From 716bb36b2dc33d4d7531bfa0f0fd5e8be1c79904 Mon Sep 17 00:00:00 2001 From: Justin <159104807+Justin24506@users.noreply.github.com> Date: Mon, 9 Nov 2026 11:43:22 +0530 Subject: [PATCH 1/4] fix(ci): force arm64 target architecture in codeql build CodeQL's macOS tracer forces traced child processes onto the x86_64 slice under Rosetta, causing AppleClang to target x86_64 by default (run 42513807606). Explicitly set CMAKE_OSX_ARCHITECTURES=arm64 to match Homebrew's arm64 libusb. Add a pull_request trigger scoped to .github/** for self-verification. --- .github/workflows/codeql.yml | 21 ++++++++++++++++----- AGENTS.md | 1 + 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f2b2988..9abbb5a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -10,10 +10,10 @@ # Free for public repos. Must run on macOS: CMakeLists fatals on non-Apple # platforms. # -# No pull_request trigger, on purpose: alerts on main are the wanted hard -# signal, and running a many-minute C++ build-and-analyze per push of a PR is -# not worth it. No concurrency block either: canceling would throw away the -# whole analysis. +# pull_request trigger restricted to workflow edits (paths: ['.github/**']): +# running a many-minute C++ build on every PR push isn't worth it, but workflow +# changes self-verify before landing. No concurrency block: canceling would throw +# away the whole analysis. name: CodeQL @@ -23,6 +23,9 @@ on: - cron: "30 6 * * 1" push: branches: [main] + pull_request: + paths: + - ".github/**" workflow_dispatch: permissions: @@ -50,7 +53,15 @@ jobs: run: | # Tests and benchmarks stay enabled: everything compiles, everything # lands in the analysis set. - cmake -S . -B build -DCMAKE_BUILD_TYPE=RelWithDebInfo + # + # CodeQL's macOS tracer forces traced child processes onto the x86_64 + # slice under Rosetta (observed: build defaulted to x86_64; run 42513807606). + # Explicitly set CMAKE_OSX_ARCHITECTURES=arm64 so AppleClang outputs arm64 + # objects matching Homebrew's arm64 libusb; arch -arm64 builds under the + # tracer break tracing. + cmake -S . -B build \ + -DCMAKE_BUILD_TYPE=RelWithDebInfo \ + -DCMAKE_OSX_ARCHITECTURES=arm64 cmake --build build -j"$(sysctl -n hw.ncpu)" - uses: github/codeql-action/analyze@v4 diff --git a/AGENTS.md b/AGENTS.md index 00edf1b..043067a 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -267,6 +267,7 @@ Swift 的 C++ 互操作吞不下，所以 C ABI 这一层不可省。 | 53 | `docs: correct row 50's event_name provenance to tests.yml` | ✅ | Unanimous round-three reviewer finding, applied verbatim after re-verification at the source: row 50 credited tests/build with gaining event_name in f0fbc1d, but that commit touched release.yml and tests.yml only, and build.yml has never carried a concurrency block at all (pickaxe for event_name and for concurrency: both empty; it is dispatch-only with nothing to cancel). Row 50 now attributes the earlier scoping to tests.yml alone; the lint.yml workflow change itself was always correct and needed no second look. Non-blocking doc-only fix | | 52 | `fix(ci): sync the root-leg and style-default comments` | ✅ | Third-round comment syncs. tests.yml's sanitized root step claimed the net\. filter selects the root-gated feth/BPF cases only, but ctest picks up all three net.* suites (live run 42506526442 executed net.abi, net.loopback, and net.feth there): the comment now says exactly that, net.feth is the one root gates and the other two ride along under the sanitizer build. AGENTS row 39 said the format gate runs `-style file` "since the binary default is LLVM style", contradicting lint.yml's corrected comment (recent clang-format already defaults to file style; the flag survives a future default change): row 39 now carries the corrected rationale. Delegation record: three antigravity/gemini-3.8-flash delegates applied the lint, bench, and tests edits byte-exact within scope; the update-tap edits were applied directly, because the workspace guard blocks non-primary providers from a secret-bearing file, and update-tap.yml is exactly such a file | | 51 | `fix(ci): drop the dead bench args dispatch input` | ✅ | Third-round residual, addressed rather than left moot: the Run step carried the args dispatch input through an unquoted BENCH_ARGS (intentional word-splitting), but the input itself was dead: benchmarks/ contains no argv or argc use at all (grep-verified before the comment that says so was written), so no dispatch text could ever change the run. workflow_dispatch now declares no inputs, the Run step invokes tetherkit_bench bare behind pipefail+tee, and the inputs.args env-passage comment went with the plumbing it described | +| 54 | `fix(ci): force arm64 target architecture in codeql build` | ✅ | Diagnosed CodeQL run 42513807606 (2026-11-08): job failed with linker error "Undefined symbols for architecture x86_64" and "found architecture 'arm64', required architecture 'x86_64'" against Homebrew's /opt/homebrew/Cellar/libusb/1.0.30/lib/libusb-1.0.dylib. CodeQL's macOS tracer forces traced child processes onto the x86_64 slice under Rosetta; without an explicit target architecture, AppleClang emits x86_64 objects that cannot link against arm64-only Homebrew dependencies. `codeql.yml` pins `CMAKE_OSX_ARCHITECTURES=arm64` so clang cross-emits arm64 regardless of driver process architecture; `arch -arm64` cannot be used instead because child builds forced native bypass CodeQL tracing. Hardened `codeql.yml` with a `pull_request` trigger scoped to `.github/**` so workflow edits self-verify. | ### 当前状态 From 75634adb506432c7ef82a147cb7b46213ba948fb Mon Sep 17 00:00:00 2001 From: Justin <159104807+Justin24506@users.noreply.github.com> Date: Mon, 9 Nov 2026 13:30:05 +0530 Subject: [PATCH 2/4] fix(ci): narrow codeql pr trigger, event-scope concurrency --- .github/workflows/codeql.yml | 35 ++++++++++++++++++++++++++++++----- AGENTS.md | 3 ++- 2 files changed, 32 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9abbb5a..1637135 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -7,13 +7,25 @@ # in the libusb transfer pool, the BPF buffer walk, and the # reinterpret_cast-heavy private ABI bridge are exactly its turf. # +# third_party/doctest stays in the analysis set on purpose: paths-ignore is +# inert for C/C++ manual builds (github/codeql-action#3890; the docs confine +# paths filtering to build-mode none, and the workflow would warn about it at +# run time). SARIF post-filtering means a new third-party action for exactly +# one benign vendored-code alert (cpp/use-after-free at +# third_party/doctest/doctest.h:3710). Accepted as baseline noise instead. +# # Free for public repos. Must run on macOS: CMakeLists fatals on non-Apple # platforms. # -# pull_request trigger restricted to workflow edits (paths: ['.github/**']): -# running a many-minute C++ build on every PR push isn't worth it, but workflow -# changes self-verify before landing. No concurrency block: canceling would throw -# away the whole analysis. +# pull_request trigger restricted to workflow edits (paths: +# ['.github/workflows/**']): running a many-minute C++ build on every PR push +# isn't worth it, but workflow changes self-verify before landing. dependabot.yml +# and .github/scripts/ edits never reach the analyzer; Dependabot's weekly +# grouped action-bump PR deliberately rides along because it edits workflow +# files. The concurrency group below is event-scoped (the tests.yml doctrine): +# push-to-main, the Monday cron and pull_request runs sit in different groups +# and never cancel each other; within one event, canceling a superseded run is +# safe because the newer run's SARIF simply replaces its alerts. name: CodeQL @@ -25,7 +37,7 @@ on: branches: [main] pull_request: paths: - - ".github/**" + - ".github/workflows/**" workflow_dispatch: permissions: @@ -33,6 +45,15 @@ permissions: security-events: write contents: read +# Event-scoped group keyed like tests.yml's: github.event_name in the key keeps +# a push to main from canceling the in-flight Monday cron, and pull_request +# runs live in their own groups. Within one event, cancel-in-progress is safe: +# a superseded commit's alerts are simply replaced by the newer run's SARIF, +# and macOS minutes bill at 