TabbyML/tabby

16 workflows · maturity 67% · 7 patterns · GitHub ↗

Security 10.94/100

Practices

✓ Matrix✓ Permissions○ Security scan○ AI review✓ Cache✓ Concurrency○ Reusable workflows

Detected patterns

chaos-engineering ecosystem-ci hardware-matrix least-privilege-permissions multi-channel-release multi-stage-release multiple-build-systems

Security dimensions

permissions

10.9

security scan

supply chain

secret handling

harden runner

Workflows (16)

ast-grep-lint .github/workflows/ast-grep-lint.yml

Triggers: push
Runs on: ubuntu-latest
Jobs: sg-lint
Actions: ast-grep/action

View raw YAML

name: ast-grep lint
on: [push]

jobs:
  sg-lint:
    runs-on: ubuntu-latest
    name: ast-grep-lint
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: ast-grep lint step
        uses: ast-grep/action@v1.4
        with:
          version: 0.20.1

autofix-pnpm perms .github/workflows/autofix-pnpm.yml

Triggers

pull_request

Runs on

ubuntu-latest

Jobs

autofix

Actions

pnpm/action-setup, autofix-ci/action

Commands

echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
pnpm install
pnpm lint:fix

View raw YAML

name: autofix.ci

on:
  pull_request:
    branches: ["main" ]
    paths:
      - '.github/workflows/autofix-pnpm.yml'
      - 'clients/**'
      - 'ee/tabby-ui/**'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow_ref }}-${{ github.head_ref || github.ref_name }}

  # If this is enabled it will cancel current running and start latest
  cancel-in-progress: true

jobs:
  autofix:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 18

      - uses: pnpm/action-setup@v4
        name: Install pnpm
        with:
          version: 9
          run_install: false

      - name: Get pnpm store directory
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - uses: actions/cache@v4
        name: Setup pnpm cache
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install

      - name: Fix lint
        run: pnpm lint:fix

      - uses: autofix-ci/action@551dded8c6cc8a1054039c8bc0b8b48c51dfc6ef

autofix-python perms .github/workflows/autofix-python.yml

Triggers: pull_request
Runs on: ubuntu-latest
Jobs: autofix
Actions: chartboost/ruff-action, autofix-ci/action

View raw YAML

name: autofix.ci

on:
  pull_request:
    branches: [ "main" ]
    paths:
      - '.github/workflows/autofix-python.yml'
      - 'python/**'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow_ref }}-${{ github.head_ref || github.ref_name }} 
  
  # If this is enabled it will cancel current running and start latest
  cancel-in-progress: true

jobs:
  autofix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive

      - uses: chartboost/ruff-action@v1
        with:
          src: "./python"
          args: --fix

      - uses: autofix-ci/action@551dded8c6cc8a1054039c8bc0b8b48c51dfc6ef

autofix-rust perms .github/workflows/autofix-rust.yml

Triggers

pull_request

Runs on

ubuntu-latest

Jobs

autofix

Actions

actions-rs/toolchain, mozilla-actions/sccache-action, actions-rs/cargo, autofix-ci/action

Commands

sudo bash ./ci/prepare_build_environment.sh
make fix
make update-graphql-schema

View raw YAML

name: autofix.ci

on:
  pull_request:
    branches: ["main" ]
    paths:
      - '.github/workflows/autofix-rust.yml'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'crates/**'
      - 'ee/**'
      - '!ee/tabby-ui/**'
      - '!ee/tabby-email/**'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow_ref }}-${{ github.head_ref || github.ref_name }}

  # If this is enabled it will cancel current running and start latest
  cancel-in-progress: true

jobs:
  autofix:
    env:
      CARGO_TERM_COLOR: always
      SCCACHE_GHA_ENABLED: true
      RUSTC_WRAPPER: sccache
      CARGO_INCREMENTAL: 0
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
          toolchain: nightly
          components: rustfmt, clippy

      - name: Sccache cache
        uses: mozilla-actions/sccache-action@v0.0.9

      - name: Install cargo-machete
        uses: actions-rs/cargo@v1
        with:
          command: install
          args: --version 0.7.0 cargo-machete

      - name: Cargo registry cache
        uses: actions/cache@v4
        with:
          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-${{ github.sha }}
          restore-keys: |
            cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
            cargo-${{ runner.os }}-
          path: |
            ~/.cargo/registry
            ~/.cargo/git

      - run: sudo bash ./ci/prepare_build_environment.sh

      - run: make fix

      - run: make update-graphql-schema

      - uses: autofix-ci/action@551dded8c6cc8a1054039c8bc0b8b48c51dfc6ef

bloat perms .github/workflows/bloat.yml

Triggers

pull_request, push

Runs on

ubuntu-latest

Jobs

cargo_bloat

Actions

actions-rs/toolchain, mozilla-actions/sccache-action, wsxiaoys/cargo-bloat-action

Commands

sudo bash ./ci/prepare_build_environment.sh

View raw YAML

on: # rebuild any PRs and main branch changes
  pull_request:
    branches: ["main"]
    paths:
      - '.github/workflows/bloat.yml'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'crates/**'
      - 'ee/**'
      - '!ee/tabby-ui/**'
  push:
    branches:
      - main

name: bloat

permissions: write-all

concurrency:
  group: ${{ github.workflow_ref }}-${{ github.head_ref || github.ref_name }}

  # If this is enabled it will cancel current running and start latest
  cancel-in-progress: true

jobs:
  cargo_bloat:
    env:
      CARGO_TERM_COLOR: always
      SCCACHE_GHA_ENABLED: true
      RUSTC_WRAPPER: sccache
      CARGO_INCREMENTAL: 0

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
          toolchain: stable

      - name: Sccache cache
        uses: mozilla-actions/sccache-action@v0.0.9

      - name: Cargo registry cache
        uses: actions/cache@v4
        with:
          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-${{ github.sha }}
          restore-keys: |
            cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
            cargo-${{ runner.os }}-
          path: |
            ~/.cargo/registry
            ~/.cargo/git

      - run: sudo bash ./ci/prepare_build_environment.sh

      - name: Run cargo bloat
        uses: wsxiaoys/cargo-bloat-action@master
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          include_packages: tabby

docker matrix .github/workflows/docker.yml

Triggers

workflow_dispatch, schedule, push

Runs on

buildjet-2vcpu-ubuntu-2204

Jobs

release-docker

Matrix

device-type, include, include.device-type, include.image-suffix→ , cuda

Actions

jlumbroso/free-disk-space, docker/setup-buildx-action, docker/login-action, docker/login-action, int128/docker-build-cache-config-action, docker/metadata-action, docker/build-push-action, docker/metadata-action, docker/build-push-action, peter-evans/dockerhub-description

Commands

echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}${IMAGE_SUFFIX}" >>${GITHUB_ENV}

View raw YAML

name: Create and publish docker image

on:
  workflow_dispatch:
  schedule:
    - cron: "0 20 */1 * *"
  push:
    tags:
      - "v*"
      - "!*-dev.*"
      - "!vscode@*"
      - '!vim@*'

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}

  # If this is enabled it will cancel current running and start latest
  cancel-in-progress: true

env:
  RUST_TOOLCHAIN: 1.82.0
  CUDA_VERSION: 12.4.1

jobs:
  release-docker:
    runs-on: buildjet-2vcpu-ubuntu-2204
    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write

    strategy:
      matrix:
        device-type: [cuda]
        include:
          - device-type: cuda
            image-suffix: ""

    steps:
      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@main
        with:
          # this might remove tools that are actually needed,
          # if set to "true" but frees about 6 GB
          tool-cache: true

          # all of these default to true, but feel free to set to
          # "false" if necessary for your workflow
          android: true
          dotnet: true
          haskell: true
          large-packages: false
          swap-storage: true

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive

      # Workaround: https://github.com/docker/build-push-action/issues/461
      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@v3

      # Login against a Docker registry except on PR
      # https://github.com/docker/login-action
      - name: Log into GitHub Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log into Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Generate image name
        env:
          IMAGE_SUFFIX: ${{ matrix.image-suffix }}
        run: |
          echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}${IMAGE_SUFFIX}" >>${GITHUB_ENV}

      - uses: int128/docker-build-cache-config-action@v1
        id: cache
        with:
          image: ghcr.io/${{ env.IMAGE_NAME }}/cache

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          # list of Docker images to use as base name for tags
          images: |
            ghcr.io/${{ env.IMAGE_NAME }}
            ${{ env.IMAGE_NAME }}
          # generate Docker tags based on the following events/attributes
          tags: |
            type=raw,value={{branch}}-{{sha}},enable=${{ startsWith(github.ref, 'refs/heads') }}
            type=schedule,pattern=nightly
            type=schedule,pattern={{date 'YYYYMMDD'}}
            type=semver,pattern={{version}}

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@v5
        with:
          file: docker/Dockerfile.${{ matrix.device-type }}
          push: true
          context: .
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: ${{ steps.cache.outputs.cache-from }}
          cache-to: ${{ steps.cache.outputs.cache-to }}
          build-args: |
            RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }}
            CUDA_VERSION=${{ env.CUDA_VERSION }}

      - name: Docker meta for CUDA 11
        if: startsWith(github.ref, 'refs/tags/v')
        id: meta-cuda11
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ env.IMAGE_NAME }}
            ${{ env.IMAGE_NAME }}
          # do not generate tags for latest since cuda12 is the latest
          flavor: |
            latest=false
            suffix=-cuda11
          tags: |
            type=semver,pattern={{version}}

