Repository navigation
P1 test suite evidence (manual) #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: P1 test suite evidence (manual) | |
| on: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| GIT_CONFIG_COUNT: '1' | |
| GIT_CONFIG_KEY_0: core.autocrlf | |
| GIT_CONFIG_VALUE_0: 'false' | |
| jobs: | |
| expanded: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: windows-x64 | |
| runner: windows-2025 | |
| rid: win-x64 | |
| - name: linux-x64 | |
| runner: ubuntu-24.04 | |
| rid: linux-x64 | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 75 | |
| env: | |
| GITHUB_SHA: ${{ github.sha }} | |
| CI_COMMIT_SHA: ${{ github.sha }} | |
| DOTNET_CLI_USE_MSBUILD_SERVER: '0' | |
| DOTNET_CLI_UI_LANGUAGE: en-US | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.sha }} | |
| fetch-depth: 0 | |
| - uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: | | |
| 10.0.400 | |
| 10.0.401 | |
| - name: Verify PowerShell 7 and CI publication contract | |
| shell: pwsh | |
| run: | | |
| if ($PSVersionTable.PSVersion.Major -lt 7) { throw 'PowerShell 7 or newer is required.' } | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath pwsh -ArgumentList @('-NoLogo', '-NoProfile', '-File', 'eng/Test-P1CiPublicationContract.ps1') -TimeoutSeconds 90 -CapturePrefix artifacts/p1-preflight/ci-publication-contract | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath pwsh -ArgumentList @('-NoLogo', '-NoProfile', '-File', 'eng/Test-P1ProductionReceiptDiagnostics.ps1', '-ResultPath', 'artifacts/p1-preflight/receipt-diagnostic-controls.json') -TimeoutSeconds 35 -CapturePrefix artifacts/p1-preflight/receipt-diagnostic-controls | |
| - name: Install and bind rustc 1.98 oracle | |
| shell: pwsh | |
| timeout-minutes: 5 | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| if ($PSVersionTable.PSVersion.Major -lt 7) { throw 'PowerShell 7 or newer is required.' } | |
| $rustup = (Get-Command rustup -CommandType Application -ErrorAction Stop | Select-Object -First 1).Source | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath $rustup -ArgumentList @('toolchain','install','1.98.0','--profile','minimal') -TimeoutSeconds 180 -CapturePrefix artifacts/p1-preflight/oracle-install | |
| # Resolve the rustup proxy, which accepts +1.98.0, through registered PATH. | |
| # The generated Drop harness intentionally searches only 64 PATH entries. | |
| $rustc = (Get-Command rustc -CommandType Application -ErrorAction Stop | Select-Object -First 1).Source | |
| $dotnet = (Get-Command dotnet -CommandType Application -ErrorAction Stop | Select-Object -First 1).Source | |
| if (-not [IO.Path]::IsPathFullyQualified($rustc) -or -not [IO.File]::Exists($rustc) -or | |
| -not [IO.Path]::IsPathFullyQualified($dotnet) -or -not [IO.File]::Exists($dotnet)) { throw 'Explicit oracle/host paths are missing.' } | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath $rustc -ArgumentList @('+1.98.0','--version') -TimeoutSeconds 30 -CapturePrefix artifacts/p1-preflight/oracle-version | |
| $version = [IO.File]::ReadAllText((Join-Path $PWD 'artifacts/p1-preflight/oracle-version.stdout.log')).Trim() | |
| if (-not $version.StartsWith('rustc 1.98.0 (',[StringComparison]::Ordinal)) { throw 'The configured proxy did not select rustc 1.98.0.' } | |
| "RUSTSHARP_RUSTC_PATH=$rustc" | Out-File -LiteralPath $env:GITHUB_ENV -Encoding utf8 -Append | |
| "RUSTSHARP_DOTNET_PATH=$dotnet" | Out-File -LiteralPath $env:GITHUB_ENV -Encoding utf8 -Append | |
| - name: Bind candidate source before build and execution | |
| if: always() | |
| shell: pwsh | |
| run: ./eng/Invoke-BoundedProcess.ps1 -FilePath pwsh -ArgumentList @('-NoLogo','-NoProfile','-File','eng/Get-P1SourceSnapshot.ps1','-CandidateSha',$env:GITHUB_SHA,'-EvidencePath','artifacts/p1-expanded/${{ matrix.name }}/source-snapshot-before.json') -TimeoutSeconds 100 -CapturePrefix 'artifacts/p1-expanded/${{ matrix.name }}/snapshot-before-launch' | |
| - name: Restore and verify zero-warning Release build | |
| shell: pwsh | |
| run: ./eng/Invoke-P1ReleaseBuild.ps1 -CandidateSha $env:GITHUB_SHA -ReportPath 'artifacts/p1-expanded/${{ matrix.name }}/release-build.json' | |
| - name: Verify evidence rejection checks | |
| shell: pwsh | |
| run: ./eng/Invoke-BoundedProcess.ps1 -FilePath pwsh -ArgumentList @('-NoLogo', '-NoProfile', '-File', 'eng/Test-P1EvidenceValidation.ps1') -TimeoutSeconds 40 -CapturePrefix artifacts/p1-preflight/evidence-rejections | |
| - name: Restore ILVerify 10.0.11 tool | |
| shell: pwsh | |
| run: ./eng/Invoke-BoundedProcess.ps1 -FilePath dotnet -ArgumentList @('tool', 'restore', '--tool-manifest', '.config/dotnet-tools.json') -TimeoutSeconds 180 -CapturePrefix artifacts/p1-preflight/tools | |
| - name: Install Linux Native AOT prerequisites | |
| if: matrix.name == 'linux-x64' | |
| shell: pwsh | |
| run: | | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath sudo -ArgumentList @('timeout', '--kill-after=10s', '180s', 'apt-get', 'update') -TimeoutSeconds 200 -CapturePrefix artifacts/p1-preflight/apt-update | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath sudo -ArgumentList @('timeout', '--kill-after=10s', '180s', 'apt-get', 'install', '--no-install-recommends', '-y', 'clang', 'zlib1g-dev') -TimeoutSeconds 200 -CapturePrefix artifacts/p1-preflight/apt-install | |
| - name: Run expanded reports, full harness and immutable baseline audit | |
| if: always() | |
| shell: pwsh | |
| run: ./eng/Invoke-P1SuiteReports.ps1 -CandidateSha $env:GITHUB_SHA -PlatformName '${{ matrix.name }}' | |
| - name: Reverify candidate source after execution | |
| if: always() | |
| shell: pwsh | |
| run: ./eng/Invoke-BoundedProcess.ps1 -FilePath pwsh -ArgumentList @('-NoLogo','-NoProfile','-File','eng/Get-P1SourceSnapshot.ps1','-CandidateSha',$env:GITHUB_SHA,'-EvidencePath','artifacts/p1-expanded/${{ matrix.name }}/source-snapshot.json') -TimeoutSeconds 100 -CapturePrefix 'artifacts/p1-expanded/${{ matrix.name }}/snapshot-after-launch' | |
| - name: Bind frozen gate coverage to the actual full harness | |
| if: always() | |
| shell: pwsh | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| $snapshot = Get-Content -LiteralPath 'artifacts/p1-expanded/${{ matrix.name }}/source-snapshot.json' -Raw | ConvertFrom-Json -Depth 32 | |
| if ($snapshot.candidateSha -cne $env:GITHUB_SHA -or $snapshot.verified -ne $true) { throw 'Fresh candidate snapshot is required.' } | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath dotnet -ArgumentList @('tools/RustSharp.Conformance/bin/Release/net10.0/RustSharp.Conformance.dll','--p1-gate-harness','artifacts/p1-expanded/${{ matrix.name }}/regression-harness.json',$env:GITHUB_SHA,[string]$snapshot.treeSha,'${{ matrix.rid }}','artifacts/p1-expanded/${{ matrix.name }}/p1-gate-harness-coverage.json') -TimeoutSeconds 40 -CapturePrefix 'artifacts/p1-expanded/${{ matrix.name }}/gate-harness-coverage-launch' | |
| - name: Preserve unavailable reports and bind CI publication | |
| if: always() | |
| shell: pwsh | |
| env: | |
| UPSTREAM_STATUS: ${{ job.status }} | |
| run: ./eng/Write-P1CiPublication.ps1 -CandidateSha $env:GITHUB_SHA -PlatformName '${{ matrix.name }}' -RunId '${{ github.run_id }}' -RunAttempt '${{ github.run_attempt }}' -Repository '${{ github.repository }}' -UpstreamStatus $env:UPSTREAM_STATUS | |
| - name: Upload all native reports and bounded launch diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: p1-expanded-${{ matrix.name }}-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-expanded/${{ matrix.name }} | |
| if-no-files-found: error | |
| retention-days: 30 | |
| - name: Upload preflight diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: p1-preflight-${{ matrix.name }}-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-preflight | |
| if-no-files-found: warn | |
| retention-days: 30 | |
| suite-gate: | |
| if: always() | |
| needs: expanded | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.sha }} | |
| - name: Download Windows candidate reports | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: p1-expanded-windows-x64-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-expanded/windows-x64 | |
| - name: Download Linux candidate reports | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: p1-expanded-linux-x64-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-expanded/linux-x64 | |
