CI Workflows and Quality Gates
The primary Continuous Integration (CI) pipeline enforces strict quality gates across the Rust and TypeScript codebases. It utilizes a build-and-test matrix to ensure compatibility acrossubuntu-latest, macos-latest, and windows-latest .github/workflows/ci.yml#17-23.
Key verification steps include:
- Rust Hygiene: Enforcement of
cargo fmtandclippywith denials on warnings .github/workflows/ci.yml#207-212. - Frontend Validation: Using the
vpworkspace orchestrator to checkapps/web,apps/desktop/ui, andapps/browser-extension.github/workflows/ci.yml#204-205. - CLI Parity: Validating that the CLI command structure remains consistent with the expected parity matrix .github/workflows/ci.yml#213-230.
Security Gates and Supply Chain
Palyra implements a “Security Gates” workflow that scans for vulnerabilities in the supply chain and prevents the accidental exposure of secrets. This workflow is integrated into the PR process and periodic scheduled scans.| Tool | Purpose |
|---|---|
npm audit | Scans JavaScript dependencies with a custom dev-only allowlist .github/workflows/security.yml#30-64. |
cargo audit / deny | Checks Rust crates for known vulnerabilities and license compliance .github/workflows/security.yml#95-99. |
osv-scanner | Google’s Open Source Vulnerabilities scanner for lockfile analysis .github/workflows/security.yml#101-105. |
gitleaks | Detects hardcoded secrets in the repository history .github/workflows/security.yml#120-124. |
CodeQL | Static analysis for high-risk patterns in Rust and TypeScript .github/workflows/codeql.yml#1-48. |
Release Packaging and Distribution
The release engineering process transforms the monorepo source into portable, platform-specific archives. Packaging is handled by PowerShell scripts that bundle the corepalyrad daemon, palyra-browserd automation service, the palyra CLI, and the pre-built web dashboard .github/workflows/release.yml#84-85.
Distribution Flow
Sources: scripts/release/package-portable.ps1#1-148, scripts/release/common.ps1#1-200 The release workflow validates version coherence across all crates before generating artifacts .github/workflows/release.yml#45. It also produces detailed migration and release notes .github/workflows/release.yml#81-106. For details, see Release Packaging and Distribution. Sources: .github/workflows/release.yml#1-169, scripts/release/package-portable.ps1#1-170Testing Strategy: Deterministic, Fuzz, and Regression
Palyra employs a multi-tiered testing strategy that moves beyond simple unit tests to ensure system-level reliability.- Deterministic Core: A suite designed to verify the core logic of the daemon and state machine under reproducible conditions .github/workflows/ci.yml#89-122.
- Workflow Regression: Matrix-based testing of common agent workflows to prevent regressions in tool calling or session compaction .github/workflows/ci.yml#123-137.
- Release Smoke Tests: Before any release is finalized, the
run-release-smoke.ps1script performs a full installation and execution test of the packaged archives, verifying commands likepalyra setup,palyra doctor, andpalyra docsscripts/test/run-release-smoke.ps1#40-108. - Offline Documentation: The
palyra docscommand allows operators to search and view bundled markdown documentation (likemigration-notes.md) directly from the CLI crates/palyra-cli/src/commands/docs.rs#74-85.