Skip to content

Commit cf63fe6

Browse files
ngallodevngallodev
authored
Merge pull request #32 from ngallodev/rescue/upstream-remainder-with-main-20261104
sync: reconcile upstream checkpoints through 13L
2 parents 1b16c71 + 2f5fb5e commit cf63fe6

291 files changed

Lines changed: 43861 additions & 8224 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/codeql/codeql-config.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# CodeQL scope: the repository's first-party source.
2+
#
3+
# Read by .github/workflows/codeql.yml (every scan, full and PR) and by
4+
# scripts/ci/select-lanes.sh (which changed paths select which language's PR
5+
# scan). Keep the lists plain: one path prefix per line, no globs.
6+
#
7+
# paths / paths-ignore narrow what the INTERPRETED languages extract
8+
# (javascript-typescript, python, actions). For c-cpp they have no effect:
9+
# CodeQL extracts exactly what the traced build compiles. A PR's c-cpp scan
10+
# keeps vendored C out by compiling it before tracing starts (except vendored
11+
# files the PR changes); the full scan on main, the dry run and the release
12+
# traces everything, vendored C included.
13+
name: cbm first-party source
14+
paths:
15+
- src
16+
- internal
17+
- graph-ui
18+
- pkg
19+
- scripts
20+
- tests
21+
- .github
22+
paths-ignore:
23+
- internal/cbm/vendored
24+
- graph-ui/vendor
25+
- graph-ui/fixtures
26+
- graph-ui/verification
27+
- tests/fixtures

‎.github/dependabot.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,9 @@ updates:
44
directory: "/"
55
schedule:
66
interval: "weekly"
7+
groups:
8+
# init and analyze must run the same CodeQL Action version within a job, and
9+
# upload-sarif is kept in step with them, so one PR bumps all three.
10+
codeql-action:
11+
patterns:
12+
- "github/codeql-action*"

‎.github/workflows/_build.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
fail-fast: false
3636
# platforms=linux drops the darwin legs; the default keeps all four.
3737
matrix:
38-
include: ${{ fromJSON(inputs.platforms == 'linux' && '[{"os":"ubuntu-latest","goos":"linux","goarch":"amd64","cc":"gcc","cxx":"g++"},{"os":"ubuntu-24.04-arm","goos":"linux","goarch":"arm64","cc":"gcc","cxx":"g++"}]' || '[{"os":"ubuntu-latest","goos":"linux","goarch":"amd64","cc":"gcc","cxx":"g++"},{"os":"ubuntu-24.04-arm","goos":"linux","goarch":"arm64","cc":"gcc","cxx":"g++"},{"os":"macos-14","goos":"darwin","goarch":"arm64","cc":"cc","cxx":"c++"},{"os":"macos-15-intel","goos":"darwin","goarch":"amd64","cc":"cc","cxx":"c++"}]') }}
38+
include: ${{ fromJSON(inputs.platforms == 'linux' && '[{"os":"ubuntu-latest","goos":"linux","goarch":"amd64","cc":"gcc","cxx":"g++"},{"os":"ubuntu-24.04-arm","goos":"linux","goarch":"arm64","cc":"gcc","cxx":"g++"}]' || '[{"os":"ubuntu-latest","goos":"linux","goarch":"amd64","cc":"gcc","cxx":"g++"},{"os":"ubuntu-24.04-arm","goos":"linux","goarch":"arm64","cc":"gcc","cxx":"g++"},{"os":"macos-15","goos":"darwin","goarch":"arm64","cc":"cc","cxx":"c++"},{"os":"macos-15-intel","goos":"darwin","goarch":"amd64","cc":"cc","cxx":"c++"}]') }}
3939
runs-on: ${{ matrix.os }}
4040
# Every leg is BLOCKING — no continue-on-error. The darwin-amd64 binary
4141
# built on macos-15-intel must ship with every release; if that runner is
@@ -49,7 +49,8 @@ jobs:
4949

5050
- name: Install deps (Ubuntu)
5151
if: startsWith(matrix.os, 'ubuntu')
52-
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
52+
timeout-minutes: 10
53+
run: APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update && sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y zlib1g-dev
5354

5455
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
5556
with:
@@ -103,7 +104,7 @@ jobs:
103104
steps:
104105
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
105106

106-
- uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
107+
- uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2
107108
with:
108109
msystem: CLANG64
109110
path-type: inherit
@@ -166,7 +167,7 @@ jobs:
166167
steps:
167168
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
168169

