3fa3b0278a
tools/scene/parity.mjs serves site/ (tools/site-serve.mjs) and the app's UI (tools/ui-mock/server.mjs) on a build box, answers every page's /api/live from scene/fixtures/live-2026-10-07.json, freezes the clock at the fixture's instant (Date, timers, requestAnimationFrame) and reads each scene canvas at 900 by 420 px at the first push and the next two polls: the read is the push's own synchronous paint, so a frame depends on the fake time alone, never on how long a fetch took. Known-failed first: the app with --included moved by one unit must differ from /live at every instant (it does: 1,549 / 1,282 / 1,157 px). Then home fold = /live, app Inspect = /live, app with this machine's key = /live with the same key (the overlay is the same picture), and the app's overlay frame differs from its base frame (the overlay is drawn). The compact card is rendered and reported, not compared. A RED line names the differing pixels and their box. tools/scene/parity-remote.sh carries the files to the box (~/.config/igneum/build-server-2 by default) under this lane's prefix and runs it there; a plain CI runner with no box and no Playwright prints a skip line. One new line in tools/ci/pre-push.sh. First run on build-2 at 15:4x UK, release-0.3.21 tree plus scene-parity: every comparison equal at T+0, T+2 and T+4 s. Found on the way and fixed in the harness, not the renderer: lane order keeps the history of earlier layouts (the scene must be at the compared size before its first layout); the app's recorded mock card is a real devnet key (cleared for the base case). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit 4102c935e518e83eba39d880daad1a57b77c3bf8)
171 lines
16 KiB
Bash
Executable file
171 lines
16 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# The one gate. Every fast tree check CI runs, in one script, so the local gate and CI can never drift: the `site` job
|
|
# of .github/workflows/ci.yml calls `tools/ci/pre-push.sh --ci`, and the pre-push hook (tools/ci/install-hooks.sh) calls
|
|
# `tools/ci/pre-push.sh --hook` before any push to master or a release-* branch and refuses the push on red.
|
|
#
|
|
# tools/ci/pre-push.sh # the full gate over this working tree (any worktree; reads the tree, writes nothing in it)
|
|
# tools/ci/pre-push.sh --ci # the same, with the site built in place (a CI checkout is disposable)
|
|
# tools/ci/pre-push.sh --hook # from .git/hooks/pre-push: full gate for master and release-*; the light gate for every
|
|
# # other ref: the two structural checks (conflict markers, Windows paths) and the two
|
|
# # never-push classes (the no-secrets check, the identity grep), about 20 s on the Mac
|
|
# tools/ci/pre-push.sh --self-test # the runner fires on a known failure, passes a known success, the hook picks the
|
|
# # right gate from the ref lines, and the light gate carries the never-push classes
|
|
# tools/ci/pre-push.sh --list # the check names, one per line
|
|
#
|
|
# What is NOT here, on purpose: the three compile-or-compute jobs (igneum-pow tests, igneum-census, the simulators) and
|
|
# the live public API check (master only, a network call), which stay separate steps in ci.yml. Everything here finished
|
|
# in under 25 s on the Mac on 6 October 2026 (no-secrets 10 s, everything else under 3 s each).
|
|
#
|
|
# Local mode never writes into the worktree: the site is built in a temporary copy with SITE_DOWNLOADS_OFFLINE=1
|
|
# (063bbca, 6 October 2026: a hook that built in place rewrote the downloads snapshot in five worktrees). The link, ledger
|
|
# and identity checks then read the committed pages; CI builds in place and checks the rebuilt pages, the one difference.
|
|
set -uo pipefail
|
|
cd "$(git rev-parse --show-toplevel)" || exit 1
|
|
# git hands a hook its own repository through the environment (GIT_DIR, GIT_INDEX_FILE, GIT_PREFIX, ...). Left in place,
|
|
# every nested git inside the self-tests (remote-run.sh builds a mirror and pushes into it) would act on THIS repository
|
|
# and fire this hook again inside the fixture: the first master push through the gate died that way (6 October 2026).
|
|
unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_PREFIX GIT_COMMON_DIR GIT_OBJECT_DIRECTORY GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_QUARANTINE_PATH GIT_PUSH_OPTION_COUNT
|
|
MODE="${1:-local}"; MODE="${MODE#--}"
|
|
RED=0; N=0; LOG="$(mktemp)"; trap 'rm -rf "$LOG" "${SITE_TMP:-}"' EXIT
|
|
T0=$(date +%s)
|
|
|
|
run() {
|
|
# run <name> <command...>: one line per check; the output of a red check is shown in full
|
|
local name="$1"; shift; N=$((N + 1))
|
|
local s=$(date +%s)
|
|
if "$@" >"$LOG" 2>&1; then
|
|
printf ' ok %3ds %s\n' "$(( $(date +%s) - s ))" "$name"
|
|
else
|
|
printf ' RED %3ds %s\n' "$(( $(date +%s) - s ))" "$name"; sed 's/^/ /' "$LOG" | cut -c1-240; RED=1
|
|
fi
|
|
}
|
|
run_quiet() { "$@" >/dev/null 2>&1; }
|
|
|
|
site_build() {
|
|
if [ "$MODE" = ci ]; then node site/build.mjs; return; fi
|
|
SITE_TMP="$(mktemp -d)"; cp -R site "$SITE_TMP/site"
|
|
(cd "$SITE_TMP/site" && SITE_DOWNLOADS_OFFLINE=1 node build.mjs)
|
|
}
|
|
|
|
structural_checks() {
|
|
run "no conflict markers in tracked files" bash tools/ci/no-conflict-markers.sh
|
|
run "every tracked path is valid on Windows (colon, trailing dot, reserved names, length)" bash tools/ci/windows-paths-check.sh
|
|
}
|
|
|
|
never_push_checks() {
|
|
# The two never-push classes, on EVERY ref (7 October 2026: three gate summaries on ca3-v4-node carried a 64-hex key
|
|
# through eight red CI runs in 80 minutes; the feature-branch hook ran only the structural checks, so no lane saw it).
|
|
# A secret or an identity leak must not reach the remote on any branch; together about 20 s on the Mac.
|
|
run "identity grep of the public export list and the served site" bash tools/ci/identity-check.sh
|
|
run "no secret file names and no 64-hex secrets in the tree" bash -c 'bash tools/ci/no-secrets-check.sh --self-test && bash tools/ci/no-secrets-check.sh'
|
|
}
|
|
|
|
tree_checks() {
|
|
run "site build (in a temporary copy locally, in place in CI)" site_build
|
|
run "internal link check of site/*.html" node tools/ci/link-check.mjs
|
|
run "every served page carries the full header (six items, Download, burger)" node tools/ci/site-nav-check.mjs
|
|
run "ledger sentences present verbatim on their public pages" node tools/ci/ledger-text-check.mjs
|
|
never_push_checks
|
|
run "shell inside .github/workflows parses (bash -n, the PowerShell 5.1 rule)" node tools/ci/check-workflow-shell.mjs
|
|
run "PowerShell drive-reference check (\$name: in a double-quoted string)" bash tools/ci/ps-drive-ref-check.sh
|
|
run "copied sources are re-stamped before a build" bash tools/ci/copied-sources-check.sh
|
|
run "the prover pair is built from the pinned node's exec types (prover-pair-check)" bash -c 'bash tools/ci/prover-pair-check.sh --self-test && bash tools/ci/prover-pair-check.sh'
|
|
run "override params files parse with no duplicate key" bash tools/ci/override-json-check.sh
|
|
run "second-engine playbooks log to a file and end their tree (C35)" bash tools/ci/second-engine-check.sh
|
|
run "no playbook quits, pauses or resumes the installed app" bash -c 'bash tools/ci/playbook-quit-check.sh --self-test && bash tools/ci/playbook-quit-check.sh'
|
|
run "no script writes into another worktree or walks Projects" bash -c 'bash tools/ci/no-foreign-tree-writes.sh --self-test && bash tools/ci/no-foreign-tree-writes.sh'
|
|
run "the signer is never piped into head" bash tools/ci/signer-pipe-check.sh
|
|
run "bash bodies in PowerShell job scripts pass bash -n" bash -c 'bash tools/ci/bash-body-check.sh --self-test && bash tools/ci/bash-body-check.sh'
|
|
run "run jobs test their fetched kit before use" bash -c 'bash tools/ci/kit-path-check.sh --self-test && bash tools/ci/kit-path-check.sh'
|
|
run "every Windows spawn of the app runs with a hidden console" bash -c 'node tools/ci/windows-spawn-check.mjs --self-test && node tools/ci/windows-spawn-check.mjs'
|
|
run "pinned guest programs match their manifest" bash tools/ci/pinned-guests-check.sh
|
|
run "no permanent miner fault in the engine (miner-faults.md MF-2)" bash -c 'bash tools/ci/permanent-fault-check.sh --self-test && bash tools/ci/permanent-fault-check.sh'
|
|
run "root prover playbooks kill the GPU server and unlink its socket" bash tools/ci/prover-socket-check.sh
|
|
run "commit-string gate self-test" bash tools/ci/commit-string-check.sh --self-test
|
|
run "build server remote checkout self-test" bash infra/build-server/remote-run.sh --self-test
|
|
run "a slot holder keeps its own line for the whole run (the watcher-trust rule)" bash infra/build-server/remote-run.sh --self-test-keeper
|
|
run "the remote checkout resets the mirror's tree before the branch checkout (the stale-overlay class)" bash -c 'bash tools/ci/mirror-reset-check.sh --self-test && bash tools/ci/mirror-reset-check.sh'
|
|
run "the remote checkout's clean spares a lane's scratch (.igneum-scratch-spare, the fixed prefixes, never -x; the lost-scratch class)" bash -c 'bash tools/ci/scratch-spare-check.sh --self-test && bash tools/ci/scratch-spare-check.sh'
|
|
run "long-running tools keep their body in one parsed block (the edited-while-running class)" bash -c 'bash tools/ci/whole-body-check.sh --self-test && bash tools/ci/whole-body-check.sh'
|
|
run "build-remote without a priority flag bounds suites and benches (nice 10, 32 cores); a gate runs unbounded" bash tools/ci/build-kind-default-check.sh
|
|
run "the class router is a preference with spill-over (a held or overloaded box hands the job to the other one)" bash tools/ci/route-spill-check.sh
|
|
run "no shell assignment hides behind a trailing comment (the swallowed-defaults class)" bash -c 'bash tools/ci/defaults-line-check.sh --self-test && bash tools/ci/defaults-line-check.sh'
|
|
run "no script kills or finds a process by a plain name or a file name (pgrep/pkill -f literals, ps | grep)" bash -c 'bash tools/ci/kill-by-name-check.sh --self-test && bash tools/ci/kill-by-name-check.sh'
|
|
run "the identity check's own self-test (excluded research path passes, exported leak fails)" bash tools/ci/identity-check.sh --self-test
|
|
run "the Windows paths check's own self-test" bash tools/ci/windows-paths-check.sh --self-test
|
|
run "the red watcher's own self-test (one line per run, posted once)" node tools/ci/red-watch.mjs --self-test
|
|
run "faucet unit tests" node --test site/api/faucet.test.mjs
|
|
run "redesign package data tests (the /api/live contract the pages read)" node tools/site-redesign/tests/data-tests.cjs
|
|
run "the home hero's loop never idles in view, stops hidden, resumes without a jump" node tools/site-redesign/tests/hero-loop-test.cjs
|
|
run "chain scene: the site's and the app's copies are scene/ byte for byte, the palette tokens live once (self-test, then the tree)" bash -c 'node tools/scene/sync.mjs --self-test && node tools/scene/sync.mjs --check'
|
|
run "chain scene: a push paints with the document hidden and no animation frame (the blank /live of 7 Oct 2026; known-failed first)" node tools/scene/paint-test.cjs
|
|
run "chain scene: the live feed contract (the recorded reply validates; a rewritten miner, a float now, a stray key refused)" node --test tools/scene/feed-contract.test.mjs
|
|
run "chain scene parity: one recorded feed through the home fold, /live and the app's Inspect view on build-2, three frames each pixel-equal apart from the app's own-key overlay (a changed token fails first; skipped with no box and no Playwright)" bash tools/scene/parity-remote.sh
|
|
run "explorer, emission and public stats unit tests" node --test site/lib/explorer.test.mjs site/lib/emission.test.mjs site/api/public-stats.test.mjs
|
|
run "ship tool self-test" node tools/ship-app.mjs --self-test
|
|
run "interface bundle publisher self-test (pack, and sign when the signer is built)" node tools/ui-ota/publish.mjs --self-test
|
|
run "heat gate reader self-test (a known hold passes, a known drift fails)" node tools/heat-gate.mjs --self-test
|
|
run "relay unit tests" node --test relay/test/parse.test.mjs relay/test/auth.test.mjs relay/test/wake.test.mjs relay/test/ember.test.mjs
|
|
run "miner app notice strip and update card tests" node --test app/igneum-app/ui/notices.test.mjs app/igneum-app/ui/update-card.test.mjs app/igneum-app/ui/view.test.mjs app/igneum-app/ui/tune-line.test.mjs app/igneum-app/ui/ui-ota.test.mjs
|
|
run "the Intel rotate-fold rewrite: Intel gets the shift form, AMD and NVIDIA untouched (proto-opencl/test_intel_rotr.c)" bash -c 'cc -std=c99 -Wall -Wextra -o "${TMPDIR:-/tmp}/test_intel_rotr.$$" proto-opencl/test_intel_rotr.c && "${TMPDIR:-/tmp}/test_intel_rotr.$$"; s=$?; rm -f "${TMPDIR:-/tmp}/test_intel_rotr.$$"; exit $s'
|
|
run "no secret file names and no 64-hex secrets in the tree" bash -c 'bash tools/ci/no-secrets-check.sh --self-test && bash tools/ci/no-secrets-check.sh'
|
|
run "miner app notice strip and update card tests" node --test app/igneum-app/ui/notices.test.mjs app/igneum-app/ui/update-card.test.mjs app/igneum-app/ui/view.test.mjs app/igneum-app/ui/tune-line.test.mjs
|
|
run "launch gates: every row with its check, the handoff text clean (self-test, then the tree)" bash -c 'node tools/ci/launch-gates-check.mjs --self-test && node tools/ci/launch-gates-check.mjs'
|
|
run "income per tier: the public table equals its inputs, the schedule arithmetic" bash -c 'node tools/launch/income-tiers.mjs --check && node --test tools/launch/income-tiers.test.mjs'
|
|
run "hash-origin report: a known-finished day and a known-failed day" node --test tools/observer/hash-origin.test.mjs
|
|
run "harness summaries never carry a raw 64-hex key (the writer's own redaction and check)" node infra/fast-time/lib/redact-keys.mjs --self-test
|
|
}
|
|
|
|
gated_refs() {
|
|
# stdin: the pre-push hook's lines "<local ref> <local sha> <remote ref> <remote sha>". Prints "full" when any remote
|
|
# ref is master or release-*, else "light".
|
|
local lref lsha rref rsha full=0
|
|
while read -r lref lsha rref rsha; do
|
|
case "$rref" in refs/heads/master|refs/heads/release-*) full=1 ;; esac
|
|
done
|
|
[ "$full" = 1 ] && echo full || echo light
|
|
}
|
|
|
|
finish() {
|
|
local what="$1" secs=$(( $(date +%s) - T0 ))
|
|
if [ "$RED" = 0 ]; then echo "pre-push gate ($what): GREEN, $N checks in ${secs}s"; exit 0; fi
|
|
echo "pre-push gate ($what): RED after $N checks in ${secs}s. Fix it before pushing (every check above is one CI runs; the same script runs there)." >&2
|
|
exit 1
|
|
}
|
|
|
|
case "$MODE" in
|
|
self-test)
|
|
fails=0
|
|
st="$(mktemp)" # run in this shell, not a $(...) subshell, so RED is visible here
|
|
run "known failure" false >"$st" 2>&1; out="$(cat "$st")"; case "$out" in *"RED"*"known failure"*) ;; *) echo "self-test failed: a failing check was not reported RED"; fails=1 ;; esac
|
|
[ "$RED" = 1 ] || { echo "self-test failed: a failing check did not set RED"; fails=1; }
|
|
RED=0
|
|
run "known success" true >"$st" 2>&1; out="$(cat "$st")"; rm -f "$st"; case "$out" in *"ok"*"known success"*) ;; *) echo "self-test failed: a passing check was not reported ok"; fails=1 ;; esac
|
|
[ "$RED" = 0 ] || { echo "self-test failed: a passing check set RED"; fails=1; }
|
|
[ "$(printf 'refs/heads/x 1 refs/heads/master 2\n' | gated_refs)" = full ] || { echo "self-test failed: a push to master did not select the full gate"; fails=1; }
|
|
[ "$(printf 'refs/heads/x 1 refs/heads/release-0.3.15 2\n' | gated_refs)" = full ] || { echo "self-test failed: a push to release-0.3.15 did not select the full gate"; fails=1; }
|
|
[ "$(printf 'refs/heads/x 1 refs/heads/x 2\n' | gated_refs)" = light ] || { echo "self-test failed: a push to a feature branch selected the full gate"; fails=1; }
|
|
[ "$(printf '' | gated_refs)" = light ] || { echo "self-test failed: a push with no refs selected the full gate"; fails=1; }
|
|
# the light gate carries the two never-push classes beside the structural checks, and the full gate runs them too
|
|
declare -f never_push_checks | grep -q 'tools/ci/no-secrets-check.sh' || { echo "self-test failed: the never-push checks do not run the no-secrets check"; fails=1; }
|
|
declare -f never_push_checks | grep -q 'tools/ci/identity-check.sh' || { echo "self-test failed: the never-push checks do not run the identity grep"; fails=1; }
|
|
grep -qE '^\s+structural_checks; never_push_checks; finish "feature branch"' "$0" || { echo "self-test failed: the hook's light gate does not run the never-push checks"; fails=1; }
|
|
declare -f tree_checks | grep -q 'never_push_checks' || { echo "self-test failed: the full gate does not run the never-push checks"; fails=1; }
|
|
[ "$fails" = 0 ] && echo "self-test passed: a failing check is RED and fails the gate, a passing one is ok; master and release-* select the full gate, other refs the light one (structural checks, no-secrets, identity grep)"
|
|
exit $fails ;;
|
|
list)
|
|
grep -E '^\s+run "' "$0" | sed -E 's/^\s+run "([^"]+)".*/\1/' ;;
|
|
hook)
|
|
which="$(gated_refs)"
|
|
if [ "$which" = full ]; then
|
|
echo "pre-push gate: a push to master or release-*, the full gate (the same checks CI runs):"
|
|
structural_checks; tree_checks; finish "push to master or release-*"
|
|
else
|
|
echo "pre-push gate: a feature branch, the light gate (the two structural checks, the no-secrets check, the identity grep):"
|
|
structural_checks; never_push_checks; finish "feature branch"
|
|
fi ;;
|
|
ci|local)
|
|
[ "$MODE" = ci ] && echo "pre-push gate in CI (the same script as the local hook):" || echo "pre-push gate over this working tree:"
|
|
structural_checks; tree_checks; finish "$MODE" ;;
|
|
*) echo "usage: tools/ci/pre-push.sh [--ci|--hook|--self-test|--list]" >&2; exit 2 ;;
|
|
esac
|