Repository navigation
v3 installed package validation #51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: v3 remaining native captures (diagnostic branch only) | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| approved_sha: | |
| description: Exact diagnostic source commit after full readiness validation | |
| required: true | |
| type: string | |
| permissions: | |
| contents: read | |
| jobs: | |
| windows: | |
| runs-on: windows-2022 | |
| timeout-minutes: 90 | |
| defaults: | |
| run: | |
| shell: msys2 {0} | |
| steps: | |
| - name: Keep selected Git source bytes unchanged | |
| shell: pwsh | |
| run: git config --global core.autocrlf false | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| with: | |
| fetch-depth: 0 | |
| - name: Verify the caller-approved diagnostic source and first attempt | |
| shell: pwsh | |
| env: | |
| APPROVED_SHA: ${{ inputs.approved_sha }} | |
| run: | | |
| if ($env:GITHUB_SHA -ne $env:APPROVED_SHA -or $env:GITHUB_RUN_ATTEMPT -ne '1' -or $env:GITHUB_REF -ne 'refs/heads/task/FEATURE-ci-remaining-native-captures') { | |
| throw 'Only the approved diagnostic branch commit and first workflow attempt are authorized' | |
| } | |
| - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c | |
| with: | |
| msystem: MINGW64 | |
| path-type: inherit | |
| update: true | |
| install: >- | |
| autotools base-devel perl git | |
| mingw-w64-x86_64-clang mingw-w64-x86_64-gcc mingw-w64-x86_64-binutils | |
| mingw-w64-x86_64-python mingw-w64-x86_64-pkgconf mingw-w64-x86_64-libtool mingw-w64-x86_64-curl mingw-w64-x86_64-libsystre | |
| - name: Selected MSYS2 toolchain provenance | |
| run: | | |
| mkdir -p "$RUNNER_TEMP/package-evidence" | |
| pacman -Q > "$RUNNER_TEMP/package-evidence/msys2-packages.txt" | |
| export PATH="/c/Program Files/Git/cmd:$PATH" | |
| /mingw64/bin/python -c 'import subprocess; subprocess.run(["git", "--version"], check=True)' | |
| - name: Bootstrap | |
| run: ./bootstrap | |
| - name: Build selected TLS-off programs and run bounded categories | |
| env: | |
| CI_DIAGNOSTIC_APPROVED_SHA: ${{ inputs.approved_sha }} | |
| run: | | |
| export PATH="/c/Program Files/Git/cmd:$PATH" | |
| /mingw64/bin/python scripts/ci_remaining_native_captures.py \ | |
| --output "$(cygpath -m "$RUNNER_TEMP/package-evidence/native")" \ | |
| --toolchain-prefix "$(cygpath -m /mingw64)" --compiler clang++ --cc clang | |
| - if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 | |
| with: | |
| name: remaining-native-windows-${{ github.sha }} | |
| path: | | |
| ${{ runner.temp }}/package-evidence/**/*.json | |
| ${{ runner.temp }}/package-evidence/**/*.log | |
| ${{ runner.temp }}/package-evidence/**/*.bin | |
| ${{ runner.temp }}/package-evidence/**/*.diff | |
| ${{ runner.temp }}/package-evidence/**/*.dmp | |
| ${{ runner.temp }}/package-evidence/**/modules/* | |
| ${{ runner.temp }}/package-evidence/native/setup/* | |
| ${{ runner.temp }}/package-evidence/msys2-packages.txt | |
| retention-days: 14 | |
| if-no-files-found: error | |
| darwin: | |
| runs-on: macos-15 | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| with: | |
| fetch-depth: 0 | |
| - name: Verify the caller-approved diagnostic source and first attempt | |
| env: | |
| APPROVED_SHA: ${{ inputs.approved_sha }} | |
| run: | | |
| test "$GITHUB_SHA" = "$APPROVED_SHA" | |
| test "$GITHUB_RUN_ATTEMPT" = 1 | |
| test "$GITHUB_REF" = refs/heads/task/FEATURE-ci-remaining-native-captures | |
| - name: Prerequisites | |
| run: brew install autoconf automake libtool pkg-config python curl llvm make | |
| - name: Select complete C++20 compiler and runtime | |
| run: bash scripts/ci-macos-toolchain.sh | |
| - name: Build selected prerequisites | |
| run: python3 scripts/prepare-v3-package-ci.py --output "$RUNNER_TEMP/package-evidence/prerequisites" | |
| - name: Bootstrap | |
| run: ./bootstrap | |
| - name: Build PSK and TLS-off static external-H1; run each once | |
| env: | |
| CI_DIAGNOSTIC_APPROVED_SHA: ${{ inputs.approved_sha }} | |
| run: | | |
| mkdir -p "$RUNNER_TEMP/package-evidence" | |
| python3 scripts/ci_remaining_native_captures.py \ | |
| --output "$RUNNER_TEMP/package-evidence/native" \ | |
| --provider-prefix "$RUNNER_TEMP/package-evidence/prerequisites/provider" \ | |
| --toolchain-prefix "$V3_PACKAGE_TOOLCHAIN" --compiler "$V3_CXX" --cc "$V3_CC" \ | |
| --pkg-config-dir "$(brew --prefix)/share/pkgconfig" --make gmake | |
| - if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 | |
| with: | |
| name: remaining-native-darwin-${{ github.sha }} | |
| path: | | |
| ${{ runner.temp }}/package-evidence/**/*.json | |
| ${{ runner.temp }}/package-evidence/**/*.log | |
| ${{ runner.temp }}/package-evidence/**/*.bin | |
| ${{ runner.temp }}/package-evidence/**/*.diff | |
| ${{ runner.temp }}/package-evidence/**/*.dmp | |
| ${{ runner.temp }}/package-evidence/**/modules/* | |
| ${{ runner.temp }}/package-evidence/native/setup/* | |
| ${{ runner.temp }}/v3-toolchain | |
| retention-days: 14 | |
| if-no-files-found: error | |
| linux: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| with: | |
| fetch-depth: 0 | |
| - name: Verify the caller-approved diagnostic source and first attempt | |
| env: | |
| APPROVED_SHA: ${{ inputs.approved_sha }} | |
| run: | | |
| test "$GITHUB_SHA" = "$APPROVED_SHA" | |
| test "$GITHUB_RUN_ATTEMPT" = 1 | |
| test "$GITHUB_REF" = refs/heads/task/FEATURE-ci-remaining-native-captures | |
| - name: Prerequisites | |
| run: sudo apt-get update && sudo apt-get install -y autoconf automake libtool pkg-config clang python3 | |
| - name: Bootstrap | |
| run: ./bootstrap | |
| - name: Build TLS-off fixture and run only the first six wire checks with cleanup | |
| env: | |
| CI_DIAGNOSTIC_APPROVED_SHA: ${{ inputs.approved_sha }} | |
| run: | | |
| python3 scripts/ci_remaining_native_captures.py \ | |
| --output "$RUNNER_TEMP/package-evidence/native" --compiler clang++ --cc clang | |
| - if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 | |
| with: | |
| name: remaining-native-linux-${{ github.sha }} | |
| path: | | |
| ${{ runner.temp }}/package-evidence/**/*.json | |
| ${{ runner.temp }}/package-evidence/**/*.log | |
| ${{ runner.temp }}/package-evidence/**/*.bin | |
| ${{ runner.temp }}/package-evidence/**/*.diff | |
| ${{ runner.temp }}/package-evidence/native/setup/* | |
| retention-days: 14 | |
| if-no-files-found: error |