ci(web): add precise wasm-freshness gate; drop flawed drift heuristic

The web build shipped a ~3-week-stale pkg/ because the old "Check wasm pkg drift" step in docker-build.yml only hard-failed on direct solitaire_web/ edits and treated solitaire_engine/_core changes as a non-blocking notice — so the entire card_game migration (engine/core/data churn, v4->v5 save schema) slipped through. Replace it with a dedicated `web-wasm-freshness` workflow that rebuilds the artifacts and diffs them against what's committed. A fresh build on a pinned toolchain (rust 1.95.0 / wasm-bindgen 0.2.120 / wasm-pack 0.14.0 / binaryen 130) is byte-for-byte reproducible — verified locally — so this is precise: it fails on *any* real drift (including gameplay-logic changes that don't touch the JS API surface) and has no false positives on wasm-irrelevant edits. Runs on pull_request as well as master push, so staleness is caught before merge rather than only blocking the post-merge deploy. Remove the superseded heuristic from docker-build.yml; master stays fresh via the PR gate, so the deploy image is always built from current artifacts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-22 12:03:00 -07:00
parent 5af69d7551
commit 43076a48d6
2 changed files with 97 additions and 41 deletions
@@ -0,0 +1,91 @@
+name: Web WASM Freshness
+
+# Guards against the committed solitaire_server/web/pkg/ artifacts going stale.
+#
+# A fresh build on a pinned toolchain is byte-for-byte reproducible (verified),
+# so this job rebuilds the artifacts and fails if they differ from what is
+# committed. Unlike a changed-files heuristic, this catches *any* drift in the
+# wasm-feeding crates — solitaire_core / _engine / _data / _sync / _wasm / _web —
+# including gameplay-logic changes that do not alter the JS API surface (e.g.
+# the v4->v5 save-schema change that the old heuristic let through as a
+# non-blocking "notice", leaving the deployed web build stale for ~3 weeks).
+#
+# Tool versions are pinned to whatever produced the committed artifacts. When
+# you regenerate the artifacts with a newer toolchain, bump these in lockstep:
+#   rust 1.95.0 · wasm-bindgen 0.2.120 · wasm-pack 0.14.0 · binaryen 130
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'solitaire_core/**'
+      - 'solitaire_engine/**'
+      - 'solitaire_data/**'
+      - 'solitaire_sync/**'
+      - 'solitaire_wasm/**'
+      - 'solitaire_web/**'
+      - 'solitaire_server/web/pkg/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'build_wasm.sh'
+      - '.gitea/workflows/web-wasm-freshness.yml'
+  pull_request:
+    paths:
+      - 'solitaire_core/**'
+      - 'solitaire_engine/**'
+      - 'solitaire_data/**'
+      - 'solitaire_sync/**'
+      - 'solitaire_wasm/**'
+      - 'solitaire_web/**'
+      - 'solitaire_server/web/pkg/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'build_wasm.sh'
+      - '.gitea/workflows/web-wasm-freshness.yml'
+  workflow_dispatch:
+
+jobs:
+  freshness:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust 1.95.0 (pinned for reproducible wasm output)
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.95.0
+          targets: wasm32-unknown-unknown
+
+      - name: Cache cargo build
+        uses: Swatinem/rust-cache@v2
+
+      - name: Install wasm-bindgen-cli + wasm-pack (pinned)
+        uses: taiki-e/install-action@v2
+        with:
+          tool: wasm-bindgen-cli@0.2.120,wasm-pack@0.14.0
+
+      - name: Install binaryen 130 (wasm-opt, pinned)
+        run: |
+          set -euo pipefail
+          curl -sSL \
+            https://github.com/WebAssembly/binaryen/releases/download/version_130/binaryen-version_130-x86_64-linux.tar.gz \
+            | tar xz
+          echo "$PWD/binaryen-version_130/bin" >> "$GITHUB_PATH"
+
+      - name: Rebuild WASM artifacts
+        run: ./build_wasm.sh
+
+      - name: Fail if committed pkg differs from a fresh build
+        run: |
+          set -euo pipefail
+          if [ -z "$(git status --porcelain -- solitaire_server/web/pkg/)" ]; then
+            echo "pkg/ artifacts match a fresh build."
+          else
+            echo "::error::solitaire_server/web/pkg/ is stale — a wasm-feeding crate changed without regenerating the artifacts."
+            echo "Fix: run ./build_wasm.sh and commit the updated solitaire_server/web/pkg/."
+            git status --porcelain -- solitaire_server/web/pkg/
+            git diff --stat -- solitaire_server/web/pkg/
+            exit 1
+          fi