      # Build and push Docker image with Buildx
      # Only built on release tags for compatibility with previous versions
      - name: Build and push Docker image for CUDA 11
        if: startsWith(github.ref, 'refs/tags/v')
        id: build-and-push-cuda11
        uses: docker/build-push-action@v5
        with:
          file: docker/Dockerfile.${{ matrix.device-type }}
          push: true
          context: .
          tags: ${{ steps.meta-cuda11.outputs.tags }}
          labels: ${{ steps.meta-cuda11.outputs.labels }}
          cache-from: ${{ steps.cache.outputs.cache-from }}
          cache-to: ${{ steps.cache.outputs.cache-to }}
          build-args: |
            RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }}
            CUDA_VERSION=11.7.1


      - name: Docker Hub Description
        uses: peter-evans/dockerhub-description@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          repository: tabbyml/tabby

gh-pages perms .github/workflows/gh-pages.yml

Triggers

push, workflow_dispatch

Runs on

ubuntu-latest

Jobs

deploy

Actions

actions/configure-pages, actions/upload-pages-artifact, actions/deploy-pages

Commands

git lfs checkout
yarn install --frozen-lockfile --non-interactive
yarn build

View raw YAML

name: Deploy static content to Pages

on:
  # Runs on pushes targeting the default branch
  push:
    branches: [main]
    paths:
      - '.github/workflows/gh-pages.yml'
      - 'website/**'

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
permissions:
  contents: read
  pages: write
  id-token: write

# Allow one concurrent deployment
concurrency:
  group: "pages"
  cancel-in-progress: true

env:
  # Hosted GitHub runners have 7 GB of memory available, let's use 6 GB
  NODE_OPTIONS: --max-old-space-size=6144

jobs:
  # Single deploy job since we're just deploying
  deploy:
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          lfs: true
      - run: git lfs checkout
      - name: Set up Node.js
        uses: actions/setup-node@v3
        with:
          node-version: 18.x
          cache: yarn
          cache-dependency-path: website/yarn.lock
      - name: Install dependencies
        working-directory: website
        run: yarn install --frozen-lockfile --non-interactive
      - name: Build
        working-directory: website
        run: yarn build
      - name: Setup Pages
        uses: actions/configure-pages@v5
      - name: Upload artifact
        uses: actions/upload-pages-artifact@v3
        with:
          path: website/build
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4

gpt-translate perms .github/workflows/gpt-translate.yml

Triggers: issue_comment
Runs on: ubuntu-latest
Jobs: gpt_translate
Actions: 3ru/gpt-translate

View raw YAML

name: GPT Translate

on:
  issue_comment:
    types: [ created ]

permissions:
  pull-requests: write
  issues: write
  contents: write

jobs:
  gpt_translate:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Run GPT Translate
        if: |
          contains(github.event.comment.body, '/gpt-translate') || 
          contains(github.event.comment.body, '/gt')
        uses: 3ru/gpt-translate@master
        with:
          apikey: ${{ secrets.OPENAI_API_KEY }}

nightly .github/workflows/nightly.yml

Triggers: workflow_dispatch, schedule
Runs on: ubuntu-latest
Jobs: sync-branches
Actions: EndBug/latest-tag

View raw YAML

name: Update nightly tag

on:
  workflow_dispatch:
  schedule:
    - cron: '0 20 */1 * *'

jobs:
  sync-branches:
    runs-on: ubuntu-latest
    name: Update nightly tag
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          ssh-key: "${{ secrets.COMMIT_KEY }}"
          
      - name: Run latest-tag
        uses: EndBug/latest-tag@latest
        with:
          ref: nightly

release matrix .github/workflows/release.yml

Triggers

workflow_dispatch, push, pull_request

Runs on

${{ matrix.os }}, ${{ matrix.os }}, ubuntu-latest, ubuntu-latest

Jobs

release-llama-server-binary, release-binary, package-from-upstream, pre-release

Matrix

binary, include, include.binary, include.build_args, include.container, include.ext, include.os, include.target→ --features binary, --features binary,cuda, --no-default-features --features prod, --no-default-features --features static-ssl,prod, .exe, aarch64-apple-darwin, buildjet-2vcpu-ubuntu-2204, macos-latest, quay.io/pypa/manylinux_2_28_x86_64, sameli/manylinux_2_28_x86_64_cuda_12.3@sha256:e12416bf249ab312f9dcfdebd7939b968dd6f1b6f810abbede818df875e86a7c, windows-latest, x86_64-manylinux_2_28, x86_64-manylinux_2_28-cuda123, x86_64-pc-windows-msvc, x86_64-unknown-linux-gnu, x86_64-windows-msvc

Actions

actions-rs/toolchain, mozilla-actions/sccache-action, Jimver/cuda-toolkit, actions-rs/toolchain, mozilla-actions/sccache-action, ncipollo/release-action

Commands

rustup update --no-self-update ${{ env.RUST_TOOLCHAIN }} rustup target add ${{ matrix.target }} rustup component add clippy --toolchain ${{ env.RUST_TOOLCHAIN }}
rustup default ${{ env.RUST_TOOLCHAIN }}
bash ./ci/prepare_build_environment.sh
./ci/prepare_build_environment.ps1
cargo build ${{ matrix.build_args }} --release --target ${{ matrix.target }} --package llama-cpp-server
mv target/${{ matrix.target }}/release/llama-server${{ matrix.ext }} llama-server_${{ matrix.binary }}${{ matrix.ext }}
rustup update --no-self-update ${{ env.RUST_TOOLCHAIN }} rustup target add ${{ matrix.target }} rustup component add clippy --toolchain ${{ env.RUST_TOOLCHAIN }}
rustup default ${{ env.RUST_TOOLCHAIN }}

View raw YAML

name: Build and release binaries.

on:
  workflow_dispatch:
  push:
    tags:
      - 'v*'
      - 'nightly'
      - "!*-dev.*"
      - '!vscode@*'
      - '!vim@*'
  pull_request:
    branches: [ "main" ]
    paths:
      - '.github/workflows/release.yml'

concurrency:
  group: ${{ github.workflow_ref }}-${{ github.head_ref || github.ref_name }}

  # If this is enabled it will cancel current running and start latest
  cancel-in-progress: true

env:
  RUST_TOOLCHAIN: 1.82.0

jobs:
  release-llama-server-binary:
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    strategy:
      matrix:
        binary:
          - aarch64-apple-darwin
          - x86_64-manylinux_2_28
          - x86_64-manylinux_2_28-cuda123
        include:
          - os: macos-latest
            target: aarch64-apple-darwin
            binary: aarch64-apple-darwin
            build_args: --features binary
          - os: buildjet-2vcpu-ubuntu-2204
            target: x86_64-unknown-linux-gnu
            binary: x86_64-manylinux_2_28
            container: quay.io/pypa/manylinux_2_28_x86_64
            build_args: --features binary
          - os: buildjet-2vcpu-ubuntu-2204
            target: x86_64-unknown-linux-gnu
            binary: x86_64-manylinux_2_28-cuda123
            container: sameli/manylinux_2_28_x86_64_cuda_12.3@sha256:e12416bf249ab312f9dcfdebd7939b968dd6f1b6f810abbede818df875e86a7c
            build_args: --features binary,cuda

    env:
      SCCACHE_GHA_ENABLED: true
      RUSTC_WRAPPER: sccache
      CARGO_INCREMENTAL: 0
      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Install Rust
        if: runner.os != 'Windows'
        uses: actions-rs/toolchain@v1
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          target: ${{ matrix.target }}
          components: clippy

      - name: Install Rust for Windows
        if: runner.os == 'Windows'
        run: |
          rustup update --no-self-update ${{ env.RUST_TOOLCHAIN }}
          rustup target add ${{ matrix.target }}
          rustup component add clippy --toolchain ${{ env.RUST_TOOLCHAIN }}

      - name: Set default rust version
        run: rustup default ${{ env.RUST_TOOLCHAIN }}

      - name: Sccache cache
        uses: mozilla-actions/sccache-action@v0.0.9

      - name: Cargo registry cache
        uses: actions/cache@v4
        with:
          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-${{ github.sha }}
          restore-keys: |
            cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
            cargo-${{ runner.os }}-
          path: |
            ~/.cargo/registry
            ~/.cargo/git

      - name: Prepare build environment for macOS & Linux
        run: bash ./ci/prepare_build_environment.sh
        if: runner.os != 'Windows'

      - name: Prepare build environment for Windows
        run: ./ci/prepare_build_environment.ps1
        if: runner.os == 'Windows'

      - name: Install CUDA toolkit for Windows
        uses: Jimver/cuda-toolkit@v0.2.11
        with:
          cuda: ${{ matrix.windows_cuda }}
          method: 'network'
          sub-packages: '["nvcc", "cudart", "cublas", "cublas_dev", "thrust", "visual_studio_integration"]'
        if: runner.os == 'Windows' && matrix.windows_cuda != ''

      - name: Bulid release binary
        run: cargo build ${{ matrix.build_args }} --release --target ${{ matrix.target }} --package llama-cpp-server