10x. +concurrency: + group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }} + cancel-in-progress: true + jobs: analyze: name: C++ analysis @@ -59,6 +80,10 @@ jobs: # Explicitly set CMAKE_OSX_ARCHITECTURES=arm64 so AppleClang outputs arm64 # objects matching Homebrew's arm64 libusb; arch -arm64 builds under the # tracer break tracing. + # + # Hard-coded on purpose: under the tracer uname -m reports x86_64 + # (Rosetta), so a tempting -DCMAKE_OSX_ARCHITECTURES=$(uname -m) + # "simplification" would silently reintroduce the bug. cmake -S . -B build \ -DCMAKE_BUILD_TYPE=RelWithDebInfo \ -DCMAKE_OSX_ARCHITECTURES=arm64 diff --git a/AGENTS.md b/AGENTS.md index 043067a..3dfc576 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -267,7 +267,8 @@ Swift 的 C++ 互操作吞不下，所以 C ABI 这一层不可省。 | 53 | `docs: correct row 50's event_name provenance to tests.yml` | ✅ | Unanimous round-three reviewer finding, applied verbatim after re-verification at the source: row 50 credited tests/build with gaining event_name in f0fbc1d, but that commit touched release.yml and tests.yml only, and build.yml has never carried a concurrency block at all (pickaxe for event_name and for concurrency: both empty; it is dispatch-only with nothing to cancel). Row 50 now attributes the earlier scoping to tests.yml alone; the lint.yml workflow change itself was always correct and needed no second look. Non-blocking doc-only fix | | 52 | `fix(ci): sync the root-leg and style-default comments` | ✅ | Third-round comment syncs. tests.yml's sanitized root step claimed the net\. filter selects the root-gated feth/BPF cases only, but ctest picks up all three net.* suites (live run 42506526442 executed net.abi, net.loopback, and net.feth there): the comment now says exactly that, net.feth is the one root gates and the other two ride along under the sanitizer build. AGENTS row 39 said the format gate runs `-style file` "since the binary default is LLVM style", contradicting lint.yml's corrected comment (recent clang-format already defaults to file style; the flag survives a future default change): row 39 now carries the corrected rationale. Delegation record: three antigravity/gemini-3.8-flash delegates applied the lint, bench, and tests edits byte-exact within scope; the update-tap edits were applied directly, because the workspace guard blocks non-primary providers from a secret-bearing file, and update-tap.yml is exactly such a file | | 51 | `fix(ci): drop the dead bench args dispatch input` | ✅ | Third-round residual, addressed rather than left moot: the Run step carried the args dispatch input through an unquoted BENCH_ARGS (intentional word-splitting), but the input itself was dead: benchmarks/ contains no argv or argc use at all (grep-verified before the comment that says so was written), so no dispatch text could ever change the run. workflow_dispatch now declares no inputs, the Run step invokes tetherkit_bench bare behind pipefail+tee, and the inputs.args env-passage comment went with the plumbing it described | -| 54 | `fix(ci): force arm64 target architecture in codeql build` | ✅ | Diagnosed CodeQL run 42513807606 (2026-11-08): job failed with linker error "Undefined symbols for architecture x86_64" and "found architecture 'arm64', required architecture 'x86_64'" against Homebrew's /opt/homebrew/Cellar/libusb/1.0.30/lib/libusb-1.0.dylib. CodeQL's macOS tracer forces traced child processes onto the x86_64 slice under Rosetta; without an explicit target architecture, AppleClang emits x86_64 objects that cannot link against arm64-only Homebrew dependencies. `codeql.yml` pins `CMAKE_OSX_ARCHITECTURES=arm64` so clang cross-emits arm64 regardless of driver process architecture; `arch -arm64` cannot be used instead because child builds forced native bypass CodeQL tracing. Hardened `codeql.yml` with a `pull_request` trigger scoped to `.github/**` so workflow edits self-verify. | +| 54 | `fix(ci): force arm64 target architecture in codeql build` | ✅ | Diagnosed CodeQL run 42513807606 (2026-11-08): job failed with linker error "Undefined symbols for architecture x86_64" and "found