From a19bf11c02b7b61d23fa0508174511d2c13f5f11 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Sat, 31 Oct 2026 01:06:37 -0700 Subject: [PATCH 1/2] ci(latchkey): advisory Latchkey CI mirror under .latchkey/workflows (D206) Port a secret-free subset of .github/workflows/tests.yml to Latchkey CI (backend tests x3, frontend tests, backend typecheck + TS lint, CLI lint, frontend build) as one advisory workflow that runs beside GitHub Actions. No .github/workflows change. Checkout is automatic, runs-on names a Latchkey size, setup-node is latchkey/setup-node@1.0.1. Advisory mode is an owner dashboard action, so merging this changes nothing that runs. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01N4VWLErW29t4LnhRfUy1NH --- .latchkey/workflows/ci.yml | 111 +++++++++++++++++++++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100644 .latchkey/workflows/ci.yml diff --git a/.latchkey/workflows/ci.yml b/.latchkey/workflows/ci.yml new file mode 100644 index 0000000000..6c35e5896c --- /dev/null +++ b/.latchkey/workflows/ci.yml @@ -0,0 +1,111 @@ +# Latchkey CI — ADVISORY mirror of GitHub Actions (D206). +# +# These jobs re-run a subset of .github/workflows/tests.yml on Latchkey CI, +# BESIDE GitHub Actions, so the two can be compared commit by commit before any +# job is switched over. The repository runs in advisory mode: a failure here is +# reported to GitHub as a NEUTRAL check titled "Advisory: failed" and never +# blocks a merge. Do NOT add any "Latchkey" context to branch-protection +# required checks while this is advisory — a neutral check satisfies a required +# one, which would let a failing commit merge. +# +# Ported here (no secrets, no service containers, no submodules): +# backend tests, frontend tests (+ frontend typecheck), backend typecheck + +# TS lint, CLI lint, frontend build. +# +# NOT ported (stay on GitHub Actions) and why: +# - service-test — service `options:` (the mongo nofile ulimit) are refused by Latchkey CI +# - tool-tests (full) — needs `submodules: recursive` + `fetch-depth: 0` for the tool-contract guard +# - chart-lint — downloads helm / kubeconform / yq binaries +# - latchkey-probe/route/backstop, test-gate — GitHub-specific runner-route plumbing +# - deploy-dev, deploy-staging, cve-scan, npm-publish, smoke-test, playwright, +# and the macOS + privileged-docker jobs — secret / WIF / OIDC / kind bound +# +# Latchkey dialect vs the GitHub file: +# - checkout is automatic (no actions/checkout step) +# - runs-on: names a Latchkey size (small|medium|large|xlarge), not a GH label +# - actions/setup-node becomes latchkey/setup-node@1.0.1 (the fork-safe +# version; 1.0.0 fails on fork PRs) +# - the backend env values below are the SAME fake test literals the GitHub +# file uses — not secrets + +name: ci + +on: + push: + branches: [main] + pull_request: + +jobs: + backend-tests: + name: Backend tests (${{ matrix.shard }}/3) + runs-on: medium + timeout-minutes: 20 + strategy: + matrix: + shard: [1, 2, 3] + env: + JWT_SECRET: test-jwt-secret + SENDGRID_API_KEY: fake-api-key + SENDGRID_FROM_EMAIL: test@example.com + FRONTEND_URL: http://localhost:3000 + steps: + - uses: latchkey/setup-node@1.0.1 + with: + node-version: '22' + - run: cd backend && npm ci --include=dev + # Backend service suites exercise the real CLI in a subprocess. + - run: cd cli && npm ci --include=dev + - run: cd backend && npx jest --forceExit --shard=${{ matrix.shard }}/3 + + frontend-tests: + name: Frontend tests + runs-on: small + timeout-minutes: 20 + steps: + - uses: latchkey/setup-node@1.0.1 + with: + node-version: '22' + # Frontend typecheck follows shared imports into backend TypeScript. + - run: cd backend && npm ci --include=dev + - run: cd frontend && OPENUI_TELEMETRY_DISABLED=1 npm install --legacy-peer-deps + - run: cd frontend && npm run typecheck + - run: cd frontend && npx jest --watchAll=false --forceExit + - run: cd frontend && node --test scripts/generate-seo-pages.test.mjs scripts/nginx-routing.test.mjs scripts/ui-card-catalogue.test.mjs + + backend-checks: + name: Backend typecheck and lint + runs-on: small + timeout-minutes: 12 + steps: + - uses: latchkey/setup-node@1.0.1 + with: + node-version: '22' + - run: cd backend && npm ci --include=dev + - run: cd backend && npm run tsc:check + - run: cd packages/types && ../../backend/node_modules/.bin/tsc --noEmit -p tsconfig.json + - run: cd backend && npm run lint:ts + + cli-lint: + name: CLI lint + runs-on: small + timeout-minutes: 10 + steps: + - uses: latchkey/setup-node@1.0.1 + with: + node-version: '22' + - run: cd cli && npm ci --include=dev + - run: cd cli && npm run lint + + frontend-build: + name: Frontend build + runs-on: small + timeout-minutes: 15 + steps: + - uses: latchkey/setup-node@1.0.1 + with: + node-version: '22' + # Frontend sources import shared backend TypeScript, so backend deps must + # be installed for the vite build to resolve them. + - run: cd backend && npm ci --include=dev + - run: cd frontend && OPENUI_TELEMETRY_DISABLED=1 npm install --legacy-peer-deps + - run: cd frontend && npm run build From a19a980023fdb5718135d4c7826aa10664d54a3a Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Sat, 31 Oct 2026 01:23:31 -0700 Subject: [PATCH 2/2] =?UTF-8?q?ci(latchkey):=20drop=20frontend-build=20?= =?UTF-8?q?=E2=80=94=20it=20mirrors=20playwright.yml,=20not=20tests.yml=20?= =?UTF-8?q?(D206)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sable's gate found frontend-build has no tests.yml counterpart: tests.yml never runs `npm run build` — only playwright.yml's "Build frontend" step does — so the "subset of tests.yml" claim was false. Drop the job so the mirror is a clean, accurate subset of tests.yml. The remaining four jobs (backend tests, frontend tests, backend checks, CLI lint) all map to tests.yml. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01N4VWLErW29t4LnhRfUy1NH --- .latchkey/workflows/ci.yml | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) diff --git a/.latchkey/workflows/ci.yml b/.latchkey/workflows/ci.yml index 6c35e5896c..3da2799e88 100644 --- a/.latchkey/workflows/ci.yml +++ b/.latchkey/workflows/ci.yml @@ -10,7 +10,7 @@ # # Ported here (no secrets, no service containers, no submodules): # backend tests, frontend tests (+ frontend typecheck), backend typecheck + -# TS lint, CLI lint, frontend build. +# TS lint, CLI lint. # # NOT ported (stay on GitHub Actions) and why: # - service-test — service `options:` (the mongo nofile ulimit) are refused by Latchkey CI @@ -95,17 +95,3 @@ jobs: node-version: '22' - run: cd cli && npm ci --include=dev - run: cd cli && npm run lint - - frontend-build: - name: Frontend build - runs-on: small - timeout-minutes: 15 - steps: - - uses: latchkey/setup-node@1.0.1 - with: - node-version: '22' - # Frontend sources import shared backend TypeScript, so backend deps must - # be installed for the vite build to resolve them. - - run: cd backend && npm ci --include=dev - - run: cd frontend && OPENUI_TELEMETRY_DISABLED=1 npm install --legacy-peer-deps - - run: cd frontend && npm run build