CI/CD pipelines

Speedwave uses GitHub Actions for automated linting, unit testing, cross-compilation, artifact signing, and deployment. Pipeline configurations reside within .github/workflows/. Action references are pinned to immutable commit SHAs.

Pull request verification (test.yml)

The primary verification workflow triggers on every push and pull request targeting main or dev, automatically canceling superseded job runs:

Pipeline job	Runner platform	Verification scope
lint	macos-latest	Rust formatting & Clippy, Prettier checks, TypeScript compiler validation, ESLint audits.
test	macos-latest	Rust unit suites, transcription modules, MCP Vitest suites with coverage, Bats shell entrypoint tests.
desktop	macos-latest	Desktop crate Clippy, Angular Karma/Vitest suites, release configuration gates, Tauri test compilation.
audit	ubuntu-latest	cargo audit across Rust workspaces, npm audit for MCP and desktop packages.
swift	macos-latest	Universal Mach-O binary compilation and SwiftPM test suite validation (PR only).
runtime-windows	windows-latest	Rust tests for WSL2 subsystems and job-object management; LF newline enforcement.
desktop-windows-check	windows-latest	Windows MSVC desktop compilation sanity check.

For detailed test coverage thresholds, see Testing and validation.

Application packaging (desktop-build.yml)

Path-filtered packaging triggers on changes to desktop, runtime, or MCP sources:

• Pull requests: Compiles unnotarized macOS Apple Silicon packages for rapid feedback.
• Pushes to dev/main: Produces universal macOS DMG archives and Windows MSI/NSIS installers.

Automated release deployment

Speedwave manages continuous delivery via Release Please:

flowchart LR
  PR["Conventional Commit PR<br/>Merged to main"] --> RP["release-please.yml<br/>Creates Release PR"]
  RP --> Merge["Merge Release PR"] --> Release["desktop-release.yml<br/>Compiles, Signs & Publishes"]

1. release-please.yml updates CHANGELOG.md and generates release pull requests on main.
2. Merging the release pull request triggers desktop-release.yml.
3. The release workflow compiles and cryptographically signs binaries:
   • macOS: Signs with Apple Developer ID and submits for Apple Notarization.
   • Windows: Signs executables with Authenticode certificates.
   • CLI: Cross-compiles standalone release binaries for all supported platforms.
4. Verifies all release assets before publishing the release from draft to public state.

Branch quality gates

• PR Title Linter (pr-title.yml): Enforces Conventional Commits syntax (feat:, fix:, chore:, etc.).
• Merge Strategy Gate (merge-strategy-check.yml): Ensures pull requests to main carry version-bumping semantic commit types.
• Dependency Automation: Dependabot evaluates dependencies daily, automatically rebased upon upstream merges.