Move IDE sources and Windows packaging to the new server

2026-10-11 04:17:46 +03:00
1 parent 48103b9ad3
commit dd5f99c406
@@ -1,118 +1,74 @@
-# AITURK IDE ajan CI (kart turkservis-20261007-1421-2).
-#
-# Bu depo bir yukari akis catalidir; .github/workflows altindaki GitHub is akislari Gitea'da kosmaz. .gitea/workflows
-# klasoru var oldugu surece Gitea yalniz buradaki is akislarini okur.
-#
-# Ne kosar: korumali talimat dosyasi onay kapisinin testleri (insana sorulamayan kosuda aninda BLOCKED, gec onayin
-# uygulanmamasi, yolo ile kapinin acilmamasi) ve dosya yazma guvenligi testleri. Kosucu Windows'tur (etiket
-# windows-latest; 7 Ekim 2026'da cevrimici kosucu hermes-laptop-windows): urunun hedefi Windows x64'tur ve hata
-# Windows asama kosusunda gorulmustur.
-#
-# Ne sayilmaz (durustluk notu): tests/tools/test_file_write_safety.py icindeki 7 test Windows'ta bu degisiklikten
-# bagimsiz olarak gecemez; yukari akis bunlari POSIX icin yazmistir (/etc, /private/etc, /boot yollari; yonetici
-# ayricaligi isteyen symlink; POSIX stat alanlari). Asagida adlariyla deselect edilir; degismemis 58dbb4523b
-# commit'inde de ayni 7 test kaliyordu (7 Ekim 2026 olcumu). Tam yukari akis test takimi burada KOSMAZ.
-name: ci
+name: Server CI and Windows package

 on:
  push:
-    branches:
-      - aiturk/main
-      - fix/ide-windows-vcruntime
+    branches: [aiturk/main, fix/ide-windows-vcruntime]
  workflow_dispatch:

