ClawRouter/.github/workflows/ci.yml at main · BlockRunAI/ClawRouter · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint & Typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # Node 24, not the package's `engines` floor of 22: the openclaw
      # devDependency (2026.10+) refuses to install below Node 24.16, so
      # `npm ci` fails on 22. Users still install fine on 22 — openclaw is
      # dev-only here, and test/Dockerfile.install-test keeps covering 22.
      # `check-latest`: the floor moves with Node security releases (2026.10.6
      # needs 24.22.1) and the runner's cached "24" lags them by weeks.
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "24"
          check-latest: true
          cache: npm

      - run: npm ci

      - name: Check formatting
        run: npx prettier --check .

      - name: Lint
        run: npx eslint src/

      - name: Typecheck
        run: npm run typecheck

  build-and-test:
    name: Build & Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "24"
          check-latest: true
          cache: npm

      - run: npm ci

      - name: Build
        run: npm run build

      # The unit suite (713 tests) was never wired in here — only the lifecycle
      # integration test ran, so a failing unit test could merge unnoticed.
      - name: Unit tests
        run: npm test

      # Fails when a number in the docs disagrees with brand-numbers.json.
      # Offline by design: it reads the committed snapshot and never fetches, so
      # a blockrun.ai deploy in progress cannot fail this repo's CI.
      - name: Brand numbers
        run: node scripts/sync-brand-numbers.mjs --check

      - name: Integration tests (lifecycle)
        run: npx vitest run --config vitest.integration.config.ts test/integration/lifecycle.test.ts

  # apps/desktop is a separate npm project — the root `npm ci` and `npm test`
  # above never touch it. Without this job its 47 tests, its typecheck and both
  # its builds are unrun on every PR, which is how the Desktop app landed in
  # #313 with no coverage at all: #291 added this job, and the branch that
  # superseded it did not carry it over.
  #
  # Deliberately NOT running `verify:runtime` here. That guard compares the
  # runtime lockfile to CLAWROUTER_PACKAGE_VERSION, and it is expected to fail
  # between a release commit and the follow-up relock — npm cannot serve the
  # version the release commit is publishing. It belongs in `dist`/`dist:release`
  # (see apps/desktop/scripts/verify-runtime-pin.mjs), where packaging happens
  # after both. Running it on every push would make each release red.
  desktop:
    name: Desktop
    runs-on: macos-latest
    defaults:
      run:
        working-directory: apps/desktop
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "24"
          check-latest: true
          cache: npm
          cache-dependency-path: |
            package-lock.json
            apps/desktop/package-lock.json

      # The Desktop typecheck reaches into the repo root: manager.ts imports
      # `../../../../src/solana-key.js` (the Solana derivation shared with the
      # proxy). TypeScript resolves that file's own imports from ITS directory,
      # so @noble/hashes and @scure/bip39 must be present in the ROOT
      # node_modules — declaring them in apps/desktop/package.json does not
      # satisfy it. Locally this passes only because the root install happens to
      # be there; in a clean checkout it fails.
      - name: Install root dependencies
        run: npm ci
        working-directory: .

      - run: npm ci

      - name: Test
        run: npm test

      - name: Typecheck
        run: npm run typecheck

      - name: Build
        run: npm run build