Settle symmetry and floor contact in code, and retire the Audit Agent #93

Workflow file for this run

	# ============================================================
	# HashCortX — continuous integration
	#
	# This repository has no frontend test suite, and `src/` is served
	# unbundled, so nothing catches a syntax error in a JavaScript file
	# before it reaches a user: the browser stops executing that script
	# and every feature after it silently disappears.
	#
	# So the gate is every check the repository has — the frontend suite
	# in `npm run check`, the Rust compile, and the Rust tests, on the three
	# platforms the app targets. Be clear about what that proves: the source
	# holds the properties the checks describe. It does NOT prove the app
	# works. Only running it does.
	#
	# The release pipeline is a separate concern — see docs/future/build.yml.
	# ============================================================

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	workflow_dispatch:

	# A second push to the same branch cancels the first — no point burning
	# minutes on a commit that has already been superseded.
	concurrency:
	group: ci-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	javascript:
	name: Frontend checks
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-node@v4
	with:
	node-version: 20

	# One step, and deliberately so. This job used to name each check
	# script in its own step, and every check written after those steps
	# were typed ran on a developer's machine and nowhere else — a third
	# of them, including the one that pins every host the content policy
	# allows. `npm run check` is the list, so a check added to package.json
	# gates a push here from the moment it exists.
	#
	# What it covers: every loaded script parses (src/ is served unbundled,
	# so one syntax error silently removes every feature after it), the
	# Permission Guard still refuses, asks about and permits exactly what it
	# should, the content policy matches the hosts the source calls, the
	# argument names on the Tauri bridge match the Rust signatures, retrieval
	# ranking holds, every element lookup and every registered command is
	# accounted for, and the stylesheets stay on the shared tokens.
	#
	# None of the check scripts import a package — they read the real source
	# into a Node VM — so there is nothing to install before running them.
	- name: Every check the repository has
	run: npm run check

	rust:
	name: Rust — ${{ matrix.label }}
	runs-on: ${{ matrix.os }}
	# All three platforms, because for the entire life of this project only
	# macOS was ever built. A dependency table header had quietly made chrono,
	# dirs and shellexpand macOS-only, so the crate did not compile on Linux or
	# Windows at all and nothing noticed. A matrix is the only thing that keeps
	# that honest — the alternative is finding out from a user.
	strategy:
	fail-fast: false
	matrix:
	include:
	# 24.04, not 22.04, and the reason is linking rather than preference.
	# ort downloads a prebuilt ONNX Runtime that wants glibc 2.38+ (the
	# __isoc23_* string functions) and libstdc++ 13+ (_M_replace_cold).
	# 22.04 ships glibc 2.35 and GCC 11, so `cargo check` passed — it does
	# not link — and `cargo test` failed with a wall of undefined symbols.
	- os: ubuntu-24.04
	label: Linux
	- os: macos-latest
	label: macOS
	- os: windows-latest
	label: Windows
	steps:
	- uses: actions/checkout@v4

	- uses: dtolnay/rust-toolchain@stable
	with:
	components: clippy

	- uses: swatinem/rust-cache@v2
	with:
	workspaces: './src-tauri -> target'
	key: ${{ matrix.label }}

	# Tauri needs the system webview and its -sys crates' headers even to
	# type-check. This is the full Tauri v2 Linux prerequisite list, not the
	# shorter one docs/future/build.yml carries: that one predates v2, names
	# libappindicator3-dev (v2 wants the ayatana fork), and omits libxdo-dev
	# and libssl-dev, whose -sys crates then fail to build.
	# macOS and Windows ship their webview with the OS and need none of this.
	- name: Install Linux system dependencies
	if: runner.os == 'Linux'
	run: \|
	sudo apt-get update
	sudo apt-get install -y \
	build-essential \
	pkg-config \
	curl wget file \
	libwebkit2gtk-4.1-dev \
	libayatana-appindicator3-dev \
	librsvg2-dev \
	libxdo-dev \
	libssl-dev \
	libdbus-1-dev \
	patchelf

	# Every cargo step on Unix goes through the annotator so a failure is
	# readable from the checks API without admin rights on the repository.
	# See the script's header for why that matters.
	- name: cargo check
	if: runner.os != 'Windows'
	run: scripts/ci/run-and-annotate.sh "cargo check (${{ matrix.label }})" cargo check --manifest-path src-tauri/Cargo.toml --all-targets

	- name: cargo test
	if: runner.os != 'Windows'
	run: scripts/ci/run-and-annotate.sh "cargo test (${{ matrix.label }})" cargo test --manifest-path src-tauri/Cargo.toml

	# Windows has no bash by default for the annotator wrapper, and its logs
	# are readable from the run page anyway. Run cargo directly there.
	- name: cargo check (Windows)
	if: runner.os == 'Windows'
	run: cargo check --manifest-path src-tauri/Cargo.toml --all-targets

	- name: cargo test (Windows)
	if: runner.os == 'Windows'
	run: cargo test --manifest-path src-tauri/Cargo.toml

	# The security code is where a warning is most worth reading, so
	# clippy runs — but it does not fail the build yet, because the
	# existing code has never been linted and a red CI that everyone
	# learns to ignore is worse than no CI.
	- name: cargo clippy (advisory)
	continue-on-error: true
	run: cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets

Navigation Menu

Settle symmetry and floor contact in code, and retire the Audit Agent #93

Workflow file

Settle symmetry and floor contact in code, and retire the Audit Agent #93

Uh oh!

Workflow file for this run