ci(web): keep WASM demo builds green when Pages is disabled

Merged
KN
1mo ago
+1389-155

Summary

  • keep the existing browser WebAssembly demo build in CI
  • stop unrelated pushes to main from failing because GitHub Pages is not enabled
  • restrict push-triggered web demo builds to Web/WASM-related paths
  • verify the generated static distribution (index.html, app.js, wasm_exec.js, main.wasm.gz)
  • make GitHub Pages deployment explicit via workflow_dispatch
  • move configure-pages into the deploy-only job

Why

The current webdemo-pages workflow fails at actions/configure-pages whenever the repository has not enabled GitHub Pages. That failure happens after the WebAssembly distribution has already built successfully, so the red check is deployment configuration noise rather than a WebAssembly regression.

This keeps the useful WASM build/demo infrastructure while making Pages publishing opt-in. To publish the demo, enable Settings → Pages → Build and deployment → GitHub Actions once, then run webdemo-pages manually.

Scope

This does not change the browser transport yet. The existing browser demo still uses Tailcat's DERP/WebSocket path; MasqueCat WebTransport/MASQUE support should be implemented separately so transport changes can be reviewed and tested independently.

Summary by Sourcery

Keep browser WebAssembly demo CI independent of GitHub Pages availability and add authenticated WebTransport support for browser MasqueCat peers.

New Features:

  • Add authenticated browser WebTransport connectivity to MasqueCat relays, including browser-side networking support for TCP and ping operations.

Bug Fixes:

  • Prevent unrelated pushes from failing when GitHub Pages is disabled by making deployment opt-in and isolating Pages configuration to manual deployments.

Enhancements:

  • Serve native MASQUE and browser WebTransport peers through the relay on a shared endpoint with configurable browser origin protection.
  • Validate the generated WebAssembly demo distribution during CI and limit push-triggered builds to relevant paths.

Build:

  • Add the WebTransport dependency and update the indirect Tailscale workflow dependency.

CI:

  • Scope web demo workflow triggers to Web/WASM-related changes and make concurrency branch-specific.

Deployment:

  • Require manual workflow dispatch for GitHub Pages publishing while retaining automatic build verification.

Summary by cubic

Keeps the web demo CI build green when GitHub Pages isn't enabled, and adds an authenticated WebTransport path so browser peers can join MasqueCat relays.

CI

  • Pages publishing is opt-in via manual dispatch; push builds only run on Web/WASM-related paths.
  • configure-pages moved into the deploy job, the build job verifies the static demo output, and workflow concurrency is scoped per branch.

WebTransport

  • The relay serves browser peers over WebTransport on the same port as native CONNECT-UDP peers, with node-key challenge/response auth and an Origin allowlist that defaults to HTTPS same-origin.
  • The js/wasm browser client reuses the existing WireGuard/gVisor data plane, fragmenting large packets for reassembly.
  • Native and browser peers share one packet forwarder; the relay takes a -web-origin flag, ServeMasqueRelay replaces ServeMasque, and github.com/quic-go/webtransport-go was added.
  • mc... tokens route through the new browser client without a DERP map; legacy tc... addresses stay on DERP/WebSocket.