Claude
dd580e0717
Build / Image RASPI (push) Successful in 5m13s
Build / Image MILKV (push) Successful in 14m9s
Build / v4 tests (32- and 64-bit cells) (push) Successful in 18m36s
Acceptance / Acceptance (pull_request) Failing after 10m33s
Build / Image PC (push) Successful in 7m34s
scripts/nightly.sh protocol: every stage a PR, the nightly and a release run -- accept amd64, aarch64, riscv64, stick-high, test-32, proofs, images, docs -- in order, never publish; the first failure ends it. protocol <stage>... runs those only, so each can be its own foreground command (the QEMU rule); accept-amd64 begins a protocol, recording the commit and whether the tree is clean. protocol-report writes logs/<TS>/PROTOCOL.md (the commit, the tree, each stage's result and output, POST and dict_hash per architecture compared, test-32's totals, the proofs' log, the images' and documents' SHA-256) and keeps every stage's output in logs/<TS>/protocol/ -- nothing is left only in build/nightly. PASS only if every stage passed on the commit it began on and the tree is unchanged but for the evidence. acceptance.yml: scripts/check_protocol.sh on the PR's head, first, before the boots. The PR template asks for PROTOCOL.md; .claude/CLAUDE.md names the protocol as the acceptance a developer runs. Captain Bob, 2026-11-07 (#135); 2026-11-12: "Keep working on alpha.5". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017RzZgrf7V7Zk2iczBXDRbm
80 lines
3.4 KiB
YAML
80 lines
3.4 KiB
YAML
# The acceptance protocol, as the gate on every pull request into master (Captain Bob, 2026-11-06:
|
|
# "failures should not be allowed to be merged to master"). It is .claude/CLAUDE.md's protocol,
|
|
# run by the same stages a developer and the nightly run (scripts/nightly.sh), in its order, one
|
|
# QEMU at a time:
|
|
#
|
|
# amd64, aarch64, riscv64 to [zuse@Hera] ok>, POST: PASSED, `3 4 + .` -> 7 ok
|
|
# the PC stick loaded high the same; and the three architectures' dict_hash agree
|
|
# the 32-bit build make -C v4 test-32, 0 failures
|
|
#
|
|
# master's branch protection requires this check to pass before a PR merges. The serial logs and
|
|
# DoE CSVs are kept as the run's artifacts, pass or fail.
|
|
name: Acceptance
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [master]
|
|
types: [opened, synchronize, reopened]
|
|
workflow_dispatch:
|
|
|
|
# No concurrency group (Captain Bob, 2026-11-11, #140: "It should be global"). The one runner
|
|
# (starshipos-vps) has capacity 1, so every job of every workflow waits its turn in Gitea's queue
|
|
# and none is cancelled; a runner-image rebuild still blocks the rest (2026-11-07). A shared
|
|
# concurrency group kept only one waiting run, and each run that joined cancelled it.
|
|
|
|
jobs:
|
|
acceptance:
|
|
name: Acceptance
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gitea.starshipos-f18.org/rajames/lithosananke-runner:4f675c8b75b2 # ci/runner-image (#120)
|
|
credentials: # the registry refuses anonymous pulls
|
|
username: rajames
|
|
password: ${{ secrets.PACKAGES_TOKEN }}
|
|
timeout-minutes: 120
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # the SBOM's version is git describe
|
|
lfs: false # only the logs and DoE CSVs are in LFS; the build needs neither
|
|
|
|
# The developer protocol's evidence first (#135): the PR's head carries a passing
|
|
# logs/<TS>/PROTOCOL.md for its own tree (scripts/nightly.sh protocol, run by hand), or it is
|
|
# refused here, before the boots. The head, not the merge commit the checkout made.
|
|
- name: The developer protocol's evidence
|
|
run: scripts/check_protocol.sh "${{ github.event.pull_request.head.sha || 'HEAD' }}"
|
|
|
|
- name: The capsule-signing key
|
|
env:
|
|
KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
|
|
run: | # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
|
|
if [ -n "$KEY" ]; then
|
|
f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
|
|
(umask 077; printf '%s\n' "$KEY" > "$f")
|
|
echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
|
|
else
|
|
echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
|
|
fi
|
|
|
|
- name: Acceptance amd64
|
|
run: scripts/nightly.sh accept amd64
|
|
- name: Acceptance aarch64
|
|
run: scripts/nightly.sh accept aarch64
|
|
- name: Acceptance riscv64
|
|
run: scripts/nightly.sh accept riscv64
|
|
- name: Acceptance PC stick loaded high
|
|
run: scripts/nightly.sh accept stick-high
|
|
- name: Acceptance 32-bit build
|
|
run: scripts/nightly.sh test-32
|
|
|
|
- name: Keep the logs and DoE CSVs
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: acceptance-logs-${{ github.run_number }}
|
|
path: |
|
|
logs/
|
|
experiments/bare_metal/runs/
|
|
build/nightly/accept-*.txt
|
|
build/nightly/test-32.txt
|