Include <sys/syscall.h> in ServerBench.cpp for SYS_perf_event_open

`ServerBench.cpp` calls `syscall(SYS_perf_event_open, ...)` but did not include `<sys/syscall.h>`, relying on `<unistd.h>` to transitively provide the `SYS_*` constants. On toolchains where that does not happen, the build fails with `SYS_perf_event_open` not declared. Add the missing include so `server_bench` compiles on any platform that provides `perf_event_open`. Resolves weaselab/conflict-set#41.
Pin CI steps that use bashisms to bash
2026-06-18 22:23:20 -04:00 · 2026-06-12 18:05:57 -04:00 · 2026-06-12 18:04:49 -04:00 · 2026-06-12 17:21:49 -04:00 · 2026-06-12 17:06:31 -04:00 · 2026-06-12 16:35:57 -04:00
7 changed files with 1016 additions and 1160 deletions
@@ -0,0 +1,282 @@
+name: CI
+
+on: [push, pull_request]
+
+jobs:
+  build-image:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest-amd64
+            arch: amd64
+          - runner: ubuntu-latest-arm64
+            arch: arm64
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to registry
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          echo "$REGISTRY_TOKEN" \
+            | docker login -u "$REGISTRY_USER" --password-stdin git.weaselab.dev
+
+      - name: Build and push image if changed
+        run: |
+          image=git.weaselab.dev/weaselab/conflict-set-ci
+          hash="$(sha256sum Dockerfile .pre-commit-config.yaml | sha256sum | cut -c 1-16)"
+          latest="$image:latest-${{ matrix.arch }}"
+          current="$(docker buildx imagetools inspect "$latest" \
+            --format '{{index .Image.Config.Labels "dev.weaselab.ci-hash"}}' 2> /dev/null || true)"
+          if [ "$current" = "$hash" ]; then
+            echo "$latest is up to date"
+          else
+            docker build --push --label "dev.weaselab.ci-hash=$hash" -t "$latest" .
+          fi
+
+  pre-commit:
+    needs: build-image
+    runs-on: ubuntu-latest-amd64
+    container:
+      image: git.weaselab.dev/weaselab/conflict-set-ci:latest-amd64
+      credentials:
+        username: ${{ secrets.REGISTRY_USER }}
+        password: ${{ secrets.REGISTRY_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run pre-commit
+        env:
+          # use the hooks pre-installed in the image
+          HOME: /tmp
+        run: |
+          git config --global --add safe.directory "$PWD"
+          pre-commit run --all-files --show-diff-on-failure
+
+  test:
+    needs: build-image
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: 64-bit-versions
+            cmake_args: -DCMAKE_CXX_FLAGS=-DUSE_64_BIT=1
+          - name: debug
+            cmake_args: -DCMAKE_BUILD_TYPE=Debug
+          - name: simd-fallback
+            cmake_args: -DUSE_SIMD_FALLBACK=ON
+          - name: gcc
+            cmake_args: -DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++
+    runs-on: ubuntu-latest-amd64
+    container:
+      image: git.weaselab.dev/weaselab/conflict-set-ci:latest-amd64
+      credentials:
+        username: ${{ secrets.REGISTRY_USER }}
+        password: ${{ secrets.REGISTRY_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/cache@v4
+        with:
+          path: .ccache
+          key: ccache-${{ matrix.name }}-${{ gitea.sha }}
+          restore-keys: |
+            ccache-${{ matrix.name }}-
+
+      - name: Build
+        run: |
+          export CCACHE_DIR="$GITHUB_WORKSPACE/.ccache"
+          rm -rf build
+          cmake -S . -B build -G Ninja -DCMAKE_CXX_COMPILER_LAUNCHER=ccache ${{ matrix.cmake_args }}
+          ninja -C build
+          ccache -s
+
+      - name: Test
+        run: |
+          cd build
