dev/hanzo.yml

# hanzoai/dev — the `dev` CLI. Hanzo owns the command surface in crates/;
# the engines are hanzoai/codex, pinned as the submodule upstream/codex.
#
# Gate only: no image, nothing to deploy. The release — five per-platform
# binaries, npm, Homebrew — is .hanzo/workflows/release.yml, one job on the
# macOS host runner.
#
# THE GATE IS THE COMPILE, because for this repo nothing else is. There is no
# meaningful lint-only proxy: the workspace is where the product lives, and a
# type error in core/ is invisible to the root `prettier --check *.json *.md`
# that is the only thing package.json offers.
#
# `cargo check`, not `cargo build`: it runs the full front end of the compiler
# over every crate in the workspace — resolution, typeck, borrowck — and skips
# only codegen and linking. That catches every break a `build` would, at roughly
# a third of the cost, on a fleet of ten shared runners.
#
# --locked so Cargo.lock is a fact rather than a suggestion: an out-of-date lock
# fails here instead of silently resolving to versions no release will ever use.
#
# The workspace is at the repo root now, so hanzoai/ci provisions Rust on its
# own; the install below stays as a fallback and costs nothing when cargo is
# already there. --default-toolchain none leaves the choice to
# rust-toolchain.toml.
#
# The engines are a submodule, built as committed — so the gate must fetch it
# before it can build anything. A shallow init is enough: nothing here reads
# upstream history.
test:
  # Cheap, and first, so a 300 KB blob fails in seconds rather than after the
  # workspace compiles. This is .github/workflows/blob-size-policy.yml, which
  # the fork added deliberately and which the canonical lane would otherwise
  # have dropped on the floor.
  #
  # The base is computed here instead of read from a PR event: the old workflow
  # took HEAD^1/HEAD^2 off GitHub's synthetic merge commit, which only exists
  # for a pull_request run. merge-base against origin/main is the same question
  # asked in a way that has an answer on a push too — where it resolves to HEAD
  # and the check is a no-op, which is correct, since main's blobs already
  # passed on the way in.
  #
  # The allowlist lives at .github/blob-size-allowlist.txt and stays there;
  # only .github/workflows went away.
  - name: blob-size
    run: |
      set -euo pipefail
      git fetch --quiet --unshallow origin main 2>/dev/null || git fetch --quiet origin main
      base=$(git merge-base origin/main HEAD)
      python3 scripts/check_blob_size.py \
        --base "$base" --head HEAD \
        --max-bytes 512000 \
        --allowlist .github/blob-size-allowlist.txt

  - name: build
    run: |
      set -euo pipefail
      if ! command -v cargo >/dev/null 2>&1; then
        curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
          | sh -s -- -y --profile minimal --default-toolchain none
      fi
      export PATH="$HOME/.cargo/bin:$PATH"
      git submodule update --init --depth 1
      make build

  # The binary answering is the shallowest check that the whole graph linked.
  - name: smoke
    run: |
      set -euo pipefail
      export PATH="$HOME/.cargo/bin:$PATH"
      ./target/debug/dev --version
      ./target/debug/dev --help >/dev/null

  - name: test
    run: |
      set -euo pipefail
      export PATH="$HOME/.cargo/bin:$PATH"
      command -v cargo-nextest >/dev/null || cargo install cargo-nextest --locked
      make test