mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-10-28 07:03:20 +08:00
Martin Vogel
75fac86b53
dry-run.yml and release.yml now pass broad_platforms:true to _test.yml + _smoke.yml, which add (via a dynamic setup-matrix job) ubuntu-22.04 (older glibc / AlmaLinux class), ubuntu-22.04-arm, macos-15, windows-2025, windows-11-arm on top of the core set — a broader 'does it run everywhere' picture. The PR gate (pr.yml) and the shipped release-binary targets (_build.yml) are unchanged. Broad-only legs are tagged optional + continue-on-error, so a flaky/less-common runner is visible but never blocks a release. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
281 lines
12 KiB
YAML
281 lines
12 KiB
YAML
# Reusable: smoke test every binary (standard + UI, all platforms)
|
|
name: Smoke
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
broad_platforms:
|
|
description: 'Smoke the shipped binaries on the broad platform matrix (extra OS versions) instead of the core set'
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
# Emit the platform matrices as JSON. The CORE set is the default (fast,
|
|
# unchanged); the BROAD set adds extra free runners (additional OS versions)
|
|
# that download the SAME shipped artifact for their goos/goarch and verify it
|
|
# runs on a wider range of OS versions. No new artifacts are built — broad
|
|
# legs reuse the exact binaries produced by _build.yml.
|
|
setup-matrix:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
outputs:
|
|
unix: ${{ steps.set.outputs.unix }}
|
|
windows: ${{ steps.set.outputs.windows }}
|
|
portable: ${{ steps.set.outputs.portable }}
|
|
steps:
|
|
- name: Compute matrices
|
|
id: set
|
|
env:
|
|
BROAD: ${{ inputs.broad_platforms }}
|
|
run: |
|
|
CORE_UNIX='[
|
|
{"os":"ubuntu-latest","goos":"linux","goarch":"amd64"},
|
|
{"os":"ubuntu-24.04-arm","goos":"linux","goarch":"arm64"},
|
|
{"os":"macos-14","goos":"darwin","goarch":"arm64"},
|
|
{"os":"macos-15-intel","goos":"darwin","goarch":"amd64"}
|
|
]'
|
|
# Broad legs reuse existing goos/goarch artifacts on newer/older OS
|
|
# versions (e.g. ubuntu-22.04 = older glibc) to widen the run-anywhere
|
|
# signal without building new targets.
|
|
BROAD_UNIX='[
|
|
{"os":"ubuntu-22.04","goos":"linux","goarch":"amd64","optional":true},
|
|
{"os":"ubuntu-22.04-arm","goos":"linux","goarch":"arm64","optional":true},
|
|
{"os":"macos-15","goos":"darwin","goarch":"arm64","optional":true}
|
|
]'
|
|
CORE_WIN='[{"os":"windows-latest"}]'
|
|
# windows-11-arm runs the shipped x86_64 binary under emulation —
|
|
# verifies the Windows artifact still launches on ARM hardware.
|
|
BROAD_WIN='[{"os":"windows-2025","optional":true},{"os":"windows-11-arm","optional":true}]'
|
|
CORE_PORTABLE='[
|
|
{"arch":"amd64","runner":"ubuntu-latest"},
|
|
{"arch":"arm64","runner":"ubuntu-24.04-arm"}
|
|
]'
|
|
BROAD_PORTABLE='[
|
|
{"arch":"amd64","runner":"ubuntu-22.04","optional":true},
|
|
{"arch":"arm64","runner":"ubuntu-22.04-arm","optional":true}
|
|
]'
|
|
if [ "$BROAD" = "true" ]; then
|
|
UNIX=$(jq -cn --argjson a "$CORE_UNIX" --argjson b "$BROAD_UNIX" '$a + $b')
|
|
WIN=$(jq -cn --argjson a "$CORE_WIN" --argjson b "$BROAD_WIN" '$a + $b')
|
|
PORTABLE=$(jq -cn --argjson a "$CORE_PORTABLE" --argjson b "$BROAD_PORTABLE" '$a + $b')
|
|
else
|
|
UNIX=$(jq -cn --argjson a "$CORE_UNIX" '$a')
|
|
WIN=$(jq -cn --argjson a "$CORE_WIN" '$a')
|
|
PORTABLE=$(jq -cn --argjson a "$CORE_PORTABLE" '$a')
|
|
fi
|
|
echo "unix={\"variant\":[\"standard\",\"ui\"],\"include\":$UNIX}" >> "$GITHUB_OUTPUT"
|
|
echo "windows={\"variant\":[\"standard\",\"ui\"],\"include\":$WIN}" >> "$GITHUB_OUTPUT"
|
|
echo "portable={\"variant\":[\"standard\",\"ui\"],\"include\":$PORTABLE}" >> "$GITHUB_OUTPUT"
