# Tests and CI

The configured Tangled workflow, `.tangled/workflows/ci.yml`, runs for branch pushes, pull requests, and
manual runs. Formatting, unit tests, the ARMv6 ReleaseSafe build, both HTTP
smoke suites, and the `@atproto/space` SDK interop lane must all pass before a
push to `main` deploys to Fly.
Pull requests, other branches, and manual workflow runs never deploy. Check the
[deployment observation](deployment.md#october-1-deployment-observation) if a
push does not start a pipeline.

## Local checks

```sh
zig fmt --check build.zig build.zig.zon src bench tools
just test
just smoke-all
git diff --check
```

`just smoke-all` builds the PDS and Spaces HTTP-signature helper once, then runs
the public and permissioned suites concurrently. Each suite gets its own temporary database,
blobstore, and response files. Default ports are 2585 (public PDS), 2586 (mock
PLC), and 2587 (permissioned PDS). Both suites must succeed. Failed runs retain
diagnostic files and print their directory; successful runs remove them.
Avoid publishing raw diagnostics, which can contain test credentials.

`just smoke` and `just smoke-permissioned` still work independently and build
the binaries they need. The standalone permissioned suite defaults to 2586.
Use `ZDS_SMOKE_PORT`, `ZDS_SMOKE_PLC_PORT`, and `ZDS_PERMISSIONED_SMOKE_PORT`
to override the ports.

`just smoke-space-sdk` runs the permissioned suite with the
[pinned `@atproto/space` SDK](permissioned-data.md#october-1-upgrade) checking
ZDS's signatures, MACs, and STAR archives; it needs Node 22 and pnpm. `just
smoke` and `just smoke-all` do not.

CI keeps the pinned Zig compiler and package cache (`.ci-cache`) between runs
on heavypad's spindle. Zig's build cache is not carried over: restored files
get new inodes and zig 0.17 recompiles everything that reads them, so
`tools/ci-build.sh` compiles the tests, the ARMv6 check, and the x86_64
release at the same time instead. Four dependencies are tangled.org archives,
whose endpoint rate-limits; `tools/ci-fetch.sh` runs `zig build --fetch` with
six attempts and doubling backoff. Timings should distinguish cold
compilation from warm test execution.
No assertions, database durability settings, or cryptographic checks are
relaxed for speed.