architecture 'arm64', required architecture 'x86_64'" against Homebrew's /opt/homebrew/Cellar/libusb/1.0.30/lib/libusb-1.0.dylib. CodeQL's macOS tracer forces traced child processes onto the x86_64 slice under Rosetta; without an explicit target architecture, AppleClang emits x86_64 objects that cannot link against arm64-only Homebrew dependencies. `codeql.yml` pins `CMAKE_OSX_ARCHITECTURES=arm64` so clang cross-emits arm64 regardless of driver process architecture; `arch -arm64` cannot be used instead because child builds forced native bypass CodeQL tracing. Hardened `codeql.yml` with a `pull_request` trigger scoped to `.github/**` so workflow edits self-verify. Verified green by two follow-up dispatch runs on the branch, 42578919426 and 42578945162 (the latter 11m59s end-to-end, Build and analyze clean against arm64 Homebrew libusb), sealing the failure-plus-verification pairing exactly like rows 39/41/42/47. | +| 55 | `fix(ci): narrow codeql pr trigger, event-scope concurrency` | ✅ | Review round on row 54, five findings, four applied in codeql.yml plus this row's amendment: (1, consensus) pull_request paths narrowed `.github/**` -> `.github/workflows/**` - dependabot.yml and .github/scripts/ edits never reach the analyzer, while Dependabot's weekly grouped action-bump PR still matches by construction (it edits workflow files) and the header comment now states that ride-along as deliberate; (2, sharpest catch) the header's "No concurrency block: canceling would throw away the whole analysis" sentence predated the PR trigger and no longer held - a superseded PR commit's SARIF is simply replaced by the newer run - so an event-scoped concurrency group mirroring tests.yml landed (group `${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}`, cancel-in-progress: true) with a comment explaining why cancellation is safe within one event and why event_name in the key keeps a push to main from canceling the Monday cron; (3) row 54 amended (above) to cite verification runs 42578919426 and 42578945162, sealing the failure-plus-verification pairing the ledger's audit value depends on; (4, nit) the Build step comment now carries the hard-coded-on-purpose guard - under the tracer `uname -m` reports x86_64, so a `-DCMAKE_OSX_ARCHITECTURES=$(uname -m)` "simplification" would silently reintroduce the bug (the deliberate-choices-need-a-magnitude rule from pitfall 16); (5, INFO) the first-ever green analysis surfaced one pre-existing `cpp/use-after-free` at vendored third_party/doctest/doctest.h:3710 - resolved as a documented decline rather than config: `paths-ignore` is verifiably inert for C/C++ manual builds (codeql team statement in github/codeql-action#3890; GitHub docs confine paths filtering to build-mode none; the traced run would warn "path-based filtering not supported"), and SARIF post-filtering via advanced-security/filter-sarif means a new third-party action for exactly one benign vendored alert - the workflow header records the accepted baseline instead; the fork-PR-403 finding was retracted by the reviewers against current GitHub docs (SARIF upload on pull_request events is permitted under read-only fork tokens). Two disjoint antigravity/gemini-3.8-flash delegates applied the codeql.yml and AGENTS.md edits byte-exact within disjoint file scopes. | ### 当前状态 From 29e2b62a5d2d713bb9e77e2e3236ed0cc43d7ada Mon Sep 17 00:00:00 2001 From: Justin <159104807+Justin24506@users.noreply.github.com> Date: Mon, 9 Nov 2026 13:48:27 +0530 Subject: [PATCH 3/4] docs(agents): attach the codeql pr verification run to row 55 --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 3dfc576..ec2a510 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -268,7 +268,7 @@ Swift 的 C++ 互操作吞不下，所以 C ABI 这一层不可省。 | 52 | `fix(ci): sync the root-leg and style-default comments` | ✅ | Third-round comment syncs. tests.yml's sanitized root step claimed the net\. filter selects the root-gated feth/BPF cases only, but ctest picks up all three net.