mirror of https://github.com/DeusData/codebase-memory-mcp.git synced 2026-11-10 09:13:53 +08:00

Files

T

Martin Vogel 0a40fe8bea feat(ci): local-remote parity lanes — artifact-flow smoke, glibc floor, Defender-ON everywhere

Closes the closable local-vs-remote venue gaps so that, outside arch
legs / YAML glue / release plumbing, every local red is a remote red
and vice versa on shared legs:

- scripts/package-release.sh: THE canonical archive step (names +
  five-file Windows bundle layout defined once); _build.yml's eight
  inline archive blocks become calls to it.
- scripts/ci/smoke-artifact.sh: the artifact-flow smoke lane — build,
  package, extract, then the canonical wrapper in artifact mode; wired
  as run.sh smoke-artifact (compose service), win.sh smoke-artifact,
  and directly runnable on macOS. Archive-layout bugs now surface
  locally instead of in a release dry run.
- glibc-floor leg (Dockerfile.glibc22 + compose + run.sh): portable
  binary smokes on ubuntu-22.04/glibc 2.35; the dynamic binary must
  refuse there (2.38+ floor by design).
- Defender-ON parity (user directive): scripts/ci/ensure-defender.ps1
  enables + VERIFIES real-time protection, fail-closed; runs in every
  Windows CI job (_test x2, _soak x3, _smoke, pr.yml) AND in the VM
  preflight; _smoke.yml's scan engine-failure soft-skip becomes a red
  gate. Expected cost: slower Windows jobs (AV scanning during
  install/build/test I/O); the next dry run proves the runner side.
- Contracts: launcher-bundle five-file check retargeted onto
  package-release.sh + per-archive canonical-call association;
  venue-parity contract requires the new lanes, counts one
  ensure-defender step per Windows job, adds --help probes for the new
  entries. Extended contract fails on the pre-change tree (verified:
  20 violations on HEAD).
- VM README: ephemerality/Defender posture documented — utmctl has no
  snapshot verb, so per-run revert stays a manual qcow2 option; the
  sweep preflight remains the standing mechanism.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

2026-07-26 22:37:48 +02:00

feat(ci): local-remote parity lanes — artifact-flow smoke, glibc floor, Defender-ON everywhere

2026-07-26 22:37:48 +02:00

docker-compose.yml

feat(ci): local-remote parity lanes — artifact-flow smoke, glibc floor, Defender-ON everywhere

2026-07-26 22:37:48 +02:00

Dockerfile

build(test-infra): pin container base images and package downloads by hash

2026-07-23 17:49:41 +02:00

Dockerfile.alpine

Fix CodeQL alerts: pin Alpine image digest, scope release permissions

2026-04-02 22:42:44 +02:00

Dockerfile.glibc22

feat(ci): local-remote parity lanes — artifact-flow smoke, glibc floor, Defender-ON everywhere

2026-07-26 22:37:48 +02:00

Dockerfile.lint

build(test-infra): pin container base images and package downloads by hash

2026-07-23 17:49:41 +02:00

Dockerfile.mingw

build(test-infra): pin container base images and package downloads by hash

2026-07-23 17:49:41 +02:00

ladder.sh

test-infra: overlap the local ladder, open the serial tail, keep container I/O off virtiofs

2026-07-23 01:33:58 +02:00

README.md

ci: unify smoke/soak/test venues onto canonical leg entries

2026-07-26 22:23:05 +02:00

run.sh

feat(ci): local-remote parity lanes — artifact-flow smoke, glibc floor, Defender-ON everywhere

2026-07-26 22:37:48 +02:00

README.md

test-infrastructure/ — the local venues

The local half of the 3-OS CI ladder. Every leg here runs the SAME canonical scripts CI runs (scripts/test.sh, build.sh, smoke-local.sh, soak-legs.sh, vm-smoke.sh — see scripts/README.md); this directory only provisions containers and the Windows VM. The venue-parity contract (tests/test_venue_parity_contract.sh, Step 0j of every test leg) fails the build if a venue grows its own harness logic — here or in the workflows.

Entry points

venue	entry	notes
Linux (arm64 + amd64) + cross-compile	`./run.sh <leg>` (`--help` for the leg list)	Colima only — Docker Desktop is broken on this machine. A clean-disk preflight (`scripts/ci/preflight-docker.sh`) runs before every leg: GitHub runners are ephemeral with a known-free 14 GB disk, so the long-lived VM is swept back to that shape first.
Real Windows (UTM ARM64 VM)	`vm/win.sh <command>` (`win.sh help`)	Same preflight idea (`scripts/ci/clean-test-residue.ps1`), plus CI's protected per-user TEMP root. Wine (`run.sh windows`) is a compile check only — never a substitute for the VM.
macOS	run the canonical scripts natively	`scripts/test.sh`, `scripts/build.sh`, `scripts/smoke-local.sh …`

The ladder (before any push)

scripts/test.sh — macOS native (or --suites … while iterating)
./test-infrastructure/run.sh full — Linux arm64 test/build/TSan/smoke/portable + mingw cross-compile (+ amd64, soak-linux as needed)
vm/win.sh test-par · guards · smoke-install · soak — the real-Windows legs

Infra unavailable = a run blocker to escalate — never a silent bypass.

Fidelity guarantees (what makes local predictive of CI)

Same scripts, same sequence, same flags — platform specifics (e.g. the CLANGARM64 trap-UBSan default) live inside the canonical entries, applied identically everywhere.
Same environment shape — protected TEMP roots, sandboxed smoke, clean builds with the content-verified ccache (a hit is byte-identical to a cold compile; caches only accelerate, never change results).
Same starting disk — preflights sweep residue and BLOCK below the runner's 14 GB floor (a quietly full disk fails inside install paths and masquerades as a product bug).
Known, deliberate residuals — runner physics (4 vCPU vs local cores, shared tenancy), Defender ON in the VM vs OFF on GitHub runners, no TSan on Windows anywhere, no ASan runtime on native ARM64 Windows (trap-UBSan + PageHeap stand in).

See vm/README.md for VM provisioning and day-to-day VM mechanics.