Forge CI: ci, release and deploy-website workflows (.ultimator/)

.ultimator/actions/nix/action.yml

@@ -0,0 +1,24 @@
+# Nix for a Forge CI job (xmit-dev/ultimator docs/CI.md), in place of DeterminateSystems/nix-installer-action and
+# magic-nix-cache-action, which are Marketplace actions Forge doesn't run. A machine that has Nix (crab) keeps its own;
+# a fresh sandbox gets it from Determinate's installer, with flakes on. There is no binary cache beyond cache.nixos.org:
+# a sandbox's first build of the flake's toolchain is cold.
+name: nix
+description: Nix with flakes, on PATH for the job's later steps
+runs:
+  using: composite
+  steps:
+    - name: Nix
+      shell: bash
+      run: |
+        if ! command -v nix >/dev/null; then
+          for profile in /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh "$HOME/.nix-profile/etc/profile.d/nix.sh"; do
+            if [ -f "$profile" ]; then . "$profile"; break; fi
+          done
+        fi
+        if ! command -v nix >/dev/null; then
+          curl --proto '=https' --tlsv1.2 -sSfL https://install.determinate.systems/nix | sh -s -- install --no-confirm
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+        fi
+        dirname "$(command -v nix)" >> "$GITHUB_PATH"
+        nix --version
+        nix config show experimental-features | grep -qw flakes || echo "NIX_CONFIG=experimental-features = nix-command flakes" >> "$GITHUB_ENV"

.ultimator/actions/packages/action.yml

@@ -0,0 +1,41 @@
+# YAS's release tarballs for one platform (bin/build-tarballs, through the flake), and on macOS the complete
+# cross-platform product graph's tests, as .github/workflows/_build-packages.yml did.
+name: packages
+description: Build the release tarballs into dist/
+inputs:
+  label:
+    description: linux-x86_64, linux-aarch64 or macos-aarch64
+    required: true
+runs:
+  using: composite
+  steps:
+    - uses: ./.ultimator/actions/nix
+    - name: Build release tarballs
+      shell: bash
+      env:
+        # Bound aggregate Cargo parallelism to the machine's memory: the arm64 machine serializes its Nix jobs.
+        NIX_CONFIG: |
+          experimental-features = nix-command flakes
+          max-jobs = ${{ inputs.label == 'linux-aarch64' && '1' || '2' }}
+          cores = ${{ inputs.label == 'linux-aarch64' && '2' || '4' }}
+      run: ./bin/build-tarballs dist
+    - name: Test the complete cross-platform YAS product graph on macOS
+      if: inputs.label == 'macos-aarch64'
+      shell: bash
+      env:
+        RUSTFLAGS: "-D warnings"
+      run: |
+        # Linux-only compositor probes are Cargo examples. Exercise every workspace library, product binary, and
+        # integration/unit test here without asking macOS to compile those live Wayland probes.
+        nix develop --command bash -lc '
+          cd crates/browser &&
+          wasm-pack build --target web --release --out-dir pkg &&
+          cd ../../js &&
+          pnpm install --frozen-lockfile &&
+          pnpm --filter @yas-run/core run build &&
+          pnpm --filter @yas-run/solid run build &&
+          pnpm --filter @yas-run/ui run build &&
+          pnpm --filter yas-web run build
+        '
+        nix develop --command cargo test --workspace --lib --bins --tests
+        nix develop --command bash -lc 'cd js && pnpm install --frozen-lockfile && pnpm run typecheck && pnpm run test'