+          ctest --no-compress-output --test-output-size-passed 100000 --test-output-size-failed 100000 -T Test -j "$(nproc)" --timeout 90 > /dev/null
+
+      - name: Upload test results to MinIO
+        if: always()
+        env:
+          MINIO_ACCESS_KEY: ${{ secrets.MINIO_ACCESS_KEY }}
+          MC_HOST_minio: https://${{ secrets.MINIO_ACCESS_KEY }}:${{ secrets.MINIO_SECRET_KEY }}@minio.weaselab.dev
+        run: |
+          if [ -z "$MINIO_ACCESS_KEY" ]; then
+            echo "MinIO credentials not configured; skipping upload"
+            exit 0
+          fi
+          zstd build/Testing/*/Test.xml
+          mc cp build/Testing/*/Test.xml.zst "minio/jenkins/conflict-set/${{ gitea.run_number }}/${{ matrix.name }}/"
+
+      - name: Test summary
+        if: always()
+        run: |
+          python3 ctest_summary.py build/Testing/*/Test.xml \
+            --link "https://minio.weaselab.dev/jenkins/conflict-set/${{ gitea.run_number }}/${{ matrix.name }}/Test.xml.zst" \
+            | tee -a "$GITHUB_STEP_SUMMARY"
+
+  release:
+    needs: build-image
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest-amd64
+            arch: amd64
+          - runner: ubuntu-latest-arm64
+            arch: arm64
+    runs-on: ${{ matrix.runner }}
+    container:
+      image: git.weaselab.dev/weaselab/conflict-set-ci:latest-${{ matrix.arch }}
+      credentials:
+        username: ${{ secrets.REGISTRY_USER }}
+        password: ${{ secrets.REGISTRY_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/cache@v4
+        with:
+          path: .ccache
+          key: ccache-release-${{ matrix.arch }}-${{ gitea.sha }}
+          restore-keys: |
+            ccache-release-${{ matrix.arch }}-
+
+      - name: Build
+        run: |
+          export CCACHE_DIR="$GITHUB_WORKSPACE/.ccache"
+          rm -rf build
+          cmake -S . -B build -G Ninja -DCMAKE_CXX_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_FLAGS=-DNVALGRIND
+          ninja -C build
+          ccache -s
+
+      - name: Test
+        run: |
+          cd build
+          # On arm64, valgrind needs the MAKE_MEM_DEFINED client requests for
+          # https://git.weaselab.dev/weaselab/conflict-set/issues/39, but this
+          # build has -DNVALGRIND, which compiles them out. Skip valgrind
+          # tests here; they run annotated in the test job.
+          ctest --no-compress-output --test-output-size-passed 100000 --test-output-size-failed 100000 ${{ matrix.arch == 'arm64' && '-E valgrind' || '' }} -T Test -j "$(nproc)" --timeout 90 > /dev/null
+
+      - name: Package
+        run: |
+          cd build
+          cpack -G DEB
+          cpack -G RPM
+
+      - name: Build paper
+        if: matrix.arch == 'amd64'
+        run: |
+          cd paper
+          make
+
+      - name: Upload artifacts to MinIO
+        if: always()
+        shell: bash
+        env:
+          MINIO_ACCESS_KEY: ${{ secrets.MINIO_ACCESS_KEY }}
+          MC_HOST_minio: https://${{ secrets.MINIO_ACCESS_KEY }}:${{ secrets.MINIO_SECRET_KEY }}@minio.weaselab.dev
+        run: |
+          if [ -z "$MINIO_ACCESS_KEY" ]; then
+            echo "MinIO credentials not configured; skipping upload"
+            exit 0
+          fi
+          dest="minio/jenkins/conflict-set/${{ gitea.run_number }}/release-${{ matrix.arch }}/"
+          zstd build/Testing/*/Test.xml
+          mc cp build/Testing/*/Test.xml.zst "$dest"
+          # This step runs even when a previous step failed, to upload test
+          # results. The packages may never have been built though, so skip
+          # them if they're missing.
