LAB-1141: CI for edge (TS) and hotpath (Rust-WASM) deploy targets - #10
Merged
Conversation
Two path-filtered workflows modelled on ingester-qa.yml, so 'CI green' on this repo means all three deploy targets, not just the Python one: - edge-qa: npm ci (lockfile-strict — the LAB-831 class of breakage), eslint, tsc --noEmit, prettier --check, vitest (25 tests). - hotpath-qa: cargo test (13 tests) + clippy -D warnings on native; clippy + worker-build --release on wasm32 with the documented build-chain pins (worker-build 0.1.14, wasm-bindgen-cli 0.2.126, checksummed) — a real wasm32 build, because clippy alone compiled the LAB-1079 runtime panic happily. READMEs updated to stop claiming 'No CI/CD by design'.
This comment has been minimized.
This comment has been minimized.
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe change adds path-filtered CI workflows for ChangesEdge CI validation
Hotpath CI validation
Repository CI documentation
Sequence Diagram(s)sequenceDiagram
participant GitHub
participant EdgeQA
participant HotpathQA
participant Checks
GitHub->>EdgeQA: Trigger for edge changes
EdgeQA->>Checks: Run Node.js quality checks
GitHub->>HotpathQA: Trigger for hotpath changes
HotpathQA->>Checks: Run Rust, wasm32, and release build checks
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
![kodus-27b[bot]](https://avatars.githubusercontent.com/u/223823690?s=60&v=4){kind=small}
worker-build 0.1.x ignores PATH and invokes the hardcoded ~/.cache/worker-build/wasm-bindgen-*-0.2.105/ binary (first CI run failed exactly as docs/architecture.md predicted). Pre-install the 0.2.126 CLI into that dir instead; docs updated to drop the false 'or PATH' alternative.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/edge-qa.yml:
- Around line 36-37: Fix the Type check step in the edge-qa workflow by either
defining the missing type-check script in edge/package.json or changing the
command to the established TypeScript validation command. Ensure the workflow
invokes a valid command that completes the edge type check successfully.
- Line 24: Disable persisted checkout credentials by adding persist-credentials:
false to all three checkout steps: .github/workflows/edge-qa.yml lines 24-24,
.github/workflows/hotpath-qa.yml lines 24-24, and
.github/workflows/hotpath-qa.yml lines 45-45.
In `@README.md`:
- Around line 91-95: Update the README deployment description to reflect that
the ingester has push-triggered Render deployment, while retaining the
manual-deployment statement only for the initial Render deployment and
Cloudflare Workers. Ensure the surrounding CI description remains unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a4e0b050-2aeb-4e65-a742-dd15c3dc0290
📒 Files selected for processing (5)
.github/workflows/edge-qa.yml.github/workflows/hotpath-qa.ymlREADME.mdedge/README.mdhotpath/README.md
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
…ert follows)" This reverts commit 5a78558.
- Pin Swatinem/rust-cache to the peeled commit SHA (was the annotated tag object SHA — immutable but illegible to audit tooling/org policy). - Assert post-build that the seeded, checksummed wasm-bindgen CLI is the only one in worker-build's cache: a future worker-build bump that hardcodes a different CLI version would otherwise silently orphan the seed and use an unchecksummed download. - Fix hotpath/README's stale 'CLI on PATH' claim (PATH is ignored); document the worker-build-pin <-> cache-dir-name coupling in docs/architecture.md; de-platform the cache path (<host-triple>). - Cut drift-prone per-workflow step enumerations from READMEs (link, don't list).
This comment has been minimized.
This comment has been minimized.
Contributor
Author
|
Red-run demonstration complete — every acceptance criterion is now CI-proven on this PR:
Also passed the workspace expert-panel review; surviving findings applied in For ray: the checks exist and are green — marking |
- persist-credentials: false on every checkout in the two new workflows (read-only QA jobs never need the token in .git/config). - README: 'No CD by design' overclaimed — the ingester rides Render's git-push auto-deploy after first setup; scoped the by-hand statement. - type-check finding rejected: edge/package.json defines the script and the step passed on this PR. CodeRabbit-Resolved: .github/workflows/edge-qa.yml:24:persist-credentials CodeRabbit-Resolved: .github/workflows/edge-qa.yml:37:type-check-false-positive CodeRabbit-Resolved: README.md:91:cd-statement
Kody Review CompleteGreat news! 🎉 Keep up the excellent work! 🚀 Kody Guide: Usage and ConfigurationInteracting with Kody
Current Kody ConfigurationReview OptionsThe following review options are enabled or disabled:
|
Contributor
Author
|
@coderabbitai review |
Contributor
Author
|
@kody start-review |
✅ Action performedReview finished.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds continuous integration (CI) workflows for two of the project's three deploy targets — the edge (TypeScript) and hotpath (Rust/WASM) components — completing CI coverage alongside the existing ingester workflow.