.ultimator/actions/windows-x64/action.yml

@@ -0,0 +1,56 @@
+# YAS for Windows x86_64 on crab-win, the Windows 11 ARM64 VM on crab, as GitHub's windows-2025 runner built it: an
+# x86_64 toolchain that runs under Windows' x64 emulation, so the binaries and the tests are x86_64 ones.
+# crab-win needs (pcarrier/sys docs/github-runner-windows.md): Git for Windows (bash), rustup, Visual Studio's x64/x86
+# build tools (component Microsoft.VisualStudio.Component.VC.Tools.x86.x64, beside the ARM64 ones), Node.js 22 or
+# later and 7-Zip. wasm-pack, pnpm and bun are installed by the job.
+name: windows-x64
+description: Build the UI and the release binaries for x86_64-pc-windows-msvc, then test the cross-platform graph
+inputs:
+  bun-version:
+    description: Bun, which js/web's tests run with
+    default: "1.3.13"
+runs:
+  using: composite
+  steps:
+    - name: x86_64 toolchain (emulated)
+      shell: bash
+      run: |
+        vswhere="/c/Program Files (x86)/Microsoft Visual Studio/Installer/vswhere.exe"
+        if [ -z "$("$vswhere" -latest -products '*' -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath)" ]; then
+          echo "::error::crab-win needs Visual Studio's x64/x86 build tools (Microsoft.VisualStudio.Component.VC.Tools.x86.x64)"
+          exit 1
+        fi
+        rustup toolchain install stable-x86_64-pc-windows-msvc --profile minimal --target wasm32-unknown-unknown --force-non-host
+        echo "RUSTUP_TOOLCHAIN=stable-x86_64-pc-windows-msvc" >> "$GITHUB_ENV"
+    - name: wasm-pack, pnpm, bun
+      shell: bash
+      run: |
+        rustc -vV | grep -Fx "host: x86_64-pc-windows-msvc"
+        command -v wasm-pack >/dev/null || cargo install wasm-pack --locked
+        npm install -g pnpm@10 "bun@${{ inputs.bun-version }}"
+        node --version; pnpm --version; bun --version; wasm-pack --version
+    - name: Build UI
+      shell: bash
+      run: |
+        (cd crates/browser && wasm-pack build --target web --release --out-dir pkg)
+        cd js
+        pnpm install --frozen-lockfile
+        pnpm --filter @yas-run/core run build
+        pnpm --filter @yas-run/solid run build
+        pnpm --filter @yas-run/ui run build
+        pnpm --filter yas-web run build
+    - name: Build release binaries
+      shell: bash
+      run: |
+        cargo build --release -p yas-cli
+        file_info="$(od -An -tx1 -j "$(( $(od -An -tu4 -j 60 -N 4 target/release/yas.exe) + 4 ))" -N 2 target/release/yas.exe | tr -d ' ')"
+        [ "$file_info" = "6486" ] || { echo "::error::target/release/yas.exe isn't x86_64 (machine $file_info)"; exit 1; }
+    - name: Test the complete cross-platform YAS product graph
+      shell: bash
+      run: |
+        # Linux-only compositor probes are Cargo examples. Exercise every workspace library, product binary, and
+        # integration/unit test here without asking Windows to compile those live Wayland probes.
+        cargo test --workspace --lib --bins --tests
+        cd js
+        pnpm run typecheck
+        pnpm run test

