agentic-kit/.github/workflows/devcontainers.yml at main · pacphi/agentic-kit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
name: devcontainers

# Builds and smoke-tests both dev container configs with the reference
# devcontainer CLI — the same tool Codespaces/VS Code use — so a config
# change is proven before merge (PR trigger) and upstream drift (base image
# tags, the published npm package's install path) is caught even when
# nothing in this repo changed (monthly schedule). See docs/DEVCONTAINERS.md.

on:
  pull_request:
    paths: &all-paths
      - '.devcontainer/**'
      - 'docker/Dockerfile'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - 'pnpm-workspace.yaml'
      - 'bin/**'
      - 'src/**'
      - '.github/workflows/devcontainers.yml'
  push:
    branches: [main]
    paths: *all-paths
  schedule:
    # Monthly: dev container definitions change rarely, but the base image
    # tag and the published package they install can drift independently.
    - cron: '23 6 1 * *'
  workflow_dispatch:

jobs:
  # Narrows the two jobs below to only what each one actually depends on, so
  # a docker/Dockerfile-only change (consumer) doesn't rebuild the maintainer
  # config and vice versa. Scheduled/manual runs always exercise both — that
  # is the point of the monthly drift check, there is no diff to filter on.
  changes:
    name: detect relevant changes
    runs-on: ubuntu-latest
    outputs:
      maintainer: ${{ steps.filter.outputs.maintainer || 'true' }}
      consumer: ${{ steps.filter.outputs.consumer || 'true' }}
    steps:
      - uses: actions/checkout@v7
        if: github.event_name == 'pull_request' || github.event_name == 'push'
      - uses: dorny/paths-filter@v4
        id: filter
        if: github.event_name == 'pull_request' || github.event_name == 'push'
        with:
          filters: |
            maintainer:
              - '.devcontainer/devcontainer.json'
              - 'package.json'
              - 'pnpm-lock.yaml'
              - 'pnpm-workspace.yaml'
              - 'bin/**'
              - 'src/**'
              - '.github/workflows/devcontainers.yml'
            consumer:
              - '.devcontainer/consumer/**'
              - 'docker/Dockerfile'
              - '.github/workflows/devcontainers.yml'

  maintainer:
    name: maintainer devcontainer (build from this checkout)
    needs: changes
    if: needs.changes.outputs.maintainer == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      # `up` runs postCreateCommand (corepack enable && pnpm install && npm
      # link), then runCmd proves `ak` actually resolved to THIS checkout —
      # not a stale global — before running the fast surface test.
      - name: Build + smoke test
        uses: devcontainers/ci@v0.3
        with:
          configFile: .devcontainer/devcontainer.json
          push: never
          runCmd: |
            set -euo pipefail
            linked=$(ak --version)
            pkg=$(node -p "require('./package.json').version")
            echo "ak --version: ${linked}"
            echo "package.json: ${pkg}"
            case "${linked}" in
              *"${pkg}"*) ;;
              *) echo "npm link did not resolve to this checkout" >&2; exit 1 ;;
            esac
            pnpm run test:surface

  consumer:
    name: consumer devcontainer (published release)
    needs: changes
    if: needs.changes.outputs.consumer == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      # `up` runs postCreate.sh (npm install -g the published package, seeds
      # ~/sandbox); runCmd checks the CLI is reachable and the sandbox exists.
      - name: Build + smoke test
        uses: devcontainers/ci@v0.3
        with:
          configFile: .devcontainer/consumer/devcontainer.json
          push: never
          runCmd: |
            set -euo pipefail
            which ak
            ak --version
            ak --help --all > /dev/null
            test -d "$HOME/sandbox/.git"
            echo "sandbox present at $HOME/sandbox"