Merge pull request #21 from ngallodev/sync/upstream-step8

Sync upstream through 0ca6e7d (steps 6-8): 0 behind, MCP stays removed

Author: ngallodev

.codebase-memory.json

@@ -0,0 +1,59 @@
+{
+  "test_impact": {
+    "version": 1,
+    "tests": {
+      "presets": {
+        "c-cbm": true
+      }
+    },
+    "rules": [
+      {
+        "id": "harness",
+        "paths": ["tests/test_framework.h", "tests/test_helpers.*", "tests/test_main.c"],
+        "action": "run_all"
+      },
+      {
+        "id": "engine",
+        "paths": [".codebase-memory.json", "src/mcp/test_impact*", "src/store/store_impact.*"],
+        "action": "run_all"
+      },
+      {
+        "id": "build",
+        "paths": ["scripts/**", "test-infrastructure/**", "pkg/**"],
+        "action": "run_all"
+      },
+      {
+        "id": "grammars",
+        "paths": ["internal/cbm/vendored/**"],
+        "action": "run_all"
+      },
+      {
+        "id": "fixtures",
+        "paths": ["tests/fixtures/*/**"],
+        "action": "referencing_tests",
+        "key": "path_segment:2"
+      },
+      {
+        "id": "contracts",
+        "paths": ["tests/**/*.{sh,py,json,txt}"],
+        "action": "ignore"
+      },
+      {
+        "id": "notices",
+        "paths": ["NOTICE*", "CHANGELOG*", "THIRD_PARTY*"],
+        "action": "ignore"
+      }
+    ],
+    "unmapped_files": "run_all",
+    "coverage": {
+      "compatibility_paths": [
+        "tests/test_framework.h",
+        "tests/test_main.c",
+        "tests/test_helpers.h",
+        "Makefile.cbm",
+        "scripts/test-impact/coverage-map.py",
+        "scripts/test-impact/coverage-merge.py"
+      ]
+    }
+  }
+}

.gitattributes

@@ -15,3 +15,10 @@ scripts/hooks/pre-commit       text eol=lf
 # Chialisp grammar corpus: one case asserts CRLF comment termination, so this
 # file must keep its exact bytes on every platform (no eol conversion). (#919)
 tools/tree-sitter-chialisp/test/corpus/comments.txt -text
+
+# llvm-profdata text captures: tests/test_profile_text_parser.py checks their
+# SHA-256, so they keep their exact bytes on every platform (no eol conversion).
+tests/fixtures/profile_text/*.proftext -text
+# Golden profile-map outputs: tests/test_profile_map_v2.py compares the
+# producer's LF bytes against them, so they keep their exact bytes too.
+tests/fixtures/profile_map_v2/*.tsv -text

.github/workflows/_lint.yml

@@ -3,22 +3,31 @@
 name: Lint & Security
 
 on:
-  workflow_call: {}
+  workflow_call:
+    inputs:
+      lanes:
+        description: 'PR lane selection (scripts/ci/select-lanes.sh JSON list); "all" = every job (dry run, release)'
+        type: string
+        default: all
 
 permissions:
   contents: read
 
 jobs:
   lint:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'lint') }}
     # Pinned, not ubuntu-latest: the LLVM install below adds an
     # apt.llvm.org llvm-toolchain-NOBLE repo, which is 24.04 by name. When
     # GitHub moves ubuntu-latest to the next LTS this job breaks on a day
     # nobody chose. Pin the runner to the release the repo line already names.
     runs-on: ubuntu-24.04
     # 15 min proved too tight on a slow runner day and a timed-out lint reads
     # as "cancelled", which the release graph must treat as a hard stop; keep
-    # a bound, but one only a genuine hang can hit (normal runtime ~5 min).
-    timeout-minutes: 30
+    # a bound, but one only a genuine hang can hit. 30 min stopped being that
+    # in 2026-10: single-process cppcheck over a src tree that grew ~60 % in
+    # files took the lint step from ~8 to 22-29 min, and three runs on
+    # 2026-10-13 were cancelled at 30 min with cppcheck still alive.
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -64,6 +73,7 @@ jobs:
   # provability (never suppressed — the NOLINT ban applies here too).
   # Vendored-tree diagnostics are path-filtered, mirroring .cppcheck.
   lint-mem:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'lint-mem') }}
     # Pinned for the same reason as `lint`: llvm-toolchain-noble-21 below.
     runs-on: ubuntu-24.04
     timeout-minutes: 60

.github/workflows/_security.yml

@@ -4,7 +4,12 @@
 name: Security Gate
 
 on:
-  workflow_call: {}
+  workflow_call:
+    inputs:
+      lanes:
+        description: 'PR lane selection (scripts/ci/select-lanes.sh JSON list); "all" = every job (dry run, release)'
+        type: string
+        default: all
 
 permissions:
   contents: read
@@ -16,13 +21,18 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: "Layer 1: Static allow-list audit"
-        run: scripts/security-audit.sh
+        run: |
+          bash tests/test_security_audit_subprocess_calls.sh
+          scripts/security-audit.sh
       - name: "Layer 6: UI security audit"
-        run: scripts/security-ui.sh
+        run: |
+          bash tests/test_security_ui_urls.sh
+          scripts/security-ui.sh
       - name: "Layer 8: Vendored dependency integrity"
         run: scripts/security-vendored.sh
 
   license-gate:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'license-gate') }}
     runs-on: ubuntu-latest
     timeout-minutes: 240
     steps:
@@ -41,6 +51,7 @@ jobs:
         run: scripts/audit-license-provenance.py
 
   codeql-gate:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'codeql-gate') }}
     runs-on: ubuntu-latest
     timeout-minutes: 240
     # Without security-events:read this job inherits the workflow's