fix(release): pin the Windows upgrade baseline to a published build (… #3787
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Licensed to the Apache Software Foundation (ASF) under one | |
| # or more contributor license agreements. See the NOTICE file | |
| # distributed with this work for additional information | |
| # regarding copyright ownership. The ASF licenses this file | |
| # to you under the Apache License, Version 2.0 (the | |
| # "License"); you may not use this file except in compliance | |
| # with the License. You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, | |
| # software distributed under the License is distributed on an | |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | |
| # KIND, either express or implied. See the License for the | |
| # specific language governing permissions and limitations | |
| # under the License. | |
| name: Windows recovery | |
| # The paths below are a pre-filter, not this lane's real input. The real input | |
| # is the import closure of the crash and owner-death recovery authorities in | |
| # storage, runtime and Runtime Host, which reaches well past any list worth | |
| # hand-maintaining. So they name those workspaces and every workspace they hold | |
| # a TypeScript project reference to, plus the manifests, patches and scripts | |
| # the unconditional install and clean steps consume. That keeps a change there | |
| # reported before merge, and the nightly run covers the transitive edits the | |
| # list cannot match. | |
| # | |
| # GitHub evaluates a path filter against the first 300 files of the diff only, | |
| # so a pull request wider than that can skip the filter outright. A repository-wide sweep is exactly the change that touches every | |
| # recovery authority at once, which is one more reason the main push below | |
| # carries no filter at all. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - 'package.json' | |
| - 'package-lock.json' | |
| - 'patches/**' | |
| - 'scripts/apply-dependency-patches.mjs' | |
| - 'scripts/install-electron-with-retry.mjs' | |
| - 'scripts/run-electron-installer.cjs' | |
| - 'scripts/clean-build.mjs' | |
| - 'scripts/clean-paths.mjs' | |
| - 'scripts/windows-runtime-host-local-ipc-trust.ps1' | |
| - 'tsconfig.base.json' | |
| - 'tsconfig.lib.json' | |
| - 'packages/core/package.json' | |
| - 'packages/core/tsconfig.json' | |
| - 'packages/core/src/**' | |
| - 'packages/storage/package.json' | |
| - 'packages/storage/tsconfig.json' | |
| - 'packages/storage/src/**' | |
| - 'packages/runtime/package.json' | |
| - 'packages/runtime/tsconfig.json' | |
| - 'packages/runtime/src/**' | |
| - 'packages/runtime/scripts/**' | |
| - 'packages/runtime-host/package.json' | |
| - 'packages/runtime-host/tsconfig.json' | |
| - 'packages/runtime-host/src/**' | |
| - '.github/workflows/windows-recovery.yml' | |
| # Unfiltered on purpose: required_status_checks is `strict: false`, so a pull | |
| # request goes green against a stale base and only the merged result proves | |
| # two independently green halves still agree. It is also the backstop for the | |
| # 300-file case above. The nightly alone would find either a day later, | |
| # against a batch of commits instead of one. | |
| push: | |
| branches: [main] | |
| schedule: | |
| # Offset from windows-sandbox-w0 so the Windows lanes do not overlap. | |
| - cron: '17 8 * * *' | |
| workflow_dispatch: | |
| # Pull request pushes supersede each other, keyed on the pull request number | |
| # because github.head_ref is a bare branch name two forks can share: a second | |
| # contributor pushing to their own `main` would otherwise cancel the first | |
| # contributor's run, and a cancelled check is not a failed one. | |
| # Scheduled, manual and main-push runs fall back to the run id, since | |
| # github.ref is refs/heads/main for all three and one shared group would let a | |
| # dispatch queue behind the nightly and then be discarded while still pending. | |
| # That deliberately stops main pushes from superseding each other: this lane is | |
| # the only place a merged Windows regression is observed, so every merge needs | |
| # its own evidence rather than only the newest one surviving. | |
| concurrency: | |
| group: windows-recovery-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| windows_recovery: | |
| name: windows_recovery | |
| runs-on: windows-latest | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "24" | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm.cmd ci | |
| - name: Build test artifacts | |
| run: npm.cmd run build:test | |
| - name: Verify managed dependency alternate streams | |
| shell: pwsh | |
| run: | | |
| node.exe --test --test-reporter=tap --test-concurrency=1 ` | |
| --test-name-pattern="NTFS alternate stream" ` | |
| packages/storage/dist/__tests__/managed-dependency-environment.test.js ` | |
| 2>&1 | Tee-Object -FilePath "$env:RUNNER_TEMP/managed-dependency-ads.tap" | |
| $exitCode = $LASTEXITCODE | |
| if ($exitCode -ne 0) { exit $exitCode } | |
| $output = Get-Content "$env:RUNNER_TEMP/managed-dependency-ads.tap" | |
| if ($output -notcontains '# tests 3' -or $output -notcontains '# pass 3' -or $output -notcontains '# skipped 0') { | |
| Write-Error 'Managed dependency ADS gate did not run exactly three passing Windows tests' | |
| exit 1 | |
| } | |
| - name: Verify root initialization replacement race | |
| shell: pwsh | |
| run: | | |
| node.exe --test --test-reporter=tap --test-concurrency=1 ` | |
| --test-name-pattern="rejects replacement before opening the temporary marker" ` | |
| packages/storage/dist/__tests__/root-authority.test.js ` | |
| 2>&1 | Tee-Object -FilePath "$env:RUNNER_TEMP/root-initialization-race.tap" | |
| $exitCode = $LASTEXITCODE | |
| if ($exitCode -ne 0) { exit $exitCode } | |
| $output = Get-Content "$env:RUNNER_TEMP/root-initialization-race.tap" | |
| if ($output -notcontains '# tests 1' -or $output -notcontains '# pass 1' -or $output -notcontains '# skipped 0') { | |
| Write-Error 'Root initialization race gate did not run exactly one passing Windows test' | |
| exit 1 | |
| } | |
| - name: Verify Runtime Host Local IPC trust boundary | |
| shell: pwsh | |
| run: | | |
| node.exe --test packages/runtime-host/dist/__tests__/control-endpoint.test.js | |
| ./scripts/windows-runtime-host-local-ipc-trust.ps1 | |
| - name: Verify Skill catalog on Windows | |
| shell: pwsh | |
| run: | | |
| node.exe --test --test-reporter=tap --test-concurrency=1 ` | |
| packages/runtime-host/dist/__tests__/skill-catalog-coordinator.test.js ` | |
| packages/runtime-host/dist/__tests__/skill-catalog-protocol.test.js ` | |
| packages/runtime-host/dist/__tests__/skill-catalog-repository.test.js ` | |
| packages/runtime-host/dist/__tests__/skill-catalog-transaction.test.js ` | |
| packages/runtime-host/dist/__tests__/skill-catalog-two-client-uds.test.js ` | |
| 2>&1 | Tee-Object -FilePath "$env:RUNNER_TEMP/skill-catalog.tap" | |
| $exitCode = $LASTEXITCODE | |
| if ($exitCode -ne 0) { exit $exitCode } | |
| $output = Get-Content "$env:RUNNER_TEMP/skill-catalog.tap" | |
| if ($output -notcontains '# tests 91' -or $output -notcontains '# pass 91' -or $output -notcontains '# skipped 0') { | |
| Write-Error 'Skill catalog gate did not run exactly 91 passing Windows tests' | |
| exit 1 | |
| } | |
| - name: Verify SQLite crash recovery | |
| shell: pwsh | |
| run: | | |
| node.exe --test --test-concurrency=1 ` | |
| packages/storage/dist/__tests__/sqlite-runtime-crash.test.js ` | |
| packages/storage/dist/__tests__/sqlite-long-term-memory-crash.test.js | |
| - name: Verify Runtime continuation recovery | |
| shell: pwsh | |
| run: | | |
| node.exe --test --test-concurrency=1 ` | |
| packages/runtime/dist/__tests__/runtime-resume-crash.test.js ` | |
| packages/runtime/dist/__tests__/runtime-continuation-crash.test.js | |
| - name: Verify Runtime Host owner-death recovery | |
| shell: pwsh | |
| run: | | |
| node.exe --test --test-reporter=tap --test-concurrency=1 ` | |
| --test-name-pattern="owner death|a killed Host is recovered exactly once" ` | |
| packages/runtime-host/dist/__tests__/artifact-two-client-uds.test.js ` | |
| packages/runtime-host/dist/__tests__/execution-host-queue.test.js ` | |
| 2>&1 | Tee-Object -FilePath "$env:RUNNER_TEMP/runtime-host-recovery.tap" | |
| $exitCode = $LASTEXITCODE | |
| if ($exitCode -ne 0) { exit $exitCode } | |
| $output = Get-Content "$env:RUNNER_TEMP/runtime-host-recovery.tap" | |
| if ($output -notcontains '# tests 2' -or $output -notcontains '# pass 2' -or $output -notcontains '# skipped 0') { | |
| Write-Error 'Runtime Host recovery gate did not run exactly two passing tests' | |
| exit 1 | |
| } |