      - name: Rename release binary
        run: mv target/${{ matrix.target }}/release/llama-server${{ matrix.ext }} llama-server_${{ matrix.binary }}${{ matrix.ext }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          retention-days: 3
          name: llama-server_${{ matrix.binary }}${{ matrix.ext }}
          path: llama-server_${{ matrix.binary }}${{ matrix.ext }}

  release-binary:
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    strategy:
      matrix:
        binary:
          - aarch64-apple-darwin
          - x86_64-manylinux_2_28
          - x86_64-windows-msvc
        include:
          - os: macos-latest
            target: aarch64-apple-darwin
            binary: aarch64-apple-darwin
            build_args: --no-default-features --features prod
          - os: buildjet-2vcpu-ubuntu-2204
            target: x86_64-unknown-linux-gnu
            binary: x86_64-manylinux_2_28
            container: quay.io/pypa/manylinux_2_28_x86_64
            build_args: --no-default-features --features static-ssl,prod
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            binary: x86_64-windows-msvc
            build_args: --no-default-features --features prod
            ext: .exe

    env:
      SCCACHE_GHA_ENABLED: true
      RUSTC_WRAPPER: sccache
      CARGO_INCREMENTAL: 0
      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Install Rust
        if: runner.os != 'Windows'
        uses: actions-rs/toolchain@v1
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          target: ${{ matrix.target }}
          components: clippy

      - name: Install Rust for Windows
        if: runner.os == 'Windows'
        run: |
          rustup update --no-self-update ${{ env.RUST_TOOLCHAIN }}
          rustup target add ${{ matrix.target }}
          rustup component add clippy --toolchain ${{ env.RUST_TOOLCHAIN }}

      - name: Set default rust version
        run: rustup default ${{ env.RUST_TOOLCHAIN }}

      - name: Sccache cache
        uses: mozilla-actions/sccache-action@v0.0.9

      - name: Cargo registry cache
        uses: actions/cache@v4
        with:
          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-${{ github.sha }}
          restore-keys: |
            cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
            cargo-${{ runner.os }}-
          path: |
            ~/.cargo/registry
            ~/.cargo/git

      - name: Prepare build environment for macOS & Linux
        run: bash ./ci/prepare_build_environment.sh
        if: runner.os != 'Windows'

      - name: Prepare build environment for Windows
        run: ./ci/prepare_build_environment.ps1
        if: runner.os == 'Windows'

      - name: Build release binary
        run: cargo build ${{ matrix.build_args }} --release --target ${{ matrix.target }} --package tabby

      - name: Rename release binary
        run: mv target/${{ matrix.target }}/release/tabby${{ matrix.ext }} tabby_${{ matrix.binary }}${{ matrix.ext }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          retention-days: 3
          name: tabby_${{ matrix.binary }}${{ matrix.ext }}
          path: tabby_${{ matrix.binary }}${{ matrix.ext }}

  package-from-upstream:
    runs-on: ubuntu-latest
    needs: [release-binary]
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Download all artifacts
        uses: actions/download-artifact@v4

      - name: Display structure of downloaded files
        run: ls -R

      - name: Package CPU for Windows
        run: >
          LLAMA_CPP_PLATFORM=win-cpu-x64 OUTPUT_NAME=tabby_x86_64-windows-msvc-cpu ./ci/package-from-upstream.sh

      - name: Package CUDA 12.4 for Windows
        run: >
          LLAMA_CPP_PLATFORM=win-cuda-12.4-x64 OUTPUT_NAME=tabby_x86_64-windows-msvc-cuda124 ./ci/package-from-upstream.sh

      - name: Package Vulkan for Windows
        run: >
          LLAMA_CPP_PLATFORM=win-vulkan-x64 OUTPUT_NAME=tabby_x86_64-windows-msvc-vulkan ./ci/package-from-upstream.sh

      - name: Package Vulkan for Linux
        run: >
          LLAMA_CPP_PLATFORM=ubuntu-vulkan-x64 OUTPUT_NAME=tabby_x86_64-manylinux_2_28-vulkan ./ci/package-from-upstream.sh

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          retention-days: 3
          name: dist
          path: dist/


  pre-release:
    needs: [release-llama-server-binary, release-binary, package-from-upstream]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4

      - name: Display structure of downloaded files
        run: ls -R

      - name: Creating distribution bundles
        run: |
          get_file_extension() {
            local filename="$1"
            # Check if the file has an extension
            if [[ "$filename" == *.* && ! "$filename" == .* ]]; then
              echo ".${filename##*.}"
            else
              echo ""
            fi
          }

          dist_dir=$(pwd)/dist
          mkdir -p $dist_dir

          for llama_server in llama-server_*/llama-server_*; do
            for tabby in tabby_*/tabby_*; do
              llamab=$(basename $llama_server)
              tabbyb=$(basename $tabby)
              extname=$(get_file_extension $tabbyb)

              llaman=${llamab%.*}
              tabbyn=${tabbyb%.*}

              llamav=${llaman#llama-server_}
              tabbyv=${tabbyn#tabby_}

              if [[ $llamav == *"$tabbyv"* ]]; then
                echo "Creating bundle for $llamav"