Changes
New CI Workflow:
edge-qaAdds a GitHub Actions workflow that gates the TypeScript
edge/component on pull requests and pushes tomain(path-filtered toedge/**). It runs:npm ci) — ensuring a PR that editspackage.jsonwithout updating the lockfile (or pins an uninstallable version) fails, per the LAB-831 note.npm run lint)npm run type-check)npm run format:check)npm test) — with no network or credentials.New CI Workflow:
hotpath-qaAdds a GitHub Actions workflow for the Rust/WASM
hotpath/component (path-filtered tohotpath/**), split into two jobs:cargo test --lockedandcargo clippy(native, warnings-as-errors).wasm32-unknown-unknowntarget and performs a fullworker-build --release. The comment explains this actually builds (not just lints) the WASM target because a lint-only check can compile a runtime panic that reaches a deployed Worker (referencing LAB-1079).The wasm32 job also pins the build toolchain per the architecture docs: it installs a checksummed
wasm-bindgen-cli0.2.126 andworker-build0.1.14 to avoid a version mismatch against the crate graph's pinnedwasm-bindgen.Documentation Updates
Notes
Summary
This PR fixes the Rust-WASM (hotpath) CI build by correcting how the pinned
wasm-bindgen-clibinary is installed forworker-build.Problem
The previous approach installed
wasm-bindgen-cli0.2.126 onto thePATH, assumingworker-buildwould use it. However,worker-build0.1.x ignores PATH and instead hardcodes CLI version 0.2.105 into its own cache directory (~/.cache/worker-build/wasm-bindgen-*-0.2.105/). This caused the build to fail, since the crate graph pinswasm-bindgen = "=0.2.126".Changes
.github/workflows/hotpath-qa.yml: Instead of adding the binary toPATH, the workflow now extracts the pinned 0.2.126 binary directly into the cache directory thatworker-buildactually invokes (the...-0.2.105path name is intentional). A version check was also added to verify the seeded binary. The step was renamed from "Install wasm-bindgen-cli" to "Seed worker-build cache with wasm-bindgen-cli 0.2.126".docs/architecture.md: Updated the build-chain pin documentation to reflect the corrected approach — clarifying that the CLI must be pre-installed into the specific cache path (not PATH), and noting this was verified in CI on 2026-08-03.Impact
Restores a working CI pipeline for the edge (TS) and hotpath (Rust-WASM) deploy targets by aligning the
wasm-bindgentoolchain version with the crate graph's pin.LAB-1141: CI for edge (TS) and hotpath (Rust-WASM) deploy targets
Description
This PR sets up and validates CI pipelines for two deploy targets: the edge (TypeScript) and hotpath (Rust-WASM) components. The changes introduce deliberate failing code in each target to verify that the CI configuration correctly detects and reports build/test failures ("red-run demo").
Changes
Edge (TypeScript) —
edge/src/handler.tsconst lab1141RedRunDemo: number = "deliberate red-run demo"), assigning a string to anumber-typed variable. This intentionally triggers a TypeScript type-check failure to confirm the edge CI pipeline catches type errors.Hotpath (Rust-WASM) —
hotpath/src/compute.rslab_1141_red_run_demo) that asserts1 + 1 == 3, which intentionally fails. This verifies the hotpath CI pipeline correctly runs and reports failing Rust tests.Purpose
Both additions are deliberate, intentionally-failing changes ("red-run demo") used to prove the CI validation works as expected across both deploy targets. As noted in the code comments, these are meant to be reverted immediately once the CI red-run behavior is confirmed.
Notes
main; they exist to validate CI failure detection and should be reverted after verification.Summary
This PR hardens the
hotpath-qaCI workflow for the Rust-WASM build target and simplifies documentation across the repository's QA workflows.Changes
CI hardening (
hotpath-qa.yml)WB_CACHE_DIRenv var, coupling it explicitly with the pinnedworker-build 0.1.14version so both move together on future bumps.wasm-bindgen-cli 0.2.126. It asserts the seeded CLI is executable and that only onewasm-bindgen-*cache dir exists.Swatinem/rust-cacheaction pin to a new commit SHA (still v2.9.1) in both jobs.Documentation cleanup
README.md,edge/README.md, andhotpath/README.md: condensed the per-workflow descriptions of exact CI steps into simpler "gates every PR and push" statements, reducing duplication of implementation detail.docs/architecture.mdandhotpath/README.md: clarified thatwasm-bindgen-cli0.2.126 is seeded into worker-build's cache (PATH is ignored), and made explicit that the hardcoded0.2.105dir name is tied to worker-build 0.1.14, so the two pins must be bumped together.Purpose
The core functional change ensures CI can no longer silently pass using an unverified, auto-downloaded wasm-bindgen binary — if a future worker-build version changes its hardcoded CLI path, the build now fails loudly rather than drifting off the checksummed, pinned toolchain. Documentation is streamlined so workflow files remain the single source of truth for exact CI steps.
Summary
This PR adds CI hardening for the edge (TypeScript) and hotpath (Rust-WASM) deploy targets and clarifies the deployment documentation.
Changes
CI Security Hardening
persist-credentials: falseto theactions/checkoutsteps in bothedge-qa.ymlandhotpath-qa.ymlworkflows (three checkout steps total across the two files).Documentation
README.mdto more accurately describe the deploy process. The revised text explains that deploys are performed by hand by design—initial Render setup and both Workers deploys viawrangler—with one exception: after the initial setup, the ingester relies on Render's git-push auto-deploy.Purpose
The changes reinforce the security posture of the CI pipelines that gate the edge and hotpath components, and improve the clarity of the project's deployment documentation to reflect the actual manual/auto-deploy workflow.