Skip to content

CI-only: funded exact-tree certification for ores-orm-core#12 #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
the1mills wants to merge 5 commits into
base: main
Choose a base branch
from
Open

CI-only: funded exact-tree certification for ores-orm-core#12 #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0ad728a
ci: exact-tree certify ores-orm-core#12
the1mills Oct 4, 2026
f724f99
ci: certify updated ores-orm-core#12 exact tree
the1mills Oct 4, 2026
f08d3c7
test: refresh ORM #12 .github/workflows/ci.yml
the1mills Oct 5, 2026
c2fa24f
test: refresh ORM #12 src/emit/dart.rs
the1mills Oct 5, 2026
ea14d13
test: refresh ORM #12 tests/emitters.rs
the1mills Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
277 changes: 137 additions & 140 deletions .github/workflows/zed-e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,171 +1,168 @@
name: Zed and Cargo interoperability
name: ORES ORM exact-tree funded certification

on:
pull_request:
push:
branches: [main]
workflow_dispatch:

permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
group: ores-orm-core-pr12-${{ github.event.pull_request.number || github.run_id }}
cancel-in-progress: true

env:
ZED_INTERFACES_REF: a23cdd2ac509a39ca6fd6d21a3774fdd3a0f7660
ZED_CLI_REF: bf1dc05e05900748a44ee02e7c507fd65bab4c7a
RUST_LIB_REF: f3c4e33cd0e5726b2c668c0306936f01674261fa
SOURCE_HEAD: a09fd6fa07c91a3ba65a44ab7da13a63d015450f
SOURCE_TREE: 59df9ec5ac372c041e1454124ef530d78a07a189
MIRROR_DIR: cert/ores-orm-core-pr12

jobs:
workflow-contract:
rust:
runs-on: ubuntu-24.04
timeout-minutes: 10
timeout-minutes: 20
steps:
- name: Check out exact revision
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Checkout carrier merge candidate
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
with:
persist-credentials: false

- name: Validate workflow
uses: docker://rhysd/actionlint@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
with:
args: .github/workflows/zed-e2e.yml

- name: Validate executable test script
run: bash -n scripts/zed-e2e.sh

- name: Verify immutable fixture references
- name: Verify exact source tree
shell: bash
run: |
set -euo pipefail
for value in \
"$ZED_INTERFACES_REF" \
"$ZED_CLI_REF" \
"$RUST_LIB_REF"
do
[[ "$value" =~ ^[0-9a-f]{40}$ ]]
done
test -f Cargo.lock
test ! -e .zpkg.lock

cargo-matrix:
needs: workflow-contract
strategy:
fail-fast: false
matrix:
os:
- ubuntu-24.04
- macos-15
- windows-2025
runs-on: ${{ matrix.os }}
test "$(git rev-parse "HEAD:$MIRROR_DIR")" = "$SOURCE_TREE"
printf 'source-head=%s\nsource-tree=%s\n' "$SOURCE_HEAD" "$SOURCE_TREE"
- name: Rust toolchain
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
with:
toolchain: 1.88.0
components: rustfmt,clippy
- name: Formatting
working-directory: cert/ores-orm-core-pr12
run: cargo fmt --all -- --check
- name: Check
working-directory: cert/ores-orm-core-pr12
run: cargo check --all-targets
- name: Clippy
working-directory: cert/ores-orm-core-pr12
run: cargo clippy --all-targets --all-features -- -D warnings
- name: Tests
working-directory: cert/ores-orm-core-pr12
run: cargo test --all-targets

generated-runtime-surfaces:
needs: rust
runs-on: ubuntu-24.04
timeout-minutes: 25
steps:
- name: Check out exact revision
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Checkout carrier merge candidate
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
with:
persist-credentials: false

- name: Install pinned Python
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
with:
python-version: "3.12"

- name: Install pinned Rust toolchain
uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
with:
toolchain: "1.97.0"
components: rustfmt, clippy

- name: Materialize exact Zed package fixture
- name: Verify exact source tree
shell: bash
run: |
set -euo pipefail
target=.vendor/.zed/zed-pkg-test/rust-lib
mkdir -p "$(dirname "$target")"
git init -q "$target"
git -C "$target" remote add origin https://github.com/zed-pkg-test/rust-lib.git
git -C "$target" fetch --depth 1 origin "$RUST_LIB_REF"
git -C "$target" checkout -q --detach FETCH_HEAD
test "$(git -C "$target" rev-parse HEAD)" = "$RUST_LIB_REF"

- name: Run locked Cargo matrix
shell: bash
test "$(git rev-parse "HEAD:$MIRROR_DIR")" = "$SOURCE_TREE"
- name: Rust toolchain
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
with:
toolchain: 1.88.0
- name: Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.16.0
- name: Dart
uses: dart-lang/setup-dart@6afc89df92d6eb3834022f73cd65adc8cdfcb92d
with:
sdk: 3.13.3
- name: Gleam and Erlang
uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
with:
otp-version: '29.1'
gleam-version: '1.18.1'
rebar3-version: '3'
- name: Emit exact runtime fixture
working-directory: cert/ores-orm-core-pr12
env:
ORES_ORM_RUNTIME_FIXTURE_DIR: ${{ runner.temp }}/ores-orm-generated
run: cargo run --quiet --example emit_runtime_fixture
- name: Compile generated Rust DTO
env:
GEN: ${{ runner.temp }}/ores-orm-generated
WORK: ${{ runner.temp }}/generated-rust
run: |
set -euo pipefail
cargo_lock_hash="$(git hash-object Cargo.lock)"
cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked --all-targets
cargo run --locked --quiet
cargo metadata --locked --format-version 1 > cargo-metadata.json
cargo tree --locked -e features > cargo-features.txt
cargo run --locked --offline --quiet
cargo test --locked --offline --all-targets
test "$(git hash-object Cargo.lock)" = "$cargo_lock_hash"
test ! -e .zpkg.lock

- name: Validate Cargo provenance
shell: bash
mkdir -p "$WORK/src"
cp "$GEN"/rust/*.rs "$WORK/src/lib.rs"
cat > "$WORK/Cargo.toml" <<'TOML'
[package]
name = "ores-orm-generated-runtime-witness"
version = "0.0.0"
edition = "2024"
publish = false

[dependencies]
serde = { version = "1.0.228", features = ["derive"] }
serde_json = "1.0.145"
TOML
cargo check --quiet --manifest-path "$WORK/Cargo.toml"
- name: Type-check generated TypeScript and Zod
env:
GEN: ${{ runner.temp }}/ores-orm-generated
WORK: ${{ runner.temp }}/generated-typescript
run: |
set -euo pipefail
python3 - <<'PY'
import json
from pathlib import Path

metadata = json.loads(Path("cargo-metadata.json").read_text())
packages = {package["name"]: package for package in metadata["packages"]}
assert packages["rust-app"]["version"] == "0.2.0"
assert packages["rust-lib"]["version"] == "1.0.1"
assert packages["rust-lib"]["source"] is None
assert packages["itoa"]["version"] == "1.0.18"
assert packages["unicode-ident"]["version"] == "1.0.24"
assert packages["itoa"]["source"].startswith("registry+")
assert packages["unicode-ident"]["source"].startswith("registry+")
PY

- name: Upload Cargo provenance
if: ${{ always() }}
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
with:
name: cargo-provenance-${{ matrix.os }}
path: |
cargo-metadata.json
cargo-features.txt
if-no-files-found: warn
retention-days: 7

- name: Verify source and lock cleanliness
if: ${{ always() }}
shell: bash
mkdir -p "$WORK"
cp "$GEN"/typescript/*.ts "$WORK/index.ts"
cat > "$WORK/package.json" <<'JSON'
{"private":true,"type":"module","dependencies":{"zod":"4.6.5"},"devDependencies":{"typescript":"7.0.2"}}
JSON
cd "$WORK"
npm install --ignore-scripts --no-audit --no-fund
./node_modules/.bin/tsc --noEmit --strict --skipLibCheck false --target ES2022 --module NodeNext --moduleResolution NodeNext index.ts
- name: Analyze generated Dart validator
env:
GEN: ${{ runner.temp }}/ores-orm-generated
WORK: ${{ runner.temp }}/generated-dart
run: |
set -euo pipefail
rm -rf .vendor target cargo-metadata.json cargo-features.txt .zed .zpkg.lock
git diff --exit-code -- Cargo.toml Cargo.lock .zpkg.toml build.rs src tests
test -z "$(git status --porcelain --untracked-files=all)"

zed-registry-e2e:
needs: workflow-contract
runs-on: ubuntu-24.04
timeout-minutes: 45
steps:
- name: Check out exact revision
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Run pinned cross-container interoperability suite
shell: bash
mkdir -p "$WORK/lib"
cp "$GEN"/dart/*.dart "$WORK/lib/orm_derived.dart"
cat > "$WORK/pubspec.yaml" <<'YAML'
name: ores_orm_generated_runtime_witness
version: 0.0.0
environment:
sdk: '>=3.13.0 <4.0.0'
YAML
cd "$WORK"
dart pub get
dart analyze --fatal-infos --fatal-warnings
- name: Compile generated Gleam decoder
env:
GEN: ${{ runner.temp }}/ores-orm-generated
WORK: ${{ runner.temp }}/generated-gleam
run: |
set -o pipefail
bash scripts/zed-e2e.sh 2>&1 | tee "$RUNNER_TEMP/zed-cargo-e2e.log"

- name: Upload interoperability diagnostics
if: ${{ always() }}
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
with:
name: zed-cargo-e2e-log
path: ${{ runner.temp }}/zed-cargo-e2e.log
if-no-files-found: warn
retention-days: 7
mkdir -p "$WORK/src"
cp "$GEN"/gleam/*.gleam "$WORK/src/orm_derived.gleam"
cat > "$WORK/gleam.toml" <<'TOML'
name = "ores_orm_generated_runtime_witness"
version = "0.0.0"
target = "erlang"

[dependencies]
gleam_stdlib = "1.0.5"
TOML
cd "$WORK"
gleam deps download
gleam check
- name: Parse generated Draft 2020-12 JSON Schema and manifest
env:
GEN: ${{ runner.temp }}/ores-orm-generated
run: |
node --input-type=module <<'NODE'
import { readFileSync, readdirSync } from 'node:fs';
import { join } from 'node:path';
const root = process.env.GEN;
const schemaName = readdirSync(join(root, 'json-schema')).find((name) => name.endsWith('.json'));
if (!schemaName) throw new Error('missing JSON Schema artifact');
const schema = JSON.parse(readFileSync(join(root, 'json-schema', schemaName), 'utf8'));
const manifest = JSON.parse(readFileSync(join(root, 'manifest.json'), 'utf8'));
if (schema.$schema !== 'https://json-schema.org/draft/2020-12/schema') throw new Error('wrong JSON Schema dialect');
if (manifest.publication !== 'blocked_pending_contract_admission') throw new Error('public derivative must remain blocked pending TJSV admission');
NODE
Loading
Loading