mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-05 21:02:34 +01:00
DottaandPaperclip
f774992832
Admit full source verification only for exact-source Docker or npm release work, while superseded pending sources complete metadata-only admission. Restart only strictly deferred runs; failed or cancelled checks require an explicit request. Route canonical master native images to dedicated 32-core Spot profiles and keep source checks on protected verification capacity. Use the four-slot GitHub-hosted publication pool for registry work and signing, with proof waits outside that pool and a fresh source-proof check before tagging. Trim historical checkout blobs and prepared-runner disk cleanup while preserving tag and fork publication behavior. Validation: release/source and source/artifact regressions, 665 workflow contracts, actionlint, complete latest-head PR CI, and Greptile 5/5 with all comments resolved. Existing CLI and large-file repository timing tests also passed independently; their CI shards received one scoped retry. Co-Authored-By: Paperclip <noreply@paperclip.ing>
77 lines
3.2 KiB
YAML
77 lines
3.2 KiB
YAML
name: Cloud readiness
|
|
run-name: Cloud readiness ${{ github.sha }}
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
workflow_dispatch:
|
|
|
|
permissions: {}
|
|
|
|
# Source verification stays independent of npm publication and image builds.
|
|
concurrency:
|
|
group: cloud-readiness-${{ github.sha }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
admission:
|
|
name: Cloud candidate admission v1
|
|
if: github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master'
|
|
runs-on: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.run_attempt >= 1 && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && 'runs-on/fleet=paperclip-post-merge-x64/env=public-ci' || 'ubuntu-latest' }}
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
outputs:
|
|
admitted: ${{ steps.admission.outputs.admitted }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
with:
|
|
persist-credentials: false
|
|
sparse-checkout: scripts
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
|
|
with:
|
|
node-version: 24
|
|
- id: admission
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
run: node scripts/cloud-release-admission.mjs
|
|
|
|
verify:
|
|
needs: admission
|
|
if: github.repository == 'paperclipai/paperclip' && github.ref == 'refs/heads/master' && needs.admission.outputs.admitted == 'true'
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/release-verify.yml
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
|
|
source_verified:
|
|
# npm canary publication reuses this exact-source verification proof.
|
|
# Keep it independent of image/migrator availability, and fail closed when
|
|
# any source check fails, is cancelled, or is skipped.
|
|
name: Cloud source verified v1
|
|
needs: [verify]
|
|
if: github.repository == 'paperclipai/paperclip' && github.ref == 'refs/heads/master'
|
|
# Keep the final proof off the shared hosted queue too. The protected
|
|
# fleet has a separate job ceiling and launches Spot workers on demand.
|
|
runs-on: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.run_attempt >= 1 && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && 'runs-on/fleet=paperclip-post-merge-x64/env=public-ci' || 'ubuntu-latest' }}
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Check the source verification consumer
|
|
run: node --test scripts/cloud-source-verification.test.mjs
|
|
- name: Record source verification
|
|
env:
|
|
SOURCE_SHA: ${{ github.sha }}
|
|
run: |
|
|
echo "Cloud source verified v1: $SOURCE_SHA" >> "$GITHUB_STEP_SUMMARY"
|