* suites (live run 42506526442 executed net.abi, net.loopback, and net.feth there): the comment now says exactly that, net.feth is the one root gates and the other two ride along under the sanitizer build. AGENTS row 39 said the format gate runs `-style file` "since the binary default is LLVM style", contradicting lint.yml's corrected comment (recent clang-format already defaults to file style; the flag survives a future default change): row 39 now carries the corrected rationale. Delegation record: three antigravity/gemini-3.8-flash delegates applied the lint, bench, and tests edits byte-exact within scope; the update-tap edits were applied directly, because the workspace guard blocks non-primary providers from a secret-bearing file, and update-tap.yml is exactly such a file | | 51 | `fix(ci): drop the dead bench args dispatch input` | ✅ | Third-round residual, addressed rather than left moot: the Run step carried the args dispatch input through an unquoted BENCH_ARGS (intentional word-splitting), but the input itself was dead: benchmarks/ contains no argv or argc use at all (grep-verified before the comment that says so was written), so no dispatch text could ever change the run. workflow_dispatch now declares no inputs, the Run step invokes tetherkit_bench bare behind pipefail+tee, and the inputs.args env-passage comment went with the plumbing it described | | 54 | `fix(ci): force arm64 target architecture in codeql build` | ✅ | Diagnosed CodeQL run 42513807606 (2026-11-08): job failed with linker error "Undefined symbols for architecture x86_64" and "found architecture 'arm64', required architecture 'x86_64'" against Homebrew's /opt/homebrew/Cellar/libusb/1.0.30/lib/libusb-1.0.dylib. CodeQL's macOS tracer forces traced child processes onto the x86_64 slice under Rosetta; without an explicit target architecture, AppleClang emits x86_64 objects that cannot link against arm64-only Homebrew dependencies. `codeql.yml` pins `CMAKE_OSX_ARCHITECTURES=arm64` so clang cross-emits arm64 regardless of driver process architecture; `arch -arm64` cannot be used instead because child builds forced native bypass CodeQL tracing. Hardened `codeql.yml` with a `pull_request` trigger scoped to `.github/**` so workflow edits self-verify. Verified green by two follow-up dispatch runs on the branch, 42578919426 and 42578945162 (the latter 11m59s end-to-end, Build and analyze clean against arm64 Homebrew libusb), sealing the failure-plus-verification pairing exactly like rows 39/41/42/47. | -| 55 | `fix(ci): narrow codeql pr trigger, event-scope concurrency` | ✅ | Review round on row 54, five findings, four applied in codeql.yml plus this row's amendment: (1, consensus) pull_request paths narrowed `.github/**` -> `.github/workflows/**` - dependabot.yml and .github/scripts/ edits never reach the analyzer, while Dependabot's weekly grouped action-bump PR still matches by construction (it edits workflow files) and the header comment now states that ride-along as deliberate; (2, sharpest catch) the header's "No concurrency block: canceling would throw away the whole analysis" sentence predated the PR trigger and no longer held - a superseded PR commit's SARIF is simply replaced by the newer run - so an event-scoped concurrency group mirroring tests.yml landed (group `${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}`, cancel-in-progress: true) with a comment explaining why cancellation is safe within one event and why event_name in the key keeps a push to main from canceling the Monday cron; (3) row 54 amended (above) to cite verification runs 42578919426 and 42578945162, sealing the failure-plus-verification pairing the ledger's audit value depends on; (4, nit) the Build step comment now carries the hard-coded-on-purpose guard - under the tracer `uname -m` reports x86_64, so a `-DCMAKE_OSX_ARCHITECTURES=$(uname -m)` "simplification" would silently reintroduce the bug (the deliberate-choices-need-a-magnitude rule from pitfall 16); (5, INFO) the first-ever green analysis surfaced one pre-existing `cpp/use-after-free` at vendored third_party/doctest/doctest.h:3710 - resolved as a documented decline rather than config: `paths-ignore` is verifiably inert for C/C++ manual