Build & test hardening: config.sh everywhere, generated wasm exports, server_common, C/TS unit suites, sccache-dist CI

.github/workflows/linux.yml

@@ -20,11 +20,44 @@ on:
   workflow_dispatch:
 
 jobs:
+  # Ephemeral sccache-dist compile farm. Workers serve the coordinator
+  # (the build job) and exit when it goes offline. Skipped on PRs —
+  # fork PRs have no TS_OAUTH_SECRET and same-repo PRs don't need the
+  # farm for cache-warm builds. Also skipped when TS_OAUTH_SECRET is not
+  # configured, so missing-secret runs stay green instead of failing the
+  # worker jobs. (The secrets context is not allowed in `if` expressions,
+  # so its presence is laundered through job-level env.)
+  sccache-workers:
+    name: sccache worker ${{ matrix.idx }}
+    if: ${{ github.event_name != 'pull_request' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 75
+    strategy:
+      matrix:
+        idx: [1, 2]
+    env:
+      FARM_SECRET_SET: ${{ secrets.TS_OAUTH_SECRET != '' }}
+    steps:
+      - name: Farm disabled — TS_OAUTH_SECRET not configured
+        if: ${{ env.FARM_SECRET_SET == 'false' }}
+        run: echo "TS_OAUTH_SECRET is not set; skipping farm worker (build compiles locally)."
+      - uses: xdqi/sccache-dist-action@v0.0.5
+        if: ${{ env.FARM_SECRET_SET == 'true' }}
+        with:
+          mode: worker
+          worker-index: '${{ matrix.idx }}'
+          oauth-secret: '${{ secrets.TS_OAUTH_SECRET }}'
+          # The OAuth client owns tag:ci (not the action default tag:ci-sccache).
+          tags: 'tag:ci'
+
   build:
     name: linux-amd64
     runs-on: ubuntu-24.04
     timeout-minutes: 75
 
+    env:
+      FARM_SECRET_SET: ${{ secrets.TS_OAUTH_SECRET != '' }}
+
     steps:
       - name: Checkout anyfs-reader
         uses: actions/checkout@v4
@@ -40,7 +73,8 @@ jobs:
             libfuse3-dev libnl-3-dev libnl-genl-3-dev \
             libcurl4-openssl-dev \
             patchelf ca-certificates \
-            smbclient nfs-common curl
+            smbclient nfs-common curl \
+            shellcheck
 
       # ── Caches ──────────────────────────────────────────────────────────────
       # All source deps (linux, qemu, ksmbd-tools) are now managed by peru and
@@ -114,6 +148,35 @@ jobs:
       - name: Lint — no hardcoded paths in migrated build scripts
         run: ./scripts/lint-no-hardcoded-paths.sh
 
+      - name: Lint — shellcheck
+        run: ./scripts/lint-shellcheck.sh
+
+      # ── sccache-dist farm (best-effort; build proceeds locally if absent) ──
+      # Gated on TS_OAUTH_SECRET: without it the farm cannot come up, so skip
+      # the whole block (sccache never lands on PATH and the build uses plain
+      # gcc, exactly like the PR path).
+      - name: Cache sccache objects
+        if: ${{ github.event_name != 'pull_request' && env.FARM_SECRET_SET == 'true' }}
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/sccache
+          key: sccache-linux-amd64-${{ github.sha }}
+          restore-keys: |
+            sccache-linux-amd64-
+
+      - name: Bring up sccache-dist farm
+        if: ${{ github.event_name != 'pull_request' && env.FARM_SECRET_SET == 'true' }}
+        continue-on-error: true
+        uses: xdqi/sccache-dist-action@v0.0.5
+        with:
+          mode: coordinator
+          expected-workers: 2
+          min-workers: 1
+          wait-timeout: 180s
+          oauth-secret: '${{ secrets.TS_OAUTH_SECRET }}'
+          # The OAuth client owns tag:ci (not the action default tag:ci-sccache).
+          tags: 'tag:ci'
+
       # ── Build ksmbd-tools (linux-amd64) ────────────────────────────────────
       - name: Build ksmbd-tools
         if: steps.cache-ksmbd-build.outputs.cache-hit != 'true'
@@ -141,11 +204,16 @@ jobs:
 
       - name: Build LKL kernel
         run: |
+          CC_ARGS=()
+          if command -v sccache >/dev/null 2>&1; then
+            CC_ARGS=(--cc="sccache gcc")
+          fi
           ./scripts/build_lkl.sh \
             --linux=deps/linux \
             --out="$GITHUB_WORKSPACE" \
             --targets=linux-amd64 \
-            -j"$(nproc)"
+            "${CC_ARGS[@]}" \
+            -j"${SCCACHE_J:-$(nproc)}"
           # package_linux.sh falls back to $HOME/linux/tools/lkl/lib/liblkl.so —
           # link the per-target build there so packaging finds it.
           mkdir -p deps/linux/tools/lkl/lib
@@ -154,10 +222,15 @@ jobs:
 
