From c5a226f29157dfdba169ff9eb46800d996f8bc6a Mon Sep 17 00:00:00 2001 From: Codex Bot Date: Tue, 20 Oct 2026 01:10:02 +0800 Subject: [PATCH] ci: verify Tessera remotely against the separated Aster engine --- .dockerignore | 8 +++++++ .gitea/README.md | 22 +++++++++++++++++ .gitea/workflows/README.md | 5 ++++ .gitea/workflows/ci.yml | 49 ++++++++++++++++++++++++++++++++++++++ Dockerfile.ci | 10 ++++++++ README.md | 6 ++++- vendor/README.md | 3 +-- vendor/aster | 2 +- 8 files changed, 101 insertions(+), 4 deletions(-) create mode 100644 .dockerignore create mode 100644 .gitea/README.md create mode 100644 .gitea/workflows/README.md create mode 100644 .gitea/workflows/ci.yml create mode 100644 Dockerfile.ci diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..893df3b --- /dev/null +++ b/.dockerignore @@ -0,0 +1,8 @@ +.git +**/.git +target +**/target +**/AGENTS.md +**/work +**/ci-output +.env diff --git a/.gitea/README.md b/.gitea/README.md new file mode 100644 index 0000000..3681d3f --- /dev/null +++ b/.gitea/README.md @@ -0,0 +1,22 @@ +# Tessera GUI automation + +[workflows](workflows/README.md) contains repository workflows. + +## CI checkout prerequisites + +All workflows use `runs-on: ces-control`; no shared Runner configuration is changed. +Configure repository or organization secrets `CODEX_BOT_SSH_KEY` (the dedicated +codex-bot private SSH key) and `GITEA_SSH_KNOWN_HOSTS` (the independently verified +known_hosts entry for `[gitea.entroia.com]:22222`). The bot needs read access to the +repository and its Aster submodule. Workflows use an isolated SSH command with +`-F /dev/null`, `IdentitiesOnly=yes`, an explicit key and port, strict host-key +checking, and temporary credential files removed after checkout. Keys are never +written into tracked files. Missing secrets fail checkout explicitly. + +The SSH submodule URL's repository owner is separate from the authenticated bot. +Local Git operations must use the same dedicated bot identity; configure the +checkout's isolated command in `GIT_SSH_COMMAND` for submodule initialization. + +Workflow definitions do not prove CI passed. CI/deployment state is not queried +automatically. Local runtime checks are not performed for Aster, Lyra or Hestia; +Tessera permits local native builds/window runs, with automated tests in CI. diff --git a/.gitea/workflows/README.md b/.gitea/workflows/README.md new file mode 100644 index 0000000..bf083ac --- /dev/null +++ b/.gitea/workflows/README.md @@ -0,0 +1,5 @@ +# Tessera GUI workflows + +[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. Checkout and secret requirements are in [the parent README](../README.md). + +There is no production service deployment in this workflow. diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml new file mode 100644 index 0000000..988ea2a --- /dev/null +++ b/.gitea/workflows/ci.yml @@ -0,0 +1,49 @@ +name: Verify Tessera GUI + +on: + push: + branches: [main] + pull_request: + workflow_dispatch: + +jobs: + verify: + runs-on: ces-control + timeout-minutes: 60 + env: + DOCKER_BUILDKIT: "0" + steps: + - name: Checkout with codex-bot + env: + CODEX_BOT_SSH_KEY: ${{ secrets.CODEX_BOT_SSH_KEY }} + GITEA_SSH_KNOWN_HOSTS: ${{ secrets.GITEA_SSH_KNOWN_HOSTS }} + SOURCE_SHA: ${{ gitea.sha }} + SOURCE_REPOSITORY: ${{ gitea.repository }} + run: | + set -eu + test -n "$CODEX_BOT_SSH_KEY" + test -n "$GITEA_SSH_KNOWN_HOSTS" + case "$SOURCE_SHA" in *[!0-9a-f]*|'') exit 1;; esac + test "${#SOURCE_SHA}" -eq 40 + umask 077 + checkout_keys=$(mktemp -d) + trap 'rm -rf "$checkout_keys"' EXIT + printf '%s\n' "$CODEX_BOT_SSH_KEY" > "$checkout_keys/key" + printf '%s\n' "$GITEA_SSH_KNOWN_HOSTS" > "$checkout_keys/known_hosts" + unset CODEX_BOT_SSH_KEY GITEA_SSH_KNOWN_HOSTS + export GIT_SSH_COMMAND="ssh -F /dev/null -o IdentitiesOnly=yes -i $checkout_keys/key -p 22222 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$checkout_keys/known_hosts" + git init . + source_url="ssh://git@gitea.entroia.com:22222/$SOURCE_REPOSITORY.git" + if git remote get-url origin >/dev/null 2>&1; then + git remote set-url origin "$source_url" + else + git remote add origin "$source_url" + fi + git fetch --no-tags --depth=1 origin "$SOURCE_SHA" + git checkout --detach --force FETCH_HEAD + git submodule update --init --recursive + - name: Verify portable GUI code + run: | + image="endorphin-tessera-gui-ci:${{ gitea.sha }}" + docker build -f Dockerfile.ci -t "$image" . + docker run --rm --init "$image" diff --git a/Dockerfile.ci b/Dockerfile.ci new file mode 100644 index 0000000..911657a --- /dev/null +++ b/Dockerfile.ci @@ -0,0 +1,10 @@ +FROM rust:1.91.1-bookworm +WORKDIR /build +RUN apt-get update && apt-get install -y --no-install-recommends pkg-config libx11-dev libxkbcommon-dev libwayland-dev libudev-dev libegl1-mesa-dev libgbm-dev \ + && rm -rf /var/lib/apt/lists/* \ + && rustup component add rustfmt clippy +ENV CARGO_BUILD_JOBS=1 CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_TEST_DEBUG=0 +COPY Cargo.toml Cargo.lock ./ +COPY src ./src +COPY vendor ./vendor +CMD ["sh", "-eu", "-c", "cargo fmt --check && cargo test --locked && cargo clippy --all-targets --locked -- -D warnings"] diff --git a/README.md b/README.md index c07fb4e..2798faa 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ Initialize the Aster submodule first, following the SSH identity instructions in git submodule update --init --recursive ``` -In the designated build or validation environment: +For local native builds and window runs (automated tests run only in CI): ```bash cargo run --release @@ -102,3 +102,7 @@ The first parser intentionally supports only enough syntax to test the architect - `gap`, `padding`, and `.title` There are no files, HTML, CSS, JavaScript, DOM, or resource-network concepts in the runtime. + +## Validation + +Local Cargo builds and native window runs are allowed; do not run local tests or Docker. Automated tests and Clippy run in [.gitea](.gitea/README.md) on ces-control using Dockerfile.ci. The Linux CI checks portable code and software-renderer tests, not macOS window presentation. Aster dependency unit tests remain in Aster CI. CI bot SSH secrets are documented in .gitea/README.md. diff --git a/vendor/README.md b/vendor/README.md index 49a25a3..f0ddcc4 100644 --- a/vendor/README.md +++ b/vendor/README.md @@ -56,8 +56,7 @@ git -C vendor/aster fetch origin git -C vendor/aster checkout --detach ``` -Review the Aster changes and reconcile Tessera's dependencies and lockfile in the -designated validation environment as needed. Commit `vendor/aster` in Tessera +Review the Aster changes and reconcile Tessera's dependencies and lockfile as needed; local native compilation is allowed, while automated tests run in CI. Commit `vendor/aster` in Tessera along with any integration changes; that records the new Aster commit. Aster updates do not automatically advance Tessera's recorded revision. diff --git a/vendor/aster b/vendor/aster index 51cd64e..55475a9 160000 --- a/vendor/aster +++ b/vendor/aster @@ -1 +1 @@ -Subproject commit 51cd64e6884c1036564c22e5de582c083d6db142 +Subproject commit 55475a9d4b3948a569bf76c84041ad9cea0ec6ea