Merge pull request #93 from logannye/agent/fix-v0.4-ci

fix(ci): restore v0.4 release gates

Author: logannye

.github/workflows/ci.yml

@@ -144,6 +144,7 @@ jobs:
             --reference examples/data/illumina_toy/reference.fa \
             --reads examples/data/illumina_toy/reads_R1.fastq \
             --format bam \
+            --force \
             --output examples/data/illumina_toy/alignments.bam
       - name: Call variants
         run: |
@@ -323,6 +324,13 @@ jobs:
         run: scripts/build-wasm-verifier.sh
       - name: Generated assets are reproducible
         run: git diff --exit-code -- web/verify/pkg crates/receipt-wasm/Cargo.lock
+      - name: Upload generated assets on mismatch
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: receipt-studio-generated-${{ github.run_id }}
+          path: web/verify/pkg
+          if-no-files-found: error
       - name: WASM unit tests
         run: cargo test --manifest-path crates/receipt-wasm/Cargo.toml
 

crates/receipt-wasm/Cargo.toml

@@ -18,3 +18,8 @@ crate-type = ["cdylib", "rlib"]
 rosalind-receipt = { path = "../receipt" }
 wasm-bindgen = "0.2"
 blake3 = "=1.8.2"
+
+# wasm-opt adds a second architecture-dependent transformation. Keep the
+# canonical Linux/amd64 Rust/wasm-bindgen bundle directly reproducible in CI.
+[package.metadata.wasm-pack.profile.release]
+wasm-opt = false

scripts/build-wasm-verifier.sh

@@ -4,15 +4,29 @@
 # Requires:
 #   rustup target add wasm32-unknown-unknown
 #   cargo install wasm-pack --version 0.14.0
-# CI sets RUSTUP_TOOLCHAIN=1.83.0 so committed output is reproducible at the MSRV.
+# CI sets RUSTUP_TOOLCHAIN=1.83.0. The committed bytes are canonical on the
+# Linux/amd64 release platform; other host architectures may emit valid but
+# byte-different optimized Wasm.
 #
-# NOTE: RUSTFLAGS is cleared on purpose. A global `target-cpu` (e.g. the common
+# NOTE: RUSTFLAGS is replaced on purpose. A global `target-cpu` (e.g. the common
 # `~/.cargo/config.toml` with rustflags = ["-C","target-cpu=native"]) resolves to a
-# host CPU that is invalid for wasm32 and makes the wasm-bindgen step fail with
-# "failed to find intrinsics to enable `clone_ref`". Clearing it avoids that.
+# host CPU that is invalid for wasm32. Remapping the checkout and Cargo registry
+# also prevents macOS/Linux absolute paths from leaking into the committed Wasm.
 set -eu
 cd "$(dirname "$0")/.."
-RUSTFLAGS="" wasm-pack build crates/receipt-wasm \
+repo_root=$(pwd)
+cargo_home=${CARGO_HOME:-"$HOME/.cargo"}
+# Populate the registry source directory before deriving canonical remaps. This
+# matters in a fresh CI home where the loop below would otherwise see no crates.
+RUSTFLAGS="" cargo fetch --manifest-path crates/receipt-wasm/Cargo.toml --locked
+separator=$(printf '\037')
+encoded_flags="--remap-path-prefix=$repo_root=/workspace${separator}--remap-path-prefix=$cargo_home=/cargo"
+for registry_source in "$cargo_home"/registry/src/*; do
+  [ -d "$registry_source" ] || continue
+  encoded_flags="${encoded_flags}${separator}--remap-path-prefix=$registry_source=/cargo/registry/src/index"
+done
+RUSTFLAGS="" CARGO_ENCODED_RUSTFLAGS="$encoded_flags" \
+  wasm-pack build crates/receipt-wasm \
   --target web \
   --out-dir ../../web/verify/pkg \
   --out-name rosalind_verify

src/call/types.rs

@@ -23,7 +23,7 @@ pub enum Filter {
 }
 
 /// ACGT index (0..=3) → uppercase ASCII base. Shared by the calling functions.
-pub(crate) const ACGT: [u8; 4] = [b'A', b'C', b'G', b'T'];
+pub(crate) const ACGT: [u8; 4] = *b"ACGT";
 
 /// Tunable thresholds for germline genotyping and honest filtering.
 #[derive(Debug, Clone)]

src/contract.rs

@@ -834,7 +834,7 @@ fn effective_cgroup_v2_limit_bytes() -> Option<u64> {
             .join("memory.max");
         let value = std::fs::read_to_string(path).ok()?;
         let value = value.trim();
-        return (value != "max").then(|| value.parse().ok()).flatten();
+        (value != "max").then(|| value.parse().ok()).flatten()
     }
     #[cfg(not(target_os = "linux"))]
     {

tests/germline_accuracy.rs

@@ -27,7 +27,7 @@ use rosalind::{
     call_germline_whole_genome, GermlineCall, GermlineParams, PileupParams, StreamingBamSource,
 };
 
-const NUCS: [u8; 4] = [b'A', b'C', b'G', b'T'];
+const NUCS: [u8; 4] = *b"ACGT";
 const N: usize = 20_000;
 const READ_LEN: usize = 100;
 

tests/plan_enforce.rs

@@ -439,7 +439,7 @@ fn estimator_upper_bounds_the_realized_working_set() {
 // contig so the reference-decode step is the RSS high-water — exactly where the
 // `Arc::from(Vec)` reallocation transient lives.
 fn pseudo_ref(n: usize) -> Vec<u8> {
-    const BASES: [u8; 4] = [b'A', b'C', b'G', b'T'];
+    const BASES: [u8; 4] = *b"ACGT";
     let mut state: u64 = 0x9E37_79B9_7F4A_7C15;
     (0..n)
         .map(|_| {

web/verify/README.md

@@ -22,6 +22,11 @@ cargo install wasm-pack --version 0.14.0
 RUSTUP_TOOLCHAIN=1.83.0 ./scripts/build-wasm-verifier.sh
 ```
 
+The committed package is generated and checked byte-for-byte on the Linux/amd64
+release platform. Rust's optimized Wasm code generation may differ on other host
+architectures even with the same target and tool versions; local builds remain
+valid but are not the canonical release artifact.
+
 ## Run locally
 
 ES modules and the WASM fetch require HTTP rather than `file://`: