Instruction file imported from uniclaw-labs/uniclaw (.github/instructions/ci.instructions.md). Copyright stays with the author.

CI / Workflow Guidelines

Gitleaks

.gitleaks.toml must exist in the repo root — it is required by both ci.yml and release.yml. The scan always uses --config .gitleaks.toml; there is no fallback.

./gitleaks detect --source . --redact --exit-code 1 --config .gitleaks.toml

When adding new files that contain placeholder tokens, API keys used as protocol constants, or example credentials, add them to the allowlist in .gitleaks.toml rather than removing the credential-like values.

Versioned GitHub Release Downloads

Never use releases/latest/download/<asset> — the redirect does not work for assets whose filenames include the version number. Always fetch the version via the API first:

VER=$(curl -sf https://api.github.com/repos/<owner>/<repo>/releases/latest \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['tag_name'][1:])")
curl -sSfL "https://github.com/<owner>/<repo>/releases/download/v${VER}/<asset>_${VER}_linux_x64.tar.gz" \
  | tar -xz <binary>

Rust Coverage (cargo llvm-cov)

tauri::generate_context!() checks for frontendDist (../dist) at compile time. The if: always() coverage step must create dist/ before running:

- name: Rust coverage (lcov)
  if: always()
  working-directory: desktop/src-tauri
  run: |
    mkdir -p ../dist
    cargo llvm-cov --lcov --output-path rust-lcov.info \
      --ignore-filename-regex='(tray|lib|main|_commands)\.rs'

Release Process

A release is triggered by pushing a version tag:

git tag v0.2.0
git push origin v0.2.0

Or via manual dispatch on the Build workflow with "Create a GitHub release" checked.

Before tagging, run through docs/security-release-gates.md.

Desktop Check Step Order

The Desktop Check job runs in this order:

1. TypeScript check (npx tsc --noEmit) — failures here skip the build step
2. npm run build — produces dist/ needed by Rust
3. Frontend tests (npx vitest run --coverage)
4. Rust tests (cargo test --all-targets)
5. Rust coverage (cargo llvm-cov, with if: always() + mkdir -p ../dist)

Steps 4–5 depend on step 2 having created dist/. If step 1 fails and step 2 is skipped, the mkdir -p ../dist in step 5 acts as the safety net.