169-
- uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
170+
- uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2
170171
with:
171172
msystem: CLANGARM64
172173
path-type: inherit
@@ -235,7 +236,8 @@ jobs:
235236
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
236237

237238
- name: Install deps
238-
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
239+
timeout-minutes: 10
240+
run: APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update && sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y zlib1g-dev
239241

240242
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
241243
with:

‎.github/workflows/_lint.yml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Reusable: lint only (cppcheck + clang-format).
2-
# Security-static and CodeQL gate are separate — see _security.yml.
2+
# Security-static is separate — see _security.yml; CodeQL — see codeql.yml.
33
name: Lint & Security
44

55
on:
@@ -37,14 +37,16 @@ jobs:
3737
run: bash scripts/check-no-test-skips.sh
3838

3939
- name: Install build deps
40-
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev cmake
40+
timeout-minutes: 10
41+
run: APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update && sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y zlib1g-dev cmake
4142

4243
- name: Install LLVM 20
44+
timeout-minutes: 10
4345
run: |
4446
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
4547
echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main" | sudo tee /etc/apt/sources.list.d/llvm-20.list
46-
sudo apt-get update
47-
sudo apt-get install -y clang-format-20
48+
APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update
49+
sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y clang-format-20
4850
4951
- uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
5052
id: cppcheck-cache
@@ -81,14 +83,16 @@ jobs:
8183
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
8284

8385
- name: Install build deps
84-
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
86+
timeout-minutes: 10
87+
run: APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update && sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y zlib1g-dev
8588

8689
- name: Install LLVM 21 (pinned analyzer toolchain)
90+
timeout-minutes: 10
8791
run: |
8892
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
8993
echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main" | sudo tee /etc/apt/sources.list.d/llvm-21.list
90-
sudo apt-get update
91-
sudo apt-get install -y clang-tidy-21
94+
APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update
95+
sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y clang-tidy-21
9296
9397
- name: Memory-analyzer gate
9498
run: scripts/ci/lint-mem.sh clang-tidy-21

‎.github/workflows/_memwaste.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@ jobs:
3737
steps:
3838
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3939
- name: Install deps
40-
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev python3 clang llvm
40+
timeout-minutes: 10
41+
run: APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update && sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y zlib1g-dev python3 clang llvm
4142
- name: Event lane on this repository
4243
run: |
4344
# `cmd | tee` reports TEE's status: without this a failing lane
@@ -66,7 +67,8 @@ jobs:
6667
steps:
6768
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
6869
- name: Install deps
69-
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev python3 clang llvm
70+
timeout-minutes: 10
71+
run: APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update && sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y zlib1g-dev python3 clang llvm
7072
- name: CPU scaling lane (src/ at 2x against 4x)
7173
# Report-only: the script exits 1 when it flags a super-linear function.
7274
continue-on-error: true
@@ -93,7 +95,8 @@ jobs:
9395
steps:
9496
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
9597
- name: Install deps
96-
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev python3 clang llvm
98+
timeout-minutes: 10
99+
run: APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update && sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y zlib1g-dev python3 clang llvm
97100
- name: Access lane on this repository
98101
run: |
99102
# `cmd | tee` reports TEE's status: without this a failing lane
@@ -115,7 +118,7 @@ jobs:
115118

116119
event-macos:
117120
if: ${{ inputs.mode == 'full' }}
118-
runs-on: macos-14
121+
runs-on: macos-15
119122
timeout-minutes: 60
120123
steps:
121124
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -146,7 +149,7 @@ jobs:
146149
timeout-minutes: 90
147150
steps:
148151
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
149-
- uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
152+
- uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2
150153
with:
151154
msystem: CLANG64
152155
path-type: inherit