       - name: Build QEMU block layer
         run: |
+          CC_ARGS=()
+          if command -v sccache >/dev/null 2>&1; then
+            CC_ARGS=(--cc="sccache gcc")
+          fi
           ./scripts/build_qemu.sh \
             --qemu-src=deps/qemu \
             --targets=linux-amd64 \
-            -j"$(nproc)"
+            "${CC_ARGS[@]}" \
+            -j"${SCCACHE_J:-$(nproc)}"
 
       - name: Build anyfs-reader (core + server + fuse)
         run: |
@@ -169,6 +242,17 @@ jobs:
             --ksmbd-root=deps/ksmbd-tools \
             -j"$(nproc)"
 
+      - name: sccache stats
+        if: ${{ github.event_name != 'pull_request' && env.FARM_SECRET_SET == 'true' }}
+        continue-on-error: true
+        run: sccache --show-stats || true
+
+      - name: Run C unit tests
+        run: meson test -C build-anyfs-linux-amd64 --suite unit --print-errorlogs
+
+      - name: Wasm export drift gate
+        run: ./tests/test_wasm_exports.sh
+
       # ── Integration smoke test ──────────────────────────────────────────────
       # Boots each anyfs binary against a Debian 13 generic-cloud qcow2 and
       # asserts lspart/smbclient/nfs see a real Debian rootfs. This catches

.github/workflows/mingw64.yml

@@ -32,6 +32,36 @@ on:
   workflow_dispatch:
 
 jobs:
+  # Ephemeral sccache-dist compile farm. Workers serve the coordinator
+  # (the build job) and exit when it goes offline. Skipped on PRs —
+  # fork PRs have no TS_OAUTH_SECRET and same-repo PRs don't need the
+  # farm for cache-warm builds. Also skipped when TS_OAUTH_SECRET is not
+  # configured, so missing-secret runs stay green instead of failing the
+  # worker jobs. (The secrets context is not allowed in `if` expressions,
+  # so its presence is laundered through job-level env.)
+  sccache-workers:
+    name: sccache worker ${{ matrix.idx }}
+    if: ${{ github.event_name != 'pull_request' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    strategy:
+      matrix:
+        idx: [1, 2]
+    env:
+      FARM_SECRET_SET: ${{ secrets.TS_OAUTH_SECRET != '' }}
+    steps:
+      - name: Farm disabled — TS_OAUTH_SECRET not configured
+        if: ${{ env.FARM_SECRET_SET == 'false' }}
+        run: echo "TS_OAUTH_SECRET is not set; skipping farm worker (build compiles locally)."
+      - uses: xdqi/sccache-dist-action@v0.0.5
+        if: ${{ env.FARM_SECRET_SET == 'true' }}
+        with:
+          mode: worker
+          worker-index: '${{ matrix.idx }}'
+          oauth-secret: '${{ secrets.TS_OAUTH_SECRET }}'
+          # The OAuth client owns tag:ci (not the action default tag:ci-sccache).
+          tags: 'tag:ci'
+
   build:
     name: mingw64
     runs-on: ubuntu-24.04
@@ -40,6 +70,7 @@ jobs:
     env:
       MSYS_CROSS_REPO: https://msys.kosaka.moe/repo
       MSYS_CROSS_PREFIX: /opt/msys2-cross
+      FARM_SECRET_SET: ${{ secrets.TS_OAUTH_SECRET != '' }}
 
     steps:
       - name: Checkout anyfs-reader
@@ -90,7 +121,7 @@ jobs:
             msys-cross-mingw64-gcc \
             msys-cross-cygwin-binutils \
             msys-cross-cygwin-gcc \
-            msys-cross-pkgconfig
+            msys-cross-mingw64-pkgconf
 
           # MSYS2 upstream sysroot libs under /opt/msys2-cross/mingw64.
           # QEMU block layer + DLL closure deps that package_mingw64.sh
@@ -111,6 +142,37 @@ jobs:
           "${MSYS_CROSS_PREFIX}/bin/x86_64-w64-mingw32-pkg-config" \
             --modversion glib-2.0
 
