779cc6cb49
Three small but high-signal changes that came out of an audit of how
much Studio surface CI actually exercises:
1. Every studio-*-smoke.yml workflow now uploads its artifacts on
`if: always()` instead of `if: failure()`. On green runs the
screenshots + studio.log are now reviewable in the Actions UI,
which closes the "passed but the UI is silently broken" hole.
SHA-pinned to actions/upload-artifact@v4.6.2 across all 7 upload
steps (was a mix of @v4 unpinned + the SHA-pin).
2. /api/system and /api/system/hardware now require a Bearer token
(Depends(get_current_subject)). Today they leak Python version,
GPU name, total memory, and the ML package set without auth --
fine on a single-user Tauri box, not fine on -H 0.0.0.0 / Colab
/ a Tauri-relayed setup. /api/system/gpu-visibility was already
gated; now /api/system + /api/system/hardware match it.
3. Path filters + health-wait plumbing:
- studio-ui-smoke.yml now triggers on tests/studio/** so a PR
that ONLY edits the Playwright test file actually runs UI CI.
- studio-tauri-smoke.yml now triggers on unsloth_cli/** so a CLI
rename or signature change that breaks Tauri's spawned
`unsloth studio` actually runs Tauri CI.
- The 60s `/api/health` wait loop in studio-ui-smoke.yml +
studio-inference-smoke.yml (3 jobs) is now 180s. Cold runners
with venv warm-up + lazy imports have been observed exceeding
60s, and the cost of a false-fail is much higher than two
extra minutes of waiting.
113 lines
4 KiB
YAML
113 lines
4 KiB
YAML
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
|
|
|
|
# PR-time smoke for the Tauri desktop wrapper. Builds the frontend and the
|
|
# Tauri Linux debug binary, with no codesigning. Catches:
|
|
# - tauri.conf.json drift
|
|
# - src-tauri Cargo.toml or rust source breakage
|
|
# - Tauri CLI version drift (we pin 2.10.1, matching release-desktop.yml)
|
|
# - frontend output not picked up by Tauri's distDir
|
|
#
|
|
# Linux-only on a free `ubuntu-latest` runner. Mac and Windows desktop builds
|
|
# stay in release-desktop.yml (manual `workflow_dispatch`) because they need
|
|
# code-signing secrets and ~30 min of runner time each.
|
|
|
|
name: Studio Tauri CI
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- 'studio/frontend/**'
|
|
- 'studio/src-tauri/**'
|
|
# CLI rename / signature change can break Tauri's spawned
|
|
# `unsloth studio` -- include unsloth_cli in the trigger set.
|
|
- 'unsloth_cli/**'
|
|
- '.github/workflows/studio-tauri-smoke.yml'
|
|
push:
|
|
branches: [main, pip]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
linux-debug-build:
|
|
name: Tauri Linux debug build (no codesign)
|
|
runs-on: ubuntu-22.04
|
|
timeout-minutes: 25
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
|
|
- name: Linux native deps for Tauri / WebKit2GTK
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y \
|
|
libwebkit2gtk-4.1-dev libayatana-appindicator3-dev \
|
|
librsvg2-dev libxdo-dev libssl-dev patchelf
|
|
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: '24'
|
|
cache: 'npm'
|
|
cache-dependency-path: studio/frontend/package-lock.json
|
|
|
|
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @ 2026-05-07
|
|
|
|
- uses: swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1
|
|
with:
|
|
workspaces: studio/src-tauri -> target
|
|
|
|
- name: Install pinned Tauri CLI (matches release-desktop.yml)
|
|
run: npm install --save-dev --prefix studio @tauri-apps/cli@2.10.1
|
|
|
|
- name: Verify pinned Tauri CLI version
|
|
run: |
|
|
out="$(npx --prefix studio tauri --version)"
|
|
echo "$out"
|
|
[ "$out" = "tauri-cli 2.10.1" ] || { echo "::error::expected tauri-cli 2.10.1, got $out"; exit 1; }
|
|
|
|
- name: Frontend build (npm ci, vite)
|
|
working-directory: studio/frontend
|
|
run: |
|
|
npm ci --no-fund --no-audit
|
|
npm run build
|
|
test -f dist/index.html
|
|
|
|
- name: Tauri debug build (Linux, no bundle, no codesign)
|
|
# `--debug` + `--no-bundle` keeps this lean: compiles the Rust crate,
|
|
# confirms the frontend dist is wired into Tauri, but skips the AppImage
|
|
# / .deb production. Code signing is irrelevant because we never produce
|
|
# a distributable artifact.
|
|
env:
|
|
TAURI_SIGNING_PRIVATE_KEY: ''
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ''
|
|
run: npx --prefix studio tauri build --debug --no-bundle
|
|
|
|
- name: Inspect produced binary
|
|
run: |
|
|
BIN=$(find studio/src-tauri/target/debug -maxdepth 1 -type f -executable 2>/dev/null \
|
|
| grep -Ev '\.(d|so|dylib|dll)$' \
|
|
| grep -Ev '/(deps|build|examples)$' \
|
|
| head -1)
|
|
echo "binary: $BIN"
|
|
if [ -z "$BIN" ]; then
|
|
echo "::error::Tauri debug binary not produced"
|
|
ls -la studio/src-tauri/target/debug/ || true
|
|
exit 1
|
|
fi
|
|
file "$BIN"
|
|
du -h "$BIN"
|
|
|
|
- name: Upload Tauri debug build
|
|
# Always upload so a green run leaves the binary inspectable too.
|
|
if: always()
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: tauri-debug-build
|
|
path: |
|
|
studio/src-tauri/target/debug
|
|
studio/frontend/dist
|
|
retention-days: 3
|