1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172

# The build, on rickub. GitLab CI next door reads source and no more, and
# deliberately builds nothing. This is the other half: three suites, each one
# checking a different seam.
#
# Nothing here is handed to Modal. The header used to say this job passed the
# work to a Sandbox against the `devshell` volume — that was the web bundle,
# and both the web target and the container that built it are gone. What runs
# now is small enough for a runner: Nim in about a second, Dart in less, and
# Flutter for as long as a Flutter toolchain takes to arrive.
#
# Every toolchain is a sha256-pinned tarball rather than an apt package or a
# third-party setup action, which is this repo's habit — see
# `tools/toolchain.sh`, which fetches the same two by the same hashes.
#
# Lives in .rickub/workflows/ rather than .github/workflows/ because rickub
# reads one or the other and never both: with this directory present, a
# .github/workflows/ added later would be silently ignored. There is none
# today, so nothing is being shadowed — see
# https://rickub.com/docs/actions and https://rickub.com/docs/migrating-from-github

name: build

on:
  push:
  workflow_dispatch:

jobs:
  # The Nim core: its own suite, and the library the Dart job needs.
  #
  # NOT in a `container:`, and that is the whole reason this job is shaped the
  # way it is. `actions/upload-artifact` is a node20 action and JS actions run
  # inside the job container, so `nimlang/nim` — which carries no node — failed
  # the upload step with `node: command not found` after everything real had
  # already passed. The runner image has node; Nim is what it lacks, and Nim is
  # the easier of the two to bring.
  #
  # Pinned by sha256 rather than taken from apt, which is this repo's habit
  # elsewhere — see `tools/toolchain.sh`, which fetches Flutter, a JDK and the
  # Clojure CLI the same way. An apt Nim is whatever the distro froze, and
  # `nim/nim.cfg` needs >= 2.0.
  nim-test:
    runs-on: ubuntu-latest
    env:
      NIM_VERSION: "2.2.10"
      NIM_SHA256: "0a3a38752e97e9d44aa479b3a7b37336dfe0176daf22ee5b5218ad0991ecd211"
    steps:
      - uses: actions/checkout@v4

      # libssl-dev because `nim/nim.cfg` sets `-d:ssl`: std/net wants OpenSSL
      # for the TLS on :6697 and `frq.atproto` uses httpclient over the same.
      - name: OpenSSL headers
        run: sudo apt-get update -qq && sudo apt-get install -y -qq libssl-dev

      - name: Nim ${{ env.NIM_VERSION }}
        run: |
          set -euo pipefail
          url="https://nim-lang.org/download/nim-${NIM_VERSION}-linux_x64.tar.xz"
          curl -fsSL -o /tmp/nim.tar.xz "$url"
          echo "${NIM_SHA256}  /tmp/nim.tar.xz" | sha256sum -c -
          mkdir -p /opt/nim && tar -xJf /tmp/nim.tar.xz -C /opt/nim --strip-components=1
          echo "/opt/nim/bin" >> "$GITHUB_PATH"

      - name: The Nim suite
        run: cd nim && for t in tests/t*.nim; do nim c -r --hints:off --path:src "$t"; done

      - name: Build libfrqcore.so
        run: |
          cd nim && nim c --app:lib --mm:orc -d:release --hints:off --path:src \
            --out:../build/nim/libfrqcore.so src/frq_core.nim
          # Diagnostic, not a gate. Worth reading: Nim resolves OpenSSL through
          # dlopen rather than a link-time NEEDED, so libssl will not appear
          # here and the Dart job still has to have one installed.
          objdump -p ../build/nim/libfrqcore.so | grep NEEDED || true

      - uses: actions/upload-artifact@v4
        with:
          name: libfrqcore
          path: build/nim/libfrqcore.so
          if-no-files-found: error

