workinf_Blender_Wasm/docs/web/CI.md

M6 CI contract

The repository remote is Gitea, so the authoritative workflow is .gitea/workflows/m6-ci.yml. main is the protected release ref. Pull requests and ordinary pushes run quick and Chromium lanes; the release lane runs only for a main push or an explicit workflow_dispatch.

Pinned runner matrix

Component	Pinned value	Lane
Runner	self-hosted Debian 13 x86_64, labels blender-web / blender-web-release	all
Node.js	20.19.2	all
npm	lockfile-compatible npm 9	all
Playwright	1.62.1	Chromium, release
Chromium	Playwright Chromium 149.0.7827.55 or CHROME_PATH override	Chromium, release
Blender	official Blender 5.2.0 LTS with USD enabled, configured by BLENDER_BIN	release
Emscripten	3.1.69	release

BLENDER_ARCHIVE_SHA256 must identify the official Blender archive used by acceptance. VDB jobs use VDB_RESOURCE_ROOT; when it is absent, tools resolve resource-library/blender-web-vdb under the runner home directory.

Lane contents

npm --prefix web run ci:quick installs from package-lock.json, then runs typecheck, lint, Node tests, status consistency and release-evidence schema checks.

npm --prefix web run ci:chromium runs the P0 user loop (including main-thread and Offscreen viewports), release browser smoke, network interruption, device loss, OOM, real OPFS quota, malicious blend and archive gates. Every browser command receives a newly allocated loopback port; Playwright owns and cleans its server process.

npm --prefix web run ci:release runs full E2E, the complete performance and VDB matrices, V1 acceptance, reproducible offline packaging, archive cold boot, and binary/source independent verification.

Each lane writes release/ci-reports/<lane>.json, a sidecar SHA-256 and one immutable log per command. Reports use docs/status/ci-lane-report.schema.json and bind the commit, lockfile, parity ledger, engine manifest, SBOM, available archives and every command log. A failed subcommand writes an atomic FAILED report before the lane exits nonzero; it cannot reuse an older READY report.

The npm cache key is derived from web/package-lock.json. The Emscripten cache additionally binds version 3.1.69 and tools/web/emscripten-env.sh. Release evidence, reports and archives are never cache inputs. Artifact retention is fixed at 7 days for quick, 14 days for Chromium and 30 days for release; the report checker runs before upload.