                # the downloaded files may have the same folder name with release_dir
                # put the release files in a new folder
                build_dir=build
                release_name=tabby_${llamav}
                release_dir=$build_dir/$release_name
                mkdir -p $release_dir
                cp $llama_server $release_dir/llama-server${extname}
                cp $tabby $release_dir/tabby${extname}

                pushd $build_dir
                # Release zip for Windows, tar.gz for macOS and Linux
                # use `extname` to determine the platform
                if [[ "$extname" == ".exe" ]]; then
                  zip -r $release_name.zip $release_name
                  mv $release_name.zip $dist_dir/
                else
                  chmod +x $release_name/llama-server${extname} $release_name/tabby${extname}
                  tar zcvf $release_name.tar.gz $release_name
                  mv $release_name.tar.gz $dist_dir/
                fi
                rm -rf "$release_name"
                popd
              fi
            done
          done

      - name: Display structure of created files
        run: ls -R dist

      - uses: ncipollo/release-action@v1
        if: github.event_name == 'push'
        with:
          allowUpdates: true
          prerelease: true
          makeLatest: false
          artifacts: "dist/tabby_*.zip,dist/tabby_*.tar.gz"
          tag: ${{ github.ref_name }}
          removeArtifacts: true

release-intellij .github/workflows/release-intellij.yml

Triggers

workflow_dispatch, push

Runs on

ubuntu-latest, ubuntu-latest

Jobs

release-marketplace, release-github

Actions

pnpm/action-setup, gradle/gradle-build-action, pnpm/action-setup, gradle/gradle-build-action, ncipollo/release-action

Commands

echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
pnpm install
if [[ ${{ github.ref_name }} =~ ^intellij@[0-9]+\.[0-9]+\.[0-9]+$ ]]; then echo "PUBLISH_CHANNEL=stable" >> $GITHUB_ENV else echo "PUBLISH_CHANNEL=alpha" >> $GITHUB_ENV fi
echo "Publish Channel is ${{ env.PUBLISH_CHANNEL }}"
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
pnpm install
if [[ ${{ github.ref_name }} =~ ^intellij@[0-9]+\.[0-9]+\.[0-9]+$ ]]; then echo "STABLE_RELEASE=true" >> $GITHUB_ENV else echo "STABLE_RELEASE=false" >> $GITHUB_ENV fi
echo "Stable Release is ${{ env.STABLE_RELEASE }}"

View raw YAML

name: Release Tabby Plugin for IntelliJ Platform

on:
  workflow_dispatch:
  push:
    tags:
      - "intellij@*"

concurrency:
  group: ${{ github.workflow_ref }}-${{ github.head_ref || github.ref_name }}

  # If this is enabled it will cancel current running and start latest
  cancel-in-progress: true

jobs:
  release-marketplace:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          lfs: true

      - name: Setup JDK
        uses: actions/setup-java@v3
        with:
          distribution: zulu
          java-version: 17

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 18

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9
          run_install: false

      - name: Get pnpm store directory
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@v4
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install

      - name: Determine Publish Channel
        run: |
          if [[ ${{ github.ref_name }} =~ ^intellij@[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "PUBLISH_CHANNEL=stable" >> $GITHUB_ENV
          else
            echo "PUBLISH_CHANNEL=alpha" >> $GITHUB_ENV
          fi

      - name: Check Publish Channel
        run: echo "Publish Channel is ${{ env.PUBLISH_CHANNEL }}"

      - name: Publish Plugin to Marketplace
        env:
          CERTIFICATE_CHAIN: ${{ secrets.INTELLIJ_PLUGIN_CERTIFICATE_CHAIN }}
          PRIVATE_KEY: ${{ secrets.INTELLIJ_PLUGIN_PRIVATE_KEY }}
          PUBLISH_TOKEN: ${{ secrets.INTELLIJ_PLUGIN_PUBLISH_TOKEN }}
          PUBLISH_CHANNEL: ${{ env.PUBLISH_CHANNEL }}
        uses: gradle/gradle-build-action@v2.4.2
        with:
          arguments: publishPlugin
          build-root-directory: clients/intellij

  release-github:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          lfs: true

      - name: Setup JDK
        uses: actions/setup-java@v3
        with:
          distribution: zulu
          java-version: 17

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 18

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9
          run_install: false

      - name: Get pnpm store directory
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@v4
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install

