imccyu
7f420ef6b6
apps/cli/cordis.yml now bakes in the production OTLP endpoint; CI boots of the web composition (e2e, snapshots, built smokes) must not stream test sessions there. DSH_TELEMETRY_DISABLED=1 at the workflow level disables the telemetry row before its load-time url validation; the telemetry e2e still runs — it overrides the variable to empty for its child process and points DSH_TELEMETRY_OTLP_URL at its in-test collector.
133 lines
4.0 KiB
YAML
133 lines
4.0 KiB
YAML
# Manually-dispatched CI for the landlock-run source of record
|
|
# (native/landlock-run). A separate workflow from ci.yml on purpose: the
|
|
# subtree is a self-contained pnpm workspace with its own gates, exercised on
|
|
# demand — per-architecture native legs (build + behavioral tests + pack
|
|
# rehearsal on real kernels) plus one darwin leg proving the documented
|
|
# degradation on hosts without a platform package. Legs derive from the
|
|
# subtree's checked-in package matrix (scripts/github-matrix.mjs). Packing
|
|
# for npm happens in the release mirror (node-addon-landlock-run) after an
|
|
# export — see native/README.md; this workflow never packs for release.
|
|
name: Landlock Run
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
# CI runs must never report to the production telemetry endpoint baked
|
|
# into apps/cli/cordis.yml (AppCLIEntry disables the row when set).
|
|
DSH_TELEMETRY_DISABLED: '1'
|
|
|
|
defaults:
|
|
run:
|
|
working-directory: native/landlock-run
|
|
|
|
jobs:
|
|
matrix:
|
|
name: Matrix
|
|
runs-on: ubuntu-24.04
|
|
outputs:
|
|
ci: ${{ steps.matrix.outputs.ci }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- id: matrix
|
|
run: echo "ci=$(node ./scripts/github-matrix.mjs ci)" >> "$GITHUB_OUTPUT"
|
|
|
|
native:
|
|
name: ${{ matrix.platform }}
|
|
needs: matrix
|
|
runs-on: ${{ matrix.runner }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix: ${{ fromJson(needs.matrix.outputs.ci) }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
with:
|
|
package_json_file: native/landlock-run/package.json
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
cache-dependency-path: native/landlock-run/pnpm-lock.yaml
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Install musl toolchain
|
|
run: |
|
|
sudo apt-get update -q
|
|
sudo apt-get install -yq musl-tools
|
|
|
|
- name: Build TypeScript
|
|
run: pnpm build:ts
|
|
|
|
- name: Typecheck
|
|
run: pnpm typecheck
|
|
|
|
- name: Build native binaries (this architecture is the builder of record)
|
|
run: pnpm build:native
|
|
|
|
- name: Entry tests (keyless)
|
|
run: node ./test/entry.test.js
|
|
|
|
# NALR_REQUIRE_LANDLOCK: a self-skip on the very platform that exists to
|
|
# prove enforcement would be a false green, so an unenforcing kernel
|
|
# fails the leg instead of skipping.
|
|
- name: Launcher tests (real kernel enforcement)
|
|
run: node ./test/launcher.test.js
|
|
env:
|
|
NALR_REQUIRE_LANDLOCK: 1
|
|
|
|
- name: Pack rehearsal (pack → install → confine, this platform only)
|
|
run: |
|
|
node ./scripts/pack-release.mjs .release/npm --current-platform-only
|
|
node ./scripts/verify-packed-install.mjs .release/npm --current-platform-only
|
|
env:
|
|
NALR_REQUIRE_LANDLOCK: 1
|
|
|
|
darwin:
|
|
name: darwin (no platform package — degradation proof)
|
|
runs-on: macos-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
with:
|
|
package_json_file: native/landlock-run/package.json
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
cache-dependency-path: native/landlock-run/pnpm-lock.yaml
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build TypeScript
|
|
run: pnpm build:ts
|
|
|
|
- name: Typecheck
|
|
run: pnpm typecheck
|
|
|
|
- name: Entry tests (keyless)
|
|
run: node ./test/entry.test.js
|
|
|
|
- name: Launcher tests (must self-skip cleanly)
|
|
run: node ./test/launcher.test.js
|
|
|
|
- name: Pack rehearsal (entry only — fallback resolution + unusable probe)
|
|
run: |
|
|
node ./scripts/pack-release.mjs .release/npm --current-platform-only
|
|
node ./scripts/verify-packed-install.mjs .release/npm --current-platform-only
|