docs: record stable 0.1.2 release evidence #136
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| schedule: | |
| - cron: "23 5 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| workflow-lint: | |
| name: GitHub Actions static validation | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js 24 | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24.x | |
| cache: npm | |
| - name: Install locked dependencies | |
| run: npm ci | |
| - name: Validate Public Preview content and identity | |
| run: npm run check:public-preview | |
| - name: Download the pinned actionlint release | |
| id: actionlint | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| version="$(tr -d '\n' < .github/actionlint-version)" | |
| asset="actionlint_${version}_linux_amd64.tar.gz" | |
| base="https://github.com/rhysd/actionlint/releases/download/v${version}" | |
| curl --fail --location --proto '=https' --retry 3 --silent --show-error \ | |
| "$base/$asset" --output "$RUNNER_TEMP/$asset" | |
| expected="$(awk -v file="$asset" '$2 == file { print $1 }' .github/actionlint-checksums.txt)" | |
| actual="$(sha256sum "$RUNNER_TEMP/$asset" | awk '{ print $1 }')" | |
| if [[ -z "$expected" || "$actual" != "$expected" ]]; then | |
| echo "actionlint release checksum verification failed." >&2 | |
| exit 1 | |
| fi | |
| tar -xzf "$RUNNER_TEMP/$asset" -C "$RUNNER_TEMP" actionlint | |
| echo "binary=$RUNNER_TEMP/actionlint" >> "$GITHUB_OUTPUT" | |
| - name: Validate all workflows | |
| env: | |
| ACTIONLINT_BIN: ${{ steps.actionlint.outputs.binary }} | |
| run: npm run actionlint | |
| locked: | |
| name: Locked OpenAI / Node.js ${{ matrix.node-version }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 25 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node-version: | |
| - 22.x | |
| - 24.x | |
| steps: | |
| - name: Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: npm | |
| - name: Install locked dependencies | |
| run: npm ci | |
| - name: Check formatting | |
| run: npm run format:check | |
| - name: Lint | |
| run: npm run lint | |
| - name: Type-check | |
| run: npm run typecheck | |
| - name: Run unit and mocked contract tests | |
| run: npm test | |
| - name: Scan tracked material for secret patterns | |
| run: npm run test:secrets | |
| - name: Scan current and historical standalone content | |
| run: npm run check:standalone-content | |
| - name: Build ESM and CommonJS outputs | |
| run: npm run build | |
| - name: Validate the package shape | |
| run: npm run test:package | |
| - name: Execute the documented examples against a packed artifact | |
| run: npm run test:examples | |
| - name: Verify live-smoke semantic checks with mocked transport | |
| run: npm run test:live-contract | |
| - name: Test packed-package fixtures | |
| run: npm run test:fixtures | |
| artifact-pack: | |
| name: Pack the CI artifact | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| outputs: | |
| sha256: ${{ steps.pack.outputs.sha256 }} | |
| steps: | |
| - name: Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js 24 | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24.x | |
| cache: npm | |
| - name: Install locked dependencies | |
| run: npm ci | |
| - name: Pack exactly one artifact | |
| id: pack | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| mkdir -p ci-artifacts | |
| npm pack --pack-destination ci-artifacts | |
| mapfile -t tarballs < <(find ci-artifacts -maxdepth 1 -type f -name '*.tgz' -print) | |
| if [[ "${#tarballs[@]}" -ne 1 ]]; then | |
| echo "Expected exactly one packed artifact, found ${#tarballs[@]}." >&2 | |
| exit 1 | |
| fi | |
| echo "sha256=$(sha256sum "${tarballs[0]}" | awk '{ print $1 }')" >> "$GITHUB_OUTPUT" | |
| - name: Upload the packed artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ci-npm-package | |
| path: ci-artifacts/*.tgz | |
| if-no-files-found: error | |
| artifact-download: | |
| name: Verify the CI artifact round-trip | |
| needs: | |
| - artifact-pack | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Download the packed artifact by name | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: ci-npm-package | |
| path: ci-artifacts | |
| - name: Verify the unique artifact and its digest | |
| env: | |
| EXPECTED_SHA256: ${{ needs.artifact-pack.outputs.sha256 }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| mapfile -t tarballs < <(find ci-artifacts -maxdepth 1 -type f -name '*.tgz' -print) | |
| if [[ "${#tarballs[@]}" -ne 1 ]]; then | |
| echo "Expected exactly one downloaded artifact, found ${#tarballs[@]}." >&2 | |
| exit 1 | |
| fi | |
| echo "$EXPECTED_SHA256 ${tarballs[0]}" | sha256sum --check --strict | |
| minimum-openai: | |
| name: Minimum OpenAI / Node.js 22 | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js 22 | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22.x | |
| cache: npm | |
| - name: Install locked development dependencies | |
| run: npm ci | |
| - name: Test the minimum supported OpenAI version | |
| run: npm run test:compat -- --lane minimum | |
| latest-openai: | |
| name: Latest OpenAI 6.x canary / Node.js 24 | |
| if: >- | |
| github.event_name == 'schedule' || | |
| github.event_name == 'workflow_dispatch' || | |
| (github.event_name == 'pull_request' && github.actor == 'dependabot[bot]') | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js 24 | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24.x | |
| cache: npm | |
| - name: Install locked development dependencies | |
| run: npm ci | |
| - name: Test the latest compatible OpenAI version | |
| run: npm run test:compat -- --lane latest | |
| current-node-advisory: | |
| name: Node.js 26 advisory | |
| continue-on-error: true | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js 26 | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 26.x | |
| cache: npm | |
| - name: Install locked dependencies | |
| run: npm ci | |
| - name: Type-check | |
| run: npm run typecheck | |
| - name: Run unit and mocked contract tests | |
| run: npm test | |
| - name: Build ESM and CommonJS outputs | |
| run: npm run build | |
| - name: Validate the package shape | |
| run: npm run test:package | |
| - name: Verify live-smoke semantic checks with mocked transport | |
| run: npm run test:live-contract | |
| self-contained: | |
| name: Standalone repository check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 25 | |
| steps: | |
| - name: Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js 24 | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24.x | |
| cache: npm | |
| - name: Install locked dependencies | |
| run: npm ci | |
| - name: Copy and verify the standalone repository | |
| run: npm run check:self-contained |