+          if compgen -G "build/*.deb" > /dev/null; then
+            mc cp build/*.deb "$dest"
+          fi
+          if compgen -G "build/*.rpm" > /dev/null; then
+            mc cp build/*.rpm "$dest"
+          fi
+          if compgen -G "paper/*.pdf" > /dev/null; then
+            mc cp paper/*.pdf "$dest"
+          fi
+
+      - name: Test summary
+        if: always()
+        run: |
+          python3 ctest_summary.py build/Testing/*/Test.xml \
+            --link "https://minio.weaselab.dev/jenkins/conflict-set/${{ gitea.run_number }}/release-${{ matrix.arch }}/Test.xml.zst" \
+            | tee -a "$GITHUB_STEP_SUMMARY"
+
+  coverage:
+    needs: build-image
+    runs-on: ubuntu-latest-amd64
+    container:
+      image: git.weaselab.dev/weaselab/conflict-set-ci:latest-amd64
+      credentials:
+        username: ${{ secrets.REGISTRY_USER }}
+        password: ${{ secrets.REGISTRY_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/cache@v4
+        with:
+          path: .ccache
+          key: ccache-coverage-${{ gitea.sha }}
+          restore-keys: |
+            ccache-coverage-
+
+      - name: Build
+        run: |
+          export CCACHE_DIR="$GITHUB_WORKSPACE/.ccache"
+          rm -rf build
+          cmake -S . -B build -G Ninja -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
+            -DCMAKE_C_FLAGS=--coverage -DCMAKE_CXX_FLAGS=--coverage \
+            -DCMAKE_BUILD_TYPE=Debug -DDISABLE_TSAN=ON
+          ninja -C build
+          ccache -s
+
+      - name: Test
+        run: |
+          cd build
+          ctest --no-compress-output --test-output-size-passed 100000 --test-output-size-failed 100000 -T Test -j "$(nproc)" --timeout 90 > /dev/null
+
+      - name: Coverage report
+        shell: bash
+        run: |
+          gcov_args=(-f ConflictSet.cpp -f LongestCommonPrefix.h -f Metrics.h
+                     --gcov-executable "llvm-cov gcov" --exclude-noncode-lines)
+          gcovr "${gcov_args[@]}" --cobertura > build/coverage.xml
+          gcovr "${gcov_args[@]}"
+          mkdir -p build/coverage_html
+          gcovr "${gcov_args[@]}" --html-details build/coverage_html/index.html
+          gcovr "${gcov_args[@]}" --fail-under-line 100 > /dev/null
+
+      - name: Upload results to MinIO
+        if: always()
+        env:
+          MINIO_ACCESS_KEY: ${{ secrets.MINIO_ACCESS_KEY }}
+          MC_HOST_minio: https://${{ secrets.MINIO_ACCESS_KEY }}:${{ secrets.MINIO_SECRET_KEY }}@minio.weaselab.dev
+        run: |
+          if [ -z "$MINIO_ACCESS_KEY" ]; then
+            echo "MinIO credentials not configured; skipping upload"
+            exit 0
+          fi
+          dest="minio/jenkins/conflict-set/${{ gitea.run_number }}/coverage/"
+          zstd build/Testing/*/Test.xml
+          mc cp build/Testing/*/Test.xml.zst "$dest"
+          if [ -e build/coverage.xml ]; then
+            mc cp build/coverage.xml "$dest"
+          fi
+          if [ -d build/coverage_html ]; then
+            mc cp -r build/coverage_html "$dest"
+          fi
+
+      - name: Test summary
+        if: always()
+        run: |
+          python3 ctest_summary.py build/Testing/*/Test.xml \
+            --link "https://minio.weaselab.dev/jenkins/conflict-set/${{ gitea.run_number }}/coverage/Test.xml.zst" \
+            | tee -a "$GITHUB_STEP_SUMMARY"
+          echo "" | tee -a "$GITHUB_STEP_SUMMARY"
+          echo "📊 [Coverage report](https://minio.weaselab.dev/jenkins/conflict-set/${{ gitea.run_number }}/coverage/coverage_html/index.html)" | tee -a "$GITHUB_STEP_SUMMARY"
