CI only: diagnose leave_residue on Windows — do not merge

.github/workflows/ci.yml

@@ -1,102 +1,14 @@
 name: CI
 
 on:
-  push:
-    branches: [main]
   pull_request:
 
 jobs:
-  nix-syntax:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v7
-      - uses: DeterminateSystems/nix-installer-action@main
-      - name: Parse all Nix files
-        run: find . -name '*.nix' -exec nix-instantiate --parse {} + > /dev/null
-
-  lint:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v7
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - run: ./bin/lint --check
-      - name: Check crates.io publication plan
-        run: ./bin/publish-crates --plan
-
-  # Publishing builds nothing (--no-verify), so build every crate from its
-  # package here, as crates.io users will.
-  package-crates:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v7
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - run: ./bin/package-crates
-
-  test:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v7
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - run: ./bin/tests
-
-  protocol-fuzz:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v7
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - name: Fuzz every YAS wire surface
-        run: ./bin/fuzz
-        env:
-          YAS_FUZZ_SECONDS: "60"
-
-  e2e:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v7
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - run: ./bin/e2e
-      - uses: actions/upload-artifact@v7
-        if: ${{ !cancelled() }}
-        with:
-          name: playwright-report
-          path: e2e/test-results/
-          retention-days: 7
-
-  coverage:
-    runs-on: ubuntu-24.04
-    permissions:
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v7
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - name: Run tests with coverage
-        run: ./bin/coverage
-      - name: Write coverage summary
-        run: cat coverage-summary.txt >> "$GITHUB_STEP_SUMMARY"
-      - name: Upload HTML report
-        uses: actions/upload-artifact@v7
-        if: always()
-        with:
-          name: coverage-report
-          path: coverage-report/html/
-          retention-days: 30
-      - name: Post coverage summary on PR
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-        uses: marocchino/sticky-pull-request-comment@v3
-        with:
-          header: coverage
-          path: coverage-summary.txt
-
-  build-packages:
-    uses: ./.github/workflows/_build-packages.yml
-    with:
-      macos: true
-
-  build-windows:
+  build-windows-1:
+    uses: ./.github/workflows/_build-windows.yml
+  build-windows-2:
+    uses: ./.github/workflows/_build-windows.yml
+  build-windows-3:
+    uses: ./.github/workflows/_build-windows.yml
+  build-windows-4:
     uses: ./.github/workflows/_build-windows.yml

.prettierignore

@@ -9,6 +9,9 @@ pnpm-lock.yaml
 *.astro
 man/
 
+# Written verbatim by `ultimator ci init` (`ci init --check` compares it byte for byte): never format it.
+.ultimator/ultimator-ci.d.ts
+
 # Generated byte-for-byte by crates/yas/schema_codegen.rs.
 js/core/src/yas/generated.ts
 protocol/yas/schema.json