builds (codeql team statement in github/codeql-action#3890; GitHub docs confine paths filtering to build-mode none; the traced run would warn "path-based filtering not supported"), and SARIF post-filtering via advanced-security/filter-sarif means a new third-party action for exactly one benign vendored alert - the workflow header records the accepted baseline instead; the fork-PR-403 finding was retracted by the reviewers against current GitHub docs (SARIF upload on pull_request events is permitted under read-only fork tokens). Two disjoint antigravity/gemini-3.8-flash delegates applied the codeql.yml and AGENTS.md edits byte-exact within disjoint file scopes. | +| 55 | `fix(ci): narrow codeql pr trigger, event-scope concurrency` | ✅ | Review round on row 54, five findings, four applied in codeql.yml plus this row's amendment: (1, consensus) pull_request paths narrowed `.github/**` -> `.github/workflows/**` - dependabot.yml and .github/scripts/ edits never reach the analyzer, while Dependabot's weekly grouped action-bump PR still matches by construction (it edits workflow files) and the header comment now states that ride-along as deliberate; (2, sharpest catch) the header's "No concurrency block: canceling would throw away the whole analysis" sentence predated the PR trigger and no longer held - a superseded PR commit's SARIF is simply replaced by the newer run - so an event-scoped concurrency group mirroring tests.yml landed (group `${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}`, cancel-in-progress: true) with a comment explaining why cancellation is safe within one event and why event_name in the key keeps a push to main from canceling the Monday cron; (3) row 54 amended (above) to cite verification runs 42578919426 and 42578945162, sealing the failure-plus-verification pairing the ledger's audit value depends on; (4, nit) the Build step comment now carries the hard-coded-on-purpose guard - under the tracer `uname -m` reports x86_64, so a `-DCMAKE_OSX_ARCHITECTURES=$(uname -m)` "simplification" would silently reintroduce the bug (the deliberate-choices-need-a-magnitude rule from pitfall 16); (5, INFO) the first-ever green analysis surfaced one pre-existing `cpp/use-after-free` at vendored third_party/doctest/doctest.h:3710 - resolved as a documented decline rather than config: `paths-ignore` is verifiably inert for C/C++ manual builds (codeql team statement in github/codeql-action#3890; GitHub docs confine paths filtering to build-mode none; the traced run would warn "path-based filtering not supported"), and SARIF post-filtering via advanced-security/filter-sarif means a new third-party action for exactly one benign vendored alert - the workflow header records the accepted baseline instead; the fork-PR-403 finding was retracted by the reviewers against current GitHub docs (SARIF upload on pull_request events is permitted under read-only fork tokens). Two disjoint antigravity/gemini-3.8-flash delegates applied the codeql.yml and AGENTS.md edits byte-exact within disjoint file scopes. Verification: the PR-triggered analysis run 42583242299 is green on 75634ad, and the new group's cancel-in-progress proved itself on this very push - the in-flight run 42582860934 for the superseded commit 84d8151 was canceled and replaced by the 75634ad run. | ### 当前状态 From 53dc77ca5fa92029c979798416a0cdb656cb999d Mon Sep 17 00:00:00 2001 From: Justin <159104807+Justin24506@users.noreply.github.com> Date: Mon, 9 Nov 2026 14:27:23 +0530 Subject: [PATCH 4/4] fix(ci): correct codeql trigger scope and cancellation comments --- .github/workflows/codeql.yml | 6 ++++-- AGENTS.md | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1637135..1df6747 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,7 +20,8 @@ # pull_request trigger restricted to workflow edits (paths: # ['.github/workflows/**']): running a many-minute C++ build on every PR push # isn't worth it, but workflow changes self-verify before landing. dependabot.yml -# and .github/scripts/ edits never reach the analyzer; Dependabot's weekly +# and .github/scripts/ edits never