@@ -32,8 +32,12 @@ if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
 endif()

 add_compile_options(
-  # -Werror=switch-enum
-  -Wswitch-enum -Wunused-variable -fPIC -fdata-sections -ffunction-sections
+  -Werror=switch-enum
+  -Wswitch-enum
+  -Wunused-variable
+  -fPIC
+  -fdata-sections
+  -ffunction-sections
  -fno-jump-tables # https://github.com/llvm/llvm-project/issues/54247
 )

@@ -49,6 +53,7 @@ endif()

 if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
  add_compile_options("-Wno-maybe-uninitialized")
+  add_compile_options("-Wno-maybe-musttail-local-addr")
 endif()

 if(NOT APPLE)
@@ -56,12 +61,16 @@ if(NOT APPLE)
  add_compile_options(-g -fno-omit-frame-pointer)
 endif()

-set(full_relro_flags "-pie;LINKER:-z,relro,-z,now,-z,noexecstack")
+set(relro_flags "LINKER:-z,relro,-z,now,-z,noexecstack")
+set(full_relro_flags "-pie;${relro_flags}")
 cmake_push_check_state()
 list(APPEND CMAKE_REQUIRED_LINK_OPTIONS ${full_relro_flags})
 check_cxx_source_compiles("int main(){}" HAS_FULL_RELRO FAIL_REGEX "warning:")
 if(HAS_FULL_RELRO)
-  add_link_options(${full_relro_flags})
+  # -pie only applies to executables; passing it when linking a shared library
+  # makes the driver pull in Scrt1.o, which requires main.
+  add_link_options("$<$<STREQUAL:$<TARGET_PROPERTY:TYPE>,EXECUTABLE>:-pie>"
+                   ${relro_flags})
 endif()
 cmake_pop_check_state()

@@ -374,9 +383,18 @@ if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR AND BUILD_TESTING)
  if(NOT CMAKE_CROSSCOMPILING)
    find_program(HARDENING_CHECK hardening-check)
    if(HARDENING_CHECK)
-      add_test(NAME hardening_check
-               COMMAND ${HARDENING_CHECK} $<TARGET_FILE:${PROJECT_NAME}>
-                       --nofortify --nostackprotector)
+      # Control flow integrity (CET) is x86-only and branch protection (PAC/BTI)
+      # is arm64-only, so ignore whichever doesn't apply.
+      if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR
+                                                    STREQUAL arm64)
+        set(hardening_check_arch_flags --nocfprotection)
+      else()
+        set(hardening_check_arch_flags --nobranchprotection)
+      endif()
+      add_test(
+        NAME hardening_check
+        COMMAND ${HARDENING_CHECK} $<TARGET_FILE:${PROJECT_NAME}> --nofortify
+                --nostackprotector ${hardening_check_arch_flags})
    endif()
  endif()

@@ -8,48 +8,36 @@ RUN chmod -R 777 /tmp
 RUN apt-get update
 RUN apt-get upgrade -y
 RUN TZ=America/Los_Angeles DEBIAN_FRONTEND=noninteractive apt-get install -y \
-    binutils-aarch64-linux-gnu \
+    biber \
    build-essential \
    ccache \
+    clang \
    cmake \
    curl \
    devscripts \
-    g++-aarch64-linux-gnu \
    gcovr \
    git \
-    gnupg \
+    latexmk \
    libc6-dbg \
-    lsb-release \
+    llvm \
    mold \
    ninja-build \
+    nodejs \
    pre-commit \
    python3-requests \
-    qemu-user \
    rpm \
-    software-properties-common \
-    texlive-full \
+    texlive-bibtex-extra \
+    texlive-fonts-recommended \
+    texlive-latex-extra \
+    texlive-pictures \
+    valgrind \
    wget \
    zstd

-# Install recent valgrind from source
-RUN curl -Ls https://sourceware.org/pub/valgrind/valgrind-3.22.0.tar.bz2 -o valgrind.tar.bz2 && \
-    echo "c811db5add2c5f729944caf47c4e7a65dcaabb9461e472b578765dd7bf6d2d4c  valgrind.tar.bz2" > valgrind-sha.txt && \
