fix(bash): bash permission rules apply to all commands, including echo #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tests | |
| # PR-time gate: runs Rust + plugin unit tests, Linux Docker e2e, and Windows e2e | |
| # before merge. Tag pushes go through `release.yml` which independently runs the | |
| # build matrix and publishes — both workflows call the SAME reusable e2e suite | |
| # (`_e2e-suite.yml`) so PR-time and release-time e2e never drift. | |
| # | |
| # IMPORTANT: any change to bridge transport, bash spawning, ONNX install, | |
| # locking, or platform-conditional code paths SHOULD touch the matching | |
| # integration test or e2e scenario in `_e2e-suite.yml`. The Linux harness has | |
| # caught real regressions before; the Windows e2e is here to extend that | |
| # coverage to issue-#26-class Windows-specific bugs (bash timeouts, lock | |
| # recovery, path separators). | |
| on: | |
| pull_request: | |
| paths: | |
| - "crates/**" | |
| - "packages/**" | |
| - "tests/**" | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - "package.json" | |
| - "bun.lock" | |
| - ".github/workflows/tests.yml" | |
| - ".github/workflows/_e2e-suite.yml" | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - "crates/**" | |
| - "packages/**" | |
| - "tests/**" | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - "package.json" | |
| - "bun.lock" | |
| - ".github/workflows/tests.yml" | |
| - ".github/workflows/_e2e-suite.yml" | |
| # Cancel in-flight runs for the same PR/branch when a new commit arrives. | |
| # Saves CI minutes and surfaces the latest result faster. | |
| concurrency: | |
| group: tests-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # Rust + plugin unit tests on Linux (fast inner loop) | |
| # --------------------------------------------------------------------------- | |
| unit: | |
| name: Unit tests (Linux) | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 25 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install workspace deps | |
| run: bun install --frozen-lockfile | |
| - name: Build aft-bridge dist (workspace consumers depend on it) | |
| run: bun run --cwd packages/aft-bridge build | |
| - name: Cargo build (debug — needed by plugin e2e tests) | |
| run: cargo build -p agent-file-tools | |
| - name: Cargo test | |
| run: cargo test --workspace | |
| - name: Bun typecheck | |
| run: bun run typecheck | |
| - name: Bun lint | |
| run: bun run lint | |
| - name: Bun test (all packages) | |
| run: bun run test | |
| env: | |
| # Tests don't need real cache locations — keep them out of the runner's | |
| # ~/.cache to avoid cross-test pollution. | |
| AFT_CACHE_DIR: ${{ runner.temp }}/aft-cache | |
| # --------------------------------------------------------------------------- | |
| # Rust + plugin tests on macOS | |
| # Catches macOS-specific code paths: FSEvents watcher behavior (different | |
| # coalescing latency from inotify), /var vs /private/var symlink | |
| # canonicalization, broken-symlink-chain fallback, bash_background SIGTERM | |
| # behavior, and Apple Silicon-specific Rust compilation. The build-darwin-* | |
| # jobs in release.yml only run `cargo build` — this is the only place we | |
| # actually execute tests on macOS in CI. | |
| # --------------------------------------------------------------------------- | |
| rust-macos: | |
| name: Unit tests (macOS) | |
| runs-on: macos-latest | |
| timeout-minutes: 25 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install workspace deps | |
| run: bun install --frozen-lockfile | |
| - name: Build aft-bridge dist (workspace consumers depend on it) | |
| run: bun run --cwd packages/aft-bridge build | |
| - name: Cargo build (debug — needed by plugin e2e tests) | |
| run: cargo build -p agent-file-tools | |
| - name: Cargo test | |
| run: cargo test --workspace | |
| - name: Bun typecheck | |
| run: bun run typecheck | |
| - name: Bun test (all packages) | |
| run: bun run test | |
| env: | |
| AFT_CACHE_DIR: ${{ runner.temp }}/aft-cache | |
| # --------------------------------------------------------------------------- | |
| # Rust integration tests on Windows | |
| # Catches platform-conditional code paths (#[cfg(target_os = "windows")]) | |
| # and Windows process/path/signal differences. Same suite as Linux but on a | |
| # real Windows runner — does NOT spin up OpenCode, that's the e2e job below. | |
| # --------------------------------------------------------------------------- | |
| rust-windows: | |
| name: Cargo test (Windows) | |
| runs-on: windows-2022 | |
| timeout-minutes: 30 | |
| # Non-blocking on Windows: many integration tests build NDJSON | |
| # requests by hand-formatting paths via `r#"...{path.display()}..."#`, | |
| # which produces invalid JSON on Windows because backslashes in | |
| # `C:\Users\...` get parsed as escape sequences. Migrating ~150 | |
| # call sites to `serde_json::json!` is a separate cleanup; the | |
| # production code path is platform-clean (538 lib tests pass on | |
| # Windows runners, plus the Windows native E2E job below covers | |
| # the integration layer). Tracked for follow-up. | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: x86_64-pc-windows-msvc | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Cargo test (lib only — integration tests need JSON path-escape cleanup) | |
| run: cargo test --workspace --lib | |
| shell: pwsh | |
| # --------------------------------------------------------------------------- | |
| # Linux Docker e2e + Windows native e2e — single source of truth shared | |
| # with release.yml. See `_e2e-suite.yml` for the actual job definitions. | |
| # --------------------------------------------------------------------------- | |
| e2e: | |
| name: E2E | |
| needs: unit | |
| uses: ./.github/workflows/_e2e-suite.yml |