‎.github/workflows/_smoke.yml‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ jobs:
3838
CORE_UNIX='[
3939
{"os":"ubuntu-latest","goos":"linux","goarch":"amd64"},
4040
{"os":"ubuntu-24.04-arm","goos":"linux","goarch":"arm64"},
41-
{"os":"macos-14","goos":"darwin","goarch":"arm64"},
41+
{"os":"macos-15","goos":"darwin","goarch":"arm64"},
4242
{"os":"macos-15-intel","goos":"darwin","goarch":"amd64"}
4343
]'
4444
# Broad legs reuse existing goos/goarch artifacts on additional OS
@@ -52,9 +52,10 @@ jobs:
5252
# (ubuntu-22.04 / 22.04-arm). So the dynamic broad legs stay on
5353
# forward-compatible OSes only (macOS); running the dynamic binary on
5454
# ubuntu-22.04 would fail Phase 1 (glibc too old), not a real regression.
55-
BROAD_UNIX='[
56-
{"os":"macos-15","goos":"darwin","goarch":"arm64"}
57-
]'
55+
# Empty since the move off macos-14 (retired 2026-11-02): the darwin-arm64
56+
# artifact is now built AND smoked on macos-15, the core leg, which was
57+
# this broad leg.
58+
BROAD_UNIX='[]'
5859
CORE_WIN='[{"os":"windows-latest","arch":"amd64"}]'
5960
# windows-11-arm now runs the NATIVE arm64 binary (build-windows-arm64),
6061
# not the x86_64 binary under emulation — we smoke the artifact we ship.
@@ -150,8 +151,9 @@ jobs:
150151
151152
- name: ClamAV scan (Linux)
152153
if: startsWith(matrix.os, 'ubuntu')
154+
timeout-minutes: 10
153155
run: |
154-
sudo apt-get update -qq && sudo apt-get install -y -qq clamav > /dev/null 2>&1
156+
APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update -qq && sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y -qq clamav > /dev/null 2>&1
155157
# apt auto-starts the clamav-freshclam daemon, which holds a lock on
156158
# freshclam's log/db; stop it so the manual freshclam below can run
157159
# (else: "Failed to lock the log file ... Resource temporarily unavailable").
@@ -191,7 +193,14 @@ jobs:
191193
steps:
192194
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
193195

194-
- uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
196+
# SMOKE_REQUIRE_WRAPPERS=1 needs a Go toolchain for the Go wrapper; the
197+
# MSYS2 shell below inherits it (path-type: inherit).
198+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
199+
with:
200+
go-version-file: pkg/go/go.mod
201+
cache: false
202+
203+
- uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2
195204
with:
196205
msystem: ${{ matrix.arch == 'arm64' && 'CLANGARM64' || 'CLANG64' }}
197206
path-type: inherit

‎.github/workflows/_soak.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,8 @@ jobs:
6565
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
6666
- name: Install deps (Linux)
6767
if: startsWith(matrix.os, 'ubuntu')
68-
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev python3 git
68+
timeout-minutes: 10
69+
run: APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update && sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y zlib1g-dev python3 git
6970
- name: Build
7071
if: ${{ !inputs.use_release_artifacts }}
7172
run: scripts/build.sh ${{ inputs.version && format('--version {0}', inputs.version) || '' }} CC=${{ matrix.cc }} CXX=${{ matrix.cxx }}
@@ -118,7 +119,7 @@ jobs:
118119
steps:
119120
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
120121

121-
- uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
122+
- uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2
122123
with:
123124
msystem: CLANG64
124125
path-type: inherit
@@ -197,7 +198,7 @@ jobs:
197198
steps:
198199
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
199200

200-
- uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
201+
- uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2
201202
with:
202203
msystem: CLANGARM64
203204
path-type: inherit
@@ -284,7 +285,8 @@ jobs:
284285
steps:
285286
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
286287
- name: Install soak dependencies
287-
run: sudo apt-get update && sudo apt-get install -y python3 git
288+
timeout-minutes: 10
289+
run: APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update && sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y python3 git
288290
- name: Download selected portable release container
289291
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
290292
with:
@@ -337,7 +339,8 @@ jobs:
337339
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
338340
- name: Install deps (Linux)
339341
if: startsWith(matrix.os, 'ubuntu')
340-
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev python3 git
342+
timeout-minutes: 10
343+
run: APT_RETRIES=3; [ -f /etc/apt/apt-mirrors.txt ] && APT_RETRIES=0; sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 --error-on=any update && sudo apt-get -o Acquire::Retries=$APT_RETRIES -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 install -y zlib1g-dev python3 git
341344
- name: Build (ASan)
342345
run: |
343346
SANITIZE="-fsanitize=address,undefined -fno-omit-frame-pointer"
@@ -367,7 +370,7 @@ jobs:
367370
steps:
368371
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
369372

370-
- uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
373+
- uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2
371374
with:
372375
msystem: CLANG64
373376
path-type: inherit

0 commit comments

Comments
 (0)