.ultimator/lib/steps.ts

@@ -0,0 +1,165 @@
+// What YAS's workflows share (xmit-dev/ultimator docs/CI.md): plain functions building steps, imported by relative
+// path. GitHub's reusable _build-packages.yml and _build-windows.yml are these here.
+import type { Step } from "ultimator:ci";
+
+/**
+ * A script written indented in a template literal, as it runs: its first and last empty lines and the indentation
+ * its lines share removed. `\${` keeps a shell's `${…}` from the template.
+ */
+export function sh(
+  strings: TemplateStringsArray,
+  ...values: readonly (string | number | boolean)[]
+): string {
+  let text = strings[0]!;
+  values.forEach((value, i) => {
+    text += String(value) + strings[i + 1]!;
+  });
+  const lines = text
+    .replace(/^\n/, "")
+    .replace(/\n[ \t]*$/, "")
+    .split("\n");
+  const indent = Math.min(
+    ...lines
+      .filter((line) => line.trim() !== "")
+      .map((line) => /^ */.exec(line)![0].length),
+  );
+  return lines.map((line) => line.slice(indent)).join("\n") + "\n";
+}
+
+/**
+ * Nix with flakes, on PATH for the job's later steps, in place of DeterminateSystems/nix-installer-action and
+ * magic-nix-cache-action. A machine that has Nix (crab) keeps its own; a fresh sandbox gets it from Determinate's
+ * installer, with flakes on. There is no binary cache beyond cache.nixos.org: a sandbox's first build of the flake's
+ * toolchain is cold.
+ */
+export function nix(): Step {
+  return {
+    name: "Nix",
+    run: sh`
+      if ! command -v nix >/dev/null; then
+        for profile in /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh "$HOME/.nix-profile/etc/profile.d/nix.sh"; do
+          if [ -f "$profile" ]; then . "$profile"; break; fi
+        done
+      fi
+      if ! command -v nix >/dev/null; then
+        curl --proto '=https' --tlsv1.2 -sSfL https://install.determinate.systems/nix | sh -s -- install --no-confirm
+        . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+      fi
+      dirname "$(command -v nix)" >> "$ULTIMATOR_PATH"
+      nix --version
+      nix config show experimental-features | grep -qw flakes || echo "NIX_CONFIG=experimental-features = nix-command flakes" >> "$ULTIMATOR_ENV"
+    `,
+  };
+}
+
+export type PackagesLabel = "linux-x86_64" | "linux-aarch64" | "macos-aarch64";
+
+/** YAS's release tarballs for one platform (bin/build-tarballs, through the flake) into dist/, and on macOS the
+ * complete cross-platform product graph's tests. */
+export function packages(label: PackagesLabel): Step[] {
+  // Bound aggregate Cargo parallelism to the machine's memory: the arm64 machine serializes its Nix jobs.
+  const arm = label === "linux-aarch64";
+  const steps: Step[] = [
+    nix(),
+    {
+      name: "Build release tarballs",
+      env: {
+        NIX_CONFIG: `experimental-features = nix-command flakes\nmax-jobs = ${arm ? 1 : 2}\ncores = ${arm ? 2 : 4}\n`,
+      },
+      run: "./bin/build-tarballs dist",
+    },
+  ];
+  if (label === "macos-aarch64") {
+    steps.push({
+      name: "Test the complete cross-platform YAS product graph on macOS",
+      env: { RUSTFLAGS: "-D warnings" },
+      run: sh`
+        # Linux-only compositor probes are Cargo examples. Exercise every workspace library, product binary, and
+        # integration/unit test here without asking macOS to compile those live Wayland probes.
+        nix develop --command bash -lc '
+          cd crates/browser &&
+          wasm-pack build --target web --release --out-dir pkg &&
+          cd ../../js &&
+          pnpm install --frozen-lockfile &&
+          pnpm --filter @yas-run/core run build &&
+          pnpm --filter @yas-run/solid run build &&
+          pnpm --filter @yas-run/ui run build &&
+          pnpm --filter yas-web run build
+        '
+        nix develop --command cargo test --workspace --lib --bins --tests
+        nix develop --command bash -lc 'cd js && pnpm install --frozen-lockfile && pnpm run typecheck && pnpm run test'
+      `,
+    });
+  }
+  return steps;
+}
+
+/**
+ * YAS for Windows x86_64 on crab-win, the Windows 11 ARM64 VM on crab, as GitHub's windows-2025 runner built it: an
+ * x86_64 toolchain that runs under Windows' x64 emulation, so the binaries and the tests are x86_64 ones. crab-win
+ * needs (pcarrier/sys docs/github-runner-windows.md): Git for Windows (bash), rustup, Visual Studio's x64/x86 build
+ * tools (component Microsoft.VisualStudio.Component.VC.Tools.x86.x64, beside the ARM64 ones), Node.js 22 or later and
+ * 7-Zip. wasm-pack, pnpm and bun are installed by the job.
+ */
+export function windowsX64(bunVersion = "1.3.13"): Step[] {
+  return [
+    {
+      name: "x86_64 toolchain (emulated)",
+      shell: "bash",
+      run: sh`
+        vswhere="/c/Program Files (x86)/Microsoft Visual Studio/Installer/vswhere.exe"
+        if [ -z "$("$vswhere" -latest -products '*' -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath)" ]; then
+          echo "::error::crab-win needs Visual Studio's x64/x86 build tools (Microsoft.VisualStudio.Component.VC.Tools.x86.x64)"
+          exit 1
+        fi
+        rustup toolchain install stable-x86_64-pc-windows-msvc --profile minimal --target wasm32-unknown-unknown --force-non-host
+        echo "RUSTUP_TOOLCHAIN=stable-x86_64-pc-windows-msvc" >> "$ULTIMATOR_ENV"
+      `,
+    },
+    {
+      name: "wasm-pack, pnpm, bun",
+      shell: "bash",
+      env: { BUN_VERSION: bunVersion },
+      run: sh`
+        rustc -vV | grep -Fx "host: x86_64-pc-windows-msvc"
+        command -v wasm-pack >/dev/null || cargo install wasm-pack --locked
+        npm install -g pnpm@10 "bun@$BUN_VERSION"
+        node --version; pnpm --version; bun --version; wasm-pack --version
+      `,
+    },
+    {
+      name: "Build UI",
+      shell: "bash",
+      run: sh`
+        (cd crates/browser && wasm-pack build --target web --release --out-dir pkg)
+        cd js
+        pnpm install --frozen-lockfile
+        pnpm --filter @yas-run/core run build
+        pnpm --filter @yas-run/solid run build
+        pnpm --filter @yas-run/ui run build
+        pnpm --filter yas-web run build
+      `,
+    },
+    {
+      name: "Build release binaries",
+      shell: "bash",
+      run: sh`
+        cargo build --release -p yas-cli
+        file_info="$(od -An -tx1 -j "$(( $(od -An -tu4 -j 60 -N 4 target/release/yas.exe) + 4 ))" -N 2 target/release/yas.exe | tr -d ' ')"
+        [ "$file_info" = "6486" ] || { echo "::error::target/release/yas.exe isn't x86_64 (machine $file_info)"; exit 1; }
+      `,
+    },
+    {
+      name: "Test the complete cross-platform YAS product graph",
+      shell: "bash",
+      run: sh`
+        # Linux-only compositor probes are Cargo examples. Exercise every workspace library, product binary, and
+        # integration/unit test here without asking Windows to compile those live Wayland probes.
+        cargo test --workspace --lib --bins --tests
+        cd js
+        pnpm run typecheck
+        pnpm run test
+      `,
+    },
+  ];
+}

.ultimator/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "es2022",
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "lib": ["es2022"],
+    "types": [],
+    "strict": true,
+    "noEmit": true,
+    "allowImportingTsExtensions": true,
+    "erasableSyntaxOnly": true,
+    "verbatimModuleSyntax": true
+  },
+  "include": ["**/*.ts"]
+}