Auto-Trader/.github/workflows/desktop-windows.yml at 6000b3e61dfd7b6cbc4054a098c6072c2aced729

0 Fork 0

Files

T

Haozhe Wu 97f093b8d9 ci: stop waiting on npm's 503-ing audit endpoint during npm ci

The frontend job on be623c1b spent 357 of its 407 seconds inside `npm ci`; the
build it exists to run (tsc + vite) took 13. The install itself was never the
problem — the audit request npm makes after installing was:

    npm warn audit 503 Service Unavailable -
      POST https://registry.npmjs.org/-/npm/v1/security/advisories/bulk
    npm notice This endpoint is being retired. Use the bulk advisory endpoint instead.

npm retries that call before printing "added 380 packages in 6m". Measured
locally against the same lock file with the same warm cache:

    npm ci                                                 61s
    npm ci --no-audit --no-fund                             4s
    NPM_CONFIG_AUDIT=false NPM_CONFIG_FUND=false npm ci      4s

This is the same slowdown that timed out `test / Python 3.11` on 8555a05a, so
splitting the frontend into its own job treated the symptom; this is the cause.

Turning the audit off costs no coverage:

- `npm ci` exits 0 no matter what the audit reports — verified by running it
  against this tree, not assumed from the docs. It never gated anything.
- The endpoint currently returns no advisories at all, so the call is buying
  zero information even when it does answer.
- Dependabot watches the same dependency tree and is the channel that actually
  reports: the 7 open alerts on this repo (fast-uri, @xmldom/xmldom,
  browserslist, postcss-selector-parser) all come from it, none from here.

Set as workflow-level env rather than flags on four separate `npm ci` lines, so
any npm invocation added later inherits it. It applies to CI only — a
developer's own `npm ci` still audits once npmjs.com recovers.

2026-09-04 14:35:35 +08:00

132 lines

4.8 KiB

YAML

Raw Blame History

 name: Desktop Windows
 on:
   workflow_dispatch:
   push:
     branches: [main]
     paths:
       - ".github/workflows/desktop-windows.yml"
       - "agent/**"
       - "desktop/electron/**"
       - "frontend/**"
       - "pyproject.toml"
   pull_request:
     paths:
       - ".github/workflows/desktop-windows.yml"
       - "agent/**"
       - "desktop/electron/**"
       - "frontend/**"
       - "pyproject.toml"
 permissions:
   contents: read
 # `npm ci` runs a security audit after installing and blocks on the response.
 # npmjs.com's advisory endpoint is currently answering 503 (it prints "This
 # endpoint is being retired"), so npm retries it: on 2026-09-04 that turned a
 # 4s install into a 6m one and timed the CI job out mid-install. Measured on one
 # machine, one lock file, one warm cache:
 #
 #   npm ci                                    61s
 #   npm ci --no-audit --no-fund                4s
 #   NPM_CONFIG_AUDIT=false NPM_CONFIG_FUND=false npm ci    4s
 #
 # Nothing is lost. `npm ci` exits 0 whatever the audit says (verified directly),
 # the endpoint returns no advisories at all right now, and Dependabot already
 # watches this same tree — it is what reported the 7 open npm alerts. This is CI
 # only; a developer's `npm ci` still audits when the endpoint recovers.
 env:
   NPM_CONFIG_AUDIT: "false"
   NPM_CONFIG_FUND: "false"
 jobs:
   package:
     # GTK is extracted as a checksum-pinned archive rather than executed as a
     # legacy NSIS installer, so packaging can run on the current Windows image.
     runs-on: windows-2025
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
           cache: pip
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: npm
           cache-dependency-path: |
             frontend/package-lock.json
             desktop/electron/package-lock.json
       - name: Build frontend
         working-directory: frontend
         run: |
           npm ci
           npm run build
       - name: Install desktop dependencies
         working-directory: desktop/electron
         run: npm ci
       - name: Verify dormant update rejection and recovery policy
         working-directory: desktop/electron
         run: npm run test:update-safety
       - name: Prepare verified Electron runtime
         working-directory: desktop/electron
         run: npm run prepare:electron
       - name: Verify encrypted credential storage
         working-directory: desktop/electron
         run: npm run smoke:credentials
       - name: Verify bounded native process adapter
         working-directory: desktop/electron
         shell: powershell
         run: .\scripts\test-process-utils.ps1
       - name: Assemble minimal Python runtime
         working-directory: desktop/electron
         shell: powershell
         run: .\scripts\build-backend.ps1 -BuildPython "${{ env.pythonLocation }}\python.exe" -Clean
       - name: Verify backend lifecycle
         working-directory: desktop/electron
         run: npm run smoke:lifecycle
       - name: Build NSIS installer
         working-directory: desktop/electron
         env:
           CSC_IDENTITY_AUTO_DISCOVERY: "false"
         run: npm run installer:win:review
       - name: Verify packaged startup and parent-death cleanup
         working-directory: desktop/electron
         shell: powershell
         run: |
           $env:VIBE_TRADING_DESKTOP_ELECTRON_EXECUTABLE = (
             Resolve-Path 'release\win-unpacked\Vibe-Trading Desktop (Unofficial Community Build).exe'
           ).Path
           node scripts/smoke-parent-death.mjs
       - name: Verify installer and record checksum
         working-directory: desktop/electron
         shell: powershell
         run: |
           $installer = Get-ChildItem -LiteralPath release -Filter 'Vibe-Trading-Desktop-Unofficial-*-x64.exe' |
             Sort-Object LastWriteTime -Descending |
             Select-Object -First 1
           if (-not $installer) { throw 'Installer not found' }
           $hash = (Get-FileHash -LiteralPath $installer.FullName -Algorithm SHA256).Hash.ToLowerInvariant()
           "$hash  $($installer.Name)" | Set-Content -LiteralPath release\SHA256SUMS.txt -Encoding ascii
           "### Unsigned Windows packaging check" | Add-Content -LiteralPath $env:GITHUB_STEP_SUMMARY
           "" | Add-Content -LiteralPath $env:GITHUB_STEP_SUMMARY
           "- File: ``$($installer.Name)``" | Add-Content -LiteralPath $env:GITHUB_STEP_SUMMARY
           "- SHA-256: ``$hash``" | Add-Content -LiteralPath $env:GITHUB_STEP_SUMMARY
           "- Status: built for review only; not uploaded or published" |
             Add-Content -LiteralPath $env:GITHUB_STEP_SUMMARY

132 lines 4.8 KiB YAML Raw Blame History

132 lines

4.8 KiB

YAML

Raw Blame History