devcontainer.yml

name: Devcontainer

on:
  pull_request:
    paths:
      - '.devcontainer/**'
      - '.github/workflows/devcontainer.yml'
      # Not all of rust/: ci.yml's Rust job already builds and tests every Rust
      # change. What this job adds is the container, and the only Rust file the
      # container has to agree with is the toolchain pin.
      - 'rust/rust-toolchain.toml'
  # Weekly, because some of this image's pins rot without anything under
  # .devcontainer/ changing, so the paths filter above cannot catch them:
  #   - the Node tarball and the rustup-init binaries, and their checksums, if
  #     a release is ever re-cut
  #   - RUST_VERSION, once rust/rust-toolchain.toml moves (it IS covered by the
  #     paths filter, but only if the bump goes through a pull request)
  # A rotted pin fails the build for everyone who opens the container, so it is
  # better found here.
  schedule:
    - cron: '23 12 * * 1'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  smoke:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          # vite.config.ts stamps the build with `git describe`, so the Vue
          # build needs tags and real history, not a shallow checkout.
          fetch-depth: 0

      - name: Create the development container
        run: npx --yes @devcontainers/cli@0.89.0 up --workspace-folder "$GITHUB_WORKSPACE"

      - name: Every toolchain resolves, and Rust matches its pin
        run: |
          npx --yes @devcontainers/cli@0.89.0 exec --workspace-folder "$GITHUB_WORKSPACE" bash -ec '
            node --version
            npm --version
            python3 --version
            git --version
            # cargo links build scripts, proc macros and the test binaries
            # with cc.
            cc --version | head -n 1

            # A stale RUST_VERSION in the Dockerfile does not fail anything:
            # rustup reads rust/rust-toolchain.toml and downloads the pin on
            # first use. So checking what rustc resolves to proves nothing on
            # its own; compare what the image pre-installed against what the
            # file asks for.
            rust_pinned=$(python3 -c "import tomllib;print(tomllib.load(open(\"rust/rust-toolchain.toml\",\"rb\"))[\"toolchain\"][\"channel\"])")
            echo "rust-toolchain.toml pins $rust_pinned, the image pre-installs $RUST_VERSION"
            [ "$rust_pinned" = "$RUST_VERSION" ] || {
              echo "::error::The devcontainer pre-installs Rust $RUST_VERSION but rust/rust-toolchain.toml pins $rust_pinned. Update RUST_VERSION in .devcontainer/Dockerfile."
              exit 1
            }
            rustup --version
            rustup toolchain list
            # Run inside rust/, so these resolve through the toolchain file the
            # way cargo does there.
            rustc_version=$(cd rust && rustc --version)
            cargo_version=$(cd rust && cargo --version)
            echo "$rustc_version"
            echo "$cargo_version"
            case "$rustc_version" in "rustc $rust_pinned "*) ;; *)
              echo "::error::rustc in rust/ is not $rust_pinned."
              exit 1 ;;
            esac
            case "$cargo_version" in "cargo $rust_pinned "*) ;; *)
              echo "::error::cargo in rust/ is not $rust_pinned."
              exit 1 ;;
            esac
            # build-wasm needs this target, and the planner the site loads is
            # built with it.
            rustup target list --installed --toolchain "$rust_pinned" | grep -qx wasm32-unknown-unknown || {
              echo "::error::The wasm32-unknown-unknown target is missing - npm run build-wasm cannot build the planner."
              exit 1
            }
          '

      # Debug only. The release gates (every planner snapshot, the contract
      # replay) stay in ci.yml's Rust job: they test the planner, not the
      # container, and would add their release build to this job's time.
      - name: The Rust tests pass
        run: |
          npx --yes @devcontainers/cli@0.89.0 exec --workspace-folder "$GITHUB_WORKSPACE" bash -ec '
            cd rust
            cargo test --all-targets
          '

      # The site loads the Rust planner (rust/planner-wasm), and the Vite build
      # imports it from src/vue/src/lib/planner-wasm, so build-wasm comes first.
      # postCreateCommand already ran it, so here it only confirms the output is
      # up to date, and keeps this step honest if postCreate ever stops running it.
      - name: The front-end builds and tests
        run: |
          npx --yes @devcontainers/cli@0.89.0 exec --workspace-folder "$GITHUB_WORKSPACE" bash -ec '
            cd src/vue
            npm run build-wasm
            npm run build
            npm run test
          '