match this filter; note it only gates +# pull_request runs, pushes to main still analyze them. Dependabot's weekly # grouped action-bump PR deliberately rides along because it edits workflow # files. The concurrency group below is event-scoped (the tests.yml doctrine): # push-to-main, the Monday cron and pull_request runs sit in different groups @@ -49,7 +50,8 @@ permissions: # a push to main from canceling the in-flight Monday cron, and pull_request # runs live in their own groups. Within one event, cancel-in-progress is safe: # a superseded commit's alerts are simply replaced by the newer run's SARIF, -# and macOS minutes bill at 10x. +# and macOS minutes are free for public repos — canceling is about squashed +# queue latency, not cost. concurrency: group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }} cancel-in-progress: true diff --git a/AGENTS.md b/AGENTS.md index ec2a510..22d4ee1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -267,7 +267,7 @@ Swift 的 C++ 互操作吞不下，所以 C ABI 这一层不可省。 | 53 | `docs: correct row 50's event_name provenance to tests.yml` | ✅ | Unanimous round-three reviewer finding, applied verbatim after re-verification at the source: row 50 credited tests/build with gaining event_name in f0fbc1d, but that commit touched release.yml and tests.yml only, and build.yml has never carried a concurrency block at all (pickaxe for event_name and for concurrency: both empty; it is dispatch-only with nothing to cancel). Row 50 now attributes the earlier scoping to tests.yml alone; the lint.yml workflow change itself was always correct and needed no second look. Non-blocking doc-only fix | | 52 | `fix(ci): sync the root-leg and style-default comments` | ✅ | Third-round comment syncs. tests.yml's sanitized root step claimed the net\. filter selects the root-gated feth/BPF cases only, but ctest picks up all three net.* suites (live run 42506526442 executed net.abi, net.loopback, and net.feth there): the comment now says exactly that, net.feth is the one root gates and the other two ride along under the sanitizer build. AGENTS row 39 said the format gate runs `-style file` "since the binary default is LLVM style", contradicting lint.yml's corrected comment (recent clang-format already defaults to file style; the flag survives a future default change): row 39 now carries the corrected rationale. Delegation record: three antigravity/gemini-3.8-flash delegates applied the lint, bench, and tests edits byte-exact within scope; the update-tap edits were applied directly, because the workspace guard blocks non-primary providers from a secret-bearing file, and update-tap.yml is exactly such a file | | 51 | `fix(ci): drop the dead bench args dispatch input` | ✅ | Third-round residual, addressed rather than left moot: the Run step carried the args dispatch input through an unquoted BENCH_ARGS (intentional word-splitting), but the input itself was dead: benchmarks/ contains no argv or argc use at all (grep-verified before the comment that says so was written), so no dispatch text could ever change the run. workflow_dispatch now declares no inputs, the Run step invokes tetherkit_bench bare behind pipefail+tee, and the inputs.args env-passage comment went with the plumbing it described | -| 54 | `fix(ci): force arm64 target architecture in codeql build` | ✅ | Diagnosed CodeQL run 42513807606 (2026-11-08): job failed with linker error "Undefined symbols for architecture x86_64" and "found architecture 'arm64', required architecture 'x86_64'" against Homebrew's /opt/homebrew/Cellar/libusb/1.0.30/lib/libusb-1.0.dylib. CodeQL's macOS tracer forces traced child processes onto the x86_64 slice under Rosetta; without an explicit target architecture, AppleClang emits x86_64 objects that cannot link against arm64-only Homebrew dependencies. `codeql.yml` pins `CMAKE_OSX_ARCHITECTURES=arm64` so clang cross-emits arm64 regardless of driver process architecture; `arch -arm64` cannot be used instead because child builds forced native bypass CodeQL tracing. Hardened `codeql.yml` with a `pull_request` trigger scoped to `.github/**` so workflow