# pear-git CI — auto-build + publish on `git push pear master`.
#
# Copied from favela-host's ci.yaml (install -> vendor -> guard -> tests -> publish). Before this file
# favela-surface had none, so pear-git-v3 exported every push and SKIPPED it without a log line
# (`ci-orchestrator.js`: no ci.yaml -> { skipped }) — 0.0.64 never published, and 0.0.63 and earlier
# were published by hand. Its one file: sibling (favela-markdown) is vendored like the others'.
#
# NO daemon-boot smoke: CI steps are synchronous with a hard timeout, and a step that boots a
# long-running daemon orphans the child when the timeout fires.
steps:
- name: install deps (root closure)
run: npm install --production
timeout: 300
# Vendor LAST among the npm operations. CI git-archives only this repo, so each file: dep is a
# dangling symlink until it is copied in from the build machine's working tree, and whatever is
# checked out there ships to the fleet. Refuse unless each sibling HEAD is reachable from a hosted
# branch.
#
# ⛔ The SOURCE comes from the file: spec, not the package name. Two siblings live off the flat
# layout: hyper-identity2 is `file:../packages/hyper-identity2` and hyperident is
# `file:../repos/hyperident`. Looking them up as hyper-fleeky/<name> (ap-bridge's rule) finds
# neither. The spec is resolved against the canonical checkout, because the export in /tmp has no
# meaningful `..`.
- name: "vendor file: siblings into the closure"
run: |
HF=/storage/projects/code/hypercore-kb/hyper-fleeky
[ -d "$HF" ] || HF="$HOME/hyper-fleeky"
SIBS=$(node -e 'const d=require("./package.json");const a={...d.dependencies,...d.devDependencies};console.log(Object.entries(a).filter(([,v])=>String(v).startsWith("file:../")).map(([k,v])=>k+"="+v.slice(8)).join(" "))')
echo "siblings (derived from package.json): $SIBS"
[ -n "$SIBS" ] || { echo "no file: siblings found — package.json unreadable?"; exit 1; }
rc=0
for pair in $SIBS; do
pkg=${pair%%=*}; rel=${pair#*=}
SRC="$HF/$rel"
if [ ! -d "$SRC" ]; then echo " $pkg: $SRC NOT FOUND on the build machine — refuse"; rc=1; continue; fi
GD="$HOME/git-repos/$(basename "$rel").git"
if [ ! -d "$GD" ]; then echo " $pkg: no hosted repo at $GD — refuse"; rc=1; continue; fi
LOCAL=$(git -C "$SRC" rev-parse HEAD 2>/dev/null)
REFS=$(git --git-dir="$GD" for-each-ref --contains "$LOCAL" --format='%(refname:short)' refs/heads 2>/dev/null | tr '\n' ' ')
if [ -z "$REFS" ]; then echo " $pkg: $(echo $LOCAL | cut -c1-7) NOT in hosted history — refuse (push it)"; rc=1; continue; fi
echo " $pkg ($rel): $(echo $LOCAL | cut -c1-7) ok (on: $REFS)"
rm -rf "node_modules/$pkg" && cp -rL "$SRC" "node_modules/$pkg"
done
exit $rc
timeout: 180
# Declare-your-deps guard: an undeclared runtime import resolves locally through hoisting and then
# crash-loops the --production closure with MODULE_NOT_FOUND. Checks the DECLARATION, not the
# disk. Runtime code is index.js, bin/ and lib/; `#node:` specifiers are package imports and are
# skipped by the pattern.
- name: every direct import is declared
run: |
rc=0
# Only files that exist: favela-surface has no bin/, and grep on an unmatched glob fails the step.
FILES=$(ls index.js bin/*.js lib/*.js 2>/dev/null)
for spec in $(grep -hoE "from '[a-z0-9@][^']*'" $FILES \
| sed -E "s/.*from '([^']*)'/\1/" | sort -u); do
case "$spec" in
@*) m=$(echo "$spec" | cut -d/ -f1,2) ;;
*) m=$(echo "$spec" | cut -d/ -f1) ;;
esac
if node -e "const d=require('./package.json');process.exit(({...d.dependencies,...d.devDependencies})['$m']?0:1)"; then echo " ok: $m"
else echo " UNDECLARED: $m (from '$spec') — resolves on disk but is not in package.json"; rc=1; fi
done
exit $rc
timeout: 60
# Tests AFTER vendoring, against the exact tree about to be published. npm must not touch this
# tree now (it re-resolves and deletes hand-vendored directories), so registry devDependencies go
# into a SEPARATE prefix, only what the tree lacks is copied in, the suite runs with the tree's own
# brittle (brittle-bare runs tests in-process), and exactly those additions are removed again.
- name: tests (offline, against the vendored closure)
run: |
B=$(mktemp -d)
# ⛔ The LOCKED dev graph, every package at the version package-lock.json records — not the ranges
# in package.json. Resolved fresh, brittle ^4 became 4.5.0 (2026-10-09), whose
# bare-structured-clone 2.x needs bare-type >=1.3, and that needs Bare >=1.32; this machine runs
# Bare 1.28 and the tree pins bare-type 1.1.1, so the runner died before a single test. The
# lockfile's dev graph (brittle 4.1.1) is the one the suite already passes with locally.
SPECS=$(node -p 'const l=require("./package-lock.json").packages;Object.entries(l).filter(([k,v])=>v.dev&&/^node_modules\/(@[^/]+\/)?[^/]+$/.test(k)&&v.version).map(([k,v])=>k.slice(13)+"@"+v.version).join(" ")')
echo "test-only devDependencies: $SPECS"
npm install --prefix "$B" --no-audit --no-fund --no-save $SPECS >/dev/null 2>&1 || { echo "could not install: $SPECS"; exit 1; }
ADDED=""
for p in $(cd "$B/node_modules" && ls -A | grep -v -E '^\.'); do
case "$p" in
@*) for q in $(ls -A "$B/node_modules/$p"); do
if [ ! -e "node_modules/$p/$q" ]; then mkdir -p "node_modules/$p" && cp -r "$B/node_modules/$p/$q" "node_modules/$p/$q" && ADDED="$ADDED $p/$q"; fi
done ;;
*) if [ ! -e "node_modules/$p" ]; then cp -r "$B/node_modules/$p" "node_modules/$p" && ADDED="$ADDED $p"; fi ;;
esac
done
echo "overlaid for the test run only:$ADDED"
# The runner's path comes from brittle's own bin map: brittle 4 moved it from bin/bare.js
# (ap-bridge's 3.x) to brittle-bare.js at the package root.
RUNNER=node_modules/brittle/$(node -p 'require("./node_modules/brittle/package.json").bin["brittle-bare"]')
bare "$RUNNER" test/*.test.js; rc=$?
for p in $ADDED; do rm -rf "node_modules/$p"; done
rm -rf "$B"
exit $rc
timeout: 900
- name: pgh publish (content-addressed -> installable app)
run: pgh publish . --accept-conflict "automated CI publish; dep version-splits inherited from per-app lockfiles across the pgh ecosystem"
timeout: 300