-    sha256sum --quiet -c valgrind-sha.txt && \
-    mkdir valgrind && \
-    tar --strip-components 1 --no-same-owner --no-same-permissions --directory valgrind -xjf valgrind.tar.bz2 && \
-    cd valgrind && \
-    ./configure --enable-only64bit --enable-lto && \
-    make -j`nproc` && \
-    make install && \
-    cd .. && \
-    rm -rf /tmp/*
+# MinIO client, for uploading build artifacts
+RUN curl -Ls "https://dl.min.io/client/mc/release/linux-$(dpkg --print-architecture)/mc" \
+    -o /usr/local/bin/mc && chmod +x /usr/local/bin/mc

-# Recent clang
-RUN wget https://apt.llvm.org/llvm.sh && chmod +x ./llvm.sh && ./llvm.sh 20
-
-RUN apt-get -y install clang llvm
-
-# Set after building valgrind, which doesn't build with clang for some reason
 ENV CC=clang
 ENV CXX=clang++

@@ -1,151 +0,0 @@
-def CleanBuildAndTest(String cmakeArgs) {
-    sh """
-    export CCACHE_DIR=/ccache
-    rm -rf build
-    mkdir build
-    cd build
-    cmake .. -G Ninja -DCMAKE_CXX_COMPILER_LAUNCHER=ccache ${cmakeArgs} 
-    ninja
-    ccache -s
-    """
-    catchError {
-        sh '''
-        cd build
-        ctest --no-compress-output --test-output-size-passed 100000 --test-output-size-failed 100000 -T Test -j `nproc` --timeout 90 > /dev/null
-        zstd Testing/*/Test.xml
-        '''
-    }
-    xunit tools: [CTest(pattern: 'build/Testing/*/Test.xml')], skipPublishingChecks: false
-    minio bucket: 'jenkins', credentialsId: 'jenkins-minio', excludes: '', host: 'minio.weaselab.dev', includes: 'build/Testing/*/Test.xml.zst', targetFolder: '${JOB_NAME}/${BUILD_NUMBER}/${STAGE_NAME}/'
-}
-
-pipeline {
-    agent any
-    stages {
-        stage('Pre-commit') {
-            agent {
-                dockerfile {
-                    args '-v /home/jenkins/ccache:/ccache'
-                    reuseNode true
-                }
-            }
-            steps {
-                script {
-                    env.HOME = env.WORKSPACE
-                }
-                sh 'pre-commit run --all-files --show-diff-on-failure'
-            }
-        }
-        stage('64 bit versions') {
-            agent {
-                dockerfile {
-                    args '-v /home/jenkins/ccache:/ccache'
-                    reuseNode true
-                }
-            }
-            steps {
-                CleanBuildAndTest("-DCMAKE_CXX_FLAGS=-DUSE_64_BIT=1")
-            }
-        }
-        stage('Debug') {
-            agent {
-                dockerfile {
-                    args '-v /home/jenkins/ccache:/ccache'
-                    reuseNode true
-                }
-            }
-            steps {
-                CleanBuildAndTest("-DCMAKE_BUILD_TYPE=Debug")
-            }
-        }
-        stage('SIMD fallback') {
-            agent {
-                dockerfile {
-                    args '-v /home/jenkins/ccache:/ccache'
-                    reuseNode true
-                }
-            }
-            steps {
-                CleanBuildAndTest("-DUSE_SIMD_FALLBACK=ON")
-            }
-        }
-        stage('Release [clang]') {
-            agent {
-                dockerfile {
-                    args '-v /home/jenkins/ccache:/ccache'
-                    reuseNode true
-                }
-            }
-            steps {
-                CleanBuildAndTest("-DCMAKE_CXX_FLAGS=-DNVALGRIND")
-                recordIssues(tools: [clang()])
-                sh '''
-                cd build
-                cpack -G DEB
-                cpack -G RPM
