Repository navigation
fix(sdk): qualify LLVM scans and seed shared CI cache - #65
Conversation
(cherry picked from commit e09627e2f76aaf43c4b8c2bdfe5dd98cc51637cf)
Dependency Review✅ No vulnerabilities or license issues found.Scanned FilesNone |
|
@codex review Please review current commit |
|
@codex security review Please review current commit |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 57bd822a5a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the current commit |
|
@codex security review Please review current commit |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5c66bdc3c7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
(cherry picked from commit e179eac9d2d83bc7f4da28a48ced7acab8d42fb3)
(cherry picked from commit 97b0984486963a8c58b193e8f6eded6d123fbb11)
|
@codex review Please review current commit |
|
@codex security review Please review current commit |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 643cc1edee
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
(cherry picked from commit b8b3aea6b05a30bf3971610c8c111e8d37554804)
|
@codex review Please review current commit |
|
@codex security review Please review current commit |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
🎉 This PR is included in version 1.26.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
## Summary Switch Classic workspace compilation, package inspection and coverage tooling to LLVM 23.1.3 and the LLVM-MinGW UCRT SDK. Portable exports select the authenticated SDK 1.22.0 producer for Classic revision `bd5317a03cdc82f029105c5dc26428b09fcd54b3`. ## Implementation / behavior - Fingerprint compiler, linker, archive utilities and runtime libraries so changed tool bytes invalidate cached builds. Use LLVM inspection for ELF and Windows packages and synchronize worker contracts with the released SDKs. - Freeze authenticated compiler evidence in the same operation's context. Rehash all ten LLVM executables and both runtime archives around prefix/fingerprint probes, configure, build, output capture, runtime inspection and publication. Refreshed installed metadata must equal the caller's frozen evidence. - Admit producer-authenticated CMake, Ninja and pkgconf bytes from protected paths before probing their versions. Recheck identities around tool execution. Bind the shader helper's observed host Python separately from target Python and scrub compiler-probe and packaging environments. - Authenticate the fixed producer's measured `/bin/sh` chain and executable before host probes. Hold no-follow descriptors through bounded hashing and pathname checks, then retain and revalidate the shell's identity through build and export. This separate receipt preserves `installed.json`'s three build-tool records and the seven SDK metadata files. - Obtain shell literals from [created-only collector run 38525579823](https://github.com/atrinik/atrinik/actions/runs/38525579823), using SDK #65's reviewed immutable host dependency. The collector never starts the image and verifies removal of its own container. - Preserve canonical managed-source identity and complete validated metadata in configure fingerprints. Retain source ownership, authority and CAS checks. Reject drifting local Windows producers and retain the supported Docker route when prerequisites are absent. Public `linux verify` remains a byte/layout verifier after relocation without the producer inspector. - Adopt immutable image/platform/producer/consumer coordinates, seven metadata hashes and three complete inventory digests from [SDK collector run 38513888428](https://github.com/atrinik/devcontainer/actions/runs/38513888428). Preserve all Pulse derivative input, size, edit-span, output and ELF checks. - Refresh CI scheduling weights from hosted timings while preserving all tests, three complete shards and deadlines. Retain the actual masked dependency-review job summary as an artifact for current-head inspection. Synchronize contributor and execution guidance. The broad Linux and general Windows pins already provide LLVM 23.1.3. Existing optimization settings, GNU bootstrap/distribution libraries and the replacement Rust/Go profile retain their contracts. ## Validation The preceding integrated implementation ran 2,391 native tests: 2,371 passed and 20 prerequisite cases skipped, with 86% coverage. The final integrated changes ran 176 native tests: 172 passed and four skipped (two ELF prerequisites and two exact SDK-composition cases separately exercised by the successful hosted collector). These include real compiler/shell byte, link and mode changes across build phases, immutable-context controls, receipt propagation, platform refusal and the retained-advance consumer regression. Manifest, guidance inventory, 142 in-memory Python compiles, actionlint with the explicit Ubuntu 26.04 label configuration, signatures and whitespace checks pass. Root self-review and independent review of the exact signed integrated source are clear. SDK [#65](atrinik/devcontainer#65) is merged after current-head CI and manual/automatic code and security reviews. Its local portable, slim and broad Linux qualification passed. The fixed released SDK's four collector jobs pass; independent replay verifies the retained artifact, source bindings, metadata, compiler/runtime roles, inventory maps, hosted filesystem equality and owned cleanup. The actual shell collector and its independent artifact review pass. The preceding wrapper head's actual portable export and relocation passed. Those results are interim evidence: the new head's complete hosted Integration, Windows, portable export/relocation and manual/automatic Codex reviews must pass before merge. ## Limitations / follow-up Collector evidence establishes installed identity under trusted hosted filesystem equality. Its `final_portable_cohort` remains false. Executable checks do not attest transitive OS loaders, libraries, modules or historical execution against privileged swap-and-restore. The shell's single-hardlink requirement is a runtime safety precondition; the final hosted export must confirm it in the actual fixed SDK. Current-head portable acceptance must exercise Pulse bytes and derivative output, complete ELF closure, released sound decodes and relocation with original producer inputs unavailable. Physical Linux GPU qualification belongs to the user's Linux PC; audible playback and human-approved visual results remain separate. After this PR merges, publish synchronized guidance in the provider repository and update the root's full-commit provider pin.
