ci(codeapi): publish services/codeapi to public code-interpreter repo #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Standalone CI for the public ClickHouse/code-interpreter repo, which is | |
| # published from services/codeapi via `git subtree split` (see | |
| # .github/workflows/publish-codeapi.yml in the monorepo). This file is | |
| # inert inside the monorepo — GitHub only runs workflows from the repo | |
| # root — and becomes the root workflow after the split. Keep it in sync | |
| # with ci-codeapi.yml. | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| concurrency: | |
| group: ci-${{ github.ref_name }} | |
| cancel-in-progress: true | |
| jobs: | |
| api-unit-tests: | |
| name: API Unit Tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: api | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.13 | |
| - name: Cache Bun packages | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-codeapi-api-bun-1.3.13-${{ hashFiles('api/bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-codeapi-api-bun-1.3.13- | |
| - name: Install dependencies | |
| run: bun ci | |
| - name: Build API | |
| run: bun run build | |
| - name: Compile + smoke spec-guard | |
| # spec-guard.c is otherwise only compiled by api/Dockerfile, which | |
| # the helm workflow builds post-merge. Catching syntax errors and | |
| # exec-semantic regressions pre-merge prevents broken sandbox | |
| # binaries from reaching the image build. | |
| working-directory: api/src | |
| run: | | |
| gcc -O2 -static -Wall -Wextra -Werror -o /tmp/spec-guard spec-guard.c | |
| # Smoke: spec-guard must execvp its argument cleanly. Use a | |
| # parent process with a known FD population so we also assert | |
| # the close-inherited-FDs path runs (child must see only the | |
| # FDs `ls` itself opens). | |
| PARENT_FDS=$(bash -c 'exec 10<&0 11<&0 12<&0 13<&0 14<&0; ls /proc/self/fd | wc -l') | |
| CHILD_FDS=$(bash -c 'exec 10<&0 11<&0 12<&0 13<&0 14<&0; /tmp/spec-guard /bin/ls /proc/self/fd | wc -l') | |
| echo "parent fds (with 5 extra inherited): $PARENT_FDS" | |
| echo "child fds via spec-guard: $CHILD_FDS" | |
| test "$PARENT_FDS" -ge 8 || { echo "FAIL: parent did not actually inherit extra FDs"; exit 1; } | |
| test "$CHILD_FDS" -le 5 || { echo "FAIL: spec-guard did not close inherited FDs (child saw $CHILD_FDS)"; exit 1; } | |
| - name: Bun tests | |
| run: bun run test | |
| service-unit-tests: | |
| name: Service Unit Tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: service | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.13 | |
| - name: Cache Bun packages | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-codeapi-service-bun-1.3.13-${{ hashFiles('service/bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-codeapi-service-bun-1.3.13- | |
| - name: Install dependencies | |
| run: bun ci | |
| - name: Bun tests | |
| run: bun run test |