Repository navigation
Build and test compatible release archives - #733
luisleo526 wants to merge 18 commits into
Conversation
Exercise the shipped artifact workflow and preserve strict rejection of production secrets, token minting and broader runner or permission scopes. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Bind artifact builds to the existing release environment. Admit that metadata only for the exact artifact matrix while retaining production-secret, token minting and OIDC rejection. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Inspect every staged shared library and static archive member with GNU ELF metadata tools. Reject newer glibc versions, incompatible symbol references and incomplete inspection, with real ELF fixture and mutation controls. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Build with a preloaded Debian 12 toolchain selected by a repository variable and pinned by content identity. Export credential-free source and check every staged library before packaging, preserving the ARM and release contracts. Fixes #730 Co-Authored-By: Codex <[email protected]>
Exercise raw script comments, bracket references and trailing workflow inputs without relaxing the artifact environment or token admission rules. Co-Authored-By: Codex <[email protected]>
Preserve script comment content and trailing workflow environment bindings when checking artifact credential scope. Keep unrelated jobs separate and retain exact token admission. Co-Authored-By: Codex <[email protected]>
Require complete findings for token-only jobs and exercise the registered credential-free route with a real classifier mutation. Register the complete GNU ELF artifact suite in Linux preflight and verify collection and assertion failure propagation through the registered stage. Co-Authored-By: Codex <[email protected]>
Replace document-size pins with independent runner and verifier-slice inventories and exercise same-size wrong documentation inputs. Align release runner documentation with the committed workflow's on-demand labels and sizes. Co-Authored-By: Codex <[email protected]>
Check the complete findings for each protected runner mutation and verify the clean baseline and the replacement inside the actual parsed job. Keep credential, matrix and routing refusals bound to the supplied input. Co-Authored-By: Codex <[email protected]>
Require all four real subtest failures, their route identities and the specific diagnostic for dotted and bracket token references. Preserve the real predicate mutation and unchanged positive credential checks. Co-Authored-By: Codex <[email protected]>
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| self.assertTrue({'test_version_policy_mutation_breaks_real_rejection_assertion', | ||
| 'test_isoc23_policy_mutation_breaks_real_rejection_assertion'} <= names) |
| import subprocess | ||
| import sys | ||
| import tempfile | ||
| import unittest |
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 5 advisory finding(s) below merit a look before merge.
Not checked: tests were not run; formal verification proved 0 of 5 changed function(s) (1 sampled, not proven, 4 not verified).
Formal verification. PR-changed functions: 1/5 verified (0 proven, 1 may-equivalent, 0 distinguished) · 4 not verified (4 vacuous).
Not verified on this run: app\_token\_environment\_findings (vacuous: never exercised), check\_commands (vacuous: never exercised), main (vacuous: never exercised), runner\_findings (vacuous: never exercised).
Graphify review — findings
Moves the x86_64 release prebuilt build into a preloaded, digest-pinned Bookworm container driven by scripts/build_prebuilt_bookworm.sh, with no registry pull, package install or host-compiler fallback, while the hosted arm64 cell keeps its apt Eigen and CMake steps. Adds a glibc-floor check over every staged .a/.so in both dry-run and publish, with raw checker output and exit status preserved. Also gates prebuilt behind the release environment, stops persisting checkout credentials, and moves release and notify-hub to on-demand gkp-od runners. With Configure now skipped on x86_64, STAGE_DIR and the image identity check in run_tool carry the new transport, and numeric_version decides how the glibc checker handles malformed tags.
Worth a look
- nonnumeric GLIBC tags raise NameError instead of returning None —
scripts/check_prebuilt_glibc.py:261· Escalate · high- NOT verified (no proof, no reproducing execution) — needs human review
- Compares Docker image ID to pinned manifest digest —
scripts/build_prebuilt_bookworm.sh· Escalate · high- NOT verified (no proof, no reproducing execution) — needs human review
- STAGE_DIR may be unset on x86_64 now that Configure is skipped —
.github/workflows/release.yml:491· Escalate · medium- NOT verified (no proof, no reproducing execution) — needs human review
- Read-only builder container has no writable /tmp —
scripts/build_prebuilt_bookworm.sh· Escalate · medium- NOT verified (no proof, no reproducing execution) — needs human review
- Release CI docs still claim x86_64 installs and validates Eigen on the runner —
docs/ci.md:1691· Escalate · medium- NOT verified (no proof, no reproducing execution) — needs human review
Review partial — this diff was larger than one review pass covers, so later files were not reviewed; some findings may be missing.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 1519 functions depend on the 1498 functions this change touches.
Health — this change adds coupling hotspots:
- worse:
ci_workflow_findings()— 81 callers, 24 callees - worse:
check_commands()— 22 callers, 5 callees - worse:
_job_values()— 30 callers, 3 callees - worse:
_job_block()— 18 callers, 3 callees - worse:
runner_findings()— 2 callers, 25 callees - new:
release_prebuilt_workflow_findings()— 5 callers, 5 callees - worse:
_unparsed()— 6 callers, 4 callees - worse:
_holds_credentials()— 3 callers, 6 callees - …and 6 more — each is listed as a finding
Verification — 1519 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 1519 function(s) in the blast radius were not formally verified this run
Docs that may be stale (advisory)
AGENTS.md§ REQUIRED before claiming any change is done (lines 5-45): references changed symbolssourceAGENTS.md§ SOP: adding a runtime PF_API export (CI gate — recurring failure) (lines 73-97): references changed symbolssourceAGENTS.md§ Refactor workers (native-engine programme, R4 and later) (lines 105-141): references changed symbolsgit,sourceCHANGELOG.md§ Unreleased (lines 8-135): references changed symbolscopyCHANGELOG.md§ 1.9.1 — 2026-10-31 (lines 136-258): references changed symbolsempty,sourceCHANGELOG.md§ Breaking for hosts (lines 803-842): references changed symbolscommandCHANGELOG.md§ State hashes (lines 1234-1299): references changed symbolsentry,sourceCHANGELOG.md§ 1.6.0 — 2026-10-17 (lines 1781-1946): references changed symbolsentryCHANGELOG.md§ Symbol-feed ownership (lines 2212-2236): references changed symbolssourceCHANGELOG.md§ Pine adapter corrections that can change trades ([#350], [#352]) (lines 2237-2295): references changed symbolsentry
…and 10 more.
Formal verification
No difference found (not proven): No behavior difference found in \_holds\_credentials (not a proof).
The verifier ran both versions of \_holds\_credentials on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.
Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.
Note: An input the sampler did not try could still differ.
Could not verify: Could not verify app\_token\_environment\_findings.
The verifier did not have enough to check app\_token\_environment\_findings, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: non-vacuity: domain too small (only 2 distinct inputs exercised, need 3) — 'no divergence' would be near-vacuous
Could not verify: Could not verify check\_commands.
The verifier did not have enough to check check\_commands, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: not verifiable: all 90 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly NameError — names the real obstacle, not a sampling gap)
Could not verify: Could not verify main.
The verifier did not have enough to check main, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: not verifiable: all 1 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly NameError — names the real obstacle, not a sampling gap)
Could not verify: Could not verify runner\_findings.
The verifier did not have enough to check runner\_findings, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: non-vacuity: domain too small (only 2 distinct inputs exercised, need 3) — 'no divergence' would be near-vacuous
· 7 grounded finding(s) anchored inline below; 7 more finding(s) on lines outside this diff (see the check run).
| @@ -0,0 +1,321 @@ | |||
| #!/usr/bin/env bash | |||
There was a problem hiding this comment.
build_prebuilt_bookworm.sh script
fans out to 6 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| raise | ||
|
|
||
|
|
||
| def discover(root: Path, root_fd: int, issues: list[dict]) -> tuple[list[dict], dict]: |
There was a problem hiding this comment.
discover()
fans out to 8 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| **context, reference=reference) | ||
|
|
||
|
|
||
| def inspect_target(root_fd: int, target: dict, directories: dict, |
There was a problem hiding this comment.
inspect_target()
fans out to 12 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| return row | ||
|
|
||
|
|
||
| def main(argv: list[str] | None = None) -> int: |
There was a problem hiding this comment.
main()
fans out to 8 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
|
|
||
|
|
||
| def _holds_credentials(workflow: str, body: str, *, effective_permissions: bool = False) -> bool: | ||
| def _holds_credentials(workflow: str, body: str, *, effective_permissions: bool = False, |
There was a problem hiding this comment.
_holds_credentials()
fans out to 6 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| return False | ||
|
|
||
|
|
||
| def _prebuilt_environment_admitted(name: str, job: str, workflow: str, body: str, |
There was a problem hiding this comment.
_prebuilt_environment_admitted()
fans out to 6 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| return [] | ||
|
|
||
|
|
||
| def release_prebuilt_workflow_findings(workflow: str) -> list[str]: |
There was a problem hiding this comment.
release_prebuilt_workflow_findings()
high coupling complexity (Ca·Ce = 25).
Grounded coupling-delta finding (deterministic), not an LLM guess.
|
Review of 85c9802 against main fc58eec (9 files, +3307/-121). The x86 build, the glibc scan and the upload path are correct. Four small changes are needed before merge. What holds
Needed before merge
Status note. On this head the main-tree admission rules refuse the new release job ("must keep production credentials on a hosted standard runner", "must install Eigen and assert exactly 3.4.0"), so preflight and the proof legs were skipped. That is expected for a change to those rules, but no CI result exists yet for this head. The release CI build and scan of the new archive remain the evidence. Follow-ups (not blocking)
Nothing was executed for this review. |
| import sys | ||
| import tarfile | ||
| import tempfile | ||
| import unittest |
|
Delta review of d9fd57a: f637684 on 85c9802, plus a merge of main 4c9e763 that brings only main's three-file sanitizer-shard change. Content: all four requested changes are in, plus the runner and Eigen changes. No faked pass found. Merge: NOT YET. The admission job refuses this head, so preflight and the proof legs have not run on it. What the delta does
Why admission still refuses
Before the first real release
No build or test was run for this review. |
Remove the deployment environment from the prebuilt matrix and retain artifact upload through the existing workflow token. Treat deployment environments as credentials, preserve raw secret checks, and enforce the artifact job's release dependency and token permissions. Keep packed-archive runtime checks ahead of release upload.
|
Delta review of 669de8d over feb9fa3 (one commit, b97140d, then main 09756a9 merged last, which brings only docs), read against main 09756a9; the whole PR is 10 files, +3997/-100. NOT YET: the required Blocking
Not blocking, but settle before merge
Smaller points (P3)
Checks on this head Passing: What holds
|
Preserve main's credential handling for every other workflow job. Update the deployment-environment inventory and reusable isolated-tree helper fixtures. Validate the delegated packed-archive consumer against its reviewed source identity, with genuine, missing and changed-source fixture controls.
|
Delta review of 74d0476 over 669de8d: two new commits, dcbffbe ("Scope archive credential checks to prebuilt and pin its consumer") and then main ace3079 merged last, which adds only Blocking
What was fixed (by reading)
Carried over (P3, unchanged, not blockers)
Public text. The added lines and the commit message contain no internal names. |
|
Superseded by #736, which carries the identical file tree as one commit whose message names every documentation sentence this change edits. The branch of this pull request is kept. |
Build and check Linux release archives with a digest-pinned Bookworm toolchain. Before upload, verify and unpack the packed archive, then link and run the native kernel host against its full shipped library.
Apply strict secret-expression checks only to prebuilt; retain main's credential behavior for every other job. Keep prebuilt token-only with its existing matrix and runner pins, and pin the delegated archive-consumer source. Correct the environment inventory and isolated workflow fixtures.
Validation on this head: whole preflight504tests and whole release-gate289tests passed across eight shards each. Updated-head required CI, final review and the first real archive-consumer dry run remain pending.
🤖 Generated with Claude Code