Skip to content
ci

ci #285

Sign in to view logs

ci

ci #285

Workflow file for this run

.github/workflows/ci.yml at 204b953
name: ci
on:
# Named rather than left bare, which matched every branch and every tag.
# A bare `push` beside `pull_request` runs this twice for one push to a
# branch with a PR open on it, and a branch without one is work in
# progress that its PR will gate. main and tags are what is being
# claimed to work.
push:
branches:
- main
tags:
- "v*"
pull_request:
workflow_dispatch:
# A dependency becomes vulnerable on the day the advisory lands, not on
# the day someone next touches the code. Pushes alone would mean a
# quiet week is indistinguishable from a clean one, so the audit gets a
# heartbeat. The image job opts out of it below: nothing it builds
# changes while the tree sits still.
#
# The daily entry is the boot job's heartbeat, and it exists for the
# opposite reason to the weekly one. Nothing kuma builds changes while
# the tree sits still, but the base it builds *on* moves without anyone
# pushing: a Fedora update can break a boot on a tree that was green
# yesterday. Jobs tell the two apart by matching github.event.schedule.
schedule:
- cron: "0 6 * * 1"
- cron: "0 5 * * *"
env:
CARGO_TERM_COLOR: always
# The 2026-09-30 fedora-bootc float (44.20260930.0) broke every boot
# stage at once: the composed tree's bootloader-update.service died
# parsing the .bootc-aleph.json its own install writes. While that
# looked like upstream's bug, the base was pinned by digest to a ghcr
# mirror of the last good float (quay garbage-collects a manifest
# once its tag moves, and no registry reachable from here held the
# Sep 29 build). The pin came off when a recompose proved its tools
# byte-identical to the floating ones and the real root cause turned
# out to be kuma's own composed bases shipping no version label,
# which the generator now stamps. The heartbeat below is the tripwire
# for the next time the float breaks something this tree did not
# cause. See the issue this failure filed for the whole chain.
# Declared rather than inherited. The repository default is already
# read-only (measured, not assumed: `default_workflow_permissions` is
# "read"), so this changes nothing today. It is the durable record: a
# default lives in a web UI where nobody reviewing this file can see it,
# and nothing here needs more than the checkout.
permissions:
contents: read
jobs:
# Which run is this. Four jobs below gate on "a push or the daily cron,
# but not the weekly audit", and each used to re-type the schedule
# string. Changing the time in the `schedule:` block above would have
# left all four matching nothing: both crons would run only the cheap
# jobs, the daily boot heartbeat would stop, and the workflow would
# stay green, because a skipped job is a green job. The hibernate job
# consumes this output too and deliberately gates differently, daily or
# dispatch and never a push; the reasons are in its own comment.
#
# A job rather than an `env:` value, because `env` is not available in
# a job-level `if:` and actionlint says so. The cost is one runner
# start ahead of the slow jobs; it does not gate `test`, which is what
# a pull request waits on.
when:
runs-on: ubuntu-24.04
# a guard job that takes 3s
timeout-minutes: 5
outputs:
daily: ${{ steps.q.outputs.daily }}
steps:
- id: q
env:
DAILY_CRON: "0 5 * * *"
WEEKLY_CRON: "0 6 * * 1"
run: |
set -euo pipefail
if [ "${{ github.event_name }}" != schedule ]; then
echo "daily=false" >> "$GITHUB_OUTPUT"
exit 0
fi
case "${{ github.event.schedule }}" in
"$DAILY_CRON") echo "daily=true" >> "$GITHUB_OUTPUT" ;;
"$WEEKLY_CRON") echo "daily=false" >> "$GITHUB_OUTPUT" ;;
# Loud, because the alternative is the failure this job
# exists to prevent: an unrecognised schedule would answer
# "not daily", the slow jobs would skip, and the run would be
# green. Moving a cron in the block above without moving it
# here now reddens one cheap job instead of silently
# stopping the heartbeat.
*)
echo "::error::schedule '${{ github.event.schedule }}' matches neither" \
"DAILY_CRON nor WEEKLY_CRON; the crons above and this job have drifted"
exit 1
;;
esac
# The gate that runs on every push. It covers everything checkable
# without a machine to run on, including the cheap tier of the smoke
# tests: every committed example parses, validates, and compiles to an
# image that keeps kuma's floor (greenboot, the lint, the baked
# declaration, a greeter check on every desktop).
test:
runs-on: ubuntu-24.04
# cargo with a warm cache runs in under a minute
timeout-minutes: 20
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
with:
components: clippy, rustfmt
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
- run: cargo fmt --check
- run: cargo test --locked --all-targets
- run: cargo clippy --locked --all-targets -- -D warnings
- run: cargo build --locked --release
# Pinned to an image rather than the runner's shellcheck, because
# the runner's version is whatever the Ubuntu image ships that week
# and it silently decides what this gate means. That is not
# hypothetical: 0.15 was written against 0.11.0 locally, which
# reports these files clean, while the runner had a version that
# still emits SC2015 and fails the step. "shellcheck clean locally"
# has to be the same sentence as "shellcheck clean in CI", and the
# only way to say it once is to name the version.
- name: shellcheck
run: |
docker run --rm -v "$PWD:/mnt:ro" -w /mnt \
koalaman/shellcheck:v0.11.0 scripts/smoke.sh
# A workflow can be valid YAML and still be nonsense to Actions,
# which only says so by refusing to run any job at all. That is a
# slow way to find out, and it already cost one push here: a
# `branches:` key one level too high parsed fine everywhere except
# GitHub. actionlint reads the event schema, and shellchecks the
# inline run blocks that the step above cannot see.
- name: actionlint
# Pinned by DIGEST, for the reason the step above gives about
# shellcheck: a moving tag silently decides what this gate means.
# A version tag would still be mutable, so this is the honest
# form of the same argument. Bump it deliberately. Every
# third-party action in these workflows is pinned by SHA for the
# same reason, Dependabot raising the bumps for review.
uses: docker://rhysd/actionlint@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
with:
args: -color
interop:
# The plan's equivalence proof, green in CI: the same scripted
# NIP-46 client runs against both relays — the Go original at a
# pinned commit and this tree's Rust port — and the same behaviors
# must answer on both wires: the OK replies, the forwarding, the
# refusals with their rules named, the flood refused at the same
# budget, and the eviction emptying a one-minute store. Both runs
# configure the same knobs; the lane asserts structure, because a
# refusal's wording is an implementation's own voice.
#
# The Go relay's source is pinned by commit SHA — the same argument
# the action pins carry: a moving main silently decides what this
# gate means. Dependabot cannot see a raw git clone; the pin is
# bumped by hand, and the diff is the review.
runs-on: ubuntu-24.04
timeout-minutes: 20
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
# v7 runs on node24, which v5 only reached by the runner forcing it
# there over its own node20 declaration — the one warning of its
# kind in this tree. The module cache is off because its restore
# looks for a go.sum at the workspace root and the tree has none:
# the only Go here is the relay cloned below into /tmp, pinned and
# single-module, so the check failed on every run for a download
# the build never needed.
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
cache: false
# The relay's go.mod at the pinned commit asks for go >= 1.25.4,
# and GOTOOLCHAIN=local in this job's environment refuses to fetch
# a toolchain to satisfy it. The runner's preinstalled go is
# whatever the image last shipped (1.24.13 on the day this broke),
# so the job names the version the go.mod asks for and bumps when
# the pin bumps.
go-version: '1.25.4'
- name: build the Go relay at its pinned commit
run: |
set -euo pipefail
git clone --quiet https://github.com/Letdown2491/nip46-relay /tmp/go-relay
git -C /tmp/go-relay checkout --quiet 95b740a77bd279988913634b4605ecc3f68eab9d
cd /tmp/go-relay
go build -trimpath -ldflags="-s -w" -o /tmp/go-relay/nip46-relay .
