Skip to content

Set up CI #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Soupstraw wants to merge 7 commits into
base: master
Choose a base branch
from
+121 −0
Draft

Set up CI #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d1322ff
Add CI workflow for benchmarks
Soupstraw Mar 5, 2026
905cdb1
Add tests to CI workflow
Soupstraw Mar 5, 2026
f078287
Run tests across multiple GHC versions
Soupstraw Mar 5, 2026
8d52621
Add required job for branch protection
Soupstraw Mar 5, 2026
7cf3034
Remove required job from CI
Soupstraw Mar 5, 2026
324cb1c
Add fourmolize script
Soupstraw Mar 5, 2026
e662158
Copied fourmolu CI job from cardano-ledger
Soupstraw Mar 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
99 changes: 99 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
name: CI

on:
pull_request:
branches: [master]
push:
branches: [master]

jobs:
test:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
ghc-version: ['9.6.7', '9.8.4', '9.10.2', '9.12.2']
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The CI test matrix GHC versions should align with the package’s declared support. antigen.cabal declares tested-with: GHC == 9.10.3, but the matrix uses 9.10.2 (and also includes 9.12.2). If these versions aren’t actually supported by the dependency bounds/tooling, CI will fail or be misleading; consider updating the matrix to match tested-with (or updating tested-with to match the matrix).

Suggested change
ghc-version: ['9.6.7', '9.8.4', '9.10.2', '9.12.2']
ghc-version: ['9.6.7', '9.8.4', '9.10.3']

Copilot uses AI. Check for mistakes.
steps:
- uses: actions/checkout@v4

- name: Setup Haskell
uses: haskell-actions/setup@v2
with:
ghc-version: ${{ matrix.ghc-version }}
cabal-version: '3.12'

- name: Cache cabal packages
uses: actions/cache@v4
with:
path: |
~/.cabal/packages
~/.cabal/store
dist-newstyle
key: ${{ runner.os }}-ghc-${{ matrix.ghc-version }}-cabal-${{ hashFiles('**/*.cabal') }}
restore-keys: |
${{ runner.os }}-ghc-${{ matrix.ghc-version }}-cabal-

- name: Build
run: cabal build all

- name: Run tests
run: cabal test --test-show-details=direct

benchmark:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- name: Setup Haskell
uses: haskell-actions/setup@v2
with:
ghc-version: '9.10.3'
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The benchmark job pins ghc-version: '9.10.3', but the test job matrix uses 9.10.2. This makes the workflow inconsistent and can hide version-specific issues (or fail if one of the versions isn’t available via haskell-actions/setup). Consider using the same GHC version(s) across jobs, ideally matching the cabal tested-with field.

Suggested change
ghc-version: '9.10.3'
ghc-version: '9.10.2'

Copilot uses AI. Check for mistakes.
cabal-version: '3.12'

- name: Cache cabal packages
uses: actions/cache@v4
with:
path: |
~/.cabal/packages
~/.cabal/store
dist-newstyle
key: ${{ runner.os }}-cabal-${{ hashFiles('**/*.cabal') }}
restore-keys: |
${{ runner.os }}-cabal-
Comment on lines +59 to +62
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark cache key doesn’t include the GHC (or cabal) version, so it can restore an incompatible ~/.cabal/store/dist-newstyle if the toolchain changes (or if this job’s GHC version is adjusted later). Include ${{ matrix.ghc-version }} (or the pinned GHC version) and cabal version in the cache key to avoid subtle cache poisoning.

Copilot uses AI. Check for mistakes.

- name: Build
run: cabal build bench

- name: Run benchmarks
run: cabal run bench -- --csv bench-results.csv

- name: Upload benchmark results
uses: actions/upload-artifact@v4
with:
name: benchmark-results
path: bench-results.csv

fourmolu:
runs-on: ubuntu-latest

defaults:
run:
shell: bash

strategy:
fail-fast: false

steps:
- uses: actions/checkout@v4

- name: Install fourmolu
run: |
FOURMOLU_VERSION="0.17.0.0"
BINDIR=$HOME/.local/bin
mkdir -p "$BINDIR"
curl -sSfL "https://github.com/fourmolu/fourmolu/releases/download/v${FOURMOLU_VERSION}/fourmolu-${FOURMOLU_VERSION}-linux-x86_64" -o "$BINDIR/fourmolu"
chmod a+x "$BINDIR/fourmolu"
Comment on lines +94 to +95
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow downloads an executable from GitHub Releases without verifying a checksum/signature. If the download is tampered with (or the release asset is replaced), this can execute untrusted code in CI. Consider pinning and verifying a SHA256/SHA512 checksum (or using a trusted installation method such as building from source with a pinned dependency set).