| - name: Reconcile publication hashes and aggregate P1-10 suite evidence | |
| if: always() | |
| shell: pwsh | |
| env: | |
| GITHUB_SHA: ${{ github.sha }} | |
| NATIVE_JOB_RESULT: ${{ needs.expanded.result }} | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| $failed = $false | |
| try { ./eng/Invoke-BoundedProcess.ps1 -FilePath pwsh -ArgumentList @('-NoLogo','-NoProfile','-File','eng/Test-P1CiPublication.ps1','-CandidateSha',$env:GITHUB_SHA,'-RunId','${{ github.run_id }}','-RunAttempt','${{ github.run_attempt }}','-Repository','${{ github.repository }}','-NativeJobResult',$env:NATIVE_JOB_RESULT) -TimeoutSeconds 30 -CapturePrefix artifacts/p1-candidate/publication-launch } catch { $failed = $true; Write-Warning $_.Exception.Message } | |
| try { ./eng/Invoke-BoundedProcess.ps1 -FilePath pwsh -ArgumentList @('-NoLogo','-NoProfile','-File','eng/Test-P1SuiteGate.ps1','-CandidateSha',$env:GITHUB_SHA,'-WindowsReportSet','artifacts/p1-expanded/windows-x64/p1-suite-report-set.json','-LinuxReportSet','artifacts/p1-expanded/linux-x64/p1-suite-report-set.json','-EvidencePath','artifacts/p1-candidate/p1-suite-gate.json') -TimeoutSeconds 90 -CapturePrefix artifacts/p1-candidate/suite-launch } catch { $failed = $true; Write-Warning $_.Exception.Message } | |
| if ($failed) { exit 1 } | |
| - name: Upload P1-10 aggregate and publication reconciliation | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: p1-suite-gate-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-candidate | |
| if-no-files-found: error | |
| retention-days: 30 | |
| production-native: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: windows-x64 | |
| runner: windows-2025 | |
| - name: linux-x64 | |
| runner: ubuntu-24.04 | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 90 | |
| env: | |
| GITHUB_SHA: ${{ github.sha }} | |
| CI_COMMIT_SHA: ${{ github.sha }} | |
| RUSTSHARP_NATIVE_AOT_SDK_VERSION: '10.0.401' | |
| DOTNET_CLI_USE_MSBUILD_SERVER: '0' | |
| DOTNET_CLI_UI_LANGUAGE: en-US | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.sha }} | |
| fetch-depth: 0 | |
| - uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: | | |
| 10.0.400 | |
| 10.0.401 | |
| - name: Verify PowerShell 7 | |
| shell: pwsh | |
| run: | | |
| if ($PSVersionTable.PSVersion.Major -lt 7) { throw 'PowerShell 7 or newer is required.' } | |
| - name: Install and bind rustc 1.98 oracle | |
| shell: pwsh | |
| timeout-minutes: 5 | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| if ($PSVersionTable.PSVersion.Major -lt 7) { throw 'PowerShell 7 or newer is required.' } | |
| $rustup = (Get-Command rustup -CommandType Application -ErrorAction Stop | Select-Object -First 1).Source | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath $rustup -ArgumentList @('toolchain','install','1.98.0','--profile','minimal') -TimeoutSeconds 180 -CapturePrefix artifacts/p1-production-preflight/oracle-install | |
| # Resolve the rustup proxy, which accepts +1.98.0, through registered PATH. | |
| # The generated Drop harness intentionally searches only 64 PATH entries. | |
| $rustc = (Get-Command rustc -CommandType Application -ErrorAction Stop | Select-Object -First 1).Source | |
| $dotnet = (Get-Command dotnet -CommandType Application -ErrorAction Stop | Select-Object -First 1).Source | |
| if (-not [IO.Path]::IsPathFullyQualified($rustc) -or -not [IO.File]::Exists($rustc) -or | |
| -not [IO.Path]::IsPathFullyQualified($dotnet) -or -not [IO.File]::Exists($dotnet)) { throw 'Explicit oracle/host paths are missing.' } | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath $rustc -ArgumentList @('+1.98.0','--version') -TimeoutSeconds 30 -CapturePrefix artifacts/p1-production-preflight/oracle-version | |
| $version = [IO.File]::ReadAllText((Join-Path $PWD 'artifacts/p1-production-preflight/oracle-version.stdout.log')).Trim() | |
| if (-not $version.StartsWith('rustc 1.98.0 (',[StringComparison]::Ordinal)) { throw 'The configured proxy did not select rustc 1.98.0.' } | |
| "RUSTSHARP_RUSTC_PATH=$rustc" | Out-File -LiteralPath $env:GITHUB_ENV -Encoding utf8 -Append | |