## Summary Finish the LLVM workspace integration and prevent the final test shard from timing out during cleanup. Pin [provider PR #4](atrinik/agent-integrations#4), carry its dependency-report retention repair into the workspace, and rebalance validation using complete hosted test timings. This follows [workspace PR #647](#647) and [SDK PR #65](atrinik/devcontainer#65). ## Implementation / behavior - Pin the provider's verified squash commit, `daa3073dda60b842ca50af98129ea8945447cae5`. Its reviewed guidance covers LLVM 23.1.3, the authenticated SDK 1.22.0 cohort, compiler evidence, shell requirements and Classic qualification boundaries. Provider main CI passes after the merge. - Retain oversized dependency reports for seven days through genuine runner-masked summaries. Validate complete lines, ordering and capacity before assembling masked parts. Incomplete or unsupported reports produce an unknown result. Preserve action pins, permissions and advisory policy. - Refresh 220 test weights from all three hosted timing reports, retaining estimates for shorter or conditionally skipped tests and existing fallback weights. Preserve all 2,480 discovered cases and deterministic, disjoint partitioning. Increase only the test-shard timeout from 15 to 20 minutes to cover setup, evidence upload and cleanup. ## Validation Full hosted discovery verifies all 2,480 cases exactly once: 2,460 passed and 20 were skipped. Combined coverage is 86%, with branch tracking enabled. Integration, native Windows smoke, portable build and relocation, CodeQL and the current dependency review pass. The new portable artifact is bound to this exact commit and independently accepted within its documented scope. The provider/report integration passes 49 focused tests with zero skips; the scheduling repair passes 17 focused tests. Manifest and guidance validation, Python compilation, changed-workflow actionlint 1.7.12 without suppressions, whitespace checks, signatures and strict source cleanliness pass. Guidance remains 16709 bytes under the unchanged 16750-byte limit. Self-review, independent cumulative source/artifact review, and current-commit manual Codex code/security reviews found no issues. Automatic reviews after marking ready remain required before merge. The earlier 15-minute cancellation supplied diagnostic timings, not passing acceptance. The fresh run completes all three shards and cleanup under the new limit. Its longest measured test shard is 849.482 seconds versus the previous 862.732 seconds: about 13 seconds shorter (1.5%). The earlier 21% scheduling forecast is not confirmed by this run; timings vary between hosted runners. Complete validation now succeeds, including aggregate discovery and coverage. ## Limitations / follow-up The oversized-report path has synthetic tests and verified runner semantics; an actual hosted oversized report has not been exercised. Local full coverage tooling is unavailable. The temporary worktree's trust check also prevents native coordinator-test discovery, so complete acceptance remains in hosted CI. Repository-wide actionlint reports an existing unsupported `ubuntu-26.04` label in an unchanged workflow; the changed integration workflow passes. Physical Linux GPU qualification remains user-owned on the user's Linux PC. Audible playback and human-approved visual results remain separate.
Summary
The LLVM SDK scanner cannot start with its existing local logging configuration: compression defaults to enabled and cannot be combined with one retained log file. Local execution reproduces the rejection. Its failure receipts also need reliable startup evidence and the daemon's actual fixed HTTP error code. Separately, expensive shared LLVM builds have no reusable default-branch Actions cache, so new PRs repeat the cold build.
Implementation / behavior
null. Acquisition remains schema 1 with an unstarted container. Recovery observations cannot grant successful qualification.docker-request-deniedHTTP code and known errno names while excluding raw response bodies, stderr, paths and exception text. Preserve immutable image, source, mount, ownership, filesystem equality and cleanup checks.failure.reasonwhen cleanup fails independently. Missing-container lookups remain failed cleanup; they cannot certify removal after a potentially unresolved create.mainpushes that change its inputs. Keep required PR image validation, native Windows tests, existing cache scopes and two-job hosted compiler limits intact.The Moby local driver defaults and configuration validation corroborate the reproduced startup rejection. GitHub documents cache access restrictions across PR merge refs and release tags.
Validation
All 386 integrated source tests pass (320 tools, 66 portable), along with actionlint, required-check aggregation, changed Python compilation, signatures and diff checks. The full suites also pass under ordinary and isolated Python. Regressions exercise the real Docker request path with a mocked connection: lost startup responses followed by fenced running or exited states, unresolved or drifted observations, cleanup failures, actual 403/500 responses for create/start/wait/logs, and create failures followed by missing, denied, malformed, foreign or fully fenced owned lookups. Private response text is never retained. Scanner fixtures also prove invalid execution boundaries are rejected before filesystem access. Root self-review and independent integrated source review are clear. Paired local containers reproduce startup failure with default compression and successful startup with compression disabled; the older cached diagnostic SDK then correctly rejects its missing current build-tool receipt.
Required hosted image/native validation and current-head Codex code and security reviews must pass before merge.
Limitations / follow-up
The old hosted receipt retained an opaque filesystem-qualification failure; the local experiment establishes a concrete compatibility defect without identifying that historical run's exact failing phase. Local builds do not establish equality with the immutable released image. After merge, collect the fixed released 1.22.0 SDK on hosted CI and require successful acquisition, filesystem equality and owned cleanup before adopting wrapper pins.
Local validation is headless; the portable consumer explicitly skips 24 GPU tests. It supplies no physical-GPU, audible-gameplay or native-Windows result. Bare CMake in the broad image needs project shader preparation; the supported workspace wrapper supplies it. An older Classic fixture failed separately because it omitted an LLVM CMake module; the additional broad check uses the unmodified current Classic source where that fixture is already fixed.
The first PR can still build LLVM cold before
mainhas seeded its cache. Changed inputs and cache eviction can also require rebuilding; no measured hosted speedup is claimed yet. This is the single consolidated devcontainer follow-up requested for local validation and CI acceleration.