Skip to content
CLI package validation

fix(runtime): preserve sandbox negotiation across continuations #787

Sign in to view logs

fix(runtime): preserve sandbox negotiation across continuations

fix(runtime): preserve sandbox negotiation across continuations #787

Workflow file for this run

.github/workflows/cli-package-validation.yml at 620903d
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
name: CLI package validation
on:
pull_request:
paths:
- '.github/workflows/cli-package-validation.yml'
- '.github/workflows/npm-publication.yml'
- '.github/workflows/runtime-host-peer-admission.yml'
- 'deny.toml'
- 'native/runtime-host-peer/**'
- 'package-lock.json'
- 'packages/cli/RUNTIME_HOST_PEER_*'
- 'packages/cli/src/cli-core.ts'
- 'packages/cli/src/runtime-host-cli.ts'
- 'packages/cli/src/runtime-host-peer-*'
- 'packages/cli/src/runtime-host-service-*'
- 'packages/runtime-host/package.json'
- 'packages/runtime-host/src/client/peer-client.ts'
- 'packages/runtime-host/src/peer-mesh/**'
- 'packages/runtime-host/src/server/peer-listener.ts'
- 'packages/runtime-host/src/transport/peer-native.ts'
- 'packages/storage/package.json'
- 'packages/storage/src/file-lifetime-owner.ts'
- 'packages/storage/src/native-file-lock.ts'
- 'scripts/generate-runtime-host-peer-*'
- 'scripts/release-cli-package.mjs'
- 'scripts/qualify-released-cli-state-root.mjs'
- 'scripts/qualify-released-cli-state-root.test.mjs'
- 'scripts/released-cli-state-root-fixture.mjs'
- 'scripts/smoke-release-cli-package.mjs'
workflow_call:
inputs:
source_commit:
description: Exact product release commit to build; defaults to the triggering commit
required: false
type: string
default: ''
package_version:
description: Exact Product Nightly version; empty builds the checked-in formal version
required: false
type: string
default: ''
outputs:
release_candidate_artifact_id:
description: Immutable artifact produced by the build job
value: ${{ jobs.build.outputs.release_candidate_artifact_id }}
release_candidate_run_attempt:
description: Workflow attempt that built the immutable artifact
value: ${{ jobs.build.outputs.release_candidate_run_attempt }}
release_predecessor_version:
description: Exact npm Nightly version qualified against this candidate
value: ${{ jobs.release-predecessor.outputs.version }}
release_predecessor_tarball_url:
description: Exact npm Nightly tarball qualified against this candidate
value: ${{ jobs.release-predecessor.outputs.tarball_url }}
release_predecessor_integrity:
description: npm SHA-512 integrity of the Nightly tarball qualified against this candidate
value: ${{ jobs.release-predecessor.outputs.integrity }}
workflow_dispatch:
permissions:
contents: read
concurrency:
group: cli-package-validation-${{ github.workflow }}-${{ github.ref }}
jobs:
release-predecessor:
name: Resolve immutable release predecessor
runs-on: ubuntu-24.04
timeout-minutes: 45
outputs:
version: ${{ steps.predecessor.outputs.version }}
tarball_url: ${{ steps.predecessor.outputs.tarball_url }}
integrity: ${{ steps.predecessor.outputs.integrity }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.source_commit || github.sha }}
persist-credentials: false
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: '24'
- name: Resolve the current npm Nightly as immutable evidence
id: predecessor
run: node scripts/release-cli-publication.mjs resolve-nightly-predecessor "$GITHUB_OUTPUT"
peer-native:
name: Build direct-peer addon (${{ matrix.target }})
runs-on: ${{ matrix.runner }}
timeout-minutes: 45
strategy:
fail-fast: false
matrix:
include:
- runner: macos-15
target: darwin-arm64
rust_target: ''
- runner: ubuntu-24.04-arm
target: linux-arm64
rust_target: aarch64-unknown-linux-gnu.2.28
- runner: ubuntu-24.04
target: linux-x64
rust_target: x86_64-unknown-linux-gnu.2.28
- runner: windows-2025
target: win32-x64
rust_target: ''
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.source_commit || github.sha }}
persist-credentials: false
- name: Update stable Rust
