OpenCode-GraphAgent/.github/workflows/ci-typecheck.yml at dev · LeXwDeX/OpenCode-GraphAgent · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# ============================================================================
# 🔍 CI · Typecheck
# ----------------------------------------------------------------------------
# Purpose : TypeScript type checking across all packages (bun typecheck),
#           oxlint warning ratchet, and the DAG core behavior/coverage gate
# Trigger : Push to `main`/`dev`, PRs targeting `main`/`dev`, manual dispatch
# Jobs    : typecheck — single Linux runner, `bun run lint` + `bun typecheck`
# Gate    : Required status check on BOTH `dev` and `main` rulesets. The DAG
#           core gate protects state-machine and persistence changes before
#           they merge to dev; the full suite still gates dev → main.
# Notes   : No push trigger on feat/* or fix/* (frequent changes); PRs cover
#           them.
# ============================================================================

name: 🔍 CI · Typecheck

on:
  push:
    branches:
      - main
      - dev
  pull_request:
    # ready_for_review matters: the SpecGit Acceptance verdict requires
    # required-check runs that started at/after the draft→ready transition
    # (#315 anchor). Without this type a ready transition finds only stale
    # pre-ready runs and the gate times out waiting for fresh ones.
    types: [opened, synchronize, reopened, ready_for_review]
    branches:
      - main
      - dev
  workflow_dispatch:

permissions:
  contents: read
  actions: read

jobs:
  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Check previously verified content
        id: evidence
        uses: ./.github/actions/verified-content
        with:
          check: typecheck
          job-name: Typecheck
          runner-label: ubuntu-latest

      - name: Setup Bun
        if: steps.evidence.outputs.reused != 'true'
        uses: ./.github/actions/setup-bun

      - name: Test CI verification fingerprint
        run: node --test script/ci-fingerprint.test.mjs script/ci-evidence.test.mjs

      - name: Run lint
        if: steps.evidence.outputs.reused != 'true'
        run: bun run lint

      - name: Run typecheck
        if: steps.evidence.outputs.reused != 'true'
        run: bun typecheck

      - name: Run DAG core behavior and coverage gate
        if: steps.evidence.outputs.reused != 'true'
        working-directory: packages/opencode
        run: bun run test:dag-core
        timeout-minutes: 10

      # #498 B1: archive integrity boundary of the `oc` installer — SHA256SUMS
      # must be verified before extraction and fail closed on mismatch.
      # Zero network (stub curl); portable across bash hosts.
      - name: Run oc install boundary tests
        if: steps.evidence.outputs.reused != 'true'
        run: bash script/oc-install-boundary.test.sh
        timeout-minutes: 5

      - name: Record successful verification
        if: success() && steps.evidence.outputs.reused != 'true'
        uses: ./.github/actions/record-verification
        with:
          key: ${{ steps.evidence.outputs.key }}
          path: ${{ steps.evidence.outputs.path }}
          job-name: Typecheck