Skip to content

build(deps): bump the gomod-minor-patch group across 1 directory with 8 updates #530

build(deps): bump the gomod-minor-patch group across 1 directory with 8 updates

build(deps): bump the gomod-minor-patch group across 1 directory with 8 updates #530

Workflow file for this run

name: ci
on:
pull_request:
push:
branches:
- main
workflow_dispatch:
concurrency:
group: ci-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
cancel-in-progress: true
jobs:
changes:
runs-on: ubuntu-latest
outputs:
comparison_base_sha: ${{ steps.detect.outputs.comparison_base_sha }}
docs_changed: ${{ steps.detect.outputs.docs_changed }}
core_changed: ${{ steps.detect.outputs.core_changed }}
workspace_changed: ${{ steps.detect.outputs.workspace_changed }}
workspace_filters: ${{ steps.detect.outputs.workspace_filters }}
scripts_changed: ${{ steps.detect.outputs.scripts_changed }}
authority_changed: ${{ steps.detect.outputs.authority_changed }}
kit_changed: ${{ steps.detect.outputs.kit_changed }}
sdk_changed: ${{ steps.detect.outputs.sdk_changed }}
sdk_adapter_upstream_changed: ${{ steps.detect.outputs.sdk_adapter_upstream_changed }}
sdk_conformance_changed: ${{ steps.detect.outputs.sdk_conformance_changed }}
proto_changed: ${{ steps.detect.outputs.proto_changed }}
runtime_changed: ${{ steps.detect.outputs.runtime_changed }}
cognition_changed: ${{ steps.detect.outputs.cognition_changed }}
desktop_changed: ${{ steps.detect.outputs.desktop_changed }}
desktop_native_changed: ${{ steps.detect.outputs.desktop_native_changed }}
kit_native_changed: ${{ steps.detect.outputs.kit_native_changed }}
macos_platform_changed: ${{ steps.detect.outputs.macos_platform_changed }}
windows_runtime_changed: ${{ steps.detect.outputs.windows_runtime_changed }}
windows_app_tools_changed: ${{ steps.detect.outputs.windows_app_tools_changed }}
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
- name: Detect changed paths
id: detect
env:
EVENT_NAME: ${{ github.event_name }}
BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
run: node scripts/detect-ci-scope.mjs
docs-contract:
needs: changes
if: needs.changes.outputs.docs_changed == 'true'
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup pnpm
uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8
with:
version: 10.34.5
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
cache: pnpm
cache-dependency-path: pnpm-lock.yaml
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Compile examples
run: pnpm check:examples
- name: Build docs portal
run: pnpm docs:build
- name: Markdown lint baseline
run: pnpm check:markdown
- name: Install script dry-run smoke
run: pnpm check:install-script-smoke
- name: Enforce no absolute user-home paths in docs and examples
run: pnpm check:no-absolute-user-paths
core-static:
needs: changes
if: needs.changes.outputs.core_changed == 'true'
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- name: Setup pnpm
uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8
with:
version: 10.34.5
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
cache: pnpm
cache-dependency-path: pnpm-lock.yaml
- name: Setup Go for workflow lint
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
with:
go-version-file: runtime/go.mod
cache: false
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: gate.runtime.bridge-method-projection
run: pnpm check:runtime-bridge-method-drift
- name: gate.runtime.realm-broker-policy
run: pnpm check:runtime-broker-operation-policy
- name: gate.realm.no-app-rest-bypass
run: pnpm check:no-app-realm-rest-bypass
- name: gate.app.identity-surfaces
run: pnpm check:app-identity-surfaces
- name: gate.product.no-desktop-as-user-facing-name
run: pnpm check:no-desktop-as-user-facing-name
- name: gate.ui.glass-boundary
run: pnpm check:ui-glass-boundary
- name: Install Linux dependencies for Rust bridge generation
if: needs.changes.outputs.kit_changed == 'true'
run: |
sudo apt-get update
sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
- name: Check Kit contracts
if: needs.changes.outputs.kit_changed == 'true'
run: pnpm check:nimi-kit
- name: Check text-only repository gates
if: needs.changes.outputs.scripts_changed == 'true' && needs.changes.outputs.workspace_changed != 'true'
run: pnpm check:text-encoding
- name: Check license file map
run: pnpm check:license-file-map
- name: gate.workflow.actionlint
run: pnpm check:actionlint
- name: authority.canonical.check
if: needs.changes.outputs.authority_changed == 'true'
run: pnpm spec:authority:check
- name: authority.history-review
if: needs.changes.outputs.authority_changed == 'true'
env:
AUTHORITY_BASE_SHA: ${{ needs.changes.outputs.comparison_base_sha }}
run: pnpm spec:authority:review --base "$AUTHORITY_BASE_SHA"
workspace-regression:
needs: changes
if: needs.changes.outputs.workspace_changed == 'true'
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup pnpm
uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8
with:
version: 10.34.5
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
cache: pnpm
cache-dependency-path: pnpm-lock.yaml
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Test and build selected workspace consumers
env:
