15 Commits

Include renames

Author	SHA1	Message	Date
andrew	789ae8cbb9	ci: install clang/LLVM 21 in Gitea Actions workflows ... Switch all CI jobs from the distro-packaged clang to the apt.llvm.org clang-21 / llvm-21 toolchain, and register the versioned binaries as alternatives so that CC/CXX=clang/clang++ and tools like llvm-cov and llvm-objcopy use the newer release automatically.	2026-06-22 12:26:19 -04:00
andrew	6d8b939a81	Replace CI Docker image with inline apt installs ... Drops the build-image job and the private registry dependency entirely. Each job now installs only the packages it needs, caching /var/cache/apt/archives keyed on the workflow file and ~/.cache/pre-commit keyed on .pre-commit-config.yaml.	2026-06-21 19:21:04 -04:00
andrew	48f9ee46cf	Pin CI steps that use bashisms to bash	2026-06-12 18:05:57 -04:00
andrew	1394a1a98f	Print test summaries to the step log too ... Gitea doesn't render GITHUB_STEP_SUMMARY yet (https://github.com/go-gitea/gitea/issues/36098), so tee the summary into the log where it's actually visible. Keep writing the summary file so it lights up if Gitea ships the feature.	2026-06-12 17:21:49 -04:00
andrew	c52339a2ba	Add markdown test summaries and a coverage HTML report to CI ... ctest_summary.py renders a Test.xml as markdown for GITHUB_STEP_SUMMARY: a one-liner when everything passes, otherwise the first few failures inline with a link to the full Test.xml on MinIO. It's also usable locally with --all to list every failure from a downloaded Test.xml. The coverage job now also generates and uploads gcovr's html-details report and links it from the step summary.	2026-06-12 17:06:31 -04:00
andrew	3a82d90914	Work around arm64 clang codegen issues breaking CI ... Disable preserve_none under ASan on aarch64: every clang tested (20, 21, trunk 22) miscompiles the continuation chains with that combination, crashing ~97% of fuzz corpus tests. The chains still work with the default calling convention. See #38. Mark the masked Node3 scan results defined for valgrind on aarch64: clang 21+ lowers the in-bounds tests through flags+csel, which memcheck models imprecisely, tainting bits the mask provably clears. See #39. Skip valgrind tests in the arm64 release job, since -DNVALGRIND compiles out the client requests the workaround relies on. Both issues track filing upstream bugs.	2026-06-12 16:35:57 -04:00
andrew	0921d8fedf	Fix arch-specific hardening_check and guard CI package upload globs ... hardening-check tests both CET (x86-only) and branch protection (arm64-only), so pass the ignore flag for whichever doesn't apply to the build arch. The release upload step runs with if: always() so test results are uploaded even when an earlier step fails, but in that case cpack never ran and mc errored on the unmatched package globs. Skip missing packages instead.	2026-06-12 14:45:23 -04:00
andrew	13e9e88e0e	Pass registry credentials via env instead of script interpolation ... Template interpolation embeds the secret in the generated script file; env indirection keeps it out of argv and off disk.	2026-06-12 12:21:19 -04:00
andrew	12a62a91cf	Track the CI image hash with a label instead of a tag ... Pushing per-hash tags accumulates multi-GB versions in the registry, and package cleanup rules can't distinguish the hash tags that the latest-{arch} tags currently point to from stale ones. Push only latest-{arch} and record the Dockerfile hash as an image label; the skip-rebuild check reads the label back via buildx imagetools.	2026-06-12 12:16:34 -04:00
andrew	04d02261e9	Install clang from Ubuntu and push image from buildx ... apt.llvm.org has no repository for the current ubuntu:rolling release, and nothing pins clang 20 - CC=clang already resolved to the distro clang. Drop the llvm.sh step along with its helper packages. docker build now runs under the buildx docker-container driver, which keeps the result in the build cache unless told otherwise, so push directly from the build instead of tagging locally.	2026-06-12 12:06:45 -04:00
andrew	dd8f006d3f	Remove docker socket debug step and unneeded sudo ... Jobs run as root in the job container; the earlier permission errors were SELinux denials on the mounted podman socket, fixed in the runner config with --security-opt label=disable.	2026-06-12 11:58:30 -04:00
andrew	776d06963b	Add temporary docker socket debug step	2026-06-12 11:52:51 -04:00
andrew	e03afe0651	Run docker with sudo in build-image ... The default job image runs as a non-root user that lacks access to the mounted docker socket.	2026-06-12 11:30:28 -04:00
andrew	6eecf6e4ac	Use a registry bot account for the container registry ... Gitea's ephemeral Actions token is not accepted by the container registry, so docker login and image pulls use REGISTRY_USER / REGISTRY_TOKEN secrets (a dedicated low-privilege account and its personal access token with package read/write scope) instead.	2026-06-12 11:16:33 -04:00
andrew	d74a12b5a4	Convert Jenkins CI to Gitea Actions ... Replace the Jenkinsfile with .gitea/workflows/ci.yml. The CI image is built from the Dockerfile and pushed to the Gitea container registry, rebuilt only when the Dockerfile or pre-commit config changes. The aarch64 release build now runs natively on an arm64 runner instead of cross-compiling, so the cross toolchain and qemu are dropped from the image. Artifacts still go to MinIO (via mc, skipped gracefully if credentials are not configured); ccache uses actions/cache instead of a host volume.	2026-06-12 11:13:32 -04:00