From 897f247b0b93073563da4206ac8abc272f64366a Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 10:02:02 +0800 Subject: [PATCH 1/7] ci: pin the build tool this package was released against MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pin was several releases behind, so what CI validated was not what the ecosystem resolves. 2026.8.24.6 is the version this package's current contents were released alongside — openkal 0.7.0 and the implementations that follow it. A version verified to build this package, not a measured minimum: the pin exists for reproducibility rather than because an older mcpp is known to fail. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b59d6bc..3dbbfc4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,7 +21,7 @@ on: workflow_dispatch: env: - MCPP_VERSION: 2026.8.19.4 + MCPP_VERSION: 2026.8.24.6 XLINGS_VERSION: v2026.8.17.2 XLINGS_NON_INTERACTIVE: '1' From fb9f712d47a10320997c090604ca5e94b6e67a44 Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 17:09:05 +0800 Subject: [PATCH 2/7] =?UTF-8?q?ci:=20pin=202026.8.25.1=20=E2=80=94=20the?= =?UTF-8?q?=20release=20that=20fixes=20what=202026.8.24.6=20broke?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3dbbfc4..17ba9d2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,7 +21,7 @@ on: workflow_dispatch: env: - MCPP_VERSION: 2026.8.24.6 + MCPP_VERSION: 2026.8.25.1 XLINGS_VERSION: v2026.8.17.2 XLINGS_NON_INTERACTIVE: '1' From df18b0ae485335eed34f94e91e4b2faaf189b9e9 Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 19:23:27 +0800 Subject: [PATCH 3/7] ci: validate against the mcpp under review, before it is released MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Several mcpp releases went out green and only then turned this ecosystem red. The engine's own CI cannot see a defect that appears only in a real dependency graph, and this repository could not see the engine until it had been published — so the first place the two met was after the release. `MCPP_SOURCE_REF` (a workflow_dispatch input, or a repository variable) names a branch of mcpp-community/mcpp. When set, every job builds that source with the released mcpp as bootstrap and puts the result first on PATH; when empty the job tests the released pin exactly as before. Also re-pins to 2026.8.25.2, which fixes what this repository last failed on. --- .github/workflows/ci.yml | 63 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 61 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 17ba9d2..c6eabbb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,9 +19,14 @@ on: branches: [main] pull_request: workflow_dispatch: - + inputs: + mcpp_ref: + description: "Branch of mcpp-community/mcpp to build and test against (empty = the released pin)" + required: false + default: "" env: - MCPP_VERSION: 2026.8.25.1 + MCPP_SOURCE_REF: ${{ github.event.inputs.mcpp_ref || vars.MCPP_SOURCE_REF }} + MCPP_VERSION: 2026.8.25.2 XLINGS_VERSION: v2026.8.17.2 XLINGS_NON_INTERACTIVE: '1' @@ -71,6 +76,33 @@ jobs: xlings install "mcpp@$MCPP_VERSION" -y -g mcpp --version mcpp self config --mirror GLOBAL + # ⭐⭐ CROSS-VALIDATION: BUILD THE mcpp UNDER REVIEW AND USE THAT ONE. + # + # Empty in the ordinary run, so this job keeps testing the RELEASED + # mcpp the pin above names. Set it — `workflow_dispatch` input, or the + # repository variable — and the same job runs against that source. + # + # ⚠️ THIS EXISTS BECAUSE THE ORDER USED TO BE WRONG. Several mcpp + # releases went out green and only then turned this ecosystem red: the + # engine's own CI cannot see a defect that appears only in a real + # dependency graph, and this repository could not see the engine until + # it had been published. Validating before the release closes that gap. + # + # The released mcpp installed just above is the bootstrap that compiles + # it; mcpp builds itself and there is no other compiler for it here. + if [ -n "${MCPP_SOURCE_REF:-}" ]; then + src="$RUNNER_TEMP/mcpp-src" + [ -d "$src" ] || git clone --quiet --depth 1 \ + --branch "$MCPP_SOURCE_REF" \ + https://github.com/mcpp-community/mcpp.git "$src" + ( cd "$src" && mcpp build --release ) + built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) + [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } + echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH" + # ⚠️ Reported, because a PATH entry that does not win looks exactly + # like one that does until something built with the wrong engine. + echo "under review: $("$built" --version) (from $MCPP_SOURCE_REF)" + fi - name: Select the toolchain run: | @@ -140,6 +172,33 @@ jobs: xlings update xlings install "mcpp@$MCPP_VERSION" -y -g mcpp self config --mirror GLOBAL + # ⭐⭐ CROSS-VALIDATION: BUILD THE mcpp UNDER REVIEW AND USE THAT ONE. + # + # Empty in the ordinary run, so this job keeps testing the RELEASED + # mcpp the pin above names. Set it — `workflow_dispatch` input, or the + # repository variable — and the same job runs against that source. + # + # ⚠️ THIS EXISTS BECAUSE THE ORDER USED TO BE WRONG. Several mcpp + # releases went out green and only then turned this ecosystem red: the + # engine's own CI cannot see a defect that appears only in a real + # dependency graph, and this repository could not see the engine until + # it had been published. Validating before the release closes that gap. + # + # The released mcpp installed just above is the bootstrap that compiles + # it; mcpp builds itself and there is no other compiler for it here. + if [ -n "${MCPP_SOURCE_REF:-}" ]; then + src="$RUNNER_TEMP/mcpp-src" + [ -d "$src" ] || git clone --quiet --depth 1 \ + --branch "$MCPP_SOURCE_REF" \ + https://github.com/mcpp-community/mcpp.git "$src" + ( cd "$src" && mcpp build --release ) + built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) + [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } + echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH" + # ⚠️ Reported, because a PATH entry that does not win looks exactly + # like one that does until something built with the wrong engine. + echo "under review: $("$built" --version) (from $MCPP_SOURCE_REF)" + fi - name: Every interface, every kind of examination env: From 9fb6b3dff8f8f1503828ce11bd8a73460393e650 Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 19:35:29 +0800 Subject: [PATCH 4/7] ci: bootstrap from the index when validating an unreleased mcpp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pin may name the very release the run is validating, which does not exist yet — that is what MCPP_SOURCE_REF is for. Bootstrap from whatever the index has; the build under review replaces it a step later. --- .github/workflows/ci.yml | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c6eabbb..43e48da 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -73,7 +73,15 @@ jobs: - name: Install mcpp run: | xlings update - xlings install "mcpp@$MCPP_VERSION" -y -g + # ⚠️ THE PIN MAY NAME THE RELEASE THIS RUN IS VALIDATING, which does + # not exist yet — that is the whole point of MCPP_SOURCE_REF. Bootstrap + # from whatever the index has; the step below replaces it with the + # build under review, and the pin is what an ordinary run tests. + if [ -n "${MCPP_SOURCE_REF:-}" ]; then + xlings install mcpp -y -g + else + xlings install "mcpp@$MCPP_VERSION" -y -g + fi mcpp --version mcpp self config --mirror GLOBAL # ⭐⭐ CROSS-VALIDATION: BUILD THE mcpp UNDER REVIEW AND USE THAT ONE. @@ -170,7 +178,15 @@ jobs: - name: Install mcpp run: | xlings update - xlings install "mcpp@$MCPP_VERSION" -y -g + # ⚠️ THE PIN MAY NAME THE RELEASE THIS RUN IS VALIDATING, which does + # not exist yet — that is the whole point of MCPP_SOURCE_REF. Bootstrap + # from whatever the index has; the step below replaces it with the + # build under review, and the pin is what an ordinary run tests. + if [ -n "${MCPP_SOURCE_REF:-}" ]; then + xlings install mcpp -y -g + else + xlings install "mcpp@$MCPP_VERSION" -y -g + fi mcpp self config --mirror GLOBAL # ⭐⭐ CROSS-VALIDATION: BUILD THE mcpp UNDER REVIEW AND USE THAT ONE. # From d7717801ca105672a84665ec786c54ea89f497e6 Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 19:43:48 +0800 Subject: [PATCH 5/7] ci: the clone's workspace pin does not decide which mcpp builds it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `.xlings.json` at mcpp's root pins the mcpp that compiles mcpp, and that pin does not move when mcpp is released — a build inside the checkout obeys it and installs a version the index may no longer carry. What this step wants is the source compiled by the mcpp installed a moment earlier. --- .github/workflows/ci.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 43e48da..23d420f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -103,6 +103,18 @@ jobs: [ -d "$src" ] || git clone --quiet --depth 1 \ --branch "$MCPP_SOURCE_REF" \ https://github.com/mcpp-community/mcpp.git "$src" + # ⚠️ THE CLONE'S OWN WORKSPACE PIN MUST NOT DECIDE WHICH mcpp + # BUILDS IT. `.xlings.json` at mcpp's root pins the mcpp that + # compiles mcpp, and that pin does not move when mcpp is released — + # so a build inside the checkout obeys it and tries to install a + # version the index may no longer carry: + # + # [error] xlings: version '2026.8.17.1' not found for 'mcpp' + # available: 2026.8.25.1 + # + # What is wanted here is the source compiled by the mcpp installed + # above, which is exactly what removing the file leaves. + rm -f "$src/.xlings.json" ( cd "$src" && mcpp build --release ) built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } @@ -207,6 +219,18 @@ jobs: [ -d "$src" ] || git clone --quiet --depth 1 \ --branch "$MCPP_SOURCE_REF" \ https://github.com/mcpp-community/mcpp.git "$src" + # ⚠️ THE CLONE'S OWN WORKSPACE PIN MUST NOT DECIDE WHICH mcpp + # BUILDS IT. `.xlings.json` at mcpp's root pins the mcpp that + # compiles mcpp, and that pin does not move when mcpp is released — + # so a build inside the checkout obeys it and tries to install a + # version the index may no longer carry: + # + # [error] xlings: version '2026.8.17.1' not found for 'mcpp' + # available: 2026.8.25.1 + # + # What is wanted here is the source compiled by the mcpp installed + # above, which is exactly what removing the file leaves. + rm -f "$src/.xlings.json" ( cd "$src" && mcpp build --release ) built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } From 8f0a57a90e8af12a1ef760b4b2e6db43477d141c Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 19:48:27 +0800 Subject: [PATCH 6/7] ci: note why the fresh clone needs no mtime sort MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The mcpp side of this cross-validation had to sort by mtime — its target/ is restored from a cache and `find … | head -1` returned a binary an earlier push had left, with the right version string and the wrong code. Here $src is a fresh clone, so the plain form is correct; `-printf` is a GNU extension and one of the runners reaching this line is macOS. --- .github/workflows/ci.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 23d420f..4325e0a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -116,6 +116,11 @@ jobs: # above, which is exactly what removing the file leaves. rm -f "$src/.xlings.json" ( cd "$src" && mcpp build --release ) + # ⭐ `$src` is a FRESH clone each run, so `target/` holds exactly what + # this step just built and there is no earlier fingerprint directory + # to pick by mistake. `-printf` would be the safer form on a cached + # tree and is a GNU extension this must not use — one of the runners + # that reaches this line is macOS. built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH" @@ -232,6 +237,11 @@ jobs: # above, which is exactly what removing the file leaves. rm -f "$src/.xlings.json" ( cd "$src" && mcpp build --release ) + # ⭐ `$src` is a FRESH clone each run, so `target/` holds exactly what + # this step just built and there is no earlier fingerprint directory + # to pick by mistake. `-printf` would be the safer form on a cached + # tree and is a GNU extension this must not use — one of the runners + # that reaches this line is macOS. built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH" From c206dc63fd92f907b9797fbfa556fc1c8da6d97a Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 20:10:00 +0800 Subject: [PATCH 7/7] ci: find the built mcpp by either spelling, on every runner MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The matrix reaches Windows and macOS. Measured on the Windows row: `Finished release [optimized] in 173.44s` followed by "mcpp did not build" — the build had succeeded and the search was looking for a name that filesystem does not use. --- .github/workflows/ci.yml | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4325e0a..234597e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -116,12 +116,18 @@ jobs: # above, which is exactly what removing the file leaves. rm -f "$src/.xlings.json" ( cd "$src" && mcpp build --release ) - # ⭐ `$src` is a FRESH clone each run, so `target/` holds exactly what - # this step just built and there is no earlier fingerprint directory - # to pick by mistake. `-printf` would be the safer form on a cached - # tree and is a GNU extension this must not use — one of the runners - # that reaches this line is macOS. - built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) + # ⚠️ BOTH SPELLINGS, AND NO `-perm`. The matrix reaches Windows and + # macOS runners too: on Windows the artefact is `mcpp.exe`, and + # `-perm -u+x` is not a question that filesystem answers the way this + # expects. Measured: `Finished release [optimized] in 173.44s` + # followed by "mcpp did not build" — the build had succeeded and the + # search was looking for the wrong name. + # + # `$src` is a FRESH clone each run, so `target/` holds exactly what + # this step just built; `-printf` would be the safer form on a cached + # tree and is a GNU extension this must not use. + built=$(find "$src/target" -type f \ + \( -name mcpp -o -name mcpp.exe \) | head -1) [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH" # ⚠️ Reported, because a PATH entry that does not win looks exactly @@ -237,12 +243,18 @@ jobs: # above, which is exactly what removing the file leaves. rm -f "$src/.xlings.json" ( cd "$src" && mcpp build --release ) - # ⭐ `$src` is a FRESH clone each run, so `target/` holds exactly what - # this step just built and there is no earlier fingerprint directory - # to pick by mistake. `-printf` would be the safer form on a cached - # tree and is a GNU extension this must not use — one of the runners - # that reaches this line is macOS. - built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) + # ⚠️ BOTH SPELLINGS, AND NO `-perm`. The matrix reaches Windows and + # macOS runners too: on Windows the artefact is `mcpp.exe`, and + # `-perm -u+x` is not a question that filesystem answers the way this + # expects. Measured: `Finished release [optimized] in 173.44s` + # followed by "mcpp did not build" — the build had succeeded and the + # search was looking for the wrong name. + # + # `$src` is a FRESH clone each run, so `target/` holds exactly what + # this step just built; `-printf` would be the safer form on a cached + # tree and is a GNU extension this must not use. + built=$(find "$src/target" -type f \ + \( -name mcpp -o -name mcpp.exe \) | head -1) [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH" # ⚠️ Reported, because a PATH entry that does not win looks exactly