CoalLedger/.github/workflows/ci.yml at main · TheColliery/CoalLedger · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
name: CI

on:
  push:
    branches: [main]
    paths-ignore:
      # skip verify/test only for NON-shipped docs — a SHIPPED markdown artifact (skills/**/SKILL.md, commands/*.md) MUST run CI (verify checks dist-sync)
      - 'README.md'
      - 'CHANGELOG.md'
      - 'CONTRIBUTING.md'
      - 'PRIVACY.md'
      - 'SECURITY.md'
      - 'LICENSE'
      - 'NOTICE'
  pull_request:
    branches: [main]
    paths-ignore:
      # skip verify/test only for NON-shipped docs — a SHIPPED markdown artifact (skills/**/SKILL.md, commands/*.md) MUST run CI (verify checks dist-sync)
      - 'README.md'
      - 'CHANGELOG.md'
      - 'CONTRIBUTING.md'
      - 'PRIVACY.md'
      - 'SECURITY.md'
      - 'LICENSE'
      - 'NOTICE'

permissions:
  contents: read

# cancel-in-progress: TRUE (CWK-058, canon: .github/SKILL-REPO-PATTERN.md) -- this
# workflow only reads, tests and compares; it publishes nothing and touches no external
# state, so a superseded run has nothing half-done to leave behind.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  gate:
    name: gate (${{ matrix.os }} · node ${{ matrix.node }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node: [22, 24]  # supported LTS only (24 Active, 22 Maintenance); 18/20 are EOL — bump as the Node LTS schedule moves
    runs-on: ${{ matrix.os }}
    timeout-minutes: 10 # testing.md: every run has a finite clock; CWK-154 (2) — sized from this room's own measured suite time under the wave runner (2026-10-09, n = 3 on a shared box, 34 files in waves: median 231 s, max 264 s; the runner ends a stuck run itself, 450 s for the waves, scripts/lib/test-plan.mjs, which leaves 150 s of this 600 s for checkout, setup-node and verify), zero-dependency, no install step, not the template's generic placeholder
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false # CWK-154 (2) — this job reads, tests and compares; it pushes nothing
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: ${{ matrix.node }}
      # Zero-dependency: no install step. Run the same fail-loud gate as a local pre-push,
      # cross-platform — verify (dist-sync + repo consistency checks) then the test suite.
      # No build step here: rebuilding the dist in CI would mask a stale COMMITTED
      # plugin/ — the exact drift verify exists to catch.
      - run: node scripts/verify.mjs
      - run: node scripts/test.mjs


  # A single STABLE required-check context (the matrix names drift; this does not).
  # Succeeds iff every matrix gate passed or was legitimately skipped; fails if any
  # gate failed. Rulesets require `all-green`, never the per-matrix names.
  all-green:
    name: all-green
    needs: gate
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5 # testing.md: every run has a finite clock; CWK-154 (2) — a bare case statement, no checkout
    steps:
      - name: gate result
        run: |
          case "${{ needs.gate.result }}" in
            success|skipped) echo "gate ${{ needs.gate.result }}"; exit 0 ;;
            *) echo "gate ${{ needs.gate.result }}"; exit 1 ;;
          esac