fix(ci): require built WASM artifacts for tests

Co-Authored-By: GPT-5.6 Terra <noreply@openai.com>

.gitea/workflows/ci.yml

@@ -39,6 +39,16 @@ jobs:
           name: turbo-cache-${{ github.run_id }}
           path: turbo-cache.tar.gz
 
+      - name: Archive build artifacts
+        run: |
+          shopt -s nullglob
+          tar -czf build-artifacts.tar.gz packages/*/dist packages/*/out
+
+      - uses: actions/upload-artifact@v3
+        with:
+          name: build-artifacts-${{ github.run_id }}
+          path: build-artifacts.tar.gz
+
   lint:
     runs-on: ubuntu-latest
     steps:
@@ -85,10 +95,15 @@ jobs:
         with:
           name: turbo-cache-${{ github.run_id }}
 
+      - uses: actions/download-artifact@v3
+        with:
+          name: build-artifacts-${{ github.run_id }}
+
       - name: Restore node_modules and turbo cache
         run: |
           tar -xzf node_modules.tar.gz
           tar -xzf turbo-cache.tar.gz
+          tar -xzf build-artifacts.tar.gz
 
       - name: Typecheck
         run: npm run typecheck
@@ -109,10 +124,15 @@ jobs:
         with:
           name: turbo-cache-${{ github.run_id }}
 
+      - uses: actions/download-artifact@v3
+        with:
+          name: build-artifacts-${{ github.run_id }}
+
       - name: Restore node_modules and turbo cache
         run: |
           tar -xzf node_modules.tar.gz
           tar -xzf turbo-cache.tar.gz
+          tar -xzf build-artifacts.tar.gz
 
       - name: Type tests
         run: npm run typetest
@@ -133,10 +153,15 @@ jobs:
         with:
           name: turbo-cache-${{ github.run_id }}
 
+      - uses: actions/download-artifact@v3
+        with:
+          name: build-artifacts-${{ github.run_id }}
+
       - name: Restore node_modules and turbo cache
         run: |
           tar -xzf node_modules.tar.gz
           tar -xzf turbo-cache.tar.gz
+          tar -xzf build-artifacts.tar.gz
 
       - name: Run node tests
         run: npm run test
@@ -157,10 +182,15 @@ jobs:
         with:
           name: turbo-cache-${{ github.run_id }}
 
+      - uses: actions/download-artifact@v3
+        with:
+          name: build-artifacts-${{ github.run_id }}
+
       - name: Restore node_modules and turbo cache
         run: |
           tar -xzf node_modules.tar.gz
           tar -xzf turbo-cache.tar.gz
+          tar -xzf build-artifacts.tar.gz
 
       - name: Install browser binaries
         run: npx playwright install --with-deps chromium firefox

AI_CHANGES.md

@@ -77,3 +77,5 @@ The test suite for `packages/http` was mostly generated by Claude Code, which al
 - **`AGENTS.md` / `CLAUDE.md` — `tea` mergeability and symlink clarifications**: Claude Code (Claude Fable 5) documented that `CLAUDE.md` is a symlink to `AGENTS.md`, that `tea` reports `mergeable: false` while the `WIP:` title prefix is present (so mergeability is only meaningful at finalisation), and that the conflicting-files section header in `tea` output is always printed — only files listed under it indicate actual conflicts.
 - **`AGENTS.md` / `CLAUDE.md` — exact model attribution**: Codex (GPT-5.6-Sol) documented that agents must use the exact running model for commits, PRs, reviews, and `Agent/*` labels; prefer harness-provided identity, fall back to Codex CLI session metadata when needed, and never guess or reuse another session's model identity.
 - **`AGENTS.md` / `CLAUDE.md` — project structure**: Codex (GPT-5.6 Luna) documented that this repository uses npm workspaces and `package-lock.json`, with Turbo as the task runner and `tailscale/` as a git submodule rather than an npm workspace; agents should not treat it as a pnpm repository.
+
+- **CI — require built WASM test artifacts**: Codex (GPT-5.6 Terra) made `test` and `test:coverage` depend on each package's own build, archives/restores workspace build outputs for every downstream CI job, and turns missing tsconnect WASM artifacts into CI-only test failures while preserving local skips.

packages/tsconnect-worker/src/connect.browser.ts

@@ -13,6 +13,11 @@ const wasmPath = join(pkg, "../../tsconnect/dist/main.wasm")
 const WASM_BUILT = existsSync(wasmPath)
 
 if (!WASM_BUILT) {
+  if (process.env.CI) {
+    throw new Error(
+      "tsconnect/dist/main.wasm must be built before running worker browser tests in CI",
+    )
+  }
   test("tsconnect-worker browser tests [skipped: WASM not built]", () => {})
 } else {
   forBrowsers((ctx) => {

packages/tsconnect-worker/src/connect.test.ts

@@ -11,6 +11,10 @@ import type { IpnClientHandle } from "./client.js"
 const wasmPath = join(dirname(fileURLToPath(import.meta.url)), "../../tsconnect/dist/main.wasm")
 const WASM_BUILT = existsSync(wasmPath)
 
+if (!WASM_BUILT && process.env.CI) {
+  throw new Error("tsconnect/dist/main.wasm must be built before running worker tests in CI")
+}
+
 // All tests share a single WASM+IPN instance to avoid uncaughtException noise
 // from sequentially creating and shutting down multiple Go WASM runtimes.
 suite(

packages/tsconnect/src/ipn.test.ts

@@ -24,6 +24,10 @@ const CONTROL_URL = process.env.TSCONNECT_TEST_CONTROL_URL
 const AUTH_KEY = process.env.TSCONNECT_TEST_AUTH_KEY
 const NETWORK_OK = WASM_BUILT && !!CONTROL_URL && !!AUTH_KEY
 
+if (!WASM_BUILT && process.env.CI) {
+  throw new Error("dist/main.wasm must be built before running tsconnect tests in CI")
+}
+
 // index.js is imported dynamically so that env-node.js / env-web.js (which
 // statically import wasm_exec.js) are not loaded at module evaluation time —
 // which would crash when dist/wasm_exec.js does not exist yet (before build).

turbo.json

@@ -6,10 +6,10 @@
       "outputs": ["dist/**", "out/**"]
     },
     "test": {
-      "dependsOn": ["^build"]
+      "dependsOn": ["build", "^build"]
     },
     "test:coverage": {
-      "dependsOn": ["^build"],
+      "dependsOn": ["build", "^build"],
       "outputs": ["coverage/**"]
     },
     "typecheck": {