Tests and CI #

The configured Tangled workflow, .tangled/workflows/ci.yml, runs for branch pushes, pull requests, and manual runs. Formatting, unit tests, the ARMv6 ReleaseSafe build, both HTTP smoke suites, and the @atproto/space SDK interop lane must all pass before a push to main deploys to Fly. Pull requests, other branches, and manual workflow runs never deploy. Check the deployment observation if a push does not start a pipeline.

Local checks #

zig fmt --check build.zig build.zig.zon src bench tools
just test
just smoke-all
git diff --check

just smoke-all builds the PDS and Spaces HTTP-signature helper once, then runs the public and permissioned suites concurrently. Each suite gets its own temporary database, blobstore, and response files. Default ports are 2585 (public PDS), 2586 (mock PLC), and 2587 (permissioned PDS). Both suites must succeed. Failed runs retain diagnostic files and print their directory; successful runs remove them. Avoid publishing raw diagnostics, which can contain test credentials.

just smoke and just smoke-permissioned still work independently and build the binaries they need. The standalone permissioned suite defaults to 2586. Use ZDS_SMOKE_PORT, ZDS_SMOKE_PLC_PORT, and ZDS_PERMISSIONED_SMOKE_PORT to override the ports.

just smoke-space-sdk runs the permissioned suite with the pinned @atproto/space SDK checking ZDS's signatures, MACs, and STAR archives; it needs Node 22 and pnpm. just smoke and just smoke-all do not.

CI keeps the pinned Zig compiler and package cache (.ci-cache) between runs on heavypad's spindle. Zig's build cache is not carried over: restored files get new inodes and zig 0.17 recompiles everything that reads them, so tools/ci-build.sh compiles the tests, the ARMv6 check, and the x86_64 release at the same time instead. Four dependencies are tangled.org archives, whose endpoint rate-limits; tools/ci-fetch.sh runs zig build --fetch with six attempts and doubling backoff. Timings should distinguish cold compilation from warm test execution. No assertions, database durability settings, or cryptographic checks are relaxed for speed.