  # The Dart side of the same boundary, on the plain VM — no Flutter, no
  # emulator, which is what makes it a second to run.
  #
  # No container here either, for the same node reason: `download-artifact` is
  # a JS action too. Dart comes from its own setup action instead.
  #
  # `libssl3` because the .so dlopens OpenSSL at startup and the Dart SDK
  # carries its own BoringSSL rather than bringing one.
  dart-test:
    runs-on: ubuntu-latest
    needs: [nim-test]
    env:
      DART_VERSION: "3.13.4"
      DART_SHA256: "6487a10df5eab890d746d14a55f4c70bec3c1c0633f51804eb504cbc0fc395bb"
    steps:
      - uses: actions/checkout@v4

      # The SDK by sha256 rather than `dart-lang/setup-dart`, for the reason
      # the Nim job pins its tarball: a third-party action is one more thing
      # that has to resolve on this host, and this one does not have to.
      - name: Dart ${{ env.DART_VERSION }}
        run: |
          set -euo pipefail
          url="https://storage.googleapis.com/dart-archive/channels/stable/release/${DART_VERSION}/sdk/dartsdk-linux-x64-release.zip"
          curl -fsSL -o /tmp/dart.zip "$url"
          echo "${DART_SHA256}  /tmp/dart.zip" | sha256sum -c -
          sudo unzip -q /tmp/dart.zip -d /opt
          echo "/opt/dart-sdk/bin" >> "$GITHUB_PATH"

      - run: sudo apt-get update -qq && sudo apt-get install -y -qq libssl3
      - uses: actions/download-artifact@v4
        with:
          name: libfrqcore
          path: build/nim
      - run: cd dart/frq_core && dart pub get && dart test -r expanded

  # The screens, laid out for real. Widget tests on the Dart VM: headless, no
  # GL and no window, which is exactly what makes them the check a Wayland
  # window cannot be — a GUI on Wayland cannot be clicked by a script, so for
  # a long time the biggest screen in the app went out unverified.
  #
  # They have caught five regressions that the Nim and Dart suites cannot see,
  # because what they check is what Flutter does with the tree rather than
  # what the tree says: `Expanded` outside a Flex, a `Wrap` handing a child
  # unbounded width, a scrollbar on a different controller from its view.
  #
  # The cost is a Flutter toolchain, which is why this job is last and why it
  # needs neither of the others to pass first — it needs the library the Nim
  # job builds, and nothing from Dart.
  layout-test:
    runs-on: ubuntu-latest
    needs: [nim-test]
    env:
      # The same version and hash `tools/toolchain.sh` pins, because a suite
      # that passes here and fails on the developer's machine is worse than no
      # suite. Two places rather than one is the price of a workflow file that
      # cannot source a shell script it also has to trust.
      FLUTTER_VERSION: "3.47.0"
      FLUTTER_SHA256: "26cd99d3d94b1367e6b50535a18aeef0282c10a535bbe3ec493534dcdab75296"
    steps:
      - uses: actions/checkout@v4

      - name: Flutter ${{ env.FLUTTER_VERSION }}
        run: |
          set -euo pipefail
          url="https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz"
          curl -fsSL -o /tmp/flutter.tar.xz "$url"
          echo "${FLUTTER_SHA256}  /tmp/flutter.tar.xz" | sha256sum -c -
          # Into HOME rather than /opt: flutter writes its own cache and
          # version stamp inside its directory on the first command, so a
          # root-owned copy fails as whatever user the job runs as.
          mkdir -p "$HOME/flutter"
          tar -xJf /tmp/flutter.tar.xz -C "$HOME/flutter" --strip-components=1
          echo "$HOME/flutter/bin" >> "$GITHUB_PATH"
          # The tarball is an unpacked git checkout, and flutter refuses to
          # report its own version out of a repository it thinks belongs to
          # somebody else. `tools/toolchain.sh` does this too.
          git config --global --add safe.directory "$HOME/flutter"

      # The .so dlopens OpenSSL at startup; the test loads it through FFI
      # exactly as the app does.
      - run: sudo apt-get update -qq && sudo apt-get install -y -qq libssl3

      - uses: actions/download-artifact@v4
        with:
          name: libfrqcore
          path: build/nim

      # `../build/nim/libfrqcore.so` is one of the paths `frq_core` looks in,
      # named for this case — `flutter test` runs from `flutter/`.
      - name: The layout suite
        run: cd flutter && flutter pub get && flutter test test/nim_layout_test.dart