-                '''
-                sh '''
-                cd paper
-                make
-                '''
-                minio bucket: 'jenkins', credentialsId: 'jenkins-minio', excludes: '', host: 'minio.weaselab.dev', includes: 'build/*.deb,build/*.rpm,paper/*.pdf', targetFolder: '${JOB_NAME}/${BUILD_NUMBER}/${STAGE_NAME}/'
-            }
-        }
-        stage('gcc') {
-            agent {
-                dockerfile {
-                    args '-v /home/jenkins/ccache:/ccache'
-                    reuseNode true
-                }
-            }
-            steps {
-                CleanBuildAndTest("-DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++")
-                recordIssues(tools: [gcc()])
-            }
-        }
-        stage('Release [clang,aarch64]') {
-            agent {
-                dockerfile {
-                    args '-v /home/jenkins/ccache:/ccache'
-                    reuseNode true
-                }
-            }
-            steps {
-                CleanBuildAndTest("-DCMAKE_TOOLCHAIN_FILE=../aarch64-toolchain.cmake -DCMAKE_CXX_FLAGS=-DNVALGRIND")
-                sh '''
-                cd build
-                cpack -G DEB
-                cpack -G RPM
-                '''
-                minio bucket: 'jenkins', credentialsId: 'jenkins-minio', excludes: '', host: 'minio.weaselab.dev', includes: 'build/*.deb,build/*.rpm', targetFolder: '${JOB_NAME}/${BUILD_NUMBER}/${STAGE_NAME}'
-            }
-        }
-        stage('Coverage') {
-            agent {
-                dockerfile {
-                    args '-v /home/jenkins/ccache:/ccache'
-                    reuseNode true
-                }
-            }
-            steps {
-                script {
-                    gcov_args = "-f ConflictSet.cpp -f LongestCommonPrefix.h -f Metrics.h --gcov-executable 'llvm-cov gcov' --exclude-noncode-lines"
-                }
-                CleanBuildAndTest("-DCMAKE_C_FLAGS=--coverage -DCMAKE_CXX_FLAGS=--coverage -DCMAKE_BUILD_TYPE=Debug -DDISABLE_TSAN=ON")
-                sh """
-                gcovr ${gcov_args} --cobertura > build/coverage.xml
-                """
-                recordCoverage qualityGates: [[criticality: 'NOTE', metric: 'MODULE']], tools: [[parser: 'COBERTURA', pattern: 'build/coverage.xml']]
-                sh """
-                gcovr ${gcov_args}
-                gcovr ${gcov_args} --fail-under-line 100 > /dev/null
-                """
-            }
-        }
-    }
-    post {
-        always {
-            emailext mimeType: 'text/html', body: '${SCRIPT, template="groovy-html.template"}', subject: "${env.JOB_NAME} - Build# ${env.BUILD_NUMBER} - ${currentBuild.currentResult}", to: 'andrew@weaselab.dev'
-        }
-    }
-}
@@ -12,6 +12,7 @@
 #include <sys/ioctl.h>
 #include <sys/resource.h>
 #include <sys/socket.h>
+#include <sys/syscall.h>
 #include <sys/types.h>
 #include <sys/uio.h>
 #include <thread>
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""Summarize a CTest Test.xml as markdown.
+
+Intended for $GITHUB_STEP_SUMMARY in CI, where only the first few failures
+are shown inline (pass --link to point at the full Test.xml). Also reusable
+locally to print every failure from a downloaded Test.xml with --all.
+"""
+
+import argparse
+import base64
+import gzip
+import xml.etree.ElementTree as ET
+
+# Failure output is truncated to this many trailing characters, which is
+# usually enough to include e.g. an ASan report's summary.