edits self-verify. Verified green by two follow-up dispatch runs on the branch, 42578919426 and 42578945162 (the latter 11m59s end-to-end, Build and analyze clean against arm64 Homebrew libusb), sealing the failure-plus-verification pairing exactly like rows 39/41/42/47. | +| 54 | `fix(ci): force arm64 target architecture in codeql build` | ✅ | Diagnosed CodeQL run 42513807606 (2026-11-08): job failed with linker error "Undefined symbols for architecture x86_64" and "found architecture 'arm64', required architecture 'x86_64'" against Homebrew's /opt/homebrew/Cellar/libusb/1.0.30/lib/libusb-1.0.dylib. CodeQL's macOS tracer forces traced child processes onto the x86_64 slice under Rosetta; without an explicit target architecture, AppleClang emits x86_64 objects that cannot link against arm64-only Homebrew dependencies. `codeql.yml` pins `CMAKE_OSX_ARCHITECTURES=arm64` so clang cross-emits arm64 regardless of driver process architecture; `arch -arm64` cannot be used instead because child builds forced native bypass CodeQL tracing. Hardened `codeql.yml` with a `pull_request` trigger scoped to `.github/**` so workflow edits self-verify. Verified green by two follow-up runs on the branch — 42578919426 (pull_request event) and 42578945162 (workflow_dispatch; 11m59s C++-analysis job span, 12m5s run wall, Build and analyze clean against arm64 Homebrew libusb) — sealing the failure-plus-verification pairing exactly like rows 39/41/42/47. | | 55 | `fix(ci): narrow codeql pr trigger, event-scope concurrency` | ✅ | Review round on row 54, five findings, four applied in codeql.yml plus this row's amendment: (1, consensus) pull_request paths narrowed `.github/**` -> `.github/workflows/**` - dependabot.yml and .github/scripts/ edits never reach the analyzer, while Dependabot's weekly grouped action-bump PR still matches by construction (it edits workflow files) and the header comment now states that ride-along as deliberate; (2, sharpest catch) the header's "No concurrency block: canceling would throw away the whole analysis" sentence predated the PR trigger and no longer held - a superseded PR commit's SARIF is simply replaced by the newer run - so an event-scoped concurrency group mirroring tests.yml landed (group `${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}`, cancel-in-progress: true) with a comment explaining why cancellation is safe within one event and why event_name in the key keeps a push to main from canceling the Monday cron; (3) row 54 amended (above) to cite verification runs 42578919426 and 42578945162, sealing the failure-plus-verification pairing the ledger's audit value depends on; (4, nit) the Build step comment now carries the hard-coded-on-purpose guard - under the tracer `uname -m` reports x86_64, so a `-DCMAKE_OSX_ARCHITECTURES=$(uname -m)` "simplification" would silently reintroduce the bug (the deliberate-choices-need-a-magnitude rule from pitfall 16); (5, INFO) the first-ever green analysis surfaced one pre-existing `cpp/use-after-free` at vendored third_party/doctest/doctest.h:3710 - resolved as a documented decline rather than config: `paths-ignore` is verifiably inert for C/C++ manual builds (codeql team statement in github/codeql-action#3890; GitHub docs confine paths filtering to build-mode none; the traced run would warn "path-based filtering not supported"), and SARIF post-filtering via advanced-security/filter-sarif means a new third-party action for exactly one benign vendored alert - the workflow header records the accepted baseline instead; the fork-PR-403 finding was retracted by the reviewers against current GitHub docs (SARIF upload on pull_request events is permitted under read-only fork tokens). Two disjoint antigravity/gemini-3.8-flash delegates applied the codeql.yml and AGENTS.md edits byte-exact within disjoint file scopes. Verification: the PR-triggered analysis run 42583242299 is green on 75634ad, and the new group's cancel-in-progress proved itself on this very push - the in-flight run 42582860934 for the superseded commit 84d8151 was canceled and replaced by the 75634ad run. | ### 当前状态