Workflow Orchestration
The repository utilizes GitHub Actions for primary CI/CD orchestration, supplemented by ajustfile and Makefile for local developer pre-flight checks.
Core Build and Test Matrix
Theci.yml workflow executes a parallel matrix build across ubuntu-latest, macos-latest, and windows-latest .github/workflows/ci.yml#17-23. This job performs a full workspace build and test execution using the pinned Rust toolchain (1.91.0) .github/workflows/ci.yml#31.
| Stage | Command | Purpose |
|---|---|---|
| Toolchain | dtolnay/rust-toolchain@v1 | Ensures consistent compilation environments .github/workflows/ci.yml#29. |
| Vite+ Setup | .github/actions/setup-vp-safe | Bootstraps the Node.js workspace for web/desktop UI .github/workflows/ci.yml#35. |
| Rust Build | cargo build --workspace --locked | Validates compilation and dependency resolution .github/workflows/ci.yml#46. |
| Rust Test | cargo test --workspace --locked | Executes unit and integration tests .github/workflows/ci.yml#49. |
Quality Gates and Linting
Thequality job enforces stylistic and structural consistency .github/workflows/ci.yml#172-212:
- Action Pinning:
scripts/check-gh-actions-pinned.shensures all GitHub Actions use full SHA hashes rather than mutable tags .github/workflows/ci.yml#180. - Artifact Hygiene:
scripts/check-runtime-artifacts.shandscripts/check-no-vendored-artifacts.shprevent accidental leakage of build artifacts or unauthorized third-party code into the repository .github/workflows/ci.yml#183-186. - Rustfmt & Clippy: Enforces standard Rust formatting and denies all compiler warnings .github/workflows/ci.yml#208-211.
- Vite+ Check: Validates the TypeScript/React codebases in
apps/webandapps/desktop/ui.github/workflows/ci.yml#205.
Security Gates and Supply Chain Integrity
Thesecurity.yml workflow defines the “Security Gates” that must be passed before merging. It focuses on secret detection, vulnerability scanning, and SBOM generation.
Vulnerability Scanning Pipeline
Palyra employs a multi-layered scanning strategy:- Rust Audit:
cargo auditchecksCargo.lockagainst the RustSec Advisory Database .github/workflows/security.yml#95-96. - Dependency Denial:
cargo deny checkenforces license compliance and bans specific crates .github/workflows/security.yml#98-99. - OSV Scanning:
osv-scanner(Google) provides an additional layer of vulnerability detection across multiple ecosystems .github/workflows/security.yml#101-104. - Secret Detection:
gitleaksscans the repository history for accidentally committed credentials or keys .github/workflows/security.yml#120-123.
Web Cleanroom and Audit
For the web dashboard, the CI performs a “cleanroom” build. Thevalidate-npm-audit-dev-allowlist.mjs script allows developers to temporarily ignore high-severity vulnerabilities in dev-only dependencies while strictly blocking any vulnerabilities in the runtime production bundle .github/workflows/security.yml#56-64.
CI Security Data Flow
Sources: .github/workflows/security.yml#1-156, scripts/validate-npm-audit-dev-allowlist.mjs#1-250, osv-scanner.toml#1-2
Protocol and Parity Validation
Palyra maintains strict contracts between its various components (Daemon, CLI, Web UI, Browser Service).Protocol Contract Validation
Theprotocol-validate gate (invoked via just protocol) ensures that Protobuf definitions remain backward compatible and that generated stubs for Rust/TypeScript are in sync with the .proto sources justfile#97-107.
CLI Parity Checks
To ensure the CLI remains the “source of truth” for system operations, the CI runs a parity acceptance suite:- Matrix Generation:
render_cli_parity_reportexample generates a markdown matrix of supported commands .github/workflows/ci.yml#226. - Snapshot Testing:
help_snapshotstests ensure that CLI command structures do not change unexpectedly .github/workflows/ci.yml#229.
CodeQL Analysis
Thecodeql.yml workflow runs weekly and on PRs to perform deep static analysis of the Rust and JavaScript/TypeScript codebases, identifying potential security flaws like path injection or memory safety issues .github/workflows/codeql.yml#1-48.
Sources: .github/workflows/ci.yml#213-236, justfile#97-107, .github/workflows/codeql.yml#1-48
Specialized Regression Suites
Beyond standard unit tests, the CI executes several specialized suites to validate the complex runtime behavior of the agent system.Deterministic Core Suite
Thedeterministic-core job runs the run-deterministic-core.sh script .github/workflows/ci.yml#89-122. This suite uses a mocked time and RNG environment to ensure that the agent’s reasoning and tool-calling flows are reproducible across different CI runs.
Workflow Regression Matrix
Theworkflow-regression suite validates end-to-end user journeys (e.g., setup → pairing → agent execution) .github/workflows/ci.yml#123-137. This ensures that changes to the GatewayService or PolicyEngine do not break existing automation workflows.
Performance Smoke Tests
Theperformance-smoke job monitors the resource consumption of the palyrad daemon during high-load scenarios, ensuring that memory leaks or CPU spikes are caught before release .github/workflows/ci.yml#138-171.
Testing Architecture Mapping
Sources: .github/workflows/ci.yml#89-171, justfile#47-87
Dependency Management (Dependabot)
Palyra uses GitHub Dependabot to maintain up-to-date dependencies with a monthly cadence.- Cargo: Monitors the Rust ecosystem, grouped into a single “cargo-rollup” to minimize PR noise .github/dependabot.yml#3-16.
- NPM: Monitors
apps/webdependencies .github/dependabot.yml#17-30. - GitHub Actions: Monitors the versions of actions used in the workflows, ensuring they remain pinned to secure versions .github/dependabot.yml#31-44.
- Dependency Review: Pull requests that modify dependencies are automatically scanned by
dependency-review-actionto detect newly introduced vulnerabilities or incompatible licenses .github/workflows/dependency-review.yml#1-35.