Set arm64 target architecture for CodeQL build on macOS

.github/workflows/codeql.yml

@@ -7,13 +7,26 @@
 # in the libusb transfer pool, the BPF buffer walk, and the
 # reinterpret_cast-heavy private ABI bridge are exactly its turf.
 #
+# third_party/doctest stays in the analysis set on purpose: paths-ignore is
+# inert for C/C++ manual builds (github/codeql-action#3890; the docs confine
+# paths filtering to build-mode none, and the workflow would warn about it at
+# run time). SARIF post-filtering means a new third-party action for exactly
+# one benign vendored-code alert (cpp/use-after-free at
+# third_party/doctest/doctest.h:3710). Accepted as baseline noise instead.
+#
 # Free for public repos. Must run on macOS: CMakeLists fatals on non-Apple
 # platforms.
 #
-# No pull_request trigger, on purpose: alerts on main are the wanted hard
-# signal, and running a many-minute C++ build-and-analyze per push of a PR is
-# not worth it. No concurrency block either: canceling would throw away the
-# whole analysis.
+# pull_request trigger restricted to workflow edits (paths:
+# ['.github/workflows/**']): running a many-minute C++ build on every PR push
+# isn't worth it, but workflow changes self-verify before landing. dependabot.yml
+# and .github/scripts/ edits never match this filter; note it only gates
+# pull_request runs, pushes to main still analyze them. Dependabot's weekly
+# grouped action-bump PR deliberately rides along because it edits workflow
+# files. The concurrency group below is event-scoped (the tests.yml doctrine):
+# push-to-main, the Monday cron and pull_request runs sit in different groups
+# and never cancel each other; within one event, canceling a superseded run is
+# safe because the newer run's SARIF simply replaces its alerts.
 
 name: CodeQL
 
@@ -23,13 +36,26 @@ on:
     - cron: "30 6 * * 1"
   push:
     branches: [main]
+  pull_request:
+    paths:
+      - ".github/workflows/**"
   workflow_dispatch:
 
 permissions:
   # Uploading SARIF to Code Scanning requires write access.
   security-events: write
   contents: read
 
+# Event-scoped group keyed like tests.yml's: github.event_name in the key keeps
+# a push to main from canceling the in-flight Monday cron, and pull_request
+# runs live in their own groups. Within one event, cancel-in-progress is safe:
+# a superseded commit's alerts are simply replaced by the newer run's SARIF,
+# and macOS minutes are free for public repos — canceling is about squashed
+# queue latency, not cost.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: C++ analysis
@@ -50,7 +76,19 @@ jobs:
         run: |
           # Tests and benchmarks stay enabled: everything compiles, everything
           # lands in the analysis set.
-          cmake -S . -B build -DCMAKE_BUILD_TYPE=RelWithDebInfo
+          #
+          # CodeQL's macOS tracer forces traced child processes onto the x86_64
+          # slice under Rosetta (observed: build defaulted to x86_64; run 42513807606).
+          # Explicitly set CMAKE_OSX_ARCHITECTURES=arm64 so AppleClang outputs arm64
+          # objects matching Homebrew's arm64 libusb; arch -arm64 builds under the
+          # tracer break tracing.
+          #
+          # Hard-coded on purpose: under the tracer uname -m reports x86_64
+          # (Rosetta), so a tempting -DCMAKE_OSX_ARCHITECTURES=$(uname -m)
+          # "simplification" would silently reintroduce the bug.
+          cmake -S . -B build \
+            -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+            -DCMAKE_OSX_ARCHITECTURES=arm64
           cmake --build build -j"$(sysctl -n hw.ncpu)"
 
