Local-remote CI parity: unified venues, artifact/glibc/Defender lanes, dry-run red fixes - #1280
Merged
Conversation
The staged venue-unification bundle: _smoke.yml onto the shared wrappers with an extracted-artifact input (CBM_SMOKE_ARTIFACT_DIR), soak-legs.sh as the one canonical soak entry (quick + query-leak legs across all venues), protected per-user TEMP roots shared across venues, clean-disk preflights before every VM/Docker run, win.sh and run.sh routed through the canonical scripts, soak.yml retired, and the venue-parity contract (whitelist walker: workflows may provision or call canonical entries, nothing else). Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
… wrappers The venue unification moved release-smoke staging/execution out of _smoke.yml into the canonical wrappers (vm-smoke.sh / smoke-local.sh), so Step 0e's needle checks against inline YAML failed on every venue. Re-anchor each pinned invariant where the behavior now lives: - canonical-exe execution + profile-rooted fixtures + update fixture identification: asserted in vm-smoke.sh / smoke-local.sh, plus the workflow must call the wrapper on the extracted artifact - version/install-audit preflight needles updated to the artifact-dir text shape (still workflow provisioning) - RUNNER_TEMP: absolute ban replaced by a provision/scan allowlist walker + an explicit no-exe-under-RUNNER_TEMP backstop No pinned security property is dropped; the retargeted contract fails on the pre-unification architecture (verified against HEAD). Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
…r, Defender-ON everywhere Closes the closable local-vs-remote venue gaps so that, outside arch legs / YAML glue / release plumbing, every local red is a remote red and vice versa on shared legs: - scripts/package-release.sh: THE canonical archive step (names + five-file Windows bundle layout defined once); _build.yml's eight inline archive blocks become calls to it. - scripts/ci/smoke-artifact.sh: the artifact-flow smoke lane — build, package, extract, then the canonical wrapper in artifact mode; wired as run.sh smoke-artifact (compose service), win.sh smoke-artifact, and directly runnable on macOS. Archive-layout bugs now surface locally instead of in a release dry run. - glibc-floor leg (Dockerfile.glibc22 + compose + run.sh): portable binary smokes on ubuntu-22.04/glibc 2.35; the dynamic binary must refuse there (2.38+ floor by design). - Defender-ON parity (user directive): scripts/ci/ensure-defender.ps1 enables + VERIFIES real-time protection, fail-closed; runs in every Windows CI job (_test x2, _soak x3, _smoke, pr.yml) AND in the VM preflight; _smoke.yml's scan engine-failure soft-skip becomes a red gate. Expected cost: slower Windows jobs (AV scanning during install/build/test I/O); the next dry run proves the runner side. - Contracts: launcher-bundle five-file check retargeted onto package-release.sh + per-archive canonical-call association; venue-parity contract requires the new lanes, counts one ensure-defender step per Windows job, adds --help probes for the new entries. Extended contract fails on the pre-change tree (verified: 20 violations on HEAD). - VM README: ephemerality/Defender posture documented — utmctl has no snapshot verb, so per-run revert stays a manual qcow2 option; the sweep preflight remains the standing mechanism. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
git-apply of the staged unification recorded the new canonical entries as 100644; workflows execute them directly (run: scripts/ci/...), so a fresh CI checkout would fail at ci-ok/shard-union/soak/package steps with permission denied — the same class the parity worktree's own preflight just tripped over locally. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
…ecure open Dry run 30206811293: windows-11-arm (both variants) and windows-2025 smoke failed in the update/uninstall E2E phases with 'private staged copy failed secure open (error 32)' — ERROR_SHARING_VIOLATION. On the newer hosted images a first-touch scanner transiently holds the just-staged executable without FILE_SHARE_DELETE, so the launcher's GENERIC_READ|DELETE retirement open collides on cold images. Absorb the scan window with the same bounded backoff the staged RENAME path already uses (<=~2.5s, exponential); every retry re-runs the full secure-open validation, so no TOCTOU surface changes. No deterministic local repro exists (the VM passes this phase with Defender active; the collision is image-specific) — the next dry run on the same three jobs is the arbiter. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Dry run 30206811293: macos-15-intel release smoke failed B3 with a visibly correct 'semantic: 50' table — BSD grep returns no-match for the ENTIRE output when any line carries a NUL, control byte, or invalid UTF-8 (verified: printf poisoned input -> grep -qE fails), so one bad byte in one row silently unmatches every anchored check. Close the class at the emission choke point: control bytes and invalid UTF-8 force the quoted form; quoting escapes controls as \u00XX and replaces invalid sequences with U+FFFD (RFC 3629 validation, NUL-safe). Tool output is valid UTF-8 by construction. Unit test proven RED-on-revert (raw bytes emitted) and green with the fix. The smoke's B3 failure path now also dumps od -c bytes so a future red names the exact byte. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
LSan (Linux amd64 leg): 200 bytes — the runtime client (192) plus its IPC connection (8) — leaked whenever an earlier stage of daemon_runtime_disconnect_cancels_blocked_non_index_child... failed: both close blocks were gated on the request thread having completed, so a failed run skipped the close entirely. Teardown now closes unconditionally: close_begin interrupts the transport (forcing the blocked call to complete), the join becomes safe, and close_finish frees the client on every path. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Establishes local = remote minus {arch legs, YAML glue, release plumbing} — every gate-shaped behavior now routes through the same canonical entries on every venue — and fixes the reds from the last two release dry runs.
Venue unification (staged bundle, now landed)
Parity lanes (new)
Contract updates
Dry-run red fixes
Verification