diff --git a/HISTORY.md b/HISTORY.md index 1581ffd..2c29e2e 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -41,6 +41,13 @@ pass. No native tests, CI jobs or release artifacts were rebuilt or rerun; product sources, workflows, pins and project locks are unchanged. Current scope: [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11). +### Gate `main` on a single CI check and verify it + +`paths-ignore` is replaced by an in-workflow change classification and an always-running `CI gate`, because a workflow that never starts would leave a required check pending on documentation-only pull +requests. The Linux/arm64 leg passed on a real pull request and on `push` to `main`. Ruleset `27002916` requires `CI gate` on `main` (no deletion or force push; administrators bypass so direct documentation commits keep +working). Two draft verification pull requests, closed unmerged: a documentation-only change leaves the matrix skipped, the gate green and the pull request `CLEAN`; a deliberately failing test fails all five legs and the gate and the pull +request is `BLOCKED`. The administrator bypass means a rejected push or merge was not observed. [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11). + ### Add the Linux/arm64 CI leg `ci.yml` has a required `linux-arm64` leg on `ubuntu-26.04-arm`: the pinned published Linux/aarch64 CLI Preview acquires the public Linux/aarch64 Dev SDK, builds the checked-out sources and the four diff --git a/README.md b/README.md index 9a3fa55..12af444 100644 --- a/README.md +++ b/README.md @@ -123,8 +123,8 @@ packages are out; default/project pin adoption is next; CI covers Linux/x86_64, Windows/arm64 D3 remains a separate qualification target. CI's five required jobs have a passing manual run, with Linux/x86_64 on two -Ubuntu versions. The newly added Linux/arm64 leg still needs observed push/PR -events; [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11) +Ubuntu versions. The Linux/arm64 leg has also passed on push and pull-request events, and `main` +requires the `CI gate` check; [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11) distinguishes workflow configuration, hosted results and deferred integration/release jobs. Preview qualification covers the actual packaged CLI, promoted SDK pin, trust, diff --git a/STATUS.md b/STATUS.md index 0d39548..857c5ca 100644 --- a/STATUS.md +++ b/STATUS.md @@ -26,8 +26,9 @@ process-worker change `f49c279` is test infrastructure, not a product-source rev The five required GitHub CI jobs cover Ubuntu 24.04/26.04 x86_64, Ubuntu 26.04 arm64, macOS/arm64 and Windows/x64. Manual run `42931003805` at `f6a41a8` succeeds on all five; its Linux/arm64 artifact is independently checked, while -the other four retain their earlier artifact qualification. ARM64 push/PR -events remain unobserved. [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11) +the other four retain their earlier artifact qualification. Its push to `main` and +pull-request events have since passed, and `main` is protected by a ruleset that +requires the `CI gate` check. [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11) owns the current combinations and limits. Windows/x64's earlier concurrent-install crash was root-caused/fixed in the diff --git a/TODO.md b/TODO.md index e177a60..1585fd1 100644 --- a/TODO.md +++ b/TODO.md @@ -52,17 +52,16 @@ retain their later queues. Execution policy remains in ### GitHub CI -`ci.yml` (PR and main, excluding documentation-only changes) bootstraps from +`ci.yml` (PR and main; a documentation-only change skips the matrix inside the workflow, and +`CI gate` is the one required check of the `main` ruleset) bootstraps from the pinned published Preview and is described in the [development guide](docs/guides/development.md#continuous-integration); completed steps live in HISTORY. Linux/x86_64 (`ubuntu-24.04` and `ubuntu-26.04`), Linux/arm64 (`ubuntu-26.04-arm`), macOS/arm64 (`macos-15`) and Windows/x64 (`windows-2022`) are required legs. [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11) -owns the completed combinations and event scope, including both repaired Linux -paths and the Linux/arm64 manual dispatch. +owns the completed combinations, event scope and ruleset, including both repaired Linux +paths and the Linux/arm64 dispatch, push and pull-request runs. -- [ ] Observe the new Linux/arm64 leg on push to `main` and on a pull request; - its passing branch dispatch does not establish those event paths. - [ ] `integration.yml`: the five input-gated port suites (`port-build|store|oracle|command|project-test`) with the pinned independent host tools, zlib source archive and oracle, plus redirect/transport replays. Daily and manual. - [ ] `release.yml`: protected, manually approved packaging from a tested CI artifact, independent extraction and diff --git a/docs/README.md b/docs/README.md index 0b04a5c..c68d6f2 100644 --- a/docs/README.md +++ b/docs/README.md @@ -41,7 +41,7 @@ from the SDK build baseline: - [GitHub CI](acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11): five required hosted jobs across four host/architecture pairs, the retained - local and failed-run evidence, and outstanding event/integration/release gates. + local and failed-run evidence, the `main` ruleset, and outstanding integration/release gates. - [Dev SDK / CLI Preview](acceptance/preview_acceptance.md): bounded local candidate, published Linux/x86_64, Linux/aarch64, macOS/arm64 and Windows/x64 packages, actual SDK/CLI/resource identities, isolated workflows and publication limits. diff --git a/docs/acceptance/ci_acceptance.md b/docs/acceptance/ci_acceptance.md index 558137e..02cbe67 100644 --- a/docs/acceptance/ci_acceptance.md +++ b/docs/acceptance/ci_acceptance.md @@ -433,4 +433,33 @@ required: that SDK was exercised on glibc 2.43 only, so no `ubuntu-24.04-arm` le The `linux-arm64` artifact summary was downloaded and checked: result `pass`, glibc 2.43, LLVM/LLD 21.1.8, the same four suite counts, stage 1 and stage 