mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-15 13:56:34 +08:00
Martin Vogel
f9dc6503ae
Three changes to how PR CI consumes the test-impact selection (user decisions R150 and R151, 2026-11-11). Fork PRs. select-tests ran only when vars.TEST_IMPACT_MODE was `gate`, and GitHub passes no repository variables to a pull_request run from a fork: all 24 fork runs in the last 40 PR runs skipped the job, maintainer-started ones included. The condition is now (vars.TEST_IMPACT_MODE || 'gate') == 'gate'. Setting the variable to anything else (e.g. `shadow`) still turns the gate off for same-repository and Dependabot PRs; for fork PRs the off switch is the default in the expression on main. No pull_request_target, no new permissions, no secrets. Base tooling. select-tests built and ran the PR checkout's own engine, test-impact-select.sh and selection.py, so a change to them could narrow its own tests. The job now checks out the merge base (HEAD^1 of the merge ref) into a worktree, builds that engine and runs that copy of the script with --repo pointing at the PR checkout. test-impact-select.sh separates the tooling (its own checkout) from the repository under test (--repo). Until this lands, a PR's merge base has no --repo: the job then fails and, as before, every test runs. All legs. Only the Linux x86_64 test leg consumed a selection. A narrowed answer now also produces portable/ (selection.py --whole-suites with the platform-specific suites of the base and HEAD), and the arm64 and macOS test-unix legs and the Windows leg run that view: platform-neutral suites as selected, every platform-specific suite whole. No portable view, no narrowing there. Sanitizer, TSan, MSan, diag and LSan lanes still run every test. The shard harness already slices the selected list, so the sharded arm64 leg and the shard-completeness proof need no change. docs/SMART_CI.md and README.md follow; tests/test_lane_wiring_contract.sh pins the new wiring. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
scripts/ci/ — venue plumbing (single implementations)
Support scripts that keep the venues in the SAME shape. Each exists because
the logic used to live inline in workflow YAML or was hand-duplicated between
CI and the local infrastructure — both of which the venue-parity contract
(tests/test_venue_parity_contract.sh) now forbids. Everything here answers
--help (PowerShell: comment-based help, Get-Help <script>).
| script | job | called by |
|---|---|---|
new-protected-temp-root.ps1 |
Create the owner-stamped, inheritance-protected per-user TEMP root the daemon/install suites require (shared /tmp and default runner TEMP grant Authenticated-Users mutation rights, which the trust policy correctly refuses — running there produces security refusals, not signal). -ProtectDir stamps build dirs the same way. |
_test.yml, _soak.yml, vm-run-tests.sh |
clean-test-residue.ps1 |
Sweep cbm-* residue from the Windows VM and assert runner-like free disk (default 14 GB — the GitHub runner's SSD). Long-path \\?\ fallback for the guard suites' adversarial trees; every removal VERIFIED (an earlier version counted attempts and reported 86 swept while 11 GB remained). BLOCKS below the floor: a disk that fills mid-run reads as a product bug. |
win.sh before every build/run |
preflight-docker.sh |
Same idea for Colima/docker: prune runner-unlike residue, assert free space on the filesystem backing the docker data root (not the VM's /). Build cache + named volumes KEPT (the local analogue of actions/cache); --deep drops them. |
test-infrastructure/run.sh |
check-glibc-compat.sh |
Run a linux binary in debian:bullseye (glibc 2.31) — the portable binary must start on old glibc. | _smoke.yml portable legs |
generate-sbom.py |
The release SPDX SBOM (vendored versions reviewable here, diffable by vendoring PRs — was inline YAML). | release.yml |
require-all-green.sh |
The aggregate gate: fail unless every needed job succeeded or legitimately skipped (was inline YAML) — and, under lane selection, every SELECTED lane ran and succeeded (skipped/cancelled/missing = red; unselected lanes may skip). | pr.yml ci-ok |
select-lanes.sh |
Decide which PR lanes a change set runs (tier, lanes, full, reasons) from its file list — the R1 rule set, fail-safe to every lane. Pinned by tests/test_select_lanes.sh and the September 2026 history replay (scripts/test-impact/replay-selector.sh). |
pr.yml changes |
test-impact-shadow.sh |
The report-only test-impact shadow: fetch the latest released binary (checksum-verified) or take a given one, index this checkout into a throwaway cache, run detect_changes against the base and map it to suites (scripts/test-impact/predict.py). Never gates. |
pr.yml test-impact-shadow |
verify-shard-union.sh |
Prove sharded test legs lost nothing: shard count agreement, indices 1..n, identical suite lists, union of slices == full list (was inline YAML). No manifests is green only when the lane selection holds no test leg. | _test.yml shard-completeness |
prepare-release-candidates.sh |
Copy one linker output into stripped/unstripped candidates, finalize signatures, composition-check them without execution, and record their hashes. | _build.yml, local artifact smoke |
stage-release-candidates.py |
Admit exactly eight candidate artifacts / sixteen byte-distinct binaries into the content-addressed VirusTotal scan set. | _build.yml |
select-release-candidates.py |
Apply the reviewed tuple-local VT truth table, or the explicit dry-run stripped default, and atomically copy one content-bound binary per target. | _build.yml |
verify-release-selection.py |
Recompute the selection policy and prove every executable member in all 14 public containers equals its selected SHA-256. | _build.yml, release.yml final draft verification |
check-virustotal.sh |
Poll and validate the exact candidate scan set, enforce engine coverage and the narrow documented Microsoft !ml policy, and emit content-bound results evidence. |
_build.yml |