 permissions:
  contents: read

 jobs:
-  mobile-link-windows:
-    runs-on: windows-latest
-    timeout-minutes: 15
-    steps:
-      - uses: https://gitea.twinpay.one/yilsem/ci-actions-checkout@11d5960a326750d5838078e36cf38b85af677262 # upstream v4.4.0
-        with:
-          github-server-url: https://gitea.twinpay.one
-      - name: Mobil TLS, profil ve baslatma regresyonlari
-        shell: powershell
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $deps = Join-Path $env:RUNNER_TEMP "mobile-tests-$env:GITHUB_RUN_ID"
-          New-Item -ItemType Directory -Force -Path $deps | Out-Null
-          npm install --prefix $deps --no-save --ignore-scripts --no-audit --no-fund --legacy-peer-deps vitest@4.1.10 ws@8.21.1
-          if ($LASTEXITCODE -ne 0) { throw 'Test bagimliliklari kurulamadi' }
-          New-Item -ItemType Junction -Path node_modules -Target (Join-Path $deps 'node_modules') | Out-Null
-          node node_modules/vitest/vitest.mjs run --root apps/desktop --config vitest.mobile.config.ts
-          exit $LASTEXITCODE
-      - name: Codex koprusu (Python, bagimliliksiz) testleri
-        shell: powershell
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $py = (Get-Command python -ErrorAction SilentlyContinue).Source
-          if ($py) { & $py -m unittest discover -s apps/desktop/assets/codex-bridge }
-          else { & py -3 -m unittest discover -s apps/desktop/assets/codex-bridge }
-          exit $LASTEXITCODE
-
-  approval-gate-windows:
-    runs-on: windows-latest
+  verify:
+    runs-on: ubuntu-24.04
    timeout-minutes: 40
+    env:
+      NODE_OPTIONS: --max-old-space-size=2560
+      PYTHONDONTWRITEBYTECODE: '1'
    steps:
-      - name: Kaynagi al
-        uses: https://gitea.twinpay.one/yilsem/ci-actions-checkout@11d5960a326750d5838078e36cf38b85af677262 # upstream v4.4.0
+      - uses: actions/checkout@v4
        with:
-          github-server-url: https://gitea.twinpay.one
-
-      - name: Ortami kur
-        shell: powershell
+          github-server-url: https://gitea.turkservis.online
+      - name: Exact source and Linux test environment
        run: |
-          $ErrorActionPreference = 'Stop'
-          "kosucu: $env:COMPUTERNAME / $env:USERNAME"
-          "checkout SHA: $(git rev-parse HEAD) / beklenen: $env:GITHUB_SHA"
-          $py = $null
-          $launcher = Get-Command py -ErrorAction SilentlyContinue
-          if ($launcher) { $py = (& $launcher.Source -3 -c 'import sys; print(sys.executable)').Trim() }
-          if (-not $py) {
-            $cmd = Get-Command python -ErrorAction SilentlyContinue
-            if ($cmd -and $cmd.Source -notlike '*\WindowsApps\*') { $py = $cmd.Source }
-          }
-          if (-not $py) { throw 'Python bulunamadi' }
-          "onyukleme python: $py"
-          & $py -m pip install --quiet --disable-pip-version-check --target "$env:RUNNER_TEMP\uvboot" uv
-          if ($LASTEXITCODE -ne 0) { throw 'uv kurulamadi' }
-          $env:PYTHONPATH = "$env:RUNNER_TEMP\uvboot"
-          & $py -m uv venv --python 3.11 "$env:RUNNER_TEMP\ci-venv"
-          if ($LASTEXITCODE -ne 0) { throw 'venv olusturulamadi' }
-          & $py -m uv pip install --python "$env:RUNNER_TEMP\ci-venv\Scripts\python.exe" -e . pytest
-          if ($LASTEXITCODE -ne 0) { throw 'bagimliliklar kurulamadi' }
-          $env:PYTHONPATH = ''
-          & "$env:RUNNER_TEMP\ci-venv\Scripts\python.exe" --version
-
-      - name: Onay kapisi testleri
-        shell: powershell
+          set -eu
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          python3 -m venv "$RUNNER_TEMP/bootstrap"
+          "$RUNNER_TEMP/bootstrap/bin/pip" install uv
+          "$RUNNER_TEMP/bootstrap/bin/uv" venv --python 3.11 "$RUNNER_TEMP/ci-venv"
+          "$RUNNER_TEMP/bootstrap/bin/uv" pip install --python "$RUNNER_TEMP/ci-venv/bin/python" -e . pytest
+      - name: Approval gate and file safety on the server
        run: |
-          $ErrorActionPreference = 'Continue'
-          $env:PYTHONDONTWRITEBYTECODE = '1'
-          $env:PYTHONUTF8 = '1'
-          $venv = "$env:RUNNER_TEMP\ci-venv\Scripts\python.exe"
-          $f = 'tests/tools/test_file_write_safety.py'
-          $sayilmayan = @(
-            "${f}::TestCheckSensitivePathMacOSBypass::test_etc_hosts_blocked",
-            "${f}::TestCheckSensitivePathMacOSBypass::test_private_etc_hosts_blocked",
-            "${f}::TestCheckSensitivePathMacOSBypass::test_private_etc_ssh_config_blocked",
-            "${f}::TestCheckSensitivePathMacOSBypass::test_private_var_blocked",
-            "${f}::TestCheckSensitivePathMacOSBypass::test_boot_still_blocked",
-            "${f}::TestAtomicWrite::test_patch_routes_through_atomic_write",
-            "${f}::TestProtectedInstructionFiles::test_symlink_to_protected_file_is_gated"
-          )
-          $deselect = @()
-          foreach ($t in $sayilmayan) { $deselect += '--deselect'; $deselect += $t }
-          "CI OZETI: Windows'ta sayilmayan (deselect) test sayisi: $($sayilmayan.Count)"
-          $sayilmayan | ForEach-Object { "  sayilmadi: $_" }
-          & $venv -m pytest tests/tools/test_protected_instruction_unattended.py $f `
-            tests/tools/test_computer_use_approval_isolation.py tests/cli/test_cli_approval_ui.py `
-            tests/cli/test_single_query_session_finalize.py `
-            tests/hermes_cli/test_plugin_catalog.py tests/hermes_cli/test_aiturk_plugin_catalog.py `
-            tests/hermes_cli/test_plugin_install_ref.py `
-            tests/tui_gateway/test_mobile_subagents.py @deselect -q -p no:cacheprovider -rf
-          $kod = $LASTEXITCODE
-          "pytest cikis kodu: $kod"
-          exit $kod
+          "$RUNNER_TEMP/ci-venv/bin/python" -m pytest tests/tools/test_protected_instruction_unattended.py tests/tools/test_file_write_safety.py tests/tools/test_computer_use_approval_isolation.py tests/cli/test_cli_approval_ui.py tests/cli/test_single_query_session_finalize.py -q -p no:cacheprovider -rf
+      - name: Codex bridge regression tests
+        run: python3 -m unittest discover -s apps/desktop/assets/codex-bridge
+      - name: Mobile and desktop startup regression tests
+        run: |
+          npm install --prefix "$RUNNER_TEMP/mobile-tests" --no-save --ignore-scripts --no-audit --no-fund --legacy-peer-deps vitest@4.1.10 ws@8.21.1
+          ln -s "$RUNNER_TEMP/mobile-tests/node_modules" node_modules
+          node node_modules/vitest/vitest.mjs run --root apps/desktop --config vitest.mobile.config.ts --maxWorkers=2
+
+  windows-package:
+    if: github.ref == 'refs/heads/fix/ide-windows-vcruntime'
+    needs: verify
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    # Windows packaging runs on Linux/Wine in the new server. No laptop runner.
+    container: electronuserland/builder@sha256:b226b27b1a7e95ad25eb3d6414ea90c56c04eb6d8329967f4d721dce50b989ff
+    env:
+      NODE_OPTIONS: --max-old-space-size=2560
+      CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          github-server-url: https://gitea.turkservis.online
+      - name: Install locked source dependencies
+        run: npm ci --no-audit --no-fund
+      - name: Build and package Windows x64
+        run: |
+          set -eu
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          npm run build --workspace=apps/desktop
+          npm run builder --workspace=apps/desktop -- --win nsis zip --x64 --publish never
+          git diff --exit-code
+          cd apps/desktop/release
+          sha256sum *.exe *.zip > SHA256SUMS
+      - name: Preserve exact-source Windows package
+        uses: actions/upload-artifact@v3
+        with:
+          name: aiturk-ide-windows-${{ github.sha }}
+          if-no-files-found: error
+          path: |
+            apps/desktop/release/*.exe
+            apps/desktop/release/*.zip
+            apps/desktop/release/SHA256SUMS