run: rustup update stable --no-self-update
- id: rustc
name: Resolve Rust cache version
shell: bash
run: |
echo "version=$(rustc --version | cut -d ' ' -f 2)" >> "$GITHUB_OUTPUT"
echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
{
echo "KACHE_CACHE_DIR=${{ runner.temp }}/kache"
echo "KACHE_RUNTIME_DIR=${{ runner.temp }}/kache-runtime"
echo "RUSTC_WRAPPER=kache"
} >> "$GITHUB_ENV"
- name: Install Kache
uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2
with:
tool: kache@0.16.0
- id: kache-cache
name: Restore Rust build cache
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ${{ runner.temp }}/kache
key: kache-runtime-host-peer-release-${{ matrix.target }}-v0.16.0-${{ runner.os }}-${{ runner.arch }}-rust-${{ steps.rustc.outputs.version }}-${{ steps.rustc.outputs.revision }}
restore-keys: |
kache-runtime-host-peer-release-${{ matrix.target }}-v0.16.0-${{ runner.os }}-${{ runner.arch }}-rust-${{ steps.rustc.outputs.version }}-
- name: Install the Linux baseline linker
if: startsWith(matrix.target, 'linux-')
uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
with:
version: 0.16.0
- name: Install cargo-zigbuild
if: startsWith(matrix.target, 'linux-')
uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2
with:
tool: cargo-zigbuild@0.23.2
- name: Build the release addon
env:
MAKA_RUNTIME_HOST_PEER_CARGO_SUBCOMMAND: ${{ matrix.rust_target && 'zigbuild' || '' }}
MAKA_RUNTIME_HOST_PEER_CARGO_TARGET: ${{ matrix.rust_target }}
run: node native/runtime-host-peer/build.mjs
- name: Report Rust build cache
shell: bash
run: kache report --format github >> "$GITHUB_STEP_SUMMARY"
- name: Save Rust build cache
if: github.ref_name == github.event.repository.default_branch
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ${{ runner.temp }}/kache
key: ${{ steps.kache-cache.outputs.cache-primary-key }}
- name: Enforce the Linux glibc baseline
if: startsWith(matrix.target, 'linux-')
run: |
node - <<'NODE'
const { execFileSync } = require('node:child_process');
const output = execFileSync('readelf', [
'--version-info',
'native/runtime-host-peer/target/release/maka_runtime_host_peer.node',
], { encoding: 'utf8' });
const versions = [...output.matchAll(/GLIBC_(\d+)\.(\d+)/g)].map((match) => [
Number(match[1]),
Number(match[2]),
]);
const newer = versions.find(([major, minor]) => major > 2 || (major === 2 && minor > 28));
if (newer) throw new Error(`Direct-peer addon requires GLIBC_${newer.join('.')}`);
NODE
- name: Stage the platform addon
env:
PEER_TARGET: ${{ matrix.target }}
run: node -e "const fs=require('node:fs'),p=require('node:path'); const d=p.join('peer-prebuilds',process.env.PEER_TARGET); fs.mkdirSync(d,{recursive:true}); fs.copyFileSync(p.join('native','runtime-host-peer','target','release','maka_runtime_host_peer.node'),p.join(d,'maka_runtime_host_peer.node'))"
- name: Upload the platform addon
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: runtime-host-peer-${{ matrix.target }}
path: peer-prebuilds
if-no-files-found: error
retention-days: 1
build:
name: Build immutable tarball
needs: peer-native
runs-on: ubuntu-24.04
timeout-minutes: 45
outputs:
release_candidate_artifact_id: ${{ steps.release-candidate.outputs.artifact-id }}
release_candidate_run_attempt: ${{ github.run_attempt }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.source_commit || github.sha }}
persist-credentials: false
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: '22.19.0'
cache: npm
- name: Select the release npm toolchain
run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
- name: Install cargo-deny
uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2
with:
tool: cargo-deny@0.20.2
- name: Download direct-peer addons
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: runtime-host-peer-*
path: ${{ runner.temp }}/runtime-host-peer-prebuilds
merge-multiple: true
- name: Build the release tarball once
env:
MAKA_CLI_NIGHTLY_VERSION: ${{ inputs.package_version }}
MAKA_RUNTIME_HOST_PEER_PREBUILDS: ${{ runner.temp }}/runtime-host-peer-prebuilds
run: npm run release:cli:pack
- name: Upload the immutable release candidate
id: release-candidate
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: cli-release-candidate-${{ github.run_attempt }}
path: |
packages/cli/release/*.tgz
packages/cli/release/*.tgz.sha256
packages/cli/release/*.tgz.files.json
if-no-files-found: error
retention-days: 7
smoke:
name: Validate installed CLI ${{ matrix.name }}
needs: build
runs-on: ${{ matrix.runner }}
timeout-minutes: 45
strategy:
fail-fast: false
matrix:
include:
- name: Linux x64 / Node 22.19
runner: ubuntu-24.04
node: '22.19.0'
platform: linux
arch: x64
- name: Linux x64 / Node 24
runner: ubuntu-24.04
node: '24'
platform: linux
arch: x64
- name: Linux arm64 / Node 24
runner: ubuntu-24.04-arm
node: '24'
platform: linux
arch: arm64
- name: macOS arm64 / Node 24
runner: macos-15
node: '24'
platform: darwin
arch: arm64
- name: Windows x64 / Node 24
runner: windows-2025
node: '24'
platform: win32
arch: x64
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.source_commit || github.sha }}
persist-credentials: false
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: ${{ matrix.node }}
- name: Select the release npm toolchain
run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
- name: Assert the runner architecture
env:
EXPECTED_PLATFORM: ${{ matrix.platform }}
EXPECTED_ARCH: ${{ matrix.arch }}
run: |
node -e "if (process.platform !== process.env.EXPECTED_PLATFORM || process.arch !== process.env.EXPECTED_ARCH) throw new Error('Expected ' + process.env.EXPECTED_PLATFORM + '/' + process.env.EXPECTED_ARCH + ', found ' + process.platform + '/' + process.arch)"
- name: Download the release candidate
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
artifact-ids: ${{ needs.build.outputs.release_candidate_artifact_id }}
path: packages/cli/release
- name: Validate the installed tarball
run: node scripts/smoke-release-cli-package.mjs
state-root-qualification:
name: Qualify released State Root (${{ matrix.name }})
needs: [build, release-predecessor]
runs-on: ubuntu-24.04
timeout-minutes: 45
strategy:
fail-fast: false
matrix:
include:
- name: cross epoch 74 to 76
source_url: https://registry.npmjs.org/maka-agent/-/maka-agent-0.2.0-dev.3.20260830.tgz
source_sha256: 66b1ce9307c9d5c06eaa7a6cbf533d4747d02caf71c1776c69c7dbfa12c3f414
target_kind: published
target_url: https://registry.npmjs.org/maka-agent/-/maka-agent-0.2.0-dev.4.20260830.tgz
target_sha256: b7d48adb466e16be7ffefbda3a0fcd833cc4108ea502b27778d0f4da680e1fc0
epoch_relation: different
- name: same epoch 76
source_url: https://registry.npmjs.org/maka-agent/-/maka-agent-0.2.0-dev.4.20260830.tgz
source_sha256: b7d48adb466e16be7ffefbda3a0fcd833cc4108ea502b27778d0f4da680e1fc0
target_kind: published
target_url: https://registry.npmjs.org/maka-agent/-/maka-agent-0.2.0-dev.5.20260830.tgz
target_sha256: e7a682157c6899fc7f1be86a2d7b0bd0696195a5771d8cc97bd1389a5b74989f
epoch_relation: same
- name: current Nightly predecessor to candidate
source_url: ${{ needs.release-predecessor.outputs.tarball_url }}
source_sha256: ''
source_integrity: ${{ needs.release-predecessor.outputs.integrity }}
target_kind: candidate
target_url: ''
target_sha256: ''
epoch_relation: any
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.source_commit || github.sha }}
persist-credentials: false
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: '24'
- name: Select the release npm toolchain
run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
- name: Require the account-isolation sandbox
run: |
sudo apt-get update
sudo apt-get install --yes bubblewrap
bwrap --version
- name: Download the release candidate
if: matrix.target_kind == 'candidate'
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
artifact-ids: ${{ needs.build.outputs.release_candidate_artifact_id }}
path: packages/cli/release
- name: Prepare exact source and target artifacts
env:
SOURCE_URL: ${{ matrix.source_url }}
SOURCE_SHA256: ${{ matrix.source_sha256 }}
SOURCE_INTEGRITY: ${{ matrix.source_integrity }}
TARGET_KIND: ${{ matrix.target_kind }}
TARGET_URL: ${{ matrix.target_url }}
TARGET_SHA256: ${{ matrix.target_sha256 }}
run: |
set -euo pipefail
evidence_root="$RUNNER_TEMP/released-state-root"
mkdir -p "$evidence_root"
source_path="$evidence_root/source.tgz"
curl --fail --location --max-filesize 67108864 --proto '=https' --tlsv1.2 "$SOURCE_URL" --output "$source_path"
source_sha256="$SOURCE_SHA256"
if [[ -n "$SOURCE_INTEGRITY" ]]; then
node - "$source_path" "$SOURCE_INTEGRITY" <<'NODE'
const { createHash } = require('node:crypto');
const { readFileSync } = require('node:fs');
const bytes = readFileSync(process.argv[2]);
const actual = `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
if (actual !== process.argv[3]) throw new Error('Source tarball integrity mismatch');
NODE
source_sha256="$(sha256sum "$source_path" | cut -d ' ' -f 1)"
else
test -n "$source_sha256"
fi
if [[ "$TARGET_KIND" == 'published' ]]; then
target_path="$evidence_root/target.tgz"
curl --fail --location --max-filesize 67108864 --proto '=https' --tlsv1.2 "$TARGET_URL" --output "$target_path"
target_sha256="$TARGET_SHA256"
else
target_path="$(find packages/cli/release -maxdepth 1 -name '*.tgz' -print -quit)"
test -n "$target_path"
target_path="$(realpath "$target_path")"
target_sha256="$(sha256sum "$target_path" | cut -d ' ' -f 1)"
fi
{
echo "SOURCE_PATH=$source_path"
echo "SOURCE_SHA256=$source_sha256"
echo "TARGET_PATH=$target_path"
echo "TARGET_SHA256=$target_sha256"
} >> "$GITHUB_ENV"
- name: Qualify the released State Root transition
env:
EXPECTED_EPOCH_RELATION: ${{ matrix.epoch_relation }}
MAKA_QUALIFICATION_BWRAP_USE_SUDO: '1'
run: |
set -o pipefail
npm run --silent release:cli:qualify-state-root -- \
--source "$SOURCE_PATH" \
--source-sha256 "$SOURCE_SHA256" \
--target "$TARGET_PATH" \
--target-sha256 "$TARGET_SHA256" \
--expect-epoch-relation "$EXPECTED_EPOCH_RELATION" \
| tee "$RUNNER_TEMP/released-state-root-report.json"
- name: Preserve the qualification report
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: released-state-root-${{ strategy.job-index }}
path: ${{ runner.temp }}/released-state-root-report.json
if-no-files-found: error
retention-days: 7
- name: Require the qualified Nightly predecessor to remain current
if: matrix.target_kind == 'candidate'
env:
PREDECESSOR_VERSION: ${{ needs.release-predecessor.outputs.version }}
PREDECESSOR_TARBALL_URL: ${{ needs.release-predecessor.outputs.tarball_url }}
PREDECESSOR_INTEGRITY: ${{ needs.release-predecessor.outputs.integrity }}
run: |
node scripts/release-cli-publication.mjs assert-nightly-predecessor \
"$PREDECESSOR_VERSION" \
"$PREDECESSOR_TARBALL_URL" \
"$PREDECESSOR_INTEGRITY"
eval:
name: Validate installed CLI Eval
if: github.event_name != 'pull_request'
needs: build
runs-on: ubuntu-24.04
timeout-minutes: 45
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.source_commit || github.sha }}
persist-credentials: false
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: '24'
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: '3.12'
- name: Select the release npm toolchain
run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
- name: Install pinned Eval frameworks
run: |
python -m venv "$RUNNER_TEMP/maka-harbor"
"$RUNNER_TEMP/maka-harbor/bin/python" -m pip install --disable-pip-version-check 'harbor==0.20.0'
python -m venv "$RUNNER_TEMP/maka-pier"
"$RUNNER_TEMP/maka-pier/bin/python" -m pip install --disable-pip-version-check 'datacurve-pier==0.3.0'
echo "MAKA_RELEASE_HARBOR_PYTHON=$RUNNER_TEMP/maka-harbor/bin/python" >> "$GITHUB_ENV"
echo "MAKA_RELEASE_PIER_PYTHON=$RUNNER_TEMP/maka-pier/bin/python" >> "$GITHUB_ENV"
- name: Download the release candidate
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
artifact-ids: ${{ needs.build.outputs.release_candidate_artifact_id }}
path: packages/cli/release
- name: Validate real Harbor and Pier cells
run: npm run release:cli:eval