|
|
|
|
smoke-unix:
|
|
needs: setup-matrix
|
|
strategy:
|
|
fail-fast: false
|
|
matrix: ${{ fromJSON(needs.setup-matrix.outputs.unix) }}
|
|
runs-on: ${{ matrix.os }}
|
|
continue-on-error: ${{ matrix.optional == true }}
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
|
|
|
|
- name: Extract binary
|
|
run: |
|
|
SUFFIX=${{ matrix.variant == 'ui' && '-ui' || '' }}
|
|
tar -xzf codebase-memory-mcp${SUFFIX}-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
|
|
chmod +x codebase-memory-mcp
|
|
|
|
- name: Start artifact server
|
|
run: |
|
|
mkdir -p /tmp/smoke-server
|
|
cp codebase-memory-mcp /tmp/smoke-server/
|
|
OS=${{ matrix.goos }}; ARCH=${{ matrix.goarch }}
|
|
SUFFIX=${{ matrix.variant == 'ui' && '-ui' || '' }}
|
|
tar -czf "/tmp/smoke-server/codebase-memory-mcp${SUFFIX}-${OS}-${ARCH}.tar.gz" \
|
|
-C /tmp/smoke-server codebase-memory-mcp
|
|
if [ -n "$SUFFIX" ]; then
|
|
cp "/tmp/smoke-server/codebase-memory-mcp${SUFFIX}-${OS}-${ARCH}.tar.gz" \
|
|
"/tmp/smoke-server/codebase-memory-mcp-${OS}-${ARCH}.tar.gz"
|
|
fi
|
|
cd /tmp/smoke-server
|
|
sha256sum *.tar.gz > checksums.txt 2>/dev/null || shasum -a 256 *.tar.gz > checksums.txt
|
|
python3 -m http.server 18080 -d /tmp/smoke-server &
|
|
|
|
- name: Smoke test
|
|
run: scripts/smoke-test.sh ./codebase-memory-mcp
|
|
env:
|
|
SMOKE_DOWNLOAD_URL: http://localhost:18080
|
|
|
|
- name: Security audits
|
|
run: |
|
|
scripts/security-strings.sh ./codebase-memory-mcp
|
|
scripts/security-install.sh ./codebase-memory-mcp
|
|
scripts/security-network.sh ./codebase-memory-mcp
|
|
|
|
- name: MCP robustness test (linux-amd64 standard only)
|
|
if: matrix.variant == 'standard' && matrix.goos == 'linux' && matrix.goarch == 'amd64'
|
|
run: |
|
|
scripts/security-fuzz.sh ./codebase-memory-mcp
|
|
scripts/security-fuzz-random.sh ./codebase-memory-mcp 60
|
|
|
|
- name: ClamAV scan (Linux)
|
|
if: startsWith(matrix.os, 'ubuntu')
|
|
run: |
|
|
sudo apt-get update -qq && sudo apt-get install -y -qq clamav > /dev/null 2>&1
|
|
sudo sed -i 's/^Example/#Example/' /etc/clamav/freshclam.conf 2>/dev/null || true
|
|
grep -q "DatabaseMirror" /etc/clamav/freshclam.conf 2>/dev/null || \
|
|
echo "DatabaseMirror database.clamav.net" | sudo tee -a /etc/clamav/freshclam.conf > /dev/null
|
|
sudo freshclam --quiet
|
|
clamscan --no-summary ./codebase-memory-mcp
|
|
|
|
- name: ClamAV scan (macOS)
|
|
if: startsWith(matrix.os, 'macos')
|
|
run: |
|
|
brew install clamav > /dev/null 2>&1
|
|
CLAMAV_ETC=$(brew --prefix)/etc/clamav
|
|
if [ ! -f "$CLAMAV_ETC/freshclam.conf" ]; then
|
|
cp "$CLAMAV_ETC/freshclam.conf.sample" "$CLAMAV_ETC/freshclam.conf" 2>/dev/null || true
|
|
sed -i '' 's/^Example/#Example/' "$CLAMAV_ETC/freshclam.conf" 2>/dev/null || true
|
|
echo "DatabaseMirror database.clamav.net" >> "$CLAMAV_ETC/freshclam.conf"
|
|
fi
|
|
freshclam --quiet --no-warnings 2>/dev/null || freshclam --quiet 2>/dev/null || echo "WARNING: freshclam update failed"
|
|
clamscan --no-summary ./codebase-memory-mcp
|
|
|
|
smoke-windows:
|
|
needs: setup-matrix
|
|
strategy:
|
|
fail-fast: false
|
|
matrix: ${{ fromJSON(needs.setup-matrix.outputs.windows) }}
|
|
runs-on: ${{ matrix.os }}
|
|
continue-on-error: ${{ matrix.optional == true }}
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
|
|
with:
|
|
msystem: CLANG64
|
|
path-type: inherit
|
|
install: >-
|
|
mingw-w64-clang-x86_64-python3
|
|
unzip
|
|
zip
|
|
coreutils
|
|
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: binaries-windows-amd64
|
|
|
|
- name: Extract binary
|
|
shell: msys2 {0}
|
|
run: |
|
|
SUFFIX=${{ matrix.variant == 'ui' && '-ui' || '' }}
|
|
unzip -o "codebase-memory-mcp${SUFFIX}-windows-amd64.zip"
|
|
[ -n "$SUFFIX" ] && cp "codebase-memory-mcp${SUFFIX}.exe" codebase-memory-mcp.exe || true
|
|
|
|
- name: Start artifact server
|
|
shell: msys2 {0}
|
|
run: |
|
|
mkdir -p /tmp/smoke-server
|
|
cp codebase-memory-mcp.exe /tmp/smoke-server/
|
|
SUFFIX=${{ matrix.variant == 'ui' && '-ui' || '' }}
|
|
cd /tmp/smoke-server
|
|
zip -q "codebase-memory-mcp${SUFFIX}-windows-amd64.zip" codebase-memory-mcp.exe
|
|
if [ -n "$SUFFIX" ]; then
|
|
cp "codebase-memory-mcp${SUFFIX}-windows-amd64.zip" "codebase-memory-mcp-windows-amd64.zip"
|
|
fi
|
|
sha256sum *.zip > checksums.txt
|
|
python3 -m http.server 18080 -d /tmp/smoke-server &
|
|
|
|
- name: Smoke test
|
|
shell: msys2 {0}
|
|
run: scripts/smoke-test.sh ./codebase-memory-mcp.exe
|
|
env:
|
|
SMOKE_DOWNLOAD_URL: http://localhost:18080
|
|
|
|
- name: Security audits
|
|
shell: msys2 {0}
|
|
run: |
|
|
scripts/security-strings.sh ./codebase-memory-mcp.exe
|
|
scripts/security-install.sh ./codebase-memory-mcp.exe
|
|
|
|
- name: Windows Defender scan
|
|
shell: pwsh
|
|
run: |
|
|
& "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate 2>$null
|
|
$result = & "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "$PWD\codebase-memory-mcp.exe" -DisableRemediation
|
|
Write-Host $result
|
|
if ($LASTEXITCODE -ne 0) { Write-Host "BLOCKED: Windows Defender flagged binary!"; exit 1 }
|
|
Write-Host "=== Windows Defender: clean ==="
|
|
|
|
smoke-linux-portable:
|
|
needs: setup-matrix
|
|
strategy:
|
|
fail-fast: false
|
|
matrix: ${{ fromJSON(needs.setup-matrix.outputs.portable) }}
|
|
runs-on: ${{ matrix.runner }}
|
|
continue-on-error: ${{ matrix.optional == true }}
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: binaries-linux-${{ matrix.arch }}-portable
|
|
|
|
- name: Extract and smoke test
|
|
run: |
|
|
SUFFIX=${{ matrix.variant == 'ui' && '-ui' || '' }}
|
|
tar -xzf codebase-memory-mcp${SUFFIX}-linux-${{ matrix.arch }}-portable.tar.gz
|
|
chmod +x codebase-memory-mcp
|
|
scripts/smoke-test.sh ./codebase-memory-mcp
|
|
|
|
# The -portable binary is what all linux install/update paths now deliver;
|
|
# it MUST start on old glibc (Debian 11 / RHEL 8 / Ubuntu 20.04). Runs it
|
|
# in debian:bullseye (glibc 2.31) — the standard dynamic binary would fail
|
|
# here with `GLIBC_2.38 not found`.
|
|
- name: Old-glibc compatibility
|
|
run: scripts/ci/check-glibc-compat.sh ./codebase-memory-mcp
|
|
|
|
- name: Security audits
|
|
run: |
|
|
scripts/security-strings.sh ./codebase-memory-mcp
|
|
scripts/security-install.sh ./codebase-memory-mcp
|
|
scripts/security-network.sh ./codebase-memory-mcp
|
|
|
|
# ── Packaging check (non-gating) ──────────────────────────────────
|
|
# Builds pkg/glama/Dockerfile — the image Glama builds to score the
|
|
# server — and runs an MCP initialize + tools/list handshake to confirm the
|
|
# containerized stdio server still starts and introspects. Guards the Glama
|
|
# listing integration against drift (Dockerfile breakage, release-asset
|
|
# renames, introspection regressions).
|
|
#
|
|
# Also tests the brew tap/install flow.
|
|
#
|
|
# continue-on-error: a broken *directory* image must never block a release —
|
|
# the shipped product binaries are unaffected. The red X is the signal to fix
|
|
# the integration, not a release gate.
|
|
smoke-packages:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
- name: Build Glama image and verify MCP introspection
|
|
run: bash pkg/glama/verify.sh
|
|
- name: Test homebrew installation
|
|
env:
|
|
HOMEBREW_NO_AUTO_UPDATE: 1
|
|
run: |
|
|
eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
|
|
brew tap deusdata/codebase-memory-mcp "$GITHUB_WORKSPACE"
|
|
brew trust deusdata/codebase-memory-mcp
|
|
brew install codebase-memory-mcp
|
|
codebase-memory-mcp --version
|