headroom/.github/workflows/devcontainers.yml
Patrick A 53d2342291
ci: speed up GitHub Actions — path filters, caching, timeouts, version upgrades (#620)
* ci: speed up GitHub Actions - path filters, caching, timeouts, version upgrades

Performance improvements:
- init-e2e.yml, wrap-e2e.yml: add path filters so e2e Docker builds only run when
  e2e-related files change (saves ~10 min per irrelevant PR push)
- init-e2e.yml, wrap-e2e.yml: add concurrency groups to cancel superseded PR runs
- ci.yml: add pip caching to lint and build jobs
- ci.yml: cache actionlint + act binaries in workflow-validation (skip curl on hits)
- eval.yml: add pip caching to smoke-test and weekly-suite jobs
- docs.yml: add pip caching for mkdocs-material install
- rust.yml: replace cargo install --locked cargo-audit/deny with taiki-e/install-action
  (prebuilt binaries; saves 2-5 min per audit run)

Bug fixes:
- docker.yml: fix actions/checkout@v6 -> @v4 (v6 does not exist; would break all
  Docker builds on every release/PR touching docker paths)

Version upgrades:
- wagoid/commitlint-github-action: @v5 -> @v6
- devcontainers.yml: docker/setup-buildx-action@v3 -> @v4 (align with docker.yml)

Safety improvements:
- ci.yml: add timeout-minutes to all 13 jobs (changes, lint, build-wheel,
  prefetch-model, test x4, test-extras, test-agno, commitlint, build,
  workflow-validation, docker-native-e2e, windows-native-wrapper, macos-native-wrapper)
- docker.yml: add timeout-minutes to docker-build (75m), docker-manifest (20m),
  promote-latest (10m)
- eval.yml: add timeout-minutes to smoke-test (30m); bump weekly-suite 60->90m
- rust.yml: add timeout-minutes to test (30m), wheels (45m), audit (20m)

Observed wall-clock impact on recent PRs:
- Init E2E and Wrap E2E were running on every single PR push regardless of content
- CI workflow was taking 12-17 min; path filters reduce unnecessary e2e runs to 0

* fix(ci): bust actionlint+act cache when workflow file changes

Static cache key 'ci-tools-actionlint-act-v1' never invalidated on
tool version updates. Switched to hashFiles('.github/workflows/ci.yml')
so the cache busts automatically whenever the download scripts are
updated to point at a newer release.

Flagged by adversarial review (Architecture + Testing/Reliability personas).

* fix(ci): add missing Dockerfile COPY paths to e2e path filters

e2e/init/Dockerfile and e2e/wrap/Dockerfile COPY files not covered
by the initial path filter set:

  init-e2e: Cargo.toml, Cargo.lock, rust-toolchain.toml, uv.lock,
            .claude-plugin, .github/plugin/**, plugins/headroom-agent-hooks/**
  wrap-e2e: Cargo.toml, Cargo.lock, rust-toolchain.toml, uv.lock,
            sdk/typescript/**, plugins/openclaw/**

Without these, a Rust toolchain bump or SDK change on a PR would
skip the e2e gate entirely, only catching it on the merge to main.

Flagged by adversarial review (Domain/Correctness persona).

* fix(devcontainer): upgrade uv to >=0.7.0 to parse uv.lock revision=3

* fix(devcontainer): set UV_SKIP_WHEEL_FILENAME_CHECK=1 in post-create.sh for gitpython wheel

* ci: bump actions/checkout and actions/setup-node to v5 (Node.js 20 EOL Jun 16)

* fix(devcontainer): export UV_SKIP_WHEEL_FILENAME_CHECK so uv run also skips wheel check

* ci: bump all GitHub Actions to latest versions (Node.js 24)

* fix(test): accept release-please-action v4 or v5 in workflow assertion

* fix(format): ruff format test_release_workflows.py
2026-06-05 14:32:53 -08:00

106 lines
4.1 KiB
YAML

name: Dev Containers
on:
push:
branches: [main]
paths:
- ".devcontainer/**"
- ".github/workflows/devcontainers.yml"
- "pyproject.toml"
- "uv.lock"
pull_request:
branches: [main]
paths:
- ".devcontainer/**"
- ".github/workflows/devcontainers.yml"
- "pyproject.toml"
- "uv.lock"
workflow_dispatch:
jobs:
validate:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
include:
- name: default
config: .devcontainer/devcontainer.json
- name: memory-stack
config: .devcontainer/memory-stack/devcontainer.json
steps:
- uses: actions/checkout@v6
# The memory-stack devcontainer brings up Neo4j + Postgres +
# Redis + Qdrant on top of the Docker base. PR #495 surfaced
# that the GitHub-hosted runner now ships with too little
# headroom for that stack: the runner's diagnostic log writer
# hit "No space left on device" mid-smoke-test, killing the
# job before `devcontainer exec` could finish. The default
# devcontainer is light enough to pass on the same image.
#
# Reclaim ~14 GB by stripping preinstalled tools none of the
# devcontainer paths use (Android SDK, .NET, Haskell). Run
# ONLY on memory-stack — the default validate is fast and
# benefits from the preinstalled toolcache.
- name: Free runner disk (memory-stack only)
if: matrix.name == 'memory-stack'
uses: jlumbroso/free-disk-space@v1.3.1
with:
tool-cache: true
android: true
dotnet: true
haskell: true
large-packages: false
docker-images: false
swap-storage: false
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version: "20"
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
- name: Install Dev Container CLI
run: npm install -g @devcontainers/cli@0.85.0
- name: Start ${{ matrix.name }}
run: devcontainer up --workspace-folder . --config ${{ matrix.config }} --remove-existing-container
- name: Smoke test ${{ matrix.name }}
shell: bash
run: |
if [[ "${{ matrix.name }}" == "memory-stack" ]]; then
devcontainer exec --workspace-folder . --config ${{ matrix.config }} bash -lc 'git rev-parse --show-toplevel >/dev/null && uv --version && node --version && gh --version >/dev/null && uv run python -c "import socket; socket.create_connection((\"qdrant\", 6333), 5).close(); socket.create_connection((\"neo4j\", 7687), 5).close(); from mem0 import Memory; from qdrant_client import QdrantClient; import neo4j; import headroom; print(\"memory-stack smoke test passed\")"'
else
devcontainer exec --workspace-folder . --config ${{ matrix.config }} bash -lc 'git rev-parse --show-toplevel >/dev/null && uv --version && node --version && gh --version >/dev/null && uv run python -c "import headroom; print(\"default smoke test passed\")"'
fi
validate-worktree:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Create linked worktree
run: git worktree add "$RUNNER_TEMP/headroom-worktree" HEAD
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version: "20"
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
- name: Install Dev Container CLI
run: npm install -g @devcontainers/cli@0.85.0
- name: Start linked worktree devcontainer
run: devcontainer up --workspace-folder "$RUNNER_TEMP/headroom-worktree" --config "$RUNNER_TEMP/headroom-worktree/.devcontainer/devcontainer.json" --remove-existing-container
- name: Smoke test linked worktree
run: devcontainer exec --workspace-folder "$RUNNER_TEMP/headroom-worktree" --config "$RUNNER_TEMP/headroom-worktree/.devcontainer/devcontainer.json" bash -lc 'git rev-parse --show-toplevel && uv run python -c "import headroom; print(\"worktree smoke test passed\")"'