.ultimator/workflows/ci.yml

@@ -0,0 +1,131 @@
+# YAS's CI on Forge (xmit-dev/ultimator docs/CI.md), ported from .github/workflows/ci.yml, which runs on GitHub until
+# Forge's phase P4. Linux jobs run in sandboxes, with Nix from ./.ultimator/actions/nix; packages also on arm64-ci
+# (Linux arm64) and crab (macOS arm64); Windows x86_64 on crab-win under emulation (./.ultimator/actions/windows-x64).
+# GitHub's reusable _build-packages.yml and _build-windows.yml are composite actions here (Forge has no reusable
+# workflows). The coverage summary goes to the job's summary; there is no sticky pull request comment.
+name: ci
+on:
+  push:
+    branches: [main]
+  pull_request:
+jobs:
+  nix-syntax:
+    name: Nix syntax
+    runs-on: sandbox
+    timeout-minutes: 15
+    steps:
+      - uses: checkout
+      - uses: ./.ultimator/actions/nix
+      - name: Parse all Nix files
+        run: find . -name '*.nix' -exec nix-instantiate --parse {} + > /dev/null
+
+  lint:
+    name: Lint
+    runs-on: sandbox
+    timeout-minutes: 60
+    steps:
+      - uses: checkout
+      - uses: ./.ultimator/actions/nix
+      - run: ./bin/lint --check
+      - name: Check crates.io publication plan
+        run: ./bin/publish-crates --plan
+
+  # Publishing builds nothing (--no-verify), so build every crate from its package here, as crates.io users will.
+  package-crates:
+    name: Package crates
+    runs-on: sandbox
+    timeout-minutes: 90
+    steps:
+      - uses: checkout
+      - uses: ./.ultimator/actions/nix
+      - run: ./bin/package-crates
+
+  test:
+    name: Tests
+    runs-on: sandbox
+    timeout-minutes: 90
+    steps:
+      - uses: checkout
+      - uses: ./.ultimator/actions/nix
+      - run: ./bin/tests
+
+  protocol-fuzz:
+    name: Protocol fuzz
+    runs-on: sandbox
+    timeout-minutes: 60
+    steps:
+      - uses: checkout
+      - uses: ./.ultimator/actions/nix
+      - name: Fuzz every YAS wire surface
+        run: ./bin/fuzz
+        env:
+          YAS_FUZZ_SECONDS: "60"
+
+  e2e:
+    name: E2E
+    runs-on: sandbox
+    timeout-minutes: 90
+    steps:
+      - uses: checkout
+      - uses: ./.ultimator/actions/nix
+      - run: ./bin/e2e
+      - uses: upload-artifact
+        if: ${{ !cancelled() }}
+        with:
+          name: playwright-report
+          path: e2e/test-results/
+          retention-days: 7
+
+  coverage:
+    name: Coverage
+    runs-on: sandbox
+    timeout-minutes: 90
+    steps:
+      - uses: checkout
+      - uses: ./.ultimator/actions/nix
+      - name: Run tests with coverage
+        run: ./bin/coverage
+      - name: Write coverage summary
+        run: cat coverage-summary.txt >> "$GITHUB_STEP_SUMMARY"
+      - uses: upload-artifact
+        if: always()
+        with:
+          name: coverage-report
+          path: coverage-report/html/
+          retention-days: 30
+
+  build-packages:
+    name: Packages (${{ matrix.label }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: sandbox
+            label: linux-x86_64
+          - runner: arm64-ci
+            label: linux-aarch64
+          - runner: crab
+            label: macos-aarch64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 120
+    steps:
+      - uses: checkout
+      - uses: ./.ultimator/actions/packages
+        with:
+          label: ${{ matrix.label }}
+
+  build-windows:
+    name: Windows (x86_64, emulated)
+    runs-on: crab-win
+    timeout-minutes: 150
+    env:
+      RUSTFLAGS: "-D warnings"
+    steps:
+      - uses: checkout
+      - uses: cache
+        with:
+          path: target
+          key: yas-windows-x86_64-${{ hashFiles('Cargo.lock') }}-${{ github.sha }}
+          restore-keys: |
+            yas-windows-x86_64-${{ hashFiles('Cargo.lock') }}-
+      - uses: ./.ultimator/actions/windows-x64

.ultimator/workflows/deploy-website.yml

@@ -0,0 +1,37 @@
+# The website (yas.run) on Fly, ported from .github/workflows/deploy-website.yml, which runs on GitHub until Forge's
+# phase P4. It takes the sealed secret FLY_API_TOKEN (for yas-run/yas on main): pushes to main are trusted runs once
+# main is protected.
+name: deploy-website
+on:
+  push:
+    branches: [main]
+    paths:
+      - "crates/website/**"
+      - "crates/browser/**"
+      - "js/web/**"
+      - "js/core/**"
+      - "js/solid/**"
+      - "js/ui/**"
+      - "install.sh"
+      - "install.ps1"
+      - "SKILL.md"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "js/pnpm-lock.yaml"
+      - "js/pnpm-workspace.yaml"
+      - ".dockerignore"
+      - ".ultimator/workflows/deploy-website.yml"
+concurrency:
+  group: deploy-website
+  cancel-in-progress: false
+jobs:
+  deploy:
+    name: Deploy
+    runs-on: sandbox
+    timeout-minutes: 60
+    steps:
+      - uses: checkout
+      - uses: ./.ultimator/actions/nix
+      - run: nix run .#deploy-website
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}