Suggested change
curl -sSfL "https://github.com/fourmolu/fourmolu/releases/download/v${FOURMOLU_VERSION}/fourmolu-${FOURMOLU_VERSION}-linux-x86_64" -o "$BINDIR/fourmolu"
chmod a+x "$BINDIR/fourmolu"
curl -sSfL "https://github.com/fourmolu/fourmolu/releases/download/v${FOURMOLU_VERSION}/fourmolu-${FOURMOLU_VERSION}-linux-x86_64" -o "$BINDIR/fourmolu"
curl -sSfL "https://github.com/fourmolu/fourmolu/releases/download/v${FOURMOLU_VERSION}/fourmolu-${FOURMOLU_VERSION}-linux-x86_64.sha256" -o "$BINDIR/fourmolu.sha256"
(cd "$BINDIR" && sha256sum -c fourmolu.sha256)
chmod a+x "$BINDIR/fourmolu"
rm -f "$BINDIR/fourmolu.sha256"

Copilot uses AI. Check for mistakes.
echo "$BINDIR" >> $GITHUB_PATH
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

echo "$BINDIR" >> $GITHUB_PATH should quote $GITHUB_PATH to avoid issues if the path ever contains spaces or special characters. Use >> "$GITHUB_PATH" for safer shell behavior.

Suggested change
echo "$BINDIR" >> $GITHUB_PATH
echo "$BINDIR" >> "$GITHUB_PATH"

Copilot uses AI. Check for mistakes.

- name: Run fourmolu
run: ./scripts/fourmolize.sh
22 changes: 22 additions & 0 deletions scripts/fourmolize.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
#!/usr/bin/env bash

set -euo pipefail

if [[ $# -gt 0 ]]; then
case "$1" in
--changes)
# Run fourmolu on changes compared to `master`.
git diff --diff-filter=MA --name-only origin/master HEAD -- '*.hs'
Comment on lines +8 to +9
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

--changes diffs against origin/master, which assumes (1) the default branch is named master and (2) the origin/master ref exists locally. In fresh clones or CI checkouts this ref may be missing and the command will fail. Consider diffing against the merge-base with the configured default branch (or accepting a base ref as an env/arg) and/or fetching the base ref when needed.

Suggested change
# Run fourmolu on changes compared to `master`.
git diff --diff-filter=MA --name-only origin/master HEAD -- '*.hs'
# Run fourmolu on changes compared to the default branch.
# The base ref can be overridden via FOURMOLU_BASE_REF (e.g. "origin/main").
base_ref="${FOURMOLU_BASE_REF:-origin/HEAD}"
if ! git rev-parse --verify "$base_ref" >/dev/null 2>&1; then
# Attempt to fetch the base ref if it is not available locally.
# Ignore failures so the script can still run in environments without network access.
git fetch origin "${base_ref#origin/}" >/dev/null 2>&1 || true
fi
merge_base="$(git merge-base "$base_ref" HEAD)"
git diff --diff-filter=MA --name-only "$merge_base" HEAD -- '*.hs'

Copilot uses AI. Check for mistakes.
;;
*)
echo "Invalid option: $1" >&2
exit 1
;;
esac
else
git ls-files -- '*.hs'
fi \
| { grep -v Setup.hs || true; } \
| xargs -r fourmolu -m inplace
Comment on lines +17 to +20
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This pipeline uses xargs with whitespace-delimited filenames. That will break if any tracked .hs path contains spaces/newlines, and xargs -r is GNU-specific (not available on macOS/BSD). Prefer a NUL-delimited pipeline (e.g., git … -z + grep -z/filtering + xargs -0) or an explicit bash loop/array to pass filenames safely and portably.

Copilot uses AI. Check for mistakes.

git diff --exit-code