WORKSPACE_FILTERS: ${{ needs.changes.outputs.workspace_filters }}
SCRIPTS_CHANGED: ${{ needs.changes.outputs.scripts_changed }}
run: node scripts/run-workspace-checks.mjs
kit-native-tests:
needs: changes
if: needs.changes.outputs.kit_native_changed == 'true'
runs-on: windows-latest
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup pnpm
uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8
with:
version: 10.34.5
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
- name: Setup Rust
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable
- name: Test Kit native crates on the supported Windows host
run: pnpm test:kit:native
windows-runtime-tests:
needs: changes
if: needs.changes.outputs.windows_runtime_changed == 'true' || needs.changes.outputs.windows_app_tools_changed == 'true'
runs-on: windows-latest
timeout-minutes: 45
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup pnpm
if: needs.changes.outputs.windows_app_tools_changed == 'true'
uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8
with:
version: 10.34.5
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
- name: Setup Go
if: needs.changes.outputs.windows_runtime_changed == 'true'
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
with:
go-version-file: runtime/go.mod
cache-dependency-path: |
runtime/go.sum
nimi-cognition/go.sum
- name: Build and vet Runtime for Windows
if: needs.changes.outputs.windows_runtime_changed == 'true'
working-directory: runtime
run: |
go build ./...
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
go vet ./...
- name: Test Windows-specific Runtime owners
if: needs.changes.outputs.windows_runtime_changed == 'true'
working-directory: runtime
run: |
go test -count=1 -timeout=15m ./cmd/nimi ./internal/appstorage ./internal/daemon ./internal/daemonctl ./internal/engine ./internal/entrypoint ./internal/nimiappinstall ./internal/nimiappnative ./internal/nimiapppackage ./internal/protectedlocal ./internal/services/localservice ./tools/repair-local-agent-chat
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
go test -count=1 -timeout=10m ./internal/grpcserver -run 'Test(ResolveWindowsProfileImagePath|ProtectedProductControlRootReadsCurrentWindowsProfileMapping)'
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
go test -count=1 -timeout=10m ./internal/services/ai -run 'TestScenarioJob(PersistenceRecoversFromTransientWindowsReader|PersistenceFailsClosedForPersistentWindowsReader|AppendFailsClosedForReaderDenyingWrites|ReplacementPreservesOtherFileErrors)'
- name: Test Windows Runtime installer and acceptance scripts
if: needs.changes.outputs.windows_runtime_changed == 'true'
run: node --test scripts/windows-runtime-service-installer-contract.test.mjs scripts/accept-runtime-fixed-service.test.mjs
- name: Install dependencies for App Tools
if: needs.changes.outputs.windows_app_tools_changed == 'true'
run: pnpm install --frozen-lockfile
- name: Test App Tools on Windows
if: needs.changes.outputs.windows_app_tools_changed == 'true'
run: pnpm --filter @nimiplatform/app-tools test
macos-platform-tests:
needs: changes
if: needs.changes.outputs.macos_platform_changed == 'true'
runs-on: macos-15
timeout-minutes: 45
env:
CARGO_BUILD_JOBS: '2'
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup pnpm
uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8
with:
version: 10.34.5
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
- name: Setup Go
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
with:
go-version-file: runtime/go.mod
- name: Setup Rust
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable
- name: Require Apple Silicon and install dependencies
run: |
test "$(uname -m)" = arm64
pnpm install --frozen-lockfile
- name: Check Darwin Runtime and model storage
run: |
go -C runtime test -count=1 -timeout=5m ./internal/protectedlocal ./internal/services/localservice
go -C runtime test -count=1 -timeout=5m -tags=nimi_macos_source_local_development ./internal/protectedlocal
- name: Check default and source native carriers
run: |
cargo test --locked --manifest-path kit/shell/protected-local/Cargo.toml
cargo test --locked --manifest-path kit/shell/protected-local/Cargo.toml --features macos-source-local-development
cargo test --locked --manifest-path kit/shell/protected-local-node/Cargo.toml --features macos-source-local-development
cargo build --locked --manifest-path kit/shell/protected-local-node/Cargo.toml --features macos-source-local-development
node kit/shell/protected-local-node/test/native-input-contract.cjs
- name: Check source launch and diagnostics
run: node --test scripts/dev-runtime.test.mjs scripts/lib/dev-app-launch.test.mjs scripts/doctor-dev.test.mjs
- name: Check local audio capture and streaming
run: go -C runtime test -count=1 -timeout=5m ./internal/capabilitydriver ./internal/nimillm ./internal/engine ./internal/services/ai -run 'Test(DemucsOwned|AudioSeparation|NativeSeparation|SeparationArtifacts|HTDemucs)'
- name: Check supervised Python audio Host
working-directory: runtime/internal/engine/assets
run: python3 -m unittest speech_server_test
- name: Check affected workspace consumers on macOS
if: needs.changes.outputs.workspace_changed == 'true'
env:
WORKSPACE_FILTERS: ${{ needs.changes.outputs.workspace_filters }}
SCRIPTS_CHANGED: 'false'
run: |
node scripts/run-workspace-checks.mjs
for consumer in lab zhiyu nimigo nimiday; do
pnpm --filter "@nimiplatform/$consumer" exec tsc --noEmit -p tsconfig.electron.json
done
sdk-quality:
needs: changes
if: needs.changes.outputs.sdk_changed == 'true'
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup pnpm
uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8
with:
version: 10.34.5
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
cache: pnpm
cache-dependency-path: pnpm-lock.yaml
- name: Setup Go for deterministic Buf
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
with:
go-version-file: runtime/go.mod
cache: false
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Install deterministic Buf CLI
run: |
go install github.com/bufbuild/buf/cmd/buf@v1.70.0
echo "$(go env GOPATH)/bin" >> "${GITHUB_PATH}"
- name: Build SDK and check public surface
run: pnpm check:sdk-vnext-public-surface-smoke
- name: SDK generator drift check
run: PATH="${PWD}/node_modules/.bin:${PATH}" pnpm check:sdks-generators
- name: SDK typed-core conformance check
if: needs.changes.outputs.sdk_conformance_changed == 'true'
run: pnpm check:sdks-conformance-typed-core
- name: SDK adapter upstream compatibility
if: needs.changes.outputs.sdk_adapter_upstream_changed == 'true'
run: pnpm test:sdks-adapters:upstream
runtime-quality:
needs: changes
if: needs.changes.outputs.runtime_changed == 'true'
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup pnpm
uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8
with:
version: 10.34.5
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
cache: pnpm
cache-dependency-path: pnpm-lock.yaml
- name: Setup Go
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
with:
go-version-file: runtime/go.mod
cache-dependency-path: |
runtime/go.sum
nimi-cognition/go.sum
- name: Setup Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.12'
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Install Buf CLI
run: go install github.com/bufbuild/buf/cmd/buf@v1.70.0
- name: gate.runtime.import-boundary
run: pnpm check:runtime-import-boundary
- name: gate.runtime.catalog-drift
run: pnpm check:runtime-catalog-drift
- name: Runtime tests
run: pnpm test:runtime:go && pnpm test:runtime:python
- name: Runtime vet and build
working-directory: runtime
run: go vet ./... && go build ./...
- name: Runtime golangci-lint
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
with:
version: v2.12.2
working-directory: runtime
- name: Cognition tests and lint
if: needs.changes.outputs.cognition_changed == 'true'
run: pnpm --filter @nimiplatform/cognition test && pnpm check:cognition-golangci-lint
proto-quality:
needs: changes
if: needs.changes.outputs.proto_changed == 'true'
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup pnpm
uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8
with:
version: 10.34.5
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
cache: pnpm
cache-dependency-path: pnpm-lock.yaml
- name: Setup Go for deterministic Buf
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
with:
go-version-file: runtime/go.mod
cache: false
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Install deterministic Buf CLI
run: |
go install github.com/bufbuild/buf/cmd/buf@v1.70.0
echo "$(go env GOPATH)/bin" >> "${GITHUB_PATH}"
- name: Fetch the published wire baseline source
run: |
set -euo pipefail
source_tag="$(node scripts/proto-breaking.mjs --source-tag)"
git fetch --no-tags --depth=1 origin "+refs/tags/${source_tag}:refs/tags/${source_tag}"
- name: Proto breaking-change gate tests
env:
NIMI_PROTO_GATE_REQUIRE_BUF: '1'
run: node --test scripts/proto-breaking.test.mjs
- name: Proto breaking-change gate
run: pnpm proto:breaking
- name: Proto generated drift gate
run: pnpm proto:drift-check
- name: Proto lint gate
run: pnpm proto:lint
desktop-web-quality:
needs: changes
if: needs.changes.outputs.desktop_changed == 'true'
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup pnpm
uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8
with:
version: 10.34.5
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
cache: pnpm
cache-dependency-path: pnpm-lock.yaml
- name: Setup Rust
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable
components: clippy
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Complete Desktop Electron native quality gate
if: needs.changes.outputs.desktop_native_changed == 'true'
run: pnpm check:desktop-native-quality
- name: Lint Desktop Electron
run: pnpm --filter @nimiplatform/desktop lint
ci-required:
name: ci-required
if: always()
needs:
- changes
- docs-contract
- core-static
- workspace-regression
- kit-native-tests
- windows-runtime-tests
- macos-platform-tests
- sdk-quality
- runtime-quality
- proto-quality
- desktop-web-quality
runs-on: ubuntu-latest
steps:
- name: Checkout CI selection policy
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Require every selected CI lane to pass
env:
NEEDS_JSON: ${{ toJSON(needs) }}
run: |
node --input-type=module <<'NODE'
import { assertCiResults } from './scripts/lib/ci-scope.mjs';
assertCiResults(JSON.parse(process.env.NEEDS_JSON));
NODE