wehub-resource-sync
329 lines
15 KiB
YAML
329 lines
15 KiB
YAML
# Reusable: smoke test every binary (standard + UI, all platforms)
|
|
name: Smoke
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
broad_platforms:
|
|
description: 'Smoke the shipped binaries on the broad platform matrix (extra OS versions) instead of the core set'
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
# Emit the platform matrices as JSON. The CORE set is the default (fast,
|
|
# unchanged); the BROAD set adds extra free runners (additional OS versions)
|
|
# that download the SAME shipped artifact for their goos/goarch and verify it
|
|
# runs on a wider range of OS versions. No new artifacts are built — broad
|
|
# legs reuse the exact binaries produced by _build.yml.
|
|
setup-matrix:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
outputs:
|
|
unix: ${{ steps.set.outputs.unix }}
|
|
windows: ${{ steps.set.outputs.windows }}
|
|
portable: ${{ steps.set.outputs.portable }}
|
|
steps:
|
|
- name: Compute matrices
|
|
id: set
|
|
env:
|
|
BROAD: ${{ inputs.broad_platforms }}
|
|
run: |
|
|
CORE_UNIX='[
|
|
{"os":"ubuntu-latest","goos":"linux","goarch":"amd64"},
|
|
{"os":"ubuntu-24.04-arm","goos":"linux","goarch":"arm64"},
|
|
{"os":"macos-14","goos":"darwin","goarch":"arm64"},
|
|
{"os":"macos-15-intel","goos":"darwin","goarch":"amd64"}
|
|
]'
|
|
# Broad legs reuse existing goos/goarch artifacts on additional OS
|
|
# versions to widen the run-anywhere signal without building new targets.
|
|
# Broad legs are REQUIRED gates (no optional / continue-on-error):
|
|
# every smoke leg must pass. No `optional` flags anywhere.
|
|
#
|
|
# NOTE: the *dynamic* linux binary links glibc 2.38+ and cannot run on
|
|
# older distros by design — older-glibc coverage is the -portable (static)
|
|
# binary's job, exercised green by the smoke-linux-portable broad legs
|
|
# (ubuntu-22.04 / 22.04-arm). So the dynamic broad legs stay on
|
|
# forward-compatible OSes only (macOS); running the dynamic binary on
|
|
# ubuntu-22.04 would fail Phase 1 (glibc too old), not a real regression.
|
|
BROAD_UNIX='[
|
|
{"os":"macos-15","goos":"darwin","goarch":"arm64"}
|
|
]'
|
|
CORE_WIN='[{"os":"windows-latest","arch":"amd64"}]'
|
|
# windows-11-arm now runs the NATIVE arm64 binary (build-windows-arm64),
|
|
# not the x86_64 binary under emulation — we smoke the artifact we ship.
|
|
BROAD_WIN='[{"os":"windows-2025","arch":"amd64"},{"os":"windows-11-arm","arch":"arm64"}]'
|
|
CORE_PORTABLE='[
|
|
{"arch":"amd64","runner":"ubuntu-latest"},
|
|
{"arch":"arm64","runner":"ubuntu-24.04-arm"}
|
|
]'
|
|
BROAD_PORTABLE='[
|
|
{"arch":"amd64","runner":"ubuntu-22.04"},
|
|
{"arch":"arm64","runner":"ubuntu-22.04-arm"}
|
|
]'
|
|
if [ "$BROAD" = "true" ]; then
|
|
UNIX=$(jq -cn --argjson a "$CORE_UNIX" --argjson b "$BROAD_UNIX" '$a + $b')
|
|
WIN=$(jq -cn --argjson a "$CORE_WIN" --argjson b "$BROAD_WIN" '$a + $b')
|
|
PORTABLE=$(jq -cn --argjson a "$CORE_PORTABLE" --argjson b "$BROAD_PORTABLE" '$a + $b')
|
|
else
|
|
UNIX=$(jq -cn --argjson a "$CORE_UNIX" '$a')
|
|
WIN=$(jq -cn --argjson a "$CORE_WIN" '$a')
|
|
PORTABLE=$(jq -cn --argjson a "$CORE_PORTABLE" '$a')
|
|
fi
|
|
# Expand each OS entry over both variants into a FLAT include list so
|
|
# every {os,variant} runs as its own job. A {variant:[...],include:$LIST}
|
|
# matrix collapses under GitHub's include-merge (later os entries
|
|
# overwrite the variant combos last-wins), which silently dropped every
|
|
# OS except the last — e.g. only windows-11-arm ran, never windows-latest.
|
|
# Building the cartesian explicitly avoids that.
|
|
VARIANTS='["standard","ui"]'
|
|
UNIX_M=$(jq -cn --argjson a "$UNIX" --argjson v "$VARIANTS" '{include:[$a[] as $o | $v[] as $t | ($o + {variant:$t})]}')
|
|
WIN_M=$(jq -cn --argjson a "$WIN" --argjson v "$VARIANTS" '{include:[$a[] as $o | $v[] as $t | ($o + {variant:$t})]}')
|
|
PORTABLE_M=$(jq -cn --argjson a "$PORTABLE" --argjson v "$VARIANTS" '{include:[$a[] as $o | $v[] as $t | ($o + {variant:$t})]}')
|
|
echo "unix=$UNIX_M" >> "$GITHUB_OUTPUT"
|
|
echo "windows=$WIN_M" >> "$GITHUB_OUTPUT"
|
|
echo "portable=$PORTABLE_M" >> "$GITHUB_OUTPUT"
|
|
|
|
smoke-unix:
|
|
needs: setup-matrix
|
|
strategy:
|
|
fail-fast: false
|
|
matrix: ${{ fromJSON(needs.setup-matrix.outputs.unix) }}
|
|
runs-on: ${{ matrix.os }}
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
|
|
|
|
- name: Extract binary
|
|
run: |
|
|
SUFFIX=${{ matrix.variant == 'ui' && '-ui' || '' }}
|
|
tar -xzf codebase-memory-mcp${SUFFIX}-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
|
|
chmod +x codebase-memory-mcp
|
|
|
|
- name: Start artifact server
|
|
run: |
|
|
mkdir -p /tmp/smoke-server
|
|
cp codebase-memory-mcp /tmp/smoke-server/
|
|
OS=${{ matrix.goos }}; ARCH=${{ matrix.goarch }}
|
|
SUFFIX=${{ matrix.variant == 'ui' && '-ui' || '' }}
|
|
tar -czf "/tmp/smoke-server/codebase-memory-mcp${SUFFIX}-${OS}-${ARCH}.tar.gz" \
|
|
-C /tmp/smoke-server codebase-memory-mcp
|
|
if [ -n "$SUFFIX" ]; then
|
|
cp "/tmp/smoke-server/codebase-memory-mcp${SUFFIX}-${OS}-${ARCH}.tar.gz" \
|
|
"/tmp/smoke-server/codebase-memory-mcp-${OS}-${ARCH}.tar.gz"
|
|
fi
|
|
# The linux binary self-updates from the fully-static "-portable" asset
|
|
# (build_update_url in src/cli/cli.c appends -portable on linux; _build.yml's
|
|
# build-linux-portable job ships it), so the smoke server must serve that name
|
|
# too -- otherwise `update` 404s and Phase 14 fails. Mirror the tarball(s) under
|
|
# the -portable name on linux only.
|
|
if [ "$OS" = "linux" ]; then
|
|
cp "/tmp/smoke-server/codebase-memory-mcp${SUFFIX}-${OS}-${ARCH}.tar.gz" \
|
|
"/tmp/smoke-server/codebase-memory-mcp${SUFFIX}-${OS}-${ARCH}-portable.tar.gz"
|
|
if [ -n "$SUFFIX" ]; then
|
|
cp "/tmp/smoke-server/codebase-memory-mcp${SUFFIX}-${OS}-${ARCH}-portable.tar.gz" \
|
|
"/tmp/smoke-server/codebase-memory-mcp-${OS}-${ARCH}-portable.tar.gz"
|
|
fi
|
|
fi
|
|
cd /tmp/smoke-server
|
|
sha256sum *.tar.gz > checksums.txt 2>/dev/null || shasum -a 256 *.tar.gz > checksums.txt
|
|
python3 -m http.server 18080 -d /tmp/smoke-server &
|
|
|
|
- name: Smoke test
|
|
run: scripts/smoke-test.sh ./codebase-memory-mcp
|
|
env:
|
|
SMOKE_DOWNLOAD_URL: http://localhost:18080
|
|
|
|
- name: Security audits
|
|
run: |
|
|
scripts/security-strings.sh ./codebase-memory-mcp
|
|
scripts/security-install.sh ./codebase-memory-mcp
|
|
scripts/security-network.sh ./codebase-memory-mcp
|
|
|
|
- name: MCP robustness test (linux-amd64 standard only)
|
|
if: matrix.variant == 'standard' && matrix.goos == 'linux' && matrix.goarch == 'amd64'
|
|
run: |
|
|
scripts/security-fuzz.sh ./codebase-memory-mcp
|
|
scripts/security-fuzz-random.sh ./codebase-memory-mcp 60
|
|
|
|
- name: ClamAV scan (Linux)
|
|
if: startsWith(matrix.os, 'ubuntu')
|
|
run: |
|
|
sudo apt-get update -qq && sudo apt-get install -y -qq clamav > /dev/null 2>&1
|
|
# apt auto-starts the clamav-freshclam daemon, which holds a lock on
|
|
# freshclam's log/db; stop it so the manual freshclam below can run
|
|
# (else: "Failed to lock the log file ... Resource temporarily unavailable").
|
|
sudo systemctl stop clamav-freshclam 2>/dev/null || true
|
|
sudo sed -i 's/^Example/#Example/' /etc/clamav/freshclam.conf 2>/dev/null || true
|
|
grep -q "DatabaseMirror" /etc/clamav/freshclam.conf 2>/dev/null || \
|
|
echo "DatabaseMirror database.clamav.net" | sudo tee -a /etc/clamav/freshclam.conf > /dev/null
|
|
sudo freshclam --quiet
|
|
clamscan --no-summary ./codebase-memory-mcp
|
|
|
|
- name: ClamAV scan (macOS)
|
|
if: startsWith(matrix.os, 'macos')
|
|
run: |
|
|
brew install clamav > /dev/null 2>&1
|
|
CLAMAV_ETC=$(brew --prefix)/etc/clamav
|
|
if [ ! -f "$CLAMAV_ETC/freshclam.conf" ]; then
|
|
cp "$CLAMAV_ETC/freshclam.conf.sample" "$CLAMAV_ETC/freshclam.conf" 2>/dev/null || true
|
|
sed -i '' 's/^Example/#Example/' "$CLAMAV_ETC/freshclam.conf" 2>/dev/null || true
|
|
echo "DatabaseMirror database.clamav.net" >> "$CLAMAV_ETC/freshclam.conf"
|
|
fi
|
|
freshclam --quiet --no-warnings 2>/dev/null || freshclam --quiet 2>/dev/null || echo "WARNING: freshclam update failed"
|
|
clamscan --no-summary ./codebase-memory-mcp
|
|
|
|
smoke-windows:
|
|
needs: setup-matrix
|
|
strategy:
|
|
fail-fast: false
|
|
matrix: ${{ fromJSON(needs.setup-matrix.outputs.windows) }}
|
|
runs-on: ${{ matrix.os }}
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
|
|
- uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
|
|
with:
|
|
msystem: ${{ matrix.arch == 'arm64' && 'CLANGARM64' || 'CLANG64' }}
|
|
path-type: inherit
|
|
install: >-
|
|
mingw-w64-clang-${{ matrix.arch == 'arm64' && 'aarch64' || 'x86_64' }}-python3
|
|
mingw-w64-clang-${{ matrix.arch == 'arm64' && 'aarch64' || 'x86_64' }}-curl
|
|
unzip
|
|
zip
|
|
coreutils
|
|
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: binaries-windows-${{ matrix.arch }}
|
|
|
|
- name: Extract binary
|
|
shell: msys2 {0}
|
|
run: |
|
|
SUFFIX=${{ matrix.variant == 'ui' && '-ui' || '' }}
|
|
ARCH=${{ matrix.arch }}
|
|
unzip -o "codebase-memory-mcp${SUFFIX}-windows-${ARCH}.zip"
|
|
[ -n "$SUFFIX" ] && cp "codebase-memory-mcp${SUFFIX}.exe" codebase-memory-mcp.exe || true
|
|
|
|
- name: Start artifact server
|
|
shell: msys2 {0}
|
|
run: |
|
|
mkdir -p /tmp/smoke-server
|
|
cp codebase-memory-mcp.exe /tmp/smoke-server/
|
|
SUFFIX=${{ matrix.variant == 'ui' && '-ui' || '' }}
|
|
ARCH=${{ matrix.arch }}
|
|
cd /tmp/smoke-server
|
|
zip -q "codebase-memory-mcp${SUFFIX}-windows-${ARCH}.zip" codebase-memory-mcp.exe
|
|
if [ -n "$SUFFIX" ]; then
|
|
cp "codebase-memory-mcp${SUFFIX}-windows-${ARCH}.zip" "codebase-memory-mcp-windows-${ARCH}.zip"
|
|
fi
|
|
sha256sum *.zip > checksums.txt
|
|
# Pin to explicit IPv4: on windows-11-arm, `localhost` resolves to ::1 (IPv6)
|
|
# for msys2 curl while python's http.server is IPv4-only -> instant connect
|
|
# failure in smoke Phase 12a. --bind 127.0.0.1 + a 127.0.0.1 URL pin both ends.
|
|
python3 -m http.server 18080 --bind 127.0.0.1 -d /tmp/smoke-server &
|
|
|
|
- name: Smoke test
|
|
shell: msys2 {0}
|
|
run: scripts/smoke-test.sh ./codebase-memory-mcp.exe
|
|
env:
|
|
SMOKE_DOWNLOAD_URL: http://127.0.0.1:18080
|
|
SMOKE_ARCH: ${{ matrix.arch }}
|
|
|
|
- name: Security audits
|
|
shell: msys2 {0}
|
|
run: |
|
|
scripts/security-strings.sh ./codebase-memory-mcp.exe
|
|
scripts/security-install.sh ./codebase-memory-mcp.exe
|
|
|
|
- name: Windows Defender scan
|
|
shell: pwsh
|
|
run: |
|
|
& "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate 2>$null
|
|
$result = & "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "$PWD\codebase-memory-mcp.exe" -DisableRemediation
|
|
$code = $LASTEXITCODE
|
|
Write-Host $result
|
|
# MpCmdRun -Scan exit codes: 0 = clean, 2 = threat found. Any OTHER non-zero
|
|
# means the scan engine could not run at all (e.g. hr=0x800106ba: the Defender
|
|
# antimalware service is unavailable on the runner) — that is NOT a detection.
|
|
# Fail soft on an engine failure so a transient runner-side AV outage can't
|
|
# false-fail a release; only a real detection (exit 2) hard-blocks.
|
|
if ($code -eq 2) {
|
|
Write-Host "BLOCKED: Windows Defender flagged binary!"; exit 1
|
|
} elseif ($code -ne 0) {
|
|
Write-Host "::warning::Windows Defender scan could not run (exit $code) - skipping AV gate on this runner"
|
|
} else {
|
|
Write-Host "=== Windows Defender: clean ==="
|
|
}
|
|
|
|
smoke-linux-portable:
|
|
needs: setup-matrix
|
|
strategy:
|
|
fail-fast: false
|
|
matrix: ${{ fromJSON(needs.setup-matrix.outputs.portable) }}
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: binaries-linux-${{ matrix.arch }}-portable
|
|
|
|
- name: Extract and smoke test
|
|
run: |
|
|
SUFFIX=${{ matrix.variant == 'ui' && '-ui' || '' }}
|
|
tar -xzf codebase-memory-mcp${SUFFIX}-linux-${{ matrix.arch }}-portable.tar.gz
|
|
chmod +x codebase-memory-mcp
|
|
scripts/smoke-test.sh ./codebase-memory-mcp
|
|
|
|
# The -portable binary is what all linux install/update paths now deliver;
|
|
# it MUST start on old glibc (Debian 11 / RHEL 8 / Ubuntu 20.04). Runs it
|
|
# in debian:bullseye (glibc 2.31) — the standard dynamic binary would fail
|
|
# here with `GLIBC_2.38 not found`.
|
|
- name: Old-glibc compatibility
|
|
run: scripts/ci/check-glibc-compat.sh ./codebase-memory-mcp
|
|
|
|
- name: Security audits
|
|
run: |
|
|
scripts/security-strings.sh ./codebase-memory-mcp
|
|
scripts/security-install.sh ./codebase-memory-mcp
|
|
scripts/security-network.sh ./codebase-memory-mcp
|
|
|
|
# ── Packaging check (non-gating) ──────────────────────────────────
|
|
# Builds pkg/glama/Dockerfile — the image Glama builds to score the
|
|
# server — and runs an MCP initialize + tools/list handshake to confirm the
|
|
# containerized stdio server still starts and introspects. Guards the Glama
|
|
# listing integration against drift (Dockerfile breakage, release-asset
|
|
# renames, introspection regressions).
|
|
#
|
|
# Also tests the brew tap/install flow.
|
|
#
|
|
# continue-on-error: a broken *directory* image must never block a release —
|
|
# the shipped product binaries are unaffected. The red X is the signal to fix
|
|
# the integration, not a release gate.
|
|
smoke-packages:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- name: Build Glama image and verify MCP introspection
|
|
run: bash pkg/glama/verify.sh
|
|
- name: Test homebrew installation
|
|
env:
|
|
HOMEBREW_NO_AUTO_UPDATE: 1
|
|
run: |
|
|
eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
|
|
brew tap deusdata/codebase-memory-mcp "$GITHUB_WORKSPACE"
|
|
brew trust deusdata/codebase-memory-mcp
|
|
brew install codebase-memory-mcp
|
|
codebase-memory-mcp --version
|