|
| 1 | +name: native-unix |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + branches: [main] |
| 6 | + pull_request: |
| 7 | + types: [opened, reopened, synchronize] |
| 8 | + |
| 9 | +permissions: |
| 10 | + contents: read |
| 11 | + |
| 12 | +concurrency: |
| 13 | + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} |
| 14 | + cancel-in-progress: ${{ github.event_name == 'pull_request' }} |
| 15 | + |
| 16 | +jobs: |
| 17 | + primitives: |
| 18 | + name: primitives / ${{ matrix.platform }}-${{ matrix.arch }} |
| 19 | + runs-on: ${{ matrix.runner }} |
| 20 | + timeout-minutes: 30 |
| 21 | + strategy: |
| 22 | + fail-fast: false |
| 23 | + matrix: |
| 24 | + include: |
| 25 | + - runner: ubuntu-24.04 |
| 26 | + platform: linux |
| 27 | + arch: x64 |
| 28 | + image: quay.io/pypa/manylinux_2_28_x86_64@sha256:0536c364004fa2a3c5041120b6fe35d84fc5bfe31f04c6a6304f13eac4a67b63 |
| 29 | + - runner: ubuntu-24.04-arm |
| 30 | + platform: linux |
| 31 | + arch: arm64 |
| 32 | + image: quay.io/pypa/manylinux_2_28_aarch64@sha256:1676a4f178dc6cf8a1d1e3b7e1d71fca891a466ebde72a33880ccda8af3383d8 |
| 33 | + - runner: macos-15-intel |
| 34 | + platform: darwin |
| 35 | + arch: x64 |
| 36 | + - runner: macos-15 |
| 37 | + platform: darwin |
| 38 | + arch: arm64 |
| 39 | + defaults: |
| 40 | + run: |
| 41 | + shell: bash |
| 42 | + working-directory: plugins/codex-security/native |
| 43 | + env: |
| 44 | + NATIVE_IMAGE: ${{ matrix.image }} |
| 45 | + steps: |
| 46 | + - name: Checkout repository |
| 47 | + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 48 | + with: |
| 49 | + persist-credentials: false |
| 50 | + - name: Set up pnpm |
| 51 | + uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 |
| 52 | + with: |
| 53 | + package_json_file: package.json |
| 54 | + cache: true |
| 55 | + cache_dependency_path: sdk/typescript/pnpm-lock.yaml |
| 56 | + - name: Set up Node.js 22 |
| 57 | + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 |
| 58 | + with: |
| 59 | + node-version: "22.13.0" |
| 60 | + - name: Compile TypeScript tools |
| 61 | + working-directory: . |
| 62 | + run: | |
| 63 | + pnpm --dir sdk/typescript install --frozen-lockfile |
| 64 | + pnpm --dir sdk/typescript run build:ci |
| 65 | + - name: Set up Rust |
| 66 | + run: rustup toolchain install 1.97.1 --profile minimal --component rustfmt --component clippy |
| 67 | + - name: Check Rust source and fetch locked dependencies |
| 68 | + run: | |
| 69 | + cargo fmt --check |
| 70 | + cargo clippy --locked -- -D warnings |
| 71 | + cargo fetch --locked |
| 72 | + - name: Build and verify Linux on glibc 2.28 with Node.js 22 |
| 73 | + if: matrix.platform == 'linux' |
| 74 | + run: | |
| 75 | + mkdir -p "$RUNNER_TEMP/native-cargo" "$RUNNER_TEMP/native-no-python" |
| 76 | + printf '#!/bin/sh\nexit 99\n' > "$RUNNER_TEMP/native-no-python/python" |
| 77 | + cp "$RUNNER_TEMP/native-no-python/python" "$RUNNER_TEMP/native-no-python/python3" |
| 78 | + chmod +x "$RUNNER_TEMP/native-no-python/"* |
| 79 | + docker run --rm \ |
| 80 | + --volume "$PWD:/source" \ |
| 81 | + --volume "$RUNNER_TEMP/native-cargo:/cargo" \ |
| 82 | + --volume "${CARGO_HOME:-$HOME/.cargo}/registry:/cargo/registry:ro" \ |
| 83 | + --volume "$(rustc --print sysroot):/toolchain:ro" \ |
| 84 | + --volume "$(dirname "$(dirname "$(command -v node)")"):/node:ro" \ |
| 85 | + --volume "$RUNNER_TEMP/native-no-python:/no-python:ro" \ |
| 86 | + --env CARGO_HOME=/cargo \ |
| 87 | + --env CARGO_NET_OFFLINE=true \ |
| 88 | + --env PATH=/no-python:/toolchain/bin:/opt/rh/gcc-toolset-14/root/usr/bin:/usr/local/bin:/usr/bin:/bin \ |
| 89 | + --workdir /source "$NATIVE_IMAGE" /bin/bash -euc ' |
| 90 | + /node/bin/node build.mjs |
| 91 | + /node/bin/node check.mjs |
| 92 | + PATH= /node/bin/node proof.mjs |
| 93 | + ' |
| 94 | + - name: Build and verify macOS with Node.js 22 |
| 95 | + if: matrix.platform == 'darwin' |
| 96 | + run: | |
| 97 | + node build.mjs |
| 98 | + node check.mjs |
| 99 | + native_node="$(command -v node)" |
| 100 | + PATH= "$native_node" proof.mjs |
| 101 | + - name: Set up Node.js 20 |
| 102 | + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 |
| 103 | + with: |
| 104 | + node-version: "20.0.0" |
| 105 | + - name: Verify the same Linux artifact with Node.js 20 |
| 106 | + if: matrix.platform == 'linux' |
| 107 | + run: | |
| 108 | + docker run --rm \ |
| 109 | + --volume "$PWD:/source:ro" \ |
| 110 | + --volume "$(dirname "$(dirname "$(command -v node)")"):/node:ro" \ |
| 111 | + --workdir /source "$NATIVE_IMAGE" /bin/bash -euc ' |
| 112 | + /node/bin/node check.mjs |
| 113 | + PATH= /node/bin/node proof.mjs |
| 114 | + ' |
| 115 | + - name: Verify the same macOS artifact with Node.js 20 |
| 116 | + if: matrix.platform == 'darwin' |
| 117 | + run: | |
| 118 | + node check.mjs |
| 119 | + native_node="$(command -v node)" |
| 120 | + PATH= "$native_node" proof.mjs |
| 121 | + - name: Upload verified native artifact |
| 122 | + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
| 123 | + with: |
| 124 | + name: native-${{ matrix.platform }}-${{ matrix.arch }}-${{ github.sha }} |
| 125 | + path: plugins/codex-security/native/dist/${{ matrix.platform }}-${{ matrix.arch }}/unix.node |
| 126 | + if-no-files-found: error |
| 127 | + retention-days: 7 |
0 commit comments