fix(macos): the sweep reopened its path list once per changed file #210
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # augur CI uses ONLY free GitHub-hosted runners, and NO job boots a VZ guest. GitHub's arm64 | |
| # macOS runners are themselves Virtualization.framework guests with no nested-virtualization | |
| # support, so anything that boots a VM/microVM — the macOS VM mode or Apple Container mode — | |
| # cannot run on any GitHub-hosted runner (standard or larger). The heavy live E2Es therefore | |
| # live in LOCAL gates run before tagging a release: `make e2e` (macOS VM: boots a VM and runs | |
| # xcodebuild test) and the Apple Container egress FAIL-CLOSED proof (tests/22 via | |
| # tests/verify_apple_container_host.sh). See README "Continuous integration". | |
| # | |
| # What DOES run here: | |
| # • build-unit (macos-26) Swift build/test of the CLIs, shellcheck, version smoke. No VM. | |
| # • offline-tests (ubuntu-latest) Seam + command-construction tiers (shimmed `container`, no | |
| # runtime). No engine/VM needed. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Least privilege. NEITHER job uses a secret: the coding agent is never authenticated in CI | |
| # (mock-the-agent). So pull_request runs from forks are safe — there is nothing to exfiltrate. | |
| # Do NOT add `secrets.*` to these jobs without first adding a fork-PR guard; that would break | |
| # the guarantee above. | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| # Supersede stale PR iterations, but let every push to main run to completion. | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| # ── Build + unit (Swift CLIs, lint, version smoke) — no engine, no VM ──────── | |
| build-unit: | |
| name: build-unit (macos-26) | |
| runs-on: macos-26 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Toolchain | |
| run: swift --version && sw_vers | |
| # swift build (augur-vm + augur-proxy) · swift test (augur-proxy) · shellcheck · | |
| # `augur version` smoke. Deliberately no `augur status`/`up`: they require a container | |
| # engine that isn't (and can't be) on this runner. The offline seam/construction tiers | |
| # run on the Linux job (one asserts non-macOS engine selection). | |
| - name: Build + unit + lint | |
| run: make unit | |
| # Real augur-proxy per-mode bind + teardown isolation (32_proxy_per_mode.sh covers the pure | |
| # logic; this exercises the ACTUAL binary just built by `make unit`, binding both mode | |
| # instances on the same ports at different addresses — 127.0.0.1 for VM mode vs a second | |
| # loopback standing in for the container gateway). A missing alias skips (never fails) so a | |
| # runner quirk can't break CI; a real regression (the second instance not binding, or a | |
| # `down` killing the other) fails it. | |
| - name: Proxy per-mode bind isolation (real binary) | |
| run: | | |
| if sudo ifconfig lo0 alias 127.0.0.2 up 2>/dev/null; then | |
| AUGUR_TEST_ADDR_B=127.0.0.2 bash tests/23_proxy_bind_isolation.sh | |
| else | |
| echo "note: could not add 127.0.0.2 loopback alias; skipping real-proxy bind isolation" | |
| fi | |
| # Global connection-cap liveness + capacity gauge against the real binary just built. | |
| # Only binds 127.0.0.1 (no loopback alias needed). Self-skips if the binary is missing. | |
| - name: Proxy connection cap under load (real binary) | |
| run: bash tests/24_proxy_concurrency.sh | |
| # Idle-timeout on established tunnels (#101): an idle tunnel is reclaimed, a low-traffic | |
| # stream survives, --idle-timeout 0 disables. Uses a loopback perl sink as the upstream | |
| # (both ship on the runner); only binds 127.0.0.1. Self-skips if the binary or perl is absent. | |
| - name: Proxy idle-timeout on established tunnels (real binary) | |
| run: bash tests/25_proxy_idle_timeout.sh | |
| # ── Offline seam + command-construction tiers (shimmed container, no runtime) ─ | |
| offline-tests: | |
| name: offline-tests (ubuntu-latest) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Seam + command-construction tiers drive the REAL cmd_up/cmd_claude against a `container` | |
| # shim on PATH — no engine/VM needed, so they run free on Linux. The live tiers (21/22/30) | |
| # self-skip here. The Apple Container egress fail-closed proof (tier 22) is a LOCAL gate | |
| # (Apple Container needs macOS 26+, which no GitHub-hosted runner provides). | |
| - name: Seam + construction tiers (offline shell) | |
| run: make offline-tests |