devtools/.github/workflows/ci.yml at main · pangular-inspector/devtools · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  # nx-set-shas reads previous workflow runs to find the last green main commit
  actions: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: ./.github/actions/setup

      - uses: nrwl/nx-set-shas@v4

      - name: Check formatting
        run: pnpm format:check

      - name: Validate agent skills and roles
        run: pnpm skills:check

      - name: Type-check
        run: pnpm typecheck

      - name: Test and build affected projects
        run: pnpm exec nx affected -t test build

      - name: Test devtools package
        run: pnpm test:devtools

      - name: Test devtools panel
        run: pnpm test:panel

      - name: Build Chrome extension
        run: pnpm extension:build

      - name: Check committed build output is current
        run: |
          stale=$(git status --porcelain -- extension/ui)
          if [ -n "$stale" ]; then
            echo "$stale"
            echo "::error::Committed build output is stale. Run 'pnpm extension:build' and commit the result."
            exit 1
          fi

      - name: Smoke-test the CLI
        run: node bin.mjs --help

  node-22:
    name: Package tests on Node.js 22
    # `engines.node` allows 22.12 and later, while the build job runs the `.nvmrc` version.
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup
        with:
          node-version: 22

      - name: Test devtools package
        run: pnpm test:devtools

  axe:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup

      - name: Install Chromium
        run: pnpm exec playwright install --with-deps chromium

      - name: Check the panel with axe
        run: pnpm test:axe

  # The e2e jobs below are slow, so they run only when the package, the panel, the SSR demo, the
  # tools docs (e2e:mcp reads them) or the scripts and fixtures they use change. A diff that cannot
  # be computed (a new branch, a force push) runs them.
  changes:
    name: Changed paths
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      e2e: ${{ steps.diff.outputs.e2e }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - id: diff
        env:
          BASE: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
        run: |
          paths=(packages/devtools app e2e src apps/docs/src/content/agents angular.json package.json
            scripts/e2e-security.mjs scripts/e2e-mcp.mjs pnpm-lock.yaml .github/workflows/ci.yml)
          if git diff --quiet "$BASE" HEAD -- "${paths[@]}"; then
            echo "e2e=false" >> "$GITHUB_OUTPUT"
          else
            echo "e2e=true" >> "$GITHUB_OUTPUT"
          fi

  e2e-security:
    name: Security e2e
    needs: changes
    if: needs.changes.outputs.e2e == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup

      # Playwright's own Chromium, as the axe job installs it.
      - name: Install Chromium
        run: pnpm exec playwright install --with-deps chromium

      - name: Build the package
        run: pnpm devtools:build-pkg

      # Leak corpus, access gates and a production build, on ports 5231 to 5236.
      - name: Check redaction and access
        run: pnpm e2e:security

      - name: Keep the captured channels
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: e2e-security
          path: dist/e2e-security
          if-no-files-found: ignore

  e2e-mcp:
    name: MCP e2e
    needs: changes
    if: needs.changes.outputs.e2e == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup

      - name: Install Chromium
        run: pnpm exec playwright install --with-deps chromium

      # Builds the package and the SSR demo itself, then serves the demo on port 5150 (the variant
      # hubs on 5151 to 5154) and checks every tool, resource and prompt, and agents/tools.md.
      - name: Check the agent surface
        run: pnpm e2e:mcp --report dist/e2e-mcp/report.json

      - name: Keep the report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: e2e-mcp
          path: dist/e2e-mcp
          if-no-files-found: ignore