| "RUSTSHARP_DOTNET_PATH=$dotnet" | Out-File -LiteralPath $env:GITHUB_ENV -Encoding utf8 -Append | |
| - name: Restore ILVerify 10.0.11 tool | |
| shell: pwsh | |
| run: ./eng/Invoke-BoundedProcess.ps1 -FilePath dotnet -ArgumentList @('tool', 'restore', '--tool-manifest', '.config/dotnet-tools.json') -TimeoutSeconds 180 -CapturePrefix 'artifacts/p1-production-preflight/${{ matrix.name }}/tools' | |
| - name: Install Linux Native AOT prerequisites | |
| if: matrix.name == 'linux-x64' | |
| shell: pwsh | |
| run: | | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath sudo -ArgumentList @('timeout', '--kill-after=10s', '180s', 'apt-get', 'update') -TimeoutSeconds 200 -CapturePrefix 'artifacts/p1-production-preflight/${{ matrix.name }}/apt-update' | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath sudo -ArgumentList @('timeout', '--kill-after=10s', '180s', 'apt-get', 'install', '--no-install-recommends', '-y', 'clang', 'zlib1g-dev') -TimeoutSeconds 200 -CapturePrefix 'artifacts/p1-production-preflight/${{ matrix.name }}/apt-install' | |
| - name: Run and validate frozen production source and backend evidence | |
| shell: pwsh | |
| run: ./eng/Invoke-P1ProductionNativeEvidence.ps1 -CandidateSha $env:GITHUB_SHA -PlatformName '${{ matrix.name }}' -RunId '${{ github.run_id }}' -RunAttempt '${{ github.run_attempt }}' -Repository '${{ github.repository }}' | |
| - name: Upload production receipt, bound sources and process ledgers | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: p1-production-receipt-${{ matrix.name }}-${{ github.run_id }}-${{ github.run_attempt }} | |
| include-hidden-files: true | |
| path: artifacts/p1-production/${{ matrix.name }} | |
| if-no-files-found: error | |
| retention-days: 30 | |
| - name: Upload production source package reports and retained bytes | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: p1-production-source-${{ matrix.name }}-${{ github.run_id }}-${{ github.run_attempt }} | |
| include-hidden-files: true | |
| path: artifacts/p1-source-package/${{ matrix.name }} | |
| if-no-files-found: error | |
| retention-days: 30 | |
| - name: Upload production backend reports and retained bytes | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: p1-production-backend-${{ matrix.name }}-${{ github.run_id }}-${{ github.run_attempt }} | |
| include-hidden-files: true | |
| path: artifacts/p1-backend/${{ matrix.name }} | |
| if-no-files-found: error | |
| retention-days: 30 | |
| - name: Upload production native preflight diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: p1-production-preflight-${{ matrix.name }}-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-production-preflight/${{ matrix.name }} | |
| if-no-files-found: warn | |
| retention-days: 30 | |
| drop-native: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: windows-x64 | |
| runner: windows-2025 | |
| - name: linux-x64 | |
| runner: ubuntu-24.04 | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 75 | |
| env: | |
| GITHUB_SHA: ${{ github.sha }} | |
| CI_COMMIT_SHA: ${{ github.sha }} | |
| RUSTSHARP_NATIVE_AOT_SDK_VERSION: '10.0.401' | |
| DOTNET_CLI_USE_MSBUILD_SERVER: '0' | |
| DOTNET_CLI_UI_LANGUAGE: en-US | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.sha }} | |
| fetch-depth: 0 | |
| - uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: | | |
| 10.0.400 | |
| 10.0.401 | |
| - name: Verify PowerShell 7 and bind rustc 1.98 oracle | |
| shell: pwsh | |
| timeout-minutes: 5 | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| if ($PSVersionTable.PSVersion.Major -lt 7) { throw 'PowerShell 7 or newer is required.' } | |
| $rustup = (Get-Command rustup -CommandType Application -ErrorAction Stop | Select-Object -First 1).Source | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath $rustup -ArgumentList @('toolchain','install','1.98.0','--profile','minimal') -TimeoutSeconds 180 -CapturePrefix 'artifacts/p1-drop-preflight/${{ matrix.name }}/oracle-install' | |
