Skip to content

ci(web): keep WASM demo builds green when Pages is disabled - #5

Merged
knowlet merged 20 commits into
mainfrom
fix/webdemo-pages-opt-in
Sep 7, 2026
Merged

knowlet merged 20 commits into
mainfrom
fix/webdemo-pages-opt-in

Conversation

@knowlet

@knowlet knowlet commented Sep 7, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • keep the existing browser WebAssembly demo build in CI
  • stop unrelated pushes to main from failing because GitHub Pages is not enabled
  • restrict push-triggered web demo builds to Web/WASM-related paths
  • verify the generated static distribution (index.html, app.js, wasm_exec.js, main.wasm.gz)
  • make GitHub Pages deployment explicit via workflow_dispatch
  • move configure-pages into the deploy-only job

Why

The current webdemo-pages workflow fails at actions/configure-pages whenever the repository has not enabled GitHub Pages. That failure happens after the WebAssembly distribution has already built successfully, so the red check is deployment configuration noise rather than a WebAssembly regression.

This keeps the useful WASM build/demo infrastructure while making Pages publishing opt-in. To publish the demo, enable Settings → Pages → Build and deployment → GitHub Actions once, then run webdemo-pages manually.

Scope

This does not change the browser transport yet. The existing browser demo still uses Tailcat's DERP/WebSocket path; MasqueCat WebTransport/MASQUE support should be implemented separately so transport changes can be reviewed and tested independently.

Summary by Sourcery

Keep browser WebAssembly demo CI independent of GitHub Pages availability and add authenticated WebTransport support for browser MasqueCat peers.

New Features:

  • Add authenticated browser WebTransport connectivity to MasqueCat relays, including browser-side networking support for TCP and ping operations.

Bug Fixes:

  • Prevent unrelated pushes from failing when GitHub Pages is disabled by making deployment opt-in and isolating Pages configuration to manual deployments.

Enhancements:

  • Serve native MASQUE and browser WebTransport peers through the relay on a shared endpoint with configurable browser origin protection.
  • Validate the generated WebAssembly demo distribution during CI and limit push-triggered builds to relevant paths.

Build:

  • Add the WebTransport dependency and update the indirect Tailscale workflow dependency.

CI:

  • Scope web demo workflow triggers to Web/WASM-related changes and make concurrency branch-specific.

Deployment:

  • Require manual workflow dispatch for GitHub Pages publishing while retaining automatic build verification.

Summary by cubic

Keeps the web demo CI build green when GitHub Pages isn't enabled, and adds an authenticated WebTransport path so browser peers can join MasqueCat relays.

CI

  • Pages publishing is opt-in via manual dispatch; push builds only run on Web/WASM-related paths.
  • configure-pages moved into the deploy job, the build job verifies the static demo output, and workflow concurrency is scoped per branch.

WebTransport

  • The relay serves browser peers over WebTransport on the same port as native CONNECT-UDP peers, with node-key challenge/response auth and an Origin allowlist that defaults to HTTPS same-origin.
  • The js/wasm browser client reuses the existing WireGuard/gVisor data plane, fragmenting large packets for reassembly.
  • Native and browser peers share one packet forwarder; the relay takes a -web-origin flag, ServeMasqueRelay replaces ServeMasque, and github.com/quic-go/webtransport-go was added.
  • mc... tokens route through the new browser client without a DERP map; legacy tc... addresses stay on DERP/WebSocket.

Written for commit e6c5c3a. Summary will update on new commits.

Review in cubic

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

@sourcery-ai

sourcery-ai Bot commented Sep 7, 2026 •

Copy link
Copy Markdown

Reviewer's Guide

The workflow now builds and verifies the browser WebAssembly demo for relevant main-branch changes without requiring GitHub Pages, while making publication an explicit manual action that configures and deploys Pages only when requested.

Flow diagram for web demo build and opt-in Pages deployment

flowchart TD
    Push[Relevant push to main] --> Build[build job]
    Manual[workflow_dispatch] --> Build
    Build --> Generate[go run ./cmd/tailcat-webdist -o dist]
    Generate --> Verify[verify static demo output]
    Verify --> Artifact[upload-pages-artifact]
    Artifact --> DeployCheck{workflow_dispatch?}
    DeployCheck -- No --> Complete[Build verification complete]
    DeployCheck -- Yes --> Configure[configure-pages]
    Configure --> Deploy[deploy-pages]
Loading

File-Level Changes

Change Details Files
Separate always-on WebAssembly demo validation from opt-in GitHub Pages deployment.
  • Keep push-triggered builds on relevant web/WASM paths only.
  • Gate deployment to manual workflow dispatches.
  • Move Pages configuration into the deploy job so disabled Pages does not break builds.
.github/workflows/webdemo-pages.yml
Add explicit validation of the generated static demo distribution.
  • Check that index.html, app.js, wasm_exec.js, and main.wasm.gz are present and non-empty.
  • Continue removing uncompressed and zstd WASM artifacts before publishing the artifact.
.github/workflows/webdemo-pages.yml
Update workflow execution controls and documentation for the legacy browser demo.
  • Use ref-scoped concurrency with cancellation.
  • Document the existing DERP/WebSocket transport and manual Pages setup.
  • Retain the pinned Pages actions for artifact upload and deployment.
.github/workflows/webdemo-pages.yml

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've found 1 issue

Prompt for AI Agents
Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path=".github/workflows/webdemo-pages.yml" line_range="16-24" />
<code_context>
 on:
   push:
     branches: [main]
+    paths:
+      - "web/**"
+      - "webdemo/**"
+      - "internal/wasmbuild/**"
+      - "cmd/tailcat-web/**"
+      - "cmd/tailcat-webdist/**"
+      - "go.mod"
+      - "go.sum"
+      - ".github/workflows/webdemo-pages.yml"
   workflow_dispatch:

</code_context>
<issue_to_address>
**issue (broader_impact):** The push path allowlist omits code that directly determines the WebAssembly build, including the root `tailcat` package imported by `web/main_js.go` and `internal/buildtags`, which is imported by `internal/wasmbuild`. Changes to those files do not run this workflow, so the generated demo can regress while CI remains green.

**Triggers:** When a push changes the root Tailcat package or `internal/buildtags` without changing one of the listed paths.

**Suggested fix:** Include all packages that contribute to the WASM binary, such as the root package and `internal/buildtags`, or use a broader repository path filter that covers the build dependency graph.

```suggestion
    paths:
      - "web/**"
      - "webdemo/**"
      - "internal/wasmbuild/**"
      - "internal/buildtags/**"
      - "cmd/tailcat-web/**"
      - "cmd/tailcat-webdist/**"
      - "*.go"
      - "go.mod"
      - "go.sum"
      - ".github/workflows/webdemo-pages.yml"
```
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 1 finding to address first, and if the workflow change is wrong, pushes to main will no longer publish updated demo assets, leaving the Pages site stale while manual dispatch still provides a repair path. Reverting the workflow and rerunning the deployment restores the site, so the impact is bounded and recoverable.

Blocking findings: .github/workflows/webdemo-pages.yml:24


Sourcery is free for open source - if you like our reviews please consider sharing them ✨

Comment thread .github/workflows/webdemo-pages.yml

@cubic-dev-ai cubic-dev-ai Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 1 file

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread .github/workflows/webdemo-pages.yml
sourcery-ai[bot]
sourcery-ai Bot previously approved these changes Sep 7, 2026

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sourcery assessment

Approved.

@sourcery-ai
sourcery-ai Bot dismissed their stale review September 7, 2026 02:47

Sourcery withdrew this approval because the latest commits introduced blocking findings.

@cubic-dev-ai cubic-dev-ai Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 10 files (changes from recent commits).

Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic

Comment thread masquecat_browser_js.go Outdated
Comment thread masquecat_browser_js.go Outdated
Comment thread masquecat_browser_js.go
Comment thread masquecat_browser_js.go
Comment thread web/main_js.go Outdated
Comment thread masquecat_webtransport.go Outdated
Comment thread cmd/masquecat-relay/main.go

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 14 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="web/main_js.go">

<violation number="1" location="web/main_js.go:134">
P2: When an `mc...` token is malformed, lacks a relay URL, or the browser lacks WebTransport, `BrowserMasqueClient.Ping` returns a permanent error immediately; `pingUntil` then retries it in a tight loop for 60 seconds. Stop retrying non-transient browser setup errors so the UI fails promptly.</violation>
</file>

Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic

Comment thread web/main_js.go

if strings.HasPrefix(addr, "mc") {
cl := tailcat.NewBrowserMasqueClient(tailcat.MasqueConnBlob(addr), priv, logf)
if err := pingUntil(ctx, cl.Ping); err != nil {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: When an mc... token is malformed, lacks a relay URL, or the browser lacks WebTransport, BrowserMasqueClient.Ping returns a permanent error immediately; pingUntil then retries it in a tight loop for 60 seconds. Stop retrying non-transient browser setup errors so the UI fails promptly.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At web/main_js.go, line 134:

<comment>When an `mc...` token is malformed, lacks a relay URL, or the browser lacks WebTransport, `BrowserMasqueClient.Ping` returns a permanent error immediately; `pingUntil` then retries it in a tight loop for 60 seconds. Stop retrying non-transient browser setup errors so the UI fails promptly.</comment>

<file context>
@@ -158,15 +126,30 @@ func tailcatDial(this js.Value, args []js.Value) any {
+
+		if strings.HasPrefix(addr, "mc") {
+			cl := tailcat.NewBrowserMasqueClient(tailcat.MasqueConnBlob(addr), priv, logf)
+			if err := pingUntil(ctx, cl.Ping); err != nil {
+				cl.Close()
+				return nil, err
</file context>

@knowlet
knowlet merged commit 0f33926 into main Sep 7, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant