b2e6d6159e
The app's install clears the jobs folder on a PC, so a run job whose kit was fetched by an earlier fetch job finds
nothing after an update and fails in seconds (5 October 2026, 21:49Z, the AMD kit; bench-log 4df339f). Rule: a run
playbook that reaches a path under the jobs folder other than its own tests the kit is there before its first use,
and the fetch is republished under a new id after any app update.
tools/ci/kit-path-check.sh reads every *.ps1 under relay/playbooks/ and tools/. A kit root is a path derived from
the jobs folder (`$jobs = Split-Path $env:IGNEUM_JOB_DIR` then `Join-Path $jobs '<fetch id>'`, the race-5090.ps1
shape) or one carrying a literal `jobs\` (the amd-card-test.ps1 shape); every path built from it belongs to that kit.
A presence check (Test-Path, [IO.File]::Exists, [IO.Directory]::Exists, Get-Item or Get-ChildItem with -ErrorAction)
on the root or anything under it covers the whole kit. A use before that line fails with "kit path used before a
presence check: republish the fetch after any app update", as does a literal jobs\ path in a command with no check.
The job's own folder ($env:IGNEUM_JOB_DIR) is not a kit path.
Fixtures: kit-path-ok.ps1 (both shapes, checked; a sibling pack file covered by the worker's check) and
kit-path-unchecked.ps1 (the worker run before its check, a literal never checked); --self-test asserts the lines.
Wired into ci.yml after the bash-body step, and into publish-jobs.sh add --kind run beside the other two checks;
test-publish-jobs.sh gains the refusal (34 passed, 0 failed). The current tree: race-5090.ps1 is the one playbook
with a kit, checked before use. README-ship.md: the rule.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
90 lines
4.8 KiB
YAML
90 lines
4.8 KiB
YAML
# CI on every push and pull request (private repository, free runner minutes).
|
|
#
|
|
# What runs: the lottery-hash crate's tests (igneum-pow, release profile), the census tool's build, the two Python
|
|
# simulators' --quick modes (each under two minutes), the site build with an internal link check, the gh-free
|
|
# identity grep of the public export list (tools/ci/forbidden-strings.txt), and the no-secrets check of the tree
|
|
# (tools/ci/no-secrets-check.sh: no file named like a key of ~/.config/igneum, no 64-hex value assigned to a
|
|
# token/key/secret name outside tests and the allowlist; docs/security/keys.md).
|
|
#
|
|
# What does not run, on purpose: the node fork (vendor/igneum-node*, a rusty-kaspa fork of about 500 crates with
|
|
# rocksdb, blst and the execution layer) is gitignored here and too big for the free runners today (a cold build is
|
|
# 20 to 55 minutes on 2 to 8 vCPU, docs/bench-log.md). The workflow builds igneum-pow only; the fork's own tests run
|
|
# on the Mac and the seed node (infra/seed-nodes, infra/fast-time).
|
|
name: ci
|
|
on:
|
|
push:
|
|
pull_request:
|
|
jobs:
|
|
pow:
|
|
name: igneum-pow tests, igneum-census build
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: toolchain
|
|
run: rustc --version && cargo --version
|
|
- name: igneum-pow tests (release)
|
|
working-directory: igneum-pow
|
|
run: cargo test --release
|
|
- name: igneum-census build (release)
|
|
working-directory: igneum-census
|
|
run: cargo build --release
|
|
sims:
|
|
name: simulators, quick modes
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.12'
|
|
- run: python3 -m pip install --quiet numpy
|
|
- name: finality_v2.py --quick (under two minutes)
|
|
working-directory: sim
|
|
run: time timeout 120 python3 finality_v2.py --quick > finality_quick.md
|
|
- name: difficulty/sim.py --quick (under two minutes)
|
|
working-directory: sim/difficulty
|
|
run: time timeout 120 python3 sim.py --quick > difficulty_quick.md
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: sim-quick-output
|
|
path: |
|
|
sim/finality_quick.md
|
|
sim/difficulty/difficulty_quick.md
|
|
site:
|
|
name: site build, link check, identity grep
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
- name: site build
|
|
run: node site/build.mjs
|
|
- name: internal link check of site/*.html
|
|
run: node tools/ci/link-check.mjs
|
|
- name: identity grep of the public export list
|
|
run: bash tools/ci/identity-check.sh
|
|
- name: no conflict markers in tracked files
|
|
run: bash tools/ci/no-conflict-markers.sh
|
|
- name: copied sources are re-stamped before a build
|
|
run: bash tools/ci/copied-sources-check.sh
|
|
- name: bash bodies in PowerShell job scripts pass bash -n, the lost-quote class (self-test first, then the tree)
|
|
run: bash tools/ci/bash-body-check.sh --self-test && bash tools/ci/bash-body-check.sh
|
|
- name: run jobs test their fetched kit before use, the wiped-jobs-folder class (self-test first, then the tree)
|
|
run: bash tools/ci/kit-path-check.sh --self-test && bash tools/ci/kit-path-check.sh
|
|
- name: pinned guest programs match their manifest and are built only by pin-guests.sh
|
|
run: bash tools/ci/pinned-guests-check.sh
|
|
- name: no secret file names and no 64-hex secrets in the tree (self-test first, then the tree)
|
|
run: bash tools/ci/no-secrets-check.sh --self-test && bash tools/ci/no-secrets-check.sh
|
|
- name: faucet unit tests (validation, the daily limits, the signed transaction; keccak, RLP and secp256k1 vectors)
|
|
run: node --test site/api/faucet.test.mjs
|
|
- name: explorer and public stats unit tests (search router, formatters, emission rule against the node's own test values, the documented API fields from a fixture)
|
|
run: node --test site/lib/explorer.test.mjs site/lib/emission.test.mjs site/api/public-stats.test.mjs
|
|
- name: public stats API answers with the documented fields (the live site; master only, the endpoints exist there after the merge)
|
|
if: github.ref == 'refs/heads/master'
|
|
run: node tools/ci/public-api-check.mjs https://igneum.network
|
|
- name: ship tool self-test (version bump, the dl-both and public manifest helpers)
|
|
run: node tools/ship-app.mjs --self-test
|
|
- name: relay unit tests (parsers, secret compare, the wake endpoint)
|
|
run: node --test relay/test/parse.test.mjs relay/test/auth.test.mjs relay/test/wake.test.mjs
|
|
- name: miner app notice strip and update card (ordering, keys, wording, timers, when the card shows)
|
|
run: node --test app/igneum-app/ui/notices.test.mjs app/igneum-app/ui/update-card.test.mjs
|