feat(tin-2423): substrate-boundary conformance validator (ledger item… #37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Self-contained CI for the personal tinyland-goo spoke, run through the Nix | |
| # devshell + `just` so CI == local == deploy. The scaffold default delegates to | |
| # the org's reusable spoke-ci.yml (org runner classes) that a personal repo | |
| # can't `uses:`; we wire the equivalent gates ourselves. Cache-read attach is | |
| # available via the jesssullivan-infra overlay + the gf-reapi OIDC token | |
| # exchange (no re-home), but is left dormant: Bazel is toolchain-only here and | |
| # never builds the site, so the realized cache win is ~nil. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check-build: | |
| name: check + static build (Nix devshell) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: cachix/install-nix-action@v31 | |
| with: | |
| extra_nix_config: | | |
| experimental-features = nix-command flakes | |
| - name: Install workspace dependencies | |
| run: nix develop --command just setup | |
| - name: Secrets scan (gitleaks, from the devshell) | |
| run: nix develop --command just secrets-scan-dir | |
| - name: Internal-endpoint leak scan (public-safe) | |
| run: nix develop --command just scan-endpoints | |
| - name: Conformance (16-item scaffold checklist) | |
| run: nix develop --command just conformance | |
| - name: Check (svelte-check + vitest + Flywheel contract) | |
| run: nix develop --command just check | |
| - name: Build (project base path) | |
| run: nix develop --command just build | |
| env: | |
| BASE_PATH: /tinyland-goo | |
| bazel-graph: | |
| name: Bazel module-graph integrity | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: cachix/install-nix-action@v31 | |
| with: | |
| extra_nix_config: | | |
| experimental-features = nix-command flakes | |
| # Toolchain-only module-graph proof; the site build stays `pnpm run build`. | |
| - name: bazelisk mod graph | |
| run: nix develop --command bazelisk mod graph | |
| - name: MODULE.bazel.lock has not drifted | |
| run: nix develop --command bazelisk mod graph --lockfile_mode=error | |
| # (A) GloriousFlywheel CACHE-FIRST lane (shared-cache-backed). The honestly- | |
| # live-today tier: runs-on the in-cluster tinyland-nix ARC lane (the cache data | |
| # plane is svc-internal; a hosted runner can mint a token but cannot reach it), | |
| # which injects BAZEL_REMOTE_CACHE. Read-only (uploads off per TIN-1147). Gated | |
| # on FLYWHEEL_ENABLED → skip-green until the operator arms it. | |
| flywheel-cache: | |
| name: Flywheel cache-first (shared-cache-backed) | |
| runs-on: tinyland-nix | |
| timeout-minutes: 20 | |
| if: ${{ vars.FLYWHEEL_ENABLED == 'true' }} | |
| env: | |
| GF_BAZEL_SUBSTRATE_MODE: shared-cache-backed | |
| GF_BAZEL_REMOTE_UPLOAD: 'false' | |
| # flywheel-doctor fails closed when the fleet profile state is unset and | |
| # the ARC runner env does not inject it — same one-liner as GF's own | |
| # fresh-repo-enrollment-proof.yml. A mode string, not an endpoint. | |
| GF_FLYWHEEL_PROFILE_STATE: shared-cache-backed | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: cachix/install-nix-action@v31 | |
| with: | |
| extra_nix_config: | | |
| experimental-features = nix-command flakes | |
| - name: Flywheel doctor | |
| run: nix develop --command just flywheel-doctor | |
| - name: Flywheel cache-first remote check | |
| run: nix develop --command just flywheel-check | |
| # (B) GloriousFlywheel EXECUTOR-BACKED RBE lane (the proof tier). NON-REQUIRED: | |
| # double-gated on the FLYWHEEL_EXECUTOR_ENABLED kill-switch AND same-repo only. | |
| # The executor cell is scale-to-zero-between-proofs + render-time placeholders | |
| # today, so leave this OFF until ≥2 cold-start gf-reapi-cell proofs are green. | |
| # Endpoint-free: the require-executor step asserts the runner-injected cache + | |
| # executor env, then OIDC-mints a short-lived gf-reapi-cell token (public | |
| # exchange); the wrapper attaches them. Local machine stays a thin Bazel driver. | |
| flywheel-executor: | |
| name: Flywheel executor-backed RBE (proof lane; non-required) | |
| if: >- | |
| vars.FLYWHEEL_EXECUTOR_ENABLED == 'true' && | |
| (github.event_name != 'pull_request' || | |
| github.event.pull_request.head.repo.full_name == github.repository) | |
| permissions: | |
| contents: read | |
| id-token: write | |
| runs-on: tinyland-nix | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: cachix/install-nix-action@v31 | |
| with: | |
| extra_nix_config: | | |
| experimental-features = nix-command flakes | |
| - name: Require executor-backed GloriousFlywheel lane | |
| run: | | |
| set -euo pipefail | |
| if [ -z "${BAZEL_REMOTE_CACHE:-}" ]; then | |
| echo "::error::BAZEL_REMOTE_CACHE is missing. This job must run on the in-cluster GloriousFlywheel ARC lane." | |
| exit 1 | |
| fi | |
| if [ -z "${BAZEL_REMOTE_EXECUTOR:-}" ]; then | |
| echo "::error::BAZEL_REMOTE_EXECUTOR is missing. Refusing to run check/test as shared-cache local work on an RBE-named lane." | |
| exit 1 | |
| fi | |
| echo "GF_BAZEL_SUBSTRATE_MODE=executor-backed" >> "$GITHUB_ENV" | |
| echo "GF_BAZEL_REMOTE_EXECUTION_PLATFORM=${GF_BAZEL_REMOTE_EXECUTION_PLATFORM:-gloriousflywheel-rbe-linux-x86_64}" >> "$GITHUB_ENV" | |
| - name: Mint GloriousFlywheel REAPI token | |
| env: | |
| GF_REAPI_TOKEN_EXCHANGE_TTL: 45m | |
| # Endpoint stays env authority: an unset repo variable falls through | |
| # to the script's public-front-door default. | |
| GF_REAPI_TOKEN_EXCHANGE_URL: ${{ vars.GF_REAPI_TOKEN_EXCHANGE_URL }} | |
| run: nix develop --command bash scripts/mint-gf-reapi-token-from-exchange.sh | |
| - name: Validate executor-backed attachment | |
| run: nix develop --command bash scripts/cache-attachment-contract.sh --strict | |
| - name: Remote check + test (executor-backed RBE) | |
| run: nix develop --command just flywheel-executor-check |