| $rustc = (Get-Command rustc -CommandType Application -ErrorAction Stop | Select-Object -First 1).Source | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath $rustc -ArgumentList @('+1.98.0','--version') -TimeoutSeconds 30 -CapturePrefix 'artifacts/p1-drop-preflight/${{ matrix.name }}/oracle-version' | |
| $version = [IO.File]::ReadAllText((Join-Path $PWD 'artifacts/p1-drop-preflight/${{ matrix.name }}/oracle-version.stdout.log')).Trim() | |
| if (-not $version.StartsWith('rustc 1.98.0 (',[StringComparison]::Ordinal)) { throw 'The configured proxy did not select rustc 1.98.0.' } | |
| - name: Restore ILVerify 10.0.11 tool | |
| shell: pwsh | |
| run: ./eng/Invoke-BoundedProcess.ps1 -FilePath dotnet -ArgumentList @('tool','restore','--tool-manifest','.config/dotnet-tools.json') -TimeoutSeconds 180 -CapturePrefix 'artifacts/p1-drop-preflight/${{ matrix.name }}/tools' | |
| - name: Install Linux Native AOT prerequisites | |
| if: matrix.name == 'linux-x64' | |
| shell: pwsh | |
| run: | | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath sudo -ArgumentList @('timeout','--kill-after=10s','180s','apt-get','update') -TimeoutSeconds 200 -CapturePrefix 'artifacts/p1-drop-preflight/${{ matrix.name }}/apt-update' | |
| ./eng/Invoke-BoundedProcess.ps1 -FilePath sudo -ArgumentList @('timeout','--kill-after=10s','180s','apt-get','install','--no-install-recommends','-y','clang','zlib1g-dev') -TimeoutSeconds 200 -CapturePrefix 'artifacts/p1-drop-preflight/${{ matrix.name }}/apt-install' | |
| - name: Execute fixed NativeV5, original-PE ILVerify, AOT and callable evidence | |
| shell: pwsh | |
| run: ./eng/Invoke-P1NativeDropEvidence.ps1 -CandidateSha $env:GITHUB_SHA -PlatformName '${{ matrix.name }}' -RunId '${{ github.run_id }}' -RunAttempt '${{ github.run_attempt }}' -Repository '${{ github.repository }}' | |
| - name: Bind original receipt and retained Drop bytes into transport index | |
| shell: pwsh | |
| run: ./eng/Write-P1DropTransport.ps1 -CandidateSha $env:GITHUB_SHA -PlatformName '${{ matrix.name }}' -RunId '${{ github.run_id }}' -RunAttempt '${{ github.run_attempt }}' | |
| - name: Upload Drop receipt, original verifier reports and process ledgers | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: p1-drop-receipt-${{ matrix.name }}-${{ github.run_id }}-${{ github.run_attempt }} | |
| include-hidden-files: true | |
| path: artifacts/p1-drop-ci/${{ matrix.name }} | |
| if-no-files-found: error | |
| retention-days: 30 | |
| - name: Upload all retained original PE, oracle and native Drop bytes | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: p1-drop-bytes-${{ matrix.name }}-${{ github.run_id }}-${{ github.run_attempt }} | |
| include-hidden-files: true | |
| path: artifacts/p1-drop/${{ matrix.name }} | |
| if-no-files-found: error | |
| retention-days: 30 | |
| - name: Upload Drop native preflight diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: p1-drop-preflight-${{ matrix.name }}-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-drop-preflight/${{ matrix.name }} | |
| if-no-files-found: warn | |
| retention-days: 30 | |
| production-gate: | |
| if: always() | |
| needs: [suite-gate, production-native, drop-native] | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| env: | |
| GITHUB_SHA: ${{ github.sha }} | |
| CI_COMMIT_SHA: ${{ github.sha }} | |
| RUSTSHARP_NATIVE_AOT_SDK_VERSION: '10.0.401' | |
| DOTNET_CLI_USE_MSBUILD_SERVER: '0' | |
| DOTNET_CLI_UI_LANGUAGE: en-US | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.sha }} | |
| fetch-depth: 0 | |
| - uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: | | |
| 10.0.400 | |
| 10.0.401 | |
| - name: Download Windows production receipt | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: p1-production-receipt-windows-x64-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-production/windows-x64 | |
| - name: Download Linux production receipt | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: p1-production-receipt-linux-x64-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-production/linux-x64 | |
| - name: Download Windows production source retained bytes | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: p1-production-source-windows-x64-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-source-package/windows-x64 | |
