t3-code[bot]ci: gate quality checks by changed pathsa096eb82 months agoHistory
35 lines · 2.4 KB · MarkdownRawDownload

CI quality gates

For maintainers. Using T3 Code? See docs/user.

.github/workflows/ci.yml starts with one small Classify changes job on pull requests and pushes to main. It resolves the complete changed-file list, matches both sides of renames, and decides which of the following gates can observe the change:

  • Check runs vp check, vpr typecheck, the desktop pipeline build, and preload bundle verification for Node product and configuration changes. Workflow-only changes keep the required check name but use a no-install parse marker.
  • Test runs every package test task except apps/server.
  • Test Server 1/2/3 shards the serialized apps/server suite across three runners. Server-only work skips the non-server runner, while client-only work skips all three server runners. Shared contracts, shared runtime code, workspace configuration, and server test dependencies run both.
  • Rust formats and tests native/resource-monitor, and only runs for that crate or CI-control changes.
  • Mobile Native Static Analysis runs vp run lint:mobile on macOS for handwritten Swift/Kotlin, its lint configuration, and the command dependencies it imports. Generated ios/ and android/ projects remain excluded.
  • Release Smoke exercises release-only workflow steps through scripts/release-smoke.ts. It runs for release scripts, workspace manifests, patches, mobile dependency archives, and release.yml.

Documentation, repository metadata, and agent/editor configuration skip every product runner. CI workflow or classifier changes run every gate. Unknown, missing, failed, or truncated changed-file classification fails open and runs every gate, so optimization cannot silently remove coverage. Skipped jobs retain the existing required-check names and GitHub treats them as successful.

.github/workflows/release.yml builds macOS (arm64 and x64), Linux (x64), and Windows (x64) desktop artifacts from a single v*.*.* tag and publishes one GitHub release. It auto-enables signing only when platform credentials are present. macOS passkey builds additionally require APPLE_TEAM_ID and the MACOS_PROVISIONING_PROFILE secret; Windows uses Azure Trusted Signing. Without the core signing credentials, it still releases unsigned artifacts.

See Release Checklist for the full release/signing setup checklist.