tango-node/.github/workflows/ci.yml at main · makegov/tango-node · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
name: CI

# Lint + typecheck + test gate runs on every PR and push to main.
#
# The SDK filter/shape conformance check and the reverse shape-coverage check
# are HARD gates that run offline against the vendored contract at
# contracts/filter_shape_contract.json — no secrets needed, so forks and
# tokenless runs get the full check instead of a silent skip. When
# TANGO_API_REPO_ACCESS_TOKEN is available, the same two checks ALSO run as
# hard gates against the fresh contract at makegov/tango HEAD, plus a warning
# annotation when the vendored copy has drifted (re-vendor reminder). Refresh
# the vendored contract by copying contracts/filter_shape_contract.json from
# makegov/tango.
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        node-version: ["20", "22", "24"]

    steps:
      - uses: actions/checkout@v5

      - name: Set up Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v5
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm

      - name: Install dependencies
        # The "prepare" script runs a build that needs tsc — so ignore scripts here
        # and build explicitly below.
        run: npm ci --ignore-scripts --no-audit --no-fund

      - name: Lint
        run: npm run lint

      - name: Typecheck
        run: npm run typecheck

      - name: Build
        run: npm run build

      - name: Test
        # `vitest run` forces a single non-watch pass in CI; the Node 20 leg adds `--coverage` so the suite runs exactly once per leg.
        # No coverage fail-under gate — parity with tango-python, which has none.
        # Integration tests replay the committed cassettes offline; production smoke stays excluded (env-gated on TANGO_LIVE_TESTS, never set here).
        run: npx vitest run ${{ matrix.node-version == '20' && '--coverage' || '' }}

  conformance:
    # Hard gate against the vendored contract (contracts/filter_shape_contract.json).
    # Runs unconditionally — no secrets required, so forks and tokenless runs
    # get the full check instead of a silent skip.
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v5

      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "20"
          cache: npm

      - name: Install dependencies
        run: npm ci --ignore-scripts --no-audit --no-fund

      - name: Check SDK filter/shape conformance (vendored contract)
        run: npx tsx scripts/check-filter-shape-conformance.ts

      - name: Check reverse shape coverage (Tango exposes -> SDK captures)
        # Complements the conformance check with the OTHER direction: fails when
        # Tango's shape trees expose a field/expand the SDK schema doesn't capture
        # and it isn't in contracts/shape_coverage_baseline.json. Also offline
        # against the vendored contract — no secrets, works on forks.
        run: npx tsx scripts/check-shape-coverage.ts

      - name: Check generated overlay is current
        # Regenerates the overlay and fails on drift, so a contract or curated-schema change that alters generator output can't land without `npm run generate-shape-overlay`.
        run: |
          npm run generate-shape-overlay
          git diff --exit-code src/shapes/generatedOverlay.ts

      # --- Fresh-contract gates (token-gated hard checks against tango HEAD) --
      - name: Determine token availability
        id: gate
        env:
          TANGO_API_REPO_ACCESS_TOKEN: ${{ secrets.TANGO_API_REPO_ACCESS_TOKEN }}
        run: |
          if [ -n "$TANGO_API_REPO_ACCESS_TOKEN" ]; then
            echo "ready=true" >> "$GITHUB_OUTPUT"
          else
            echo "ready=false" >> "$GITHUB_OUTPUT"
            echo "::notice::Fresh-contract gates skipped — TANGO_API_REPO_ACCESS_TOKEN not configured."
          fi

      - name: Checkout tango API repo (contract source)
        if: steps.gate.outputs.ready == 'true'
        uses: actions/checkout@v5
        with:
          repository: makegov/tango
          path: tango-api
          token: ${{ secrets.TANGO_API_REPO_ACCESS_TOKEN }}

      - name: Warn when the vendored contract has drifted from tango HEAD
        if: steps.gate.outputs.ready == 'true'
        run: |
          if ! diff -q contracts/filter_shape_contract.json tango-api/contracts/filter_shape_contract.json >/dev/null; then
            echo "::warning::Vendored contract differs from makegov/tango HEAD. Re-vendor contracts/filter_shape_contract.json and regenerate the overlay."
          else
            echo "Vendored contract matches makegov/tango HEAD."
          fi

      - name: Check SDK filter/shape conformance (fresh contract, hard gate)
        if: steps.gate.outputs.ready == 'true'
        env:
          TANGO_CONTRACT_PATH: tango-api/contracts/filter_shape_contract.json
        run: npx tsx scripts/check-filter-shape-conformance.ts

      - name: Check reverse shape coverage (fresh contract, hard gate)
        if: steps.gate.outputs.ready == 'true'
        env:
          TANGO_CONTRACT_PATH: tango-api/contracts/filter_shape_contract.json
        run: npx tsx scripts/check-shape-coverage.ts