- name: build the Rust port
run: cargo build --locked --bin nip46-relay
- name: the lane against the Go relay
run: |
set -euo pipefail
RELAY_PORT=":3339" \
KEEP_IN_MINUTES=1 ACCEPT_WINDOW_IN_MINUTES=1 RATE_LIMIT_PER_MINUTE=5 \
/tmp/go-relay/nip46-relay &
sleep 2
# The wait outlives the TTL plus one sweep: the Go store's
# evictor beats every quarter of the TTL from relay start, so
# an event that expires at ~64s is swept at ~75s, and the
# lane's replay must land after the sweep, not before it.
NIP46_RELAY_URL=ws://127.0.0.1:3339 \
NIP46_RATE_LIMIT=5 NIP46_EVICTION_WAIT_SECS=90 \
cargo test --locked --test interop -- --nocapture
- name: the lane against the Rust port
run: |
set -euo pipefail
./target/debug/nip46-relay --bind 127.0.0.1:7778 \
--keep-minutes 1 --accept-window-minutes 1 --rate-limit 5 &
sleep 2
NIP46_RELAY_URL=ws://127.0.0.1:7778 \
NIP46_RATE_LIMIT=5 NIP46_EVICTION_WAIT_SECS=90 \
cargo test --locked --test interop -- --nocapture
# The image stage: actually build every committed declaration with
# podman and inspect the result.
#
# This built only `minimal` for a long time, on the stated grounds that
# a desktop image "does not fit a hosted runner's disk with room to
# spare". Measured on 2026-08-09 rather than argued: a runner ships with
# 88 GB free before reclaiming anything, and a compose plus a full niri
# image costs 5.5 GB of podman storage. The assumption was wrong by more
# than an order of magnitude.
#
# It was also load-bearing in a way nobody intended. `minimal` names a
# base on purpose to stay fast, so the compose kuma performs by default,
# which is the whole own-base architecture, had never run here once, and
# neither had any desktop arm. Every `RUN test -x`, every portal grep,
# the desktop-entry guards and the greeter check now run on a push
# instead of only when someone remembers to build locally.
#
# Cost is about ten minutes, and it does not scale with desktops: the
# compose is the slow part (~5.5 min), and desktops share one composed
# base because their packages are added in the image build, so each
# further desktop is ~2 min. No argument list, so a new example is
# covered without touching this file.
#
image:
runs-on: ubuntu-24.04
# the real exposure here: it normally takes 12 to 14 minutes, and the default is six hours
timeout-minutes: 45
# Skipped on both scheduled runs: this builds a real image with
# podman, and the tree it builds from is the same one it built last
# week. The boot job below does run on the daily one, because its
# input is the moving base rather than the tree.
#
# Skipped on a tag for the same reason. Cutting a release means
# pushing main, waiting for it to go green, and tagging the commit
# that went green, so the tag names a tree this job has already built;
# rebuilding three composed images to reach the same answer only
# delays the release. The rest of this workflow still runs on the tag,
# so a tag made some other way is gated by everything cheap, and
# release.yml runs its own tests on the release target besides.
if: github.event_name != 'schedule' && !startsWith(github.ref, 'refs/tags/')
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
- run: cargo build --locked
- uses: ./.github/actions/kuma-shell
with:
kuma-dir: target/debug
- name: smoke (check + image)
run: ./scripts/smoke.sh
# The heavy tier: write a real encrypted disk, then boot one and ask the
# running machine questions over ssh. Until 2026-08-16 this was
# local-only on the stated grounds that it "needs KVM and sudo", which
# was measured rather than argued and turned out to be one udev rule.
# /dev/kvm is present on a hosted runner and the CPU exposes svm; the
# runner user simply is not in the kvm group. A guest kernel boots under
# the result.
#
# What genuinely does not work here is any qemu GL setup without a host
# DRM node: `-display egl-headless` builds its GL context through one
# ("egl: no drm render node available", measured on a runner and on a
# DRM-less local mount namespace). And the guest needs GL that mesa can
# allocate through — a 3D-less virtio-gpu leaves niri with a renderer it
# cannot create and zero outputs, and the greeter's layer surface is
# closed before it maps (greeter exits rc=0 in a second, measured
# 2026-10-05 in the VM). virtio-gpu-gl hands the guest virgl, and
# Xvfb-backed `gtk,gl=on` gives qemu a GL context on llvmpipe alone.
# That is what QEMU_VGA and QEMU_DISPLAY in smoke.sh select.
#
# Not on pull requests: this is the slow tier and a PR is gated by
# everything cheap. Not on tags, for the same reason the image job skips
# them. One job per example rather than one job for all three, because
# wall clock then costs the slowest example instead of their sum, and a
# failure names the example without anyone opening a log. The price is a
# composed base per desktop instead of one shared between them.
#
# --install and --boot together on purpose: --boot already runs the
# image stage, so the install stage rides along for the cost of the
# install itself rather than a second build.
boot:
runs-on: ubuntu-24.04
needs: when
if: >-
github.event_name != 'pull_request' &&
!startsWith(github.ref, 'refs/tags/') &&
(github.event_name != 'schedule' || needs.when.outputs.daily == 'true')
timeout-minutes: 60
strategy:
# One example failing says nothing about the others, and cancelling
# them costs the run its only evidence about the rest.
fail-fast: false
# niri only, deliberately, and this is the whole desktop policy:
# make one desktop first class before widening. The image job still
# builds every committed example on every push, so nothing here is
# untested, it is un-booted.
#
# cosmic is the experimental desktop and its live arm has never
# booted anywhere; boot-gating it would mean debugging a desktop
# through a harness that is itself new. minimal is not a competing
# desktop at all, it is the fast lane: it names a base rather than
# composing one, which makes it the only example covering
# `base = "..."`, and that coverage lives in the image job where it
# is cheap. Neither belongs in the slow tier yet.
matrix:
example: [niri]
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- name: smoke (install + boot)
uses: ./.github/actions/install-boot
with:
smoke_args: --install --boot ${{ matrix.example }}
# A boot failure is only useful if the guest's own account of it
# survives the runner.
#
# The path is beside the lap dir, not inside it: smoke.sh deletes
# vm-smoke/$name on every un-kept run, pass or fail, so a log read
# from inside the directory was read from a place that no longer
# existed -- these steps tailed nothing and uploaded a warn, every
# red lap, until 2026-10-09's debugging made the omission legible.
# The smoke copies the console beside the lap dir before cleaning
# up (issue #34).
#
# `failure() || cancelled()`: failure() covers a red stage, and
# cancelled() covers the runner killing the job itself (a timeout).
# What it cannot cover is a step whose outcome is "cancelled" while
# the run was never cancelled -- and that shape happened twice
# (2026-08-21 and 2026-08-22), both times because smoke.sh's EXIT
# trap signaled its own process group and the step ended 143. The
# fix for that lives in the trap, not in this predicate; the smoke
# script also asks the guest for its own account before it dies,
# so a red stage no longer depends on these steps to be read.
- name: guest console
if: failure() || cancelled()
run: tail -200 "vm-smoke/console-${{ matrix.example }}.log" || true
- uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
if: failure() || cancelled()
with:
name: console-${{ matrix.example }}
path: vm-smoke/console-${{ matrix.example }}.log
if-no-files-found: warn
# The only job that installs and boots an image built from THIS TREE.
#
# That makes it the only place an unreleased change to install-time or
# first-boot behaviour can be tested at all. The published jobs test an
# artifact that by definition cannot contain it. The boot job used to be
# the weaker sibling here: its disks came out of bootc-image-builder and
# were ext4, so every path that only runs on a btrfs root did nothing
# and a broken converger looked identical to a working one. Since the
# qcow2 exit, `kuma vm` builds its disks with kuma's own installer, so
# the boot job's disks are btrfs-root like a real machine and the
# assertions below run for real there too.
#
# It lived in published.yml until 0.14 and was called `fix-verification`
# there, a name from the one fix it was written for. Being in that file
# meant it ran on publish.yml's call, i.e. after a tag was already
# public: the only job that could catch an install-time regression could
# only report one too late to stop it. v0.13.0 shipped two new boot-time
# units with no coverage here for exactly that reason. It tests the
# tree, so it runs when the tree changes.
install:
runs-on: ubuntu-24.04
needs: when
if: >-
github.event_name != 'pull_request' &&
!startsWith(github.ref, 'refs/tags/') &&
(github.event_name != 'schedule' || needs.when.outputs.daily == 'true')
timeout-minutes: 90
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- name: install the image this tree builds, and boot it
uses: ./.github/actions/install-boot
with:
prebuild: niri
smoke_args: --published localhost/kuma-smoke-niri:latest
- name: guest console
if: failure() || cancelled()
run: tail -200 vm-smoke/console-published.log || true
- uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
if: failure() || cancelled()
with:
name: console-install
path: vm-smoke/console-published.log
if-no-files-found: warn
# 0.15's gate. Every other job here asks whether a machine booted; this
# one asks whether it is the SAME boot.
#
# That distinction is the whole feature. A machine told to hibernate can
# write its memory to disk, power off, and then start fresh, and from
# the outside it is indistinguishable from one that worked: ssh answers,
# greenboot is green, the account is there. What is gone is whatever was
# open, and nothing logs it. So the verdict is the kernel's own boot_id,
# which is made at boot and lives in the memory a real resume restores,
# plus a marker in tmpfs that a cold boot would have cleared.
#
# It runs under Secure Boot, and that is not an extra: kuma ships shim,
# so Secure Boot machines are in scope, and a kernel locked down under
# Secure Boot has historically refused hibernation outright. Without
# this, kuma could tell exactly those machines that hibernate is ready
# while logind refuses to do it. Asking both questions in one job is
# cheap, because the expensive half is the install either way.
#
# It runs on the daily heartbeat and on a manual dispatch, and no longer
# on ordinary pushes. The fixture has accumulated documented QEMU
# artifact classes (a resume that resets instead of powering off, a
# second-firmware poweroff that dies 180ms in, and 2026-08-31's cycle
# that suspended, woke on the alarm, and then never hibernated with the
# guest alive), and a push gate that goes red for a fixture reason is
# one rerun away from being ignored. The nightly run keeps the coverage
# a moving Fedora demands, because resume is exactly what a base update
# breaks silently; the release flow dispatches this job on the exact
# commit before a tag, which CONTRIBUTING records. What it loses per
# push it keeps where the promise lives: this is the only automated
# check that a hibernated machine comes back.
hibernate:
runs-on: ubuntu-24.04
needs: when
if: >-
github.event_name == 'workflow_dispatch' ||
(github.event_name == 'schedule' && needs.when.outputs.daily == 'true')
# Longer than the install job it is built from, because it pays for
# two boots and a hibernation on top of the same install.
timeout-minutes: 120
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- name: install with a swapfile, hibernate under Secure Boot, resume
uses: ./.github/actions/install-boot
with:
prebuild: niri
smoke_args: >-
--published localhost/kuma-smoke-niri:latest
--hibernate --secure-boot
- name: guest console
if: failure() || cancelled()
run: tail -200 vm-smoke/console-published.log || true
- uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
if: failure() || cancelled()
with:
name: console-hibernate
path: vm-smoke/console-published.log
if-no-files-found: warn
# 0.14's gate, and the only job here that answers a question about
# data rather than about a machine.
#
# "A dead disk is recoverable" cannot be met by any amount of testing
# that a backup ran. It is met by destroying a disk and getting the
# files back, which is what this does: install a machine, write files
# in it, back them up, delete the disk, install again with --restore,
# and read the files. MinIO on the runner stands in for the far end,
# because the half under test is kuma's. Whether somebody's own server
# is reachable is a question about their network.
#
# Slow and worth it. It is the only check that exercises the path
# nobody takes twice: you install once, and a stranger installs once,
# and if a restore does not work then nothing else here mattered.
dead-disk:
runs-on: ubuntu-24.04
needs: when
if: >-
github.event_name != 'pull_request' &&
!startsWith(github.ref, 'refs/tags/') &&
(github.event_name != 'schedule' || needs.when.outputs.daily == 'true')
timeout-minutes: 120
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- name: install, back up, destroy, restore, boot
uses: ./.github/actions/install-boot
with:
smoke_args: --dead-disk
# This lap's dir survives its own failure: smoke_dead_disk's early
# returns skip its cleanup, so unlike the loop laps, the console is
# read where it was written. No surviving-copy road here.
- name: guest console
if: failure() || cancelled()
run: tail -200 vm-smoke/dead-disk/console.log || true
- uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
if: failure() || cancelled()
with:
name: console-dead-disk
path: vm-smoke/dead-disk/console.log
if-no-files-found: warn
# The artifact a stranger downloads, and the only one that was built by
# hand on one laptop until now. Every other job here asks whether the
# tree works; this asks whether the thing on the download page works,
# which is the promise 0.10 rests on.
#
# Three questions in the order they fail. Does the ISO assemble at all
# (it never had, anywhere but one machine). Does it still fit a GitHub
# release asset, capped at 2 GB, with the ISO at 1.77 GB and every
# desktop package spending the difference. And does it boot to a
# desktop rather than to a black screen, which is asked over the serial
# console because installer media has no disk to inspect and its
# account has no password for ssh to use.
#
# niri only, and for the same reason the boot job is niri only: one
# desktop is first class and COSMIC's live arm has still never booted
# anywhere.
#
# This job is why a tag can attach an ISO at all. It builds and boots
# one on every push to main and on a daily cron, so the failures live
# here, where they cost a red run instead of a release; release.yml
# switched attaching on once this had gone green on a hosted runner.
iso:
runs-on: ubuntu-24.04
needs: when
if: >-
github.event_name != 'pull_request' &&
!startsWith(github.ref, 'refs/tags/') &&
(github.event_name != 'schedule' || needs.when.outputs.daily == 'true')
timeout-minutes: 60
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
- run: cargo build --locked
- uses: ./.github/actions/kuma-shell
with:
kuma-dir: target/debug
# For qemu and OVMF. The ISO is UEFI-only: it carries an EFI System
# Partition and no BIOS boot image, so a firmware-less qemu falls
# through to "no bootable device" and looks like a broken ISO.
- uses: ./.github/actions/kvm
# An ISO build unpacks the whole image and writes a 1.8 GB file
# beside it, and a hosted runner starts with about 25 GB free.
- name: reclaim runner disk
run: |
df -h / | tail -1
sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \
/usr/local/share/boost "$AGENT_TOOLSDIRECTORY" || true
df -h / | tail -1
- name: smoke (iso)
run: ./scripts/smoke.sh --iso --keep niri
- name: what the live session said
if: failure() || cancelled()
run: tail -200 vm-smoke/console-niri-iso.log || true
- uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
if: failure() || cancelled()
with:
name: iso-console
path: vm-smoke/console-niri-iso.log
if-no-files-found: warn
# Kept on success too, though the verdict is what this job is for:
# the ISO people download comes from a tag, and this one expires in
# a week. What the copy buys is a current known-good ISO between
# releases, which is worth a week of storage and is not a
# distribution channel. Compression is off: the ISO is already a
# solid zstd stream and re-compressing 1.8 GB buys nothing but
# minutes.
- uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
with:
name: kuma-live-iso
path: vm-smoke/niri-iso/KUMA.iso
compression-level: 0
if-no-files-found: error
retention-days: 7
# Nothing else here asks whether the dependencies have known holes.
# Clippy reads our code and the tests read our behavior; neither has an
# opinion about an advisory against a crate we merely depend on. This
# reads Cargo.lock against the RustSec database, which is the other
# reason that lock is committed rather than only pinning our builds.
#
# Plain `cargo audit` fails on vulnerabilities and reports unmaintained
# or yanked crates without failing. That split is deliberate: a crate
# losing its maintainer is worth hearing about on a Monday, and is not
# worth blocking a push over.
audit:
runs-on: ubuntu-24.04
# 17s in practice
timeout-minutes: 10
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
- uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2
with:
tool: cargo-audit
- run: cargo audit
# What a stranger clones must say nothing about who built it.
#
# Three history rewrites established that before this repo went
# public, and every line of prose written afterwards put it back:
# sixteen in tracked files and four in commit messages, found by
# hand on 2026-08-22, six releases after the rule was set. A rule
# nothing grades is not kept, so this grades it.
#
# BY SHAPE, because a public gate cannot name the private strings
# without writing them into the repo it is protecting. An absolute
# home path has a shape, and scripts/publish-audit.sh already
# matches it against the built binary for the same reason;
# linuxbrew is excluded there and here because it is a real path
# that belongs to the software rather than to a person.
- name: no builder identity in the tree
run: |
set -euo pipefail
# The allowlist is names that are deliberately not anybody's:
# linuxbrew is the software's own path, runner is GitHub's, and
# the rest are fixtures. Adding a real name here is a visible
# act in review, which is the point of listing them.
allowed='linuxbrew|/home/runner/|myuser|home/x/|home/me/|home/shared/|mira|kai|testbox'
# No `head` to bound the output: the early exit SIGPIPEs the
# grep, pipefail reads the death as a failed condition, and a
# tree full of paths prints the all-clear.
if paths=$(grep -rInoE '/(var/)?home/[a-z_][a-z0-9_-]*/' \
--exclude-dir=.git . | grep -vE "$allowed") && [ -n "$paths" ]; then
echo "::error::an absolute home path is in the tree:"; echo "$paths"; exit 1
fi
echo "no absolute home paths outside linuxbrew"
# And by name, with the names kept OUT of the repo. The needle is a
# regex in a secret; the gate is public and the thing it looks for
# is not. Absent secret means skip, so a fork and an outside pull
# request do not fail on something they cannot see.
- name: no builder identity in the messages
env:
NEEDLE: ${{ secrets.IDENTITY_REGEX }}
run: |
set -euo pipefail
if [ -z "${NEEDLE:-}" ]; then
echo "::notice::IDENTITY_REGEX is not set; name check skipped"
exit 0
fi
if git log --format='%H %B' -50 | grep -iqE "$NEEDLE"; then
echo "::error::a commit message in the last 50 names the builder"
exit 1
fi
if grep -rIlqE "$NEEDLE" --exclude-dir=.git . ; then
# the match names itself: a red run that says only "the
# builder is named" sent us hunting a regex nobody could
# read. The file list is not secret — the needle is.
grep -rIlE "$NEEDLE" --exclude-dir=.git . | sed 's/^/ /' >&2
echo "::error::a tracked file names the builder"
exit 1
fi
echo "no builder identity by name"