+OUTPUT_TAIL_CHARS = 3000
+
+
+def test_output(test):
+    value = test.find("./Results/Measurement/Value")
+    if value is None or value.text is None:
+        return ""
+    text = value.text
+    if value.get("encoding") == "base64":
+        raw = base64.b64decode(text)
+        if value.get("compression") == "gzip":
+            raw = gzip.decompress(raw)
+        text = raw.decode(errors="replace")
+    return text
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("test_xml", help="path to a ctest Testing/*/Test.xml")
+    parser.add_argument(
+        "--inline",
+        type=int,
+        default=5,
+        help="how many failures to show inline (default 5)",
+    )
+    parser.add_argument("--all", action="store_true", help="show every failure inline")
+    parser.add_argument(
+        "--link", help="URL of the full Test.xml, linked when failures are elided"
+    )
+    args = parser.parse_args()
+
+    testing = ET.parse(args.test_xml).getroot().find("Testing")
+    tests = testing.findall("Test")
+    failed = [t for t in tests if t.get("Status") == "failed"]
+    notrun = sum(1 for t in tests if t.get("Status") == "notrun")
+
+    if not failed:
+        print(f"✅ All {len(tests) - notrun} tests passed")
+    else:
+        print(f"❌ {len(failed)} of {len(tests)} tests failed\n")
+        shown = failed if args.all else failed[: args.inline]
+        for test in shown:
+            name = test.findtext("Name")
+            output = test_output(test)[-OUTPUT_TAIL_CHARS:].strip()
+            print(f"<details><summary><code>{name}</code></summary>\n")
+            print("````")
+            print(output)
+            print("````")
+            print("</details>\n")
+        remaining = len(failed) - len(shown)
+        if remaining > 0:
+            more = f"… and {remaining} more"
+            if args.link:
+                more += f" — full list in [Test.xml]({args.link})"
+            print(more)
+    if notrun:
+        print(f"\n⚠️ {notrun} tests not run")
+
+
+if __name__ == "__main__":
+    main()
Author	SHA1	Message	Date
weaselbot	25307e9ed6	Include <sys/syscall.h> in ServerBench.cpp for SYS_perf_event_open `ServerBench.cpp` calls `syscall(SYS_perf_event_open, ...)` but did not include `<sys/syscall.h>`, relying on `<unistd.h>` to transitively provide the `SYS_*` constants. On toolchains where that does not happen, the build fails with `SYS_perf_event_open` not declared. Add the missing include so `server_bench` compiles on any platform that provides `perf_event_open`. Resolves weaselab/conflict-set#41.	2026-06-18 22:23:20 -04:00
andrew	48f9ee46cf	Pin CI steps that use bashisms to bash	2026-06-12 18:05:57 -04:00
andrew	f13a30e8aa	Install biber in the CI image so the paper's bibliography builds	2026-06-12 18:04:49 -04:00
andrew	1394a1a98f	Print test summaries to the step log too Gitea doesn't render GITHUB_STEP_SUMMARY yet (https://github.com/go-gitea/gitea/issues/36098), so tee the summary into the log where it's actually visible. Keep writing the summary file so it lights up if Gitea ships the feature.	2026-06-12 17:21:49 -04:00
andrew	c52339a2ba	Add markdown test summaries and a coverage HTML report to CI ctest_summary.py renders a Test.xml as markdown for GITHUB_STEP_SUMMARY: a one-liner when everything passes, otherwise the first few failures inline with a link to the full Test.xml on MinIO. It's also usable locally with --all to list every failure from a downloaded Test.xml. The coverage job now also generates and uploads gcovr's html-details report and links it from the step summary.	2026-06-12 17:06:31 -04:00
andrew	3a82d90914	Work around arm64 clang codegen issues breaking CI Disable preserve_none under ASan on aarch64: every clang tested (20, 21, trunk 22) miscompiles the continuation chains with that combination, crashing ~97% of fuzz corpus tests. The chains still work with the default calling convention. See #38. Mark the masked Node3 scan results defined for valgrind on aarch64: clang 21+ lowers the in-bounds tests through flags+csel, which memcheck models imprecisely, tainting bits the mask provably clears. See #39. Skip valgrind tests in the arm64 release job, since -DNVALGRIND compiles out the client requests the workaround relies on. Both issues track filing upstream bugs.	2026-06-12 16:35:57 -04:00
