DIRECT push to develop used to bypass this PR-only gate
|
|
# entirely — now the push is diffed against its `before` SHA; workflow_call
|
|
# from develop.yml inherits the caller's push event). workflow_dispatch has
|
|
# nothing to diff against and still skips the job.
|
|
migration-order:
|
|
if: github.event_name == 'pull_request' || github.event_name == 'push'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Checkout (full history for the base diff)
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Added migrations must sort after the newest on the base
|
|
env:
|
|
TARGET_BRANCH: ${{ github.base_ref }}
|
|
BEFORE_SHA: ${{ github.event.before }}
|
|
run: |
|
|
set -euo pipefail
|
|
MIG_DIR="apps/server/src/database/migrations"
|
|
if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
|
|
# checkout above already did fetch-depth:0 (full history). Fetch the base
|
|
# WITHOUT --depth (a shallow graft would truncate the base history and
|
|
# break the merge-base when the base has moved ahead of the PR merge —
|
|
# exactly the long-branch-vs-moving-base case this gate guards, #361).
|
|
git fetch --no-tags origin "$TARGET_BRANCH"
|
|
BASE="origin/${TARGET_BRANCH}"
|
|
else
|
|
# push event: compare against the pre-push tip of the branch.
|
|
if [ "$BEFORE_SHA" = "0000000000000000000000000000000000000000" ]; then
|
|
echo "::notice::branch creation push — nothing to compare"
|
|
exit 0
|
|
fi
|
|
if ! git cat-file -e "${BEFORE_SHA}^{commit}" 2>/dev/null; then
|
|
# The before-SHA is not in the clone (a force-push rewrote history).
|
|
# One recovery attempt — refresh every remote head (cheap: the
|
|
# checkout is already fetch-depth:0); a fetch failure aborts via
|
|
# `set -e`, which is fail-closed too.
|
|
git fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*'
|
|
fi
|
|
if ! git cat-file -e "${BEFORE_SHA}^{commit}" 2>/dev/null; then
|
|
# FAIL-CLOSED: without the before-SHA there is no base to prove the
|
|
# ordering against, and a gate whose job is to BLOCK must not guess.
|
|
echo "::error::force-push detected — verify migration order manually, then re-run via workflow_dispatch"
|
|
exit 1
|
|
fi
|
|
BASE="$BEFORE_SHA"
|
|
fi
|
|
newest_on_target=$(git ls-tree -r --name-only "$BASE" "$MIG_DIR" | sort | tail -1)
|
|
# NO `|| true`: a diff failure (e.g. an unresolved merge-base) must fail
|
|
# the job CLOSED — a gate whose job is to BLOCK must never pass on error.
|
|
# `set -e` above already aborts on a non-zero diff exit.
|
|
added=$(git diff --diff-filter=A --name-only "${BASE}...HEAD" -- "$MIG_DIR")
|
|
bad=0
|
|
for f in $added; do
|
|
if [[ "$f" < "$newest_on_target" || "$f" == "$newest_on_target" ]]; then
|
|
echo "::error::Migration $f sorts at or before the newest on the base ($newest_on_target) — rename it with a CURRENT timestamp before merge (do not change its contents). See incident #361."
|
|
bad=1
|
|
fi
|
|
done
|
|
if [ "$bad" -eq 0 ]; then
|
|
echo "Migration order OK (added migrations all sort after $newest_on_target)."
|
|
fi
|
|
exit $bad
|
|
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
# Real Postgres + Redis so the server integration suite (`*.int-spec.ts`,
|
|
# behind `pnpm --filter server test:int`) runs in CI (red-team finding #7).
|
|
# Without it, cost-cap / FK-cascade / jsonb-round-trip / real-apply tests
|
|
# only ran locally, so regressions in those paths stayed green in CI.
|
|
# Postgres uses the pgvector image because migrations create vector columns
|
|
# and global-setup runs `CREATE EXTENSION vector`. Credentials/db match the
|
|
# defaults in apps/server/test/integration/db.ts + global-setup.ts
|
|
# (docmost / docmost_dev_pw, maintenance db `docmost`, redis on 6379), so no
|
|
# TEST_*_URL overrides are needed.
|
|
services:
|
|
postgres:
|
|
# via mirror.gcr.io (Docker Hub pull-through cache; avoids Hub anonymous
|
|
# pull rate-limit that randomly fails on shared GitHub runner IPs).
|
|
image: mirror.gcr.io/pgvector/pgvector:pg18
|
|
env:
|
|
POSTGRES_USER: docmost
|
|
POSTGRES_PASSWORD: docmost_dev_pw
|
|
POSTGRES_DB: docmost
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U docmost"
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 5
|
|
redis:
|
|
# via mirror.gcr.io (see postgres note above).
|
|
image: mirror.gcr.io/library/redis:7
|
|
ports:
|
|
- 6379:6379
|
|
options: >-
|
|
--health-cmd "redis-cli ping"
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 5
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
# Required for the client suite, which resolves @docmost/editor-ext via its
|
|
# dist build (the server suite also rebuilds it through its own pretest).
|
|
- name: Build editor-ext
|
|
run: pnpm --filter @docmost/editor-ext build
|
|
|
|
# @docmost/prosemirror-markdown is the shared converter (#293/#326); its
|
|
# build/ is gitignored, and plain `pnpm -r test` does NOT honour nx
|
|
# `dependsOn: ^build`, so its consumers (mcp `pretest: tsc`, git-sync vitest
|
|
# typecheck) fail with TS2307 Cannot find module '@docmost/prosemirror-markdown'
|
|
# unless it is built first. Build it before the recursive test run.
|
|
- name: Build prosemirror-markdown
|
|
run: pnpm --filter @docmost/prosemirror-markdown build
|
|
|
|
# @docmost/token-estimate is a shared workspace package the client vitest
|
|
# suite resolves via its dist build (main: ./dist/index.js); dist/ is
|
|
# gitignored and `pnpm -r test` does NOT honour nx `dependsOn: ^build`, so
|
|
# build it before the recursive test run or the client suite fails with
|
|
# "Failed to resolve import '@docmost/token-estimate'" (#490).
|
|
- name: Build token-estimate
|
|
run: pnpm --filter @docmost/token-estimate build
|
|
|
|
- name: Run unit tests
|
|
run: pnpm -r test
|
|
|
|
# Integration suite against the real Postgres/Redis services above. Runs
|
|
# the FK-cascade, cost-cap, jsonb-round-trip and real-apply specs that the
|
|
# unit run (mocks only) cannot cover. global-setup drops/recreates the
|
|
# isolated `docmost_test` DB and migrates it to latest.
|
|
- name: Run server integration tests
|
|
run: pnpm --filter server test:int
|
|
|
|
# Cross-package tool-spec parity gate (issue #447). The tool-spec registry lives
|
|
# in `packages/mcp` but its parity/tier guard tests live in the `apps/server`
|
|
# jest suite, so a PR touching ONLY one of the two packages must still run BOTH
|
|
# sides — otherwise an in-app wiring break (e.g. PR #434 drawio) passes the mcp
|
|
# suite green and only surfaces on develop after merge. The `test` job already
|
|
# runs everything via `pnpm -r test`; this job is a fast, explicitly-named guard
|
|
# that runs the mcp `node --test` suite AND the server tool-guard jest specs
|
|
# together, so the coupling is visible and can never be accidentally split by a
|
|
# path filter. No Postgres/Redis needed: these specs mock the DB/loader.
|
|
mcp-server-parity:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
# Shared deps first (build/ dirs are gitignored; see test.yml build order).
|
|
- name: Build editor-ext
|
|
run: pnpm --filter @docmost/editor-ext build
|
|
|
|
- name: Build prosemirror-markdown
|
|
run: pnpm --filter @docmost/prosemirror-markdown build
|
|
|
|
# Build the mcp package so build/ carries a FRESH REGISTRY_STAMP (#447): the
|
|
# build runs gen-registry-stamp.mjs before tsc, so a build/ vs src/ skew
|
|
# cannot slip into the tests that exercise the loader's stale-check.
|
|
- name: Build mcp (regenerates REGISTRY_STAMP)
|
|
run: pnpm --filter @docmost/mcp build
|
|
|
|
# mcp side: the standalone MCP server's own tool-spec / instructions guards.
|
|
- name: Run mcp tool-spec suite
|
|
run: pnpm --filter @docmost/mcp test
|
|
|
|
# server side: the parity + tier guards that read packages/mcp/src/tool-specs
|
|
# and assert the in-app AI-chat wiring matches it.
|
|
- name: Run server tool-spec guard specs
|
|
run: pnpm --filter server exec jest shared-tool-specs.contract tool-tiers ai-chat-tools.service --runInBand
|