| - name: Download Linux production source retained bytes | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: p1-production-source-linux-x64-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-source-package/linux-x64 | |
| - name: Download Windows production backend retained bytes | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: p1-production-backend-windows-x64-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-backend/windows-x64 | |
| - name: Download Linux production backend retained bytes | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: p1-production-backend-linux-x64-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-backend/linux-x64 | |
| - name: Bind fresh aggregate Release validator | |
| if: always() | |
| shell: pwsh | |
| run: | | |
| if ($PSVersionTable.PSVersion.Major -lt 7) { throw 'PowerShell 7 or newer is required.' } | |
| ./eng/Invoke-P1ReleaseBuild.ps1 -CandidateSha $env:GITHUB_SHA -SdkVersion 10.0.401 -ReportPath artifacts/p1-candidate/production-aggregate-release-build.json | |
| - name: Download Windows Drop receipt and original verifier reports | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: p1-drop-receipt-windows-x64-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-drop-ci/windows-x64 | |
| - name: Download Linux Drop receipt and original verifier reports | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: p1-drop-receipt-linux-x64-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-drop-ci/linux-x64 | |
| - name: Download Windows retained original PE and native Drop bytes | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: p1-drop-bytes-windows-x64-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-drop/windows-x64 | |
| - name: Download Linux retained original PE and native Drop bytes | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: p1-drop-bytes-linux-x64-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-drop/linux-x64 | |
| - name: Require both native Drop jobs and reconcile transferred original bytes | |
| if: always() | |
| shell: pwsh | |
| env: | |
| DROP_JOB_RESULT: ${{ needs.drop-native.result }} | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| if ($PSVersionTable.PSVersion.Major -lt 7) { throw 'PowerShell 7 or newer is required.' } | |
| $clock = [Diagnostics.Stopwatch]::StartNew() | |
| $failed = $env:DROP_JOB_RESULT -cne 'success' | |
| foreach ($platform in @('windows-x64','linux-x64')) { | |
| if ($clock.Elapsed.TotalSeconds -ge 250) { throw 'Two-platform transport validation exceeded its batch deadline.' } | |
| try { ./eng/Invoke-BoundedProcess.ps1 -FilePath pwsh -ArgumentList @('-NoLogo','-NoProfile','-File','eng/Test-P1DropTransport.ps1','-CandidateSha',$env:GITHUB_SHA,'-PlatformName',$platform,'-RunId','${{ github.run_id }}','-RunAttempt','${{ github.run_attempt }}') -TimeoutSeconds 120 -CapturePrefix ('artifacts/p1-candidate/drop-transport-'+$platform+'-launch') } catch { $failed = $true; Write-Warning $_.Exception.Message } | |
| } | |
| if ($failed) { throw 'Both native Drop jobs and physical transport validations must pass.' } | |
| - name: Require suite gate and complete native production evidence | |
| if: always() | |
| shell: pwsh | |
| env: | |
| NATIVE_JOB_RESULT: ${{ needs.production-native.result }} | |
| SUITE_JOB_RESULT: ${{ needs.suite-gate.result }} | |
| run: ./eng/Test-P1ProductionCiGate.ps1 -CandidateSha $env:GITHUB_SHA -WindowsReceipt artifacts/p1-production/windows-x64/native-receipt.json -LinuxReceipt artifacts/p1-production/linux-x64/native-receipt.json -RunId '${{ github.run_id }}' -RunAttempt '${{ github.run_attempt }}' -Repository '${{ github.repository }}' -NativeJobResult $env:NATIVE_JOB_RESULT -SuiteJobResult $env:SUITE_JOB_RESULT -EvidencePath artifacts/p1-candidate/production-ci-gate.json | |
| - name: Upload aggregate production gate and physical validation diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: p1-production-gate-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: artifacts/p1-candidate | |
| if-no-files-found: error | |
| retention-days: 30 |