andrew	0921d8fedf	Fix arch-specific hardening_check and guard CI package upload globs hardening-check tests both CET (x86-only) and branch protection (arm64-only), so pass the ignore flag for whichever doesn't apply to the build arch. The release upload step runs with if: always() so test results are uploaded even when an earlier step fails, but in that case cpack never ran and mc errored on the unmatched package globs. Skip missing packages instead.	2026-06-12 14:45:23 -04:00
andrew	f947d883e7	Only pass -pie when linking executables Passing -pie globally made the driver link Scrt1.o into shared libraries, which fails with an undefined reference to main.	2026-06-12 13:58:54 -04:00
andrew	19f430d68f	Add nodejs to the CI image The runner executes JavaScript actions (checkout, cache) with node from inside the job container, so custom container images must provide it.	2026-06-12 12:33:48 -04:00
andrew	13e9e88e0e	Pass registry credentials via env instead of script interpolation Template interpolation embeds the secret in the generated script file; env indirection keeps it out of argv and off disk.	2026-06-12 12:21:19 -04:00
andrew	12a62a91cf	Track the CI image hash with a label instead of a tag Pushing per-hash tags accumulates multi-GB versions in the registry, and package cleanup rules can't distinguish the hash tags that the latest-{arch} tags currently point to from stale ones. Push only latest-{arch} and record the Dockerfile hash as an image label; the skip-rebuild check reads the label back via buildx imagetools.	2026-06-12 12:16:34 -04:00
andrew	cbbb23bf9d	Shrink the CI image Replace texlive-full with the texlive packages the paper actually needs (latexmk, latex-extra, pictures for TikZ, bibtex-extra, recommended fonts), and use Ubuntu's valgrind instead of building 3.22 from source - the distro version is newer now. Cuts the image by several GB and removes the slowest step of the image build.	2026-06-12 12:12:10 -04:00
andrew	04d02261e9	Install clang from Ubuntu and push image from buildx apt.llvm.org has no repository for the current ubuntu:rolling release, and nothing pins clang 20 - CC=clang already resolved to the distro clang. Drop the llvm.sh step along with its helper packages. docker build now runs under the buildx docker-container driver, which keeps the result in the build cache unless told otherwise, so push directly from the build instead of tagging locally.	2026-06-12 12:06:45 -04:00
andrew	dd8f006d3f	Remove docker socket debug step and unneeded sudo Jobs run as root in the job container; the earlier permission errors were SELinux denials on the mounted podman socket, fixed in the runner config with --security-opt label=disable.	2026-06-12 11:58:30 -04:00
andrew	776d06963b	Add temporary docker socket debug step	2026-06-12 11:52:51 -04:00
andrew	e03afe0651	Run docker with sudo in build-image The default job image runs as a non-root user that lacks access to the mounted docker socket.	2026-06-12 11:30:28 -04:00
andrew	6eecf6e4ac	Use a registry bot account for the container registry Gitea's ephemeral Actions token is not accepted by the container registry, so docker login and image pulls use REGISTRY_USER / REGISTRY_TOKEN secrets (a dedicated low-privilege account and its personal access token with package read/write scope) instead.	2026-06-12 11:16:33 -04:00
andrew	d74a12b5a4	Convert Jenkins CI to Gitea Actions Replace the Jenkinsfile with .gitea/workflows/ci.yml. The CI image is built from the Dockerfile and pushed to the Gitea container registry, rebuilt only when the Dockerfile or pre-commit config changes. The aarch64 release build now runs natively on an arm64 runner instead of cross-compiling, so the cross toolchain and qemu are dropped from the image. Artifacts still go to MinIO (via mc, skipped gracefully if credentials are not configured); ccache uses actions/cache instead of a host volume.	2026-06-12 11:13:32 -04:00
andrew	755bbcbe56	Fix gcc 15 build	2025-11-06 13:12:10 -05:00
andrew	2642d453dc	Remove unnecessary branch for interleaved range writes	2024-12-11 21:53:44 -08:00