+      # ── sccache-dist farm (best-effort; build proceeds locally if absent) ──
+      # EXPERIMENTAL on this leg: sccache-dist must package the msys2-cross
+      # x86_64-w64-mingw32-gcc toolchain (under /opt/msys2-cross) and ship it
+      # to the workers. The engine supports arbitrary-toolchain packaging, but
+      # a plain cross-gcc + sysroot is unproven here. On any farm failure the
+      # build falls back to local compilation exactly as before.
+      # Gated on TS_OAUTH_SECRET: without it the farm cannot come up, so skip
+      # the whole block (sccache never lands on PATH and the build uses the
+      # plain cross-gcc, exactly like the PR path).
+      - name: Cache sccache objects
+        if: ${{ github.event_name != 'pull_request' && env.FARM_SECRET_SET == 'true' }}
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/sccache
+          key: sccache-mingw64-${{ github.sha }}
+          restore-keys: |
+            sccache-mingw64-
+
+      - name: Bring up sccache-dist farm
+        if: ${{ github.event_name != 'pull_request' && env.FARM_SECRET_SET == 'true' }}
+        continue-on-error: true
+        uses: xdqi/sccache-dist-action@v0.0.5
+        with:
+          mode: coordinator
+          expected-workers: 2
+          min-workers: 1
+          wait-timeout: 180s
+          oauth-secret: '${{ secrets.TS_OAUTH_SECRET }}'
+          # The OAuth client owns tag:ci (not the action default tag:ci-sccache).
+          tags: 'tag:ci'
+
       # ── Caches ──────────────────────────────────────────────────────────────
       # All source deps (linux, qemu, ksmbd-tools, util-linux) are now managed
       # by peru and cached together under ./deps/. Key on peru.yaml (SHA-pinned
@@ -202,11 +264,19 @@ jobs:
 
       - name: Build LKL kernel (mingw64)
         run: |
+          # Absolute compiler path so sccache-dist hashes and ships the
+          # msys2-cross toolchain (not whatever "x86_64-w64-mingw32-gcc"
+          # resolves to on a worker).
+          CC_ARGS=()
+          if command -v sccache >/dev/null 2>&1; then
+            CC_ARGS=(--cc="sccache /opt/msys2-cross/bin/x86_64-w64-mingw32-gcc")
+          fi
           ./scripts/build_lkl.sh \
             --linux=deps/linux \
             --out="$GITHUB_WORKSPACE" \
             --targets=mingw64 \
-            -j"$(nproc)"
+            "${CC_ARGS[@]}" \
+            -j"${SCCACHE_J:-$(nproc)}"
           test -f "$GITHUB_WORKSPACE/lkl-mingw64/tools/lkl/lib/liblkl.dll" \
             || { echo "::error::liblkl.dll missing"; exit 1; }
 
@@ -233,6 +303,11 @@ jobs:
             --ksmbd-root=deps/ksmbd-tools \
             -j"$(nproc)"
 
+      - name: sccache stats
+        if: ${{ github.event_name != 'pull_request' && env.FARM_SECRET_SET == 'true' }}
+        continue-on-error: true
+        run: sccache --show-stats || true
+
       - name: Package Win64 distribution tarball
         run: |
           ./scripts/package_mingw64.sh

.github/workflows/ts.yml

@@ -0,0 +1,55 @@
+name: ts
+
+# Pure TS unit tests (no wasm bundle, no LKL): @anyfs/core node:test suite +
+# @anyfs/react vitest suite + @anyfs/nbd-proxy. The wasm smoke tests
+# (test/smoke.node.mjs) need a built bundle and stay local-only.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  unit:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 11
+          package_json_file: ts/package.json
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: ts/pnpm-lock.yaml
+      - name: Install qemu-utils (qemu-img + qemu-io for nbd-proxy integration)
+        run: sudo apt-get install -y --no-install-recommends qemu-utils
+      - name: Install
+        working-directory: ts
+        # electron-demo depends on a sibling checkout (drivelist via
+        # file:../../../../drivelist-anyfs) and @anyfs/native's node-gyp
+        # install script compiles against the LKL tree — neither exists on a
+        # bare CI runner. Exclude both; electron-demo is the only dependent of
+        # @anyfs/native, and none of the CI-tested packages need either.
+        run: pnpm install --frozen-lockfile --filter '!electron-demo' --filter '!@anyfs/native'
+      - name: Build packages
+        working-directory: ts
+        run: pnpm -r --filter './packages/*' --filter '!@anyfs/native' build
+      - name: Core unit tests
+        working-directory: ts
+        run: pnpm --filter @anyfs/core run test:unit
+      - name: React unit tests
+        working-directory: ts
+        run: pnpm --filter @anyfs/react test
+      # The nbd-proxy integration test opens the PoC fixture qcow2 through the
+      # proxy with real qemu-img; the fixture is deterministic and generated
+      # on the fly (8 MiB pattern image + qemu-img convert).
+      - name: Generate nbd-proxy test fixture
+        run: node scripts/poc-nbd/make-test-image.mjs
+      - name: nbd-proxy tests
+        working-directory: ts
+        run: pnpm --filter @anyfs/nbd-proxy test