Skip to content

ci(runtime): fail a PR whose SDK runtime pin does not match its WASM #1500

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
callumalpass merged 2 commits into from
Nov 13, 2026
Merged

ci(runtime): fail a PR whose SDK runtime pin does not match its WASM #1500

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ccbe5a7
ci(runtime): fail a PR whose SDK runtime pin does not match its WASM
callumalpass Nov 13, 2026
96fa6e5
Merge branch 'main' into ci/runtime-pin-guard
callumalpass Nov 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/workflows/runtime-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,10 @@ jobs:
- name: determinism (native vs WASM replay)
run: cargo xtask determinism
- name: dedicated app runtime (feature tests, wasm32 clippy, size report, real SQLite ABI)
# Same path remapping as publish-sdk-npm.yml, so this build is byte-identical
# to the WASM the SDK publisher packs and can be checked against the SDK pin.
env:
RUSTFLAGS: --remap-path-prefix=${{ github.workspace }}=/source --remap-path-prefix=/home/runner/.cargo=/cargo
run: cargo xtask wasm-app
- name: Install isolated browser smoke tooling
run: |
Expand All @@ -98,6 +102,9 @@ jobs:
runtime/target/wasm/runtime.wasm
runtime/target/wasm/app-runtime.wasm
retention-days: 7
- name: SDK runtime pin matches this build
working-directory: .
run: node scripts/sdk-publication.mjs check-runtime-pin

sdk:
name: sdk execution
Expand Down
12 changes: 11 additions & 1 deletion scripts/sdk-publication.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,11 +146,21 @@ if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1]
refreshSdkRuntimePin(join(root, "runtime/target/wasm/app-runtime.wasm"), join(sdk, "src/application/asset-pins.json"), source);
execFileSync("node", ["scripts/runtime-methods.mjs", "--write"], { cwd: sdk, stdio: "inherit" });
}
else if (command === "check-runtime-pin") {
const file = join(root, "runtime/target/wasm/app-runtime.wasm");
try {
checkedSdkAsset(file, readJson(join(sdk, "src/application/asset-pins.json")).runtime);
} catch (error) {
console.error("The SDK runtime pin does not match app-runtime.wasm built from this commit, so SDK publication would refuse it.\n"
+ "Download this run's runtime-wasm artifact into runtime/target/wasm/, then run `node scripts/sdk-publication.mjs pin-runtime` and commit the result.");
throw error;
}
}
else if (command === "pack-all") await packAllSdks(resolve(environment));
else if (command === "verify-npm") verifySdkArchive(resolve(environment), "production",
readJson(join(root, "package.json")).version, process.env.GITHUB_SHA, publication());
else if (command === "production-version") console.log(exactSdkVersion(environment));
else if (command === "verify") await verifySdkDirectory(resolve(directory), environment, commit);
else if (command === "legacy-archive") checkLegacyArchive(environment);
else throw new Error("Expected check, ready, pin-runtime, pack-all, verify-npm, production-version, verify or legacy-archive");
else throw new Error("Expected check, ready, pin-runtime, check-runtime-pin, pack-all, verify-npm, production-version, verify or legacy-archive");
}
Loading