      - name: Build Signed Plugin
        env:
          CERTIFICATE_CHAIN: ${{ secrets.INTELLIJ_PLUGIN_CERTIFICATE_CHAIN }}
          PRIVATE_KEY: ${{ secrets.INTELLIJ_PLUGIN_PRIVATE_KEY }}
        uses: gradle/gradle-build-action@v2.4.2
        with:
          arguments: signPlugin
          build-root-directory: clients/intellij

      - name: Determine is stable release
        run: |
          if [[ ${{ github.ref_name }} =~ ^intellij@[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "STABLE_RELEASE=true" >> $GITHUB_ENV
          else
            echo "STABLE_RELEASE=false" >> $GITHUB_ENV
          fi

      - name: Check if stable release
        run: echo "Stable Release is ${{ env.STABLE_RELEASE }}"

      - name: Create GitHub Release
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          prerelease: ${{ env.STABLE_RELEASE == 'false' }}
          makeLatest: false
          tag: ${{ github.ref_name }}
          removeArtifacts: true
          artifacts: "clients/intellij/build/distributions/intellij-tabby-signed.zip"

release-vim .github/workflows/release-vim.yml

Triggers

workflow_dispatch, push

Runs on

ubuntu-latest

Jobs

release

Actions

ad-m/github-push-action

Commands

find vim-tabby/ -mindepth 1 ! -regex '^vim-tabby/\.git$/.*$?' -delete cp -r tabby/clients/vim/.gitignore vim-tabby/ cp -r tabby/clients/vim/* vim-tabby/
version=$(cat vim-tabby/autoload/tabby.vim | grep "let g:tabby_version" | sed -e 's/.*"$.*$".*/\1/') echo "::set-output name=version::$version"
cd vim-tabby/ git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com" git config --local user.name "github-actions[bot]" git add . git commit -m "release: vim-tabby version ${{ steps.get_version.outputs.version }}" git tag ${{ steps.get_version.outputs.version }}

View raw YAML

name: Release Vim Plugin

on:
  workflow_dispatch:
  push:
    tags:
      - 'vim@*'

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout tabby repo
      uses: actions/checkout@v3
      with:
        lfs: true
        path: tabby
    - name: Checkout vim-tabby repo
      uses: actions/checkout@v3
      with:
        repository: TabbyML/vim-tabby
        token: ${{ secrets.VIM_RELEASE_GH_TOKEN }}
        lfs: true
        path: vim-tabby
    - name: Copy files
      run: |
        find vim-tabby/ -mindepth 1 ! -regex '^vim-tabby/\.git\(/.*\)?' -delete
        cp -r tabby/clients/vim/.gitignore vim-tabby/
        cp -r tabby/clients/vim/* vim-tabby/
    - name: Get version
      id: get_version
      run: |
        version=$(cat vim-tabby/autoload/tabby.vim | grep "let g:tabby_version" | sed -e 's/.*"\(.*\)".*/\1/')
        echo "::set-output name=version::$version"
    - name: Commit files
      run: |
        cd vim-tabby/
        git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
        git config --local user.name "github-actions[bot]"
        git add .
        git commit -m "release: vim-tabby version ${{ steps.get_version.outputs.version }}"
        git tag ${{ steps.get_version.outputs.version }}
    - name: Push changes
      uses: ad-m/github-push-action@master
      with:
        repository: TabbyML/vim-tabby
        github_token: ${{ secrets.VIM_RELEASE_GH_TOKEN }}
        directory: vim-tabby
        force: true
        tags: true

release-vscode .github/workflows/release-vscode.yml

Triggers

workflow_dispatch, push

Runs on

ubuntu-latest

Jobs

publish-vscode

Actions

pnpm/action-setup

Commands

echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
pnpm install
cd clients/vscode && pnpm run $(node scripts/publish.cjs)

View raw YAML

name: Release vscode extension

on:
  workflow_dispatch:
  push:
    tags:
      - 'vscode@*'

concurrency:
  group: ${{ github.workflow_ref }}-${{ github.head_ref || github.ref_name }} 
  
  # If this is enabled it will cancel current running and start latest
  cancel-in-progress: true

jobs:
  publish-vscode:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          lfs: true

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 18

      - uses: pnpm/action-setup@v4
        name: Install pnpm
        with:
          version: 9
          run_install: false

      - name: Get pnpm store directory
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - uses: actions/cache@v4
        name: Setup pnpm cache
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install

      - name: Publish
        run: cd clients/vscode && pnpm run $(node scripts/publish.cjs)
        env:
          VSCE_PAT: ${{ secrets.VSCE_PAT }}
          OVSX_PAT: ${{ secrets.OVSX_PAT }}

test-intellij .github/workflows/test-intellij.yml

Triggers

pull_request

Runs on

ubuntu-latest

Jobs

build

Actions

pnpm/action-setup, gradle/gradle-build-action

Commands

echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
pnpm install

View raw YAML

name: Test IntelliJ

on:
  pull_request:
    branches: [ main ]
    paths:
      - '.github/workflows/test-intellij.yml'
      - 'clients/tabby-agent/**'
      - 'clients/intellij/**'

concurrency:
  group: ${{ github.workflow_ref }}-${{ github.head_ref || github.ref_name }} 
  
