Building Flow

cd web && npm install && npm run build && cd ..
go test ./...
CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o hotloop-flow ./cmd/hotloop-flow

Static, no cgo, runs on distroless. goja is pure Go, and so is wazero for when the WASM host goes in, which is the only reason that sentence is true. CI fails the build if the binary exceeds 40MiB or turns out to be dynamically linked, because both of those are things you discover on a plant floor otherwise.

The race detector needs cgo, so run it where a C compiler exists:

CGO_ENABLED=1 go test -race -count=1 -timeout 900s ./...

docs/compatibility.md is generated and a test fails when it drifts. Regenerate it rather than editing it:

HOTLOOP_FLOW_UPDATE_DOCS=1 go test ./internal/nodes/

Integration tests are skipped unless the environment points at a real broker and a real database. The exact variables are in the header of internal/nodes/integration_test.go, and the point of them is that “it works against my own encoder” is not a claim worth making.

Run gofmt -w ./internal ./cmd ./web before committing. CI does not check formatting, so that one is on you.

What CI does check, beyond vet and the race detector, is the set of things I have personally been burned by: that go mod tidy is committed, that the sandbox tests genuinely ran rather than silently skipping, that the editor bundle is actually inside the binary, that the binary is under 40MiB and statically linked, a 60-second fuzz run against the property expression parser, a 30-second one proving a flow never differs from itself, a rollback against a real broker that refuses anonymous clients, and the editor clicked through in a real browser, every node dialog included. Every one of those exists because the alternative was a green checkmark over something broken, and a green checkmark is worse than a red one.

Images and charts publish from version tags only, and both workflows refuse anything else twice: once in the trigger, once in a step that re-checks the ref. An artefact built from an untagged commit is one nobody can name out loud, and something on a plant floor can end up running it. Pushing to main runs CI and publishes nothing.