build: verify the zlib tarball before it lands, and mirror the fetch #445
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build | |
| on: | |
| push: | |
| branches: [ "master" ] | |
| pull_request: | |
| branches: [ "master" ] | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install dependencies | |
| # Each guard below soft-skips when its tool is absent, so an unprovisioned | |
| # tool reads as "clean" while the check silently never runs. Install them | |
| # so `make check`'s lint gate is real: | |
| # shellcheck check-shellcheck over all shipped shell scripts | |
| # jq validate-fixtures -> extra/validate-bundle | |
| # libxml2-utils check-diagram-data (xmllint over the SVGs) | |
| # device-tree-compiler check-fdt-unflatten (builds a DTB with dtc) | |
| # python3 check-fdt-unflatten / hardening-fixtures helpers | |
| # clang check-fuzz-harnesses (a -fsanitize=fuzzer compiler) | |
| # groff check-manpages (roff lint of the man pages) | |
| run: sudo apt-get update && sudo apt-get install -y zlib1g-dev gcc-i686-linux-gnu shellcheck jq libxml2-utils device-tree-compiler python3 clang groff | |
| - name: Build | |
| run: make | |
| - name: Run unit + integration tests | |
| run: make check | |
| # Build the 32-bit x86 binary too (auto-static when cross-compiling), so the | |
| # end-to-end step also covers the x86_32 fixture. If the static link is | |
| # unavailable the i686 fixture just skips below — never fatal. | |
| - name: Build i686 | |
| run: make build CC=i686-linux-gnu-gcc || true | |
| # End-to-end over the REAL binary on the x86 fixtures, run NATIVELY (no | |
| # qemu): the only CI coverage of main() + the engine bridge + the renderers, | |
| # which `make check` compiles out under -DKASLD_TESTING. Foreign-arch | |
| # fixtures need qemu and are skipped here (the cross job replays them under | |
| # qemu-user via run_replay). x86 stays native so the common-case renderer | |
| # regression fails fast, before the slow cross matrix. | |
| - name: End-to-end replay (x86, native) | |
| run: KASLD_NATIVE=1 tests/replay tests/fixtures/x86_64/* tests/fixtures/x86_32/* | |
| # Offline soundness gate: assert the resolved window contains the real base | |
| # for the truth-bearing x86 fixtures (truth ∈ window). Native, no qemu — the | |
| # x86_64 host binary matches validate-bundle's build subdir; x86_32 and every | |
| # foreign arch skip here and are covered by the cross job. | |
| - name: Fixture soundness (x86, native) | |
| run: tests/validate-fixtures tests/fixtures/x86_64/* tests/fixtures/x86_32/* | |
| # Truth-free complement: no container-fakeable input may move the GUARANTEED | |
| # window (currently the cgroup-reported MemTotal/LowTotal, faked with the | |
| # DRAM extent present and masked). Runs on anonymized captures too (no truth | |
| # needed); x86_32 is coupled (ceiling rules fire), x86_64 the decoupled | |
| # negative control. | |
| - name: Fixture perturbation (x86, native) | |
| run: tests/validate-fixtures --perturb tests/fixtures/x86_64/* tests/fixtures/x86_32/* | |
| # Compile- and test-gate every released arch on push/PR (matrix + steps in | |
| # _cross-build.yml, shared with release.yml so the arch set can't drift). | |
| # Under qemu-user each arch runs its engine tests (run_test_cross — arch-gated | |
| # rule bodies verified, not just compiled), an end-to-end crash-smoke replay of | |
| # its fixtures (run_replay), and the fixture soundness + perturbation gates | |
| # (run_validate_fixtures) — all on every push. | |
| # Pinned for deterministic PR builds + a stable cache; bump periodically. | |
| # release.yml tracks the latest cross-tools release instead. | |
| # | |
| # Gated on `build`: the slow 22-arch qemu matrix only runs once the fast host | |
| # job (unit + integration + lint + native x86 replay/soundness) has passed — | |
| # fastest-first, bail out before the expensive emulation if a quick check | |
| # already failed. clang-format runs as its own workflow, ungated by design. | |
| cross-compile: | |
| needs: build | |
| uses: ./.github/workflows/_cross-build.yml | |
| with: | |
| toolchain_version: '20260515' | |
| package: false | |
| run_replay: true | |
| run_test_cross: true | |
| run_validate_fixtures: true |