fix zai thinkback test assertions #374
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OSX | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [main] | |
| tags: ['[0-9]+.[0-9]+.[0-9]+'] | |
| jobs: | |
| build: | |
| runs-on: macos-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Restore Nim toolchain cache | |
| id: cache-nim | |
| uses: actions/cache@v4 | |
| with: | |
| path: /Users/runner/nim-toolchain | |
| key: ${{ runner.os }}-${{ runner.arch }}-nim-toolchain-${{ hashFiles('*.nimble') }} | |
| restore-keys: | | |
| ${{ runner.os }}-${{ runner.arch }}-nim-toolchain- | |
| - uses: jiro4989/setup-nim-action@v2 | |
| if: steps.cache-nim.outputs.cache-hit != 'true' | |
| with: | |
| nim-version: stable | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| parent-nim-install-directory: $HOME | |
| nim-install-directory: nim-toolchain | |
| - name: Add Nim to PATH on cache hit | |
| if: steps.cache-nim.outputs.cache-hit == 'true' | |
| run: echo "$HOME/nim-toolchain/bin" >> $GITHUB_PATH | |
| - name: Install dependencies | |
| # All deps resolve by name from threecode.nimble via the public | |
| # package registry; tags are versions, so tag builds get tagged | |
| # dependency versions. | |
| run: | | |
| nimble install -y --depsOnly | |
| - name: Compute build flags | |
| shell: bash | |
| run: | | |
| if [[ "${GITHUB_REF}" == refs/tags/* ]]; then | |
| # autoupdate on releases only | |
| echo "BUILD_FLAGS=-d:autoUpdate" >> "$GITHUB_ENV" | |
| fi | |
| - name: Build | |
| run: nimble build -y -d:release ${{ env.BUILD_FLAGS }} | |
| - name: Verify sandbox matrix (seatbelt + wall proxy) | |
| # End-to-end enforcement check of the shipped binary, mirroring | |
| # the manual stefani VM verification: the wall proxy fences | |
| # egress behind an allowlist, the box subprocess applies the | |
| # Seatbelt profile, and the policy's path denies punch through. | |
| run: | | |
| set -e | |
| BIN="$PWD/3code" | |
| SB="$(mktemp -d)/sb" | |
| mkdir -p "$SB/subdir" | |
| cd "$SB" | |
| fail() { echo "SANDBOX MATRIX FAIL: $1" >&2; exit 1; } | |
| # 1. fenced network: allowlist proxy lets google.com through | |
| printf 'allow\ndeny ./subdir\nallow *\ndeny 1.1.1.1\n' > .sandbox | |
| "$BIN" wall proxy --policy .sandbox --port 0 > /tmp/wallport.txt 2>&1 & | |
| sleep 2 | |
| PORT=$(awk '{print $2}' /tmp/wallport.txt) | |
| [ -n "$PORT" ] || fail "wall proxy did not start" | |
| export WALL_PROXY_PORT="$PORT" | |
| export http_proxy="http://127.0.0.1:$PORT" https_proxy="http://127.0.0.1:$PORT" | |
| code=$("$BIN" sandbox --policy .sandbox restrict -- curl -sS -o /dev/null -w '%{http_code}' --max-time 20 https://www.google.com) \ | |
| || fail "curl google.com through the wall proxy" | |
| [ "$code" = 200 ] || fail "google.com expected 200, got $code" | |
| # 2. denied host: the proxy must refuse 1.1.1.1. For a plain | |
| # http:// URL the 403 arrives as a regular response, so curl | |
| # exits 0; only the status code tells the deny. | |
| out=$("$BIN" sandbox --policy .sandbox restrict -- curl -sS -o /dev/null -w '%{http_code}' --max-time 20 http://1.1.1.1) \ | |
| || fail "curl 1.1.1.1 through the wall proxy errored" | |
| [ "$out" = 403 ] || fail "1.1.1.1 expected 403, got $out" | |
| # 3. writable root: bash write into the project dir works | |
| "$BIN" sandbox --policy .sandbox restrict -- sh -c 'echo hi > ok.txt' \ | |
| || fail "write to the project root was denied" | |
| [ "$(cat ok.txt)" = hi ] || fail "project-root write produced wrong content" | |
| # 4. denied subdir: bash write under ./subdir must fail | |
| if "$BIN" sandbox --policy .sandbox restrict -- sh -c 'echo bad > subdir/bad.txt' 2>/dev/null; then | |
| fail "write into ./subdir was allowed" | |
| fi | |
| [ ! -e subdir/bad.txt ] || fail "./subdir/bad.txt exists despite the deny" | |
| kill %1 2>/dev/null || true | |
| unset http_proxy https_proxy | |
| # 5. open network: a policy without host rules must not block | |
| # sockets (the (deny default) baseline covers network-* too; | |
| # regression check for the bare (allow network-*) fix) | |
| printf 'allow\ndeny ./subdir\n' > .sandbox | |
| code=$("$BIN" sandbox --policy .sandbox restrict -- curl -sS -o /dev/null -w '%{http_code}' --max-time 20 https://www.google.com) \ | |
| || fail "open-network curl google.com" | |
| [ "$code" = 200 ] || fail "open-network google.com expected 200, got $code" | |
| echo "sandbox matrix: all checks passed" | |
| - name: Build x86_64 and create universal binary | |
| env: | |
| SLICE_DIR: ${{ runner.temp }} | |
| run: | | |
| mv 3code "$SLICE_DIR/3code-arm64" | |
| rm -rf ~/.cache/nim/threecode_r | |
| nim c -d:release ${{ env.BUILD_FLAGS }} --passC:"-arch x86_64" --passL:"-arch x86_64" --cpu:amd64 -o:"$SLICE_DIR/3code-x86_64" src/threecode.nim | |
| lipo -create "$SLICE_DIR/3code-arm64" "$SLICE_DIR/3code-x86_64" -output 3code | |
| file 3code | |
| - name: Run tests | |
| # tools/ci_tests.sh wraps testament: log file instead of a pipe (a | |
| # single hung test used to stall the pipe and hide everything after | |
| # it), a watchdog that bounds the run and attributes any hang to the | |
| # exact test binary, and a propagated exit code. Categories run in | |
| # parallel via `testament all`; the tty PTY tests get the runner to | |
| # themselves because each category is still sequential inside | |
| # testament. If load-induced tty flakes reappear on this 3-core | |
| # runner, pass explicit categories to serialize them. | |
| run: sh tools/ci_tests.sh 1500 | |
| timeout-minutes: 30 | |
| - name: Package | |
| run: | | |
| mkdir -p 3code-macos-universal | |
| cp 3code 3code-macos-universal/ | |
| # Capture the version from the built binary so it can be checked | |
| # without running the binary on its target OS. | |
| ./3code -v > 3code-macos-universal/VERSION | |
| cp README.md LICENSE 3code-macos-universal/ | |
| OPENSSL_PREFIX="$(brew --prefix openssl@3)" | |
| cp "${OPENSSL_PREFIX}/lib/libssl.3.dylib" 3code-macos-universal/ | |
| cp "${OPENSSL_PREFIX}/lib/libcrypto.3.dylib" 3code-macos-universal/ | |
| chmod +w 3code-macos-universal/libssl.3.dylib 3code-macos-universal/libcrypto.3.dylib | |
| install_name_tool -id @loader_path/libcrypto.3.dylib 3code-macos-universal/libcrypto.3.dylib | |
| install_name_tool -id @loader_path/libssl.3.dylib 3code-macos-universal/libssl.3.dylib | |
| install_name_tool -change "${OPENSSL_PREFIX}/lib/libcrypto.3.dylib" \ | |
| @loader_path/libcrypto.3.dylib 3code-macos-universal/libssl.3.dylib | |
| ln -sf libssl.3.dylib 3code-macos-universal/libssl.dylib | |
| ln -sf libcrypto.3.dylib 3code-macos-universal/libcrypto.dylib | |
| curl -fsSL https://curl.se/ca/cacert.pem -o 3code-macos-universal/cacert.pem | |
| tar czf 3code-macos-universal.tar.gz 3code-macos-universal | |
| - name: Upload artifact (GitHub Actions) | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: 3code-macos-universal | |
| path: 3code-macos-universal.tar.gz | |
| - name: Upload artifact to 3code.capocasa.dev | |
| if: github.ref == 'refs/heads/main' | |
| run: | | |
| # --retry: 5xx is transient on the upload endpoint | |
| curl -f --retry 5 --retry-delay 5 -H "Authorization: Bearer ${{ secrets.RELEASE_SECRET }}" -F "file=@3code-macos-universal.tar.gz" \ | |
| https://3code.capocasa.dev/main/builds/upload.nim |