Build a complete CI pipeline modeled on magpie (yetone/magpie) #30

Reference

yetone/magpie: its .github/workflows test.yml, release.yml, docker.yml and ui-preview.yml, and the CI lessons in its LESSONS.md.

Patterns worth taking from magpie:

• Main's runs always finish. cancel-in-progress is on only off main, because a release waits for a green run on its commit, and runs cancelled by the next push would leave none.
• Fail fast and cheap. A formatting check runs before the long suite, and slow installs have timeouts. A stuck apt mirror once held magpie's main for 2.5 h.
• The OS matrix includes macOS, with OS-specific steps.
• A second job builds what users install (cli: the terminal-only release build plus the installer and site tests).
• A tag-driven release that publishes artifacts and release notes.
• Docker image smoke test and UI preview recordings on PRs.

Current CI state (main)

• .github/workflows/test.yml ("Test") runs on push to main, PRs and manual dispatch.
  • Matrix: ubuntu Node 24 / DSH 0.2.0-rc.2, windows Node 24 / rc.2, ubuntu Node 22 / rc.2, ubuntu Node 24 / DSH 0.2.1-alpha.1.
  • Steps: npm ci, the DSH harness, npm test, build-client.mjs --check, npm run lint.
• Gaps:
  • The plugin suites never run. That covers ds-bot/plugins/social/test/*.test.js and ds-bot/plugins/tree/test/tree.test.js (45 tests).
  • There is no coverage.
  • There is no macOS leg, though FlyBot users run it on macOS.
  • Nothing checks what gets packed and installed into a DSH profile.
  • There is no release workflow.
  • Every push to main cancels the previous main run.
• ds-bot/test/tree-host.test.js (the tree plugin on a real ds-bot) runs inside npm test, but is not part of any coverage.
• Branch protection on main requires the four matrix job names.

Proposal (adapted to FlyBot)

Kept from general hardening, because it's cheap and useful:

• Actions pinned to commit SHAs, with persist-credentials: false.
• A tests-ok aggregate check.
• CodeQL for javascript-typescript and actions.
• Grouped weekly Dependabot updates with a 7-day cooldown, to keep the SHA pins current.

No job requires a secret.

Impact on branch-protection required checks

Main currently requires all four legs. With the slim gate (#31), three of them are no longer reported, so protection must change:

• Keep ubuntu-latest · Node 24 · DSH 0.2.0-rc.2.
• Add package and tests-ok.
• Remove ubuntu-latest · Node 24 · DSH 0.2.1-alpha.1, ubuntu-latest · Node 22 · DSH 0.2.0-rc.2 and windows-latest · Node 24 · DSH 0.2.0-rc.2 (now non-required compat · … jobs).
• Optional: Analyze (javascript-typescript), Analyze (actions).

Tasks

• Test: main's runs finish (cancel only off main); lint/build before tests; install timeouts
• Single PR-gate job (ci: slim Test matrix to ubuntu Node 24 + DSH 0.2.0-rc.2 #31); Compatibility workflow (nightly/manual) for Windows, macOS, Node 22 and DSH next, sharing one composite action
• Test: social and tree plugin suites, incl. plugins/tree/test/tree.test.js; test/tree-host.test.js stays in ds-bot's suite
• Coverage over ds-bot, social and tree (incl. tree-host and tree.test.js): job summary and lcov artifact
• package job: pack check of the three packages, strict typecheck of types/*.d.ts, CHANGELOG check, actionlint
• tests-ok aggregate
• Release on v* tags: version check, wait for green Test, tarballs and CHANGELOG notes (GITHUB_TOKEN)
• SHA-pinned actions, least-privilege permissions, persist-credentials: false
• CodeQL; Dependabot for actions and npm
• Deferred: UI preview recordings on PRs (dev/ui-shots.mjs)
• Deferred: JS typecheck (checkJs, needs @types/node and fixes first)
• Not applicable: Docker image
• Branch protection: add the new contexts once stable (maintainers)