       - uses: github/codeql-action/analyze@v4

AGENTS.md

@@ -267,6 +267,8 @@ Swift 的 C++ 互操作吞不下，所以 C ABI 这一层不可省。
 | 53 | `docs: correct row 50's event_name provenance to tests.yml` | ✅ | Unanimous round-three reviewer finding, applied verbatim after re-verification at the source: row 50 credited tests/build with gaining event_name in f0fbc1d, but that commit touched release.yml and tests.yml only, and build.yml has never carried a concurrency block at all (pickaxe for event_name and for concurrency: both empty; it is dispatch-only with nothing to cancel). Row 50 now attributes the earlier scoping to tests.yml alone; the lint.yml workflow change itself was always correct and needed no second look. Non-blocking doc-only fix |
 | 52 | `fix(ci): sync the root-leg and style-default comments` | ✅ | Third-round comment syncs. tests.yml's sanitized root step claimed the net\. filter selects the root-gated feth/BPF cases only, but ctest picks up all three net.* suites (live run 42506526442 executed net.abi, net.loopback, and net.feth there): the comment now says exactly that, net.feth is the one root gates and the other two ride along under the sanitizer build. AGENTS row 39 said the format gate runs `-style file` "since the binary default is LLVM style", contradicting lint.yml's corrected comment (recent clang-format already defaults to file style; the flag survives a future default change): row 39 now carries the corrected rationale. Delegation record: three antigravity/gemini-3.8-flash delegates applied the lint, bench, and tests edits byte-exact within scope; the update-tap edits were applied directly, because the workspace guard blocks non-primary providers from a secret-bearing file, and update-tap.yml is exactly such a file |
 | 51 | `fix(ci): drop the dead bench args dispatch input` | ✅ | Third-round residual, addressed rather than left moot: the Run step carried the args dispatch input through an unquoted BENCH_ARGS (intentional word-splitting), but the input itself was dead: benchmarks/ contains no argv or argc use at all (grep-verified before the comment that says so was written), so no dispatch text could ever change the run. workflow_dispatch now declares no inputs, the Run step invokes tetherkit_bench bare behind pipefail+tee, and the inputs.args env-passage comment went with the plumbing it described |
+| 54 | `fix(ci): force arm64 target architecture in codeql build` | ✅ | Diagnosed CodeQL run 42513807606 (2026-11-08): job failed with linker error "Undefined symbols for architecture x86_64" and "found architecture 'arm64', required architecture 'x86_64'" against Homebrew's /opt/homebrew/Cellar/libusb/1.0.30/lib/libusb-1.0.dylib. CodeQL's macOS tracer forces traced child processes onto the x86_64 slice under Rosetta; without an explicit target architecture, AppleClang emits x86_64 objects that cannot link against arm64-only Homebrew dependencies. `codeql.yml` pins `CMAKE_OSX_ARCHITECTURES=arm64` so clang cross-emits arm64 regardless of driver process architecture; `arch -arm64` cannot be used instead because child builds forced native bypass CodeQL tracing. Hardened `codeql.yml` with a `pull_request` trigger scoped to `.github/**` so workflow edits self-verify. Verified green by two follow-up runs on the branch — 42578919426 (pull_request event) and 42578945162 (workflow_dispatch; 11m59s C++-analysis job span, 12m5s run wall, Build and analyze clean against arm64 Homebrew libusb) — sealing the failure-plus-verification pairing exactly like rows 39/41/42/47. |
+| 55 | `fix(ci): narrow codeql pr trigger, event-scope concurrency` | ✅ | Review round on row 54, five findings, four applied in codeql.yml plus this row's amendment: (1, consensus) pull_request paths narrowed `.github/**` -> `.github/workflows/**` - dependabot.yml and .github/scripts/ edits never reach the analyzer, while Dependabot's weekly grouped action-bump PR still matches by construction (it edits workflow files) and the header comment now states that ride-along as deliberate; (2, sharpest catch) the header's "No concurrency block: canceling would throw away the whole analysis" sentence predated the PR trigger and no longer held - a superseded PR commit's SARIF is simply replaced by the newer run - so an event-scoped concurrency group mirroring tests.yml landed (group `${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}`, cancel-in-progress: true) with a comment explaining why cancellation is safe within one event and why event_name in the key keeps a push to main from canceling the Monday cron; (3) row 54 amended (above) to cite verification runs 42578919426 and 42578945162, sealing the failure-plus-verification pairing the ledger's audit value depends on; (4, nit) the Build step comment now carries the hard-coded-on-purpose guard - under the tracer `uname -m` reports x86_64, so a `-DCMAKE_OSX_ARCHITECTURES=$(uname -m)` "simplification" would silently reintroduce the bug (the deliberate-choices-need-a-magnitude rule from pitfall 16); (5, INFO) the first-ever green analysis surfaced one pre-existing `cpp/use-after-free` at vendored third_party/doctest/doctest.h:3710 - resolved as a documented decline rather than config: `paths-ignore` is verifiably inert for C/C++ manual builds (codeql team statement in github/codeql-action#3890; GitHub docs confine paths filtering to build-mode none; the traced run would warn "path-based filtering not supported"), and SARIF post-filtering via advanced-security/filter-sarif means a new third-party action for exactly one benign vendored alert - the workflow header records the accepted baseline instead; the fork-PR-403 finding was retracted by the reviewers against current GitHub docs (SARIF upload on pull_request events is permitted under read-only fork tokens). Two disjoint antigravity/gemini-3.8-flash delegates applied the codeql.yml and AGENTS.md edits byte-exact within disjoint file scopes. Verification: the PR-triggered analysis run 42583242299 is green on 75634ad, and the new group's cancel-in-progress proved itself on this very push - the in-flight run 42582860934 for the superseded commit 84d8151 was canceled and replaced by the 75634ad run. |
 
 ### 当前状态