  # If this is enabled it will cancel current running and start latest
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          lfs: true

      - name: Setup JDK
        uses: actions/setup-java@v3
        with:
          distribution: zulu
          java-version: 17

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 18

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9
          run_install: false

      - name: Get pnpm store directory
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@v4
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install

      - name: Build Plugin
        uses: gradle/gradle-build-action@v2.4.2
        with:
          arguments: buildPlugin
          build-root-directory: clients/intellij

test-pnpm perms .github/workflows/test-pnpm.yml

Triggers

pull_request

Runs on

ubuntu-latest

Jobs

tests

Actions

pnpm/action-setup

Commands

echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
pnpm install
pnpm lint
pnpm test
pnpm build

View raw YAML

name: Test Pnpm

on:
  pull_request:
    branches: ["main" ]
    paths:
      - '.github/workflows/autofix-pnpm.yml'
      - 'clients/**'
      - 'ee/tabby-ui/**'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow_ref }}-${{ github.head_ref || github.ref_name }}

  # If this is enabled it will cancel current running and start latest
  cancel-in-progress: true

jobs:
  tests:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 18

      - uses: pnpm/action-setup@v4
        name: Install pnpm
        with:
          version: 9
          run_install: false

      - name: Get pnpm store directory
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - uses: actions/cache@v4
        name: Setup pnpm cache
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install

      - name: Lint
        run: pnpm lint

      - name: Test
        run: pnpm test

      - name: Build
        run: pnpm build

test-rust .github/workflows/test-rust.yml

Triggers

push, pull_request

Runs on

ubuntu-latest, ubuntu-latest

Jobs

tests, coverage

Actions

actions-rs/toolchain, mozilla-actions/sccache-action, actions-rs/toolchain, taiki-e/install-action, mozilla-actions/sccache-action, codecov/codecov-action

Commands

sudo bash ./ci/prepare_build_environment.sh
cargo test --doc
cargo test --bin tabby --no-default-features
cargo test --bin tabby --lib
sudo bash ./ci/prepare_build_environment.sh
cargo llvm-cov --bin tabby --lib --lcov --output-path lcov.info

View raw YAML

name: Test Rust

on:
  push:
    branches: [ "main" ]
    paths:
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'crates/**'
      - 'ee/**'
      - '!ee/tabby-ui/**'
      - '.github/workflows/test-rust.yml'

  pull_request:
    branches: [ "main" ]
    paths:
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'crates/**'
      - 'ee/**'
      - '!ee/tabby-ui/**'
      - '.github/workflows/test-rust.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}

  # If this is enabled it will cancel current running and start latest
  cancel-in-progress: true

env:
  RUST_TOOLCHAIN: 1.82.0

jobs:
  tests:
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    env:
      CARGO_TERM_COLOR: always
      SCCACHE_GHA_ENABLED: true
      RUSTC_WRAPPER: sccache
      CARGO_INCREMENTAL: 0
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Sccache cache
        uses: mozilla-actions/sccache-action@v0.0.9

      - name: Cargo registry cache
        uses: actions/cache@v4
        with:
          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-${{ github.sha }}
          restore-keys: |
            cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
            cargo-${{ runner.os }}-
          path: |
            ~/.cargo/registry
            ~/.cargo/git

      - run: sudo bash ./ci/prepare_build_environment.sh

      - name: Run doc tests
        run: cargo test --doc

      - name: Run unit tests on community build
        run: cargo test --bin tabby --no-default-features

      - name: Run unit tests
        run: cargo test --bin tabby --lib

  coverage:
    runs-on: ubuntu-latest
    env:
      CARGO_TERM_COLOR: always
      SCCACHE_GHA_ENABLED: true
      RUSTC_WRAPPER: sccache
      CARGO_INCREMENTAL: 0
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov

      - name: Sccache cache
        uses: mozilla-actions/sccache-action@v0.0.9

      - name: Cargo registry cache
        uses: actions/cache@v4
        with:
          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-${{ github.sha }}
          restore-keys: |
            cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
            cargo-${{ runner.os }}-
          path: |
            ~/.cargo/registry
            ~/.cargo/git

      - run: sudo bash ./ci/prepare_build_environment.sh

      - name: Generate code coverage
        env:
          CI_COVERAGE: 1
        run: cargo llvm-cov --bin tabby --lib --lcov --output-path lcov.info

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v3
        env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
          files: lcov.info
          fail_ci_if_error: true