Repository navigation
v3 installed package validation #48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: v3 native missing receipts (diagnostic branch only) | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| approved_sha: | |
| description: Exact diagnostic source commit after full readiness validation | |
| required: true | |
| type: string | |
| permissions: | |
| contents: read | |
| jobs: | |
| windows: | |
| runs-on: windows-2022 | |
| timeout-minutes: 90 | |
| defaults: | |
| run: | |
| shell: msys2 {0} | |
| steps: | |
| - name: Keep selected Git source bytes unchanged | |
| shell: pwsh | |
| run: git config --global core.autocrlf false | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| with: | |
| fetch-depth: 0 | |
| - name: Verify the caller-approved diagnostic source and first attempt | |
| shell: pwsh | |
| env: | |
| APPROVED_SHA: ${{ inputs.approved_sha }} | |
| run: | | |
| if ($env:GITHUB_SHA -ne $env:APPROVED_SHA -or $env:GITHUB_RUN_ATTEMPT -ne '1' -or $env:GITHUB_REF -ne 'refs/heads/task/FEATURE-ci-native-missing-receipts') { | |
| throw 'Only the approved diagnostic branch commit and first workflow attempt are authorized' | |
| } | |
| - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c | |
| with: | |
| msystem: MINGW64 | |
| path-type: inherit | |
| update: true | |
| install: >- | |
| autotools base-devel perl git | |
| mingw-w64-x86_64-clang mingw-w64-x86_64-gcc mingw-w64-x86_64-binutils | |
| mingw-w64-x86_64-python mingw-w64-x86_64-pkgconf mingw-w64-x86_64-libtool mingw-w64-x86_64-curl mingw-w64-x86_64-libsystre | |
| - name: Selected MSYS2 toolchain provenance | |
| run: | | |
| mkdir -p "$RUNNER_TEMP/package-evidence" | |
| pacman -Q > "$RUNNER_TEMP/package-evidence/msys2-packages.txt" | |
| export PATH="/c/Program Files/Git/cmd:$PATH" | |
| /mingw64/bin/python -c 'import subprocess; subprocess.run(["git", "--version"], check=True)' | |
| - name: Bootstrap | |
| run: ./bootstrap | |
| - name: Build only selected TLS-off shared programs and run each once | |
| env: | |
| CI_DIAGNOSTIC_APPROVED_SHA: ${{ inputs.approved_sha }} | |
| run: | | |
| export PATH="/c/Program Files/Git/cmd:$PATH" | |
| /mingw64/bin/python scripts/ci_native_missing_receipts.py \ | |
| --output "$(cygpath -m "$RUNNER_TEMP/package-evidence/native")" \ | |
| --toolchain-prefix "$(cygpath -m /mingw64)" --compiler clang++ --cc clang | |
| - if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 | |
| with: | |
| name: missing-native-windows-${{ github.sha }} | |
| path: | | |
| ${{ runner.temp }}/package-evidence/**/*.json | |
| ${{ runner.temp }}/package-evidence/**/*.log | |
| ${{ runner.temp }}/package-evidence/**/*.bin | |
| ${{ runner.temp }}/package-evidence/**/*.diff | |
| ${{ runner.temp }}/package-evidence/native/setup/* | |
| ${{ runner.temp }}/package-evidence/msys2-packages.txt | |
| retention-days: 14 | |
| if-no-files-found: error | |
| darwin: | |
| runs-on: macos-15 | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| with: | |
| fetch-depth: 0 | |
| - name: Verify the caller-approved diagnostic source and first attempt | |
| env: | |
| APPROVED_SHA: ${{ inputs.approved_sha }} | |
| run: | | |
| test "$GITHUB_SHA" = "$APPROVED_SHA" | |
| test "$GITHUB_RUN_ATTEMPT" = 1 | |
| test "$GITHUB_REF" = refs/heads/task/FEATURE-ci-native-missing-receipts | |
| - name: Prerequisites | |
| run: brew install autoconf automake libtool pkg-config python curl llvm make | |
| - name: Select complete C++20 compiler and runtime | |
| run: bash scripts/ci-macos-toolchain.sh | |
| - name: Build selected prerequisites | |
| run: python3 scripts/prepare-v3-package-ci.py --output "$RUNNER_TEMP/package-evidence/prerequisites" | |
| - name: Bootstrap | |
| run: ./bootstrap | |
| - name: Select original execution privilege, build two TLS programs and run each once | |
| env: | |
| CI_DIAGNOSTIC_APPROVED_SHA: ${{ inputs.approved_sha }} | |
| run: | | |
| mkdir -p "$RUNNER_TEMP/package-evidence" | |
| prefix=() | |
| if ! python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1",443)); s.close()'; then | |
| prefix=(sudo env "PATH=$PATH" GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory "GIT_CONFIG_VALUE_0=$PWD" "CI_DIAGNOSTIC_APPROVED_SHA=$CI_DIAGNOSTIC_APPROVED_SHA" "GITHUB_ACTIONS=$GITHUB_ACTIONS" "GITHUB_RUN_ATTEMPT=$GITHUB_RUN_ATTEMPT" "GITHUB_REF=$GITHUB_REF") | |
| fi | |
| printf 'Privilege selection: %s\n' "${prefix[*]:-current-user}" > "$RUNNER_TEMP/package-evidence/execution-setup.txt" | |
| "${prefix[@]}" python3 scripts/ci_native_missing_receipts.py \ | |
| --output "$RUNNER_TEMP/package-evidence/native" \ | |
| --provider-prefix "$RUNNER_TEMP/package-evidence/prerequisites/provider" \ | |
| --toolchain-prefix "$V3_PACKAGE_TOOLCHAIN" --compiler "$V3_CXX" --cc "$V3_CC" \ | |
| --pkg-config-dir "$(brew --prefix)/share/pkgconfig" --make gmake | |
| - name: Make privileged proof readable by artifact upload | |
| if: always() | |
| run: | | |
| if [ -d "$RUNNER_TEMP/package-evidence" ]; then | |
| sudo chown -R "$(id -u):$(id -g)" "$RUNNER_TEMP/package-evidence" | |
| fi | |
| - if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 | |
| with: | |
| name: missing-native-darwin-${{ github.sha }} | |
| path: | | |
| ${{ runner.temp }}/package-evidence/**/*.json | |
| ${{ runner.temp }}/package-evidence/**/*.log | |
| ${{ runner.temp }}/package-evidence/**/*.bin | |
| ${{ runner.temp }}/package-evidence/**/*.diff | |
| ${{ runner.temp }}/package-evidence/native/setup/* | |
| ${{ runner.temp }}/package-evidence/execution-setup.txt | |
| ${{ runner.temp }}/v3-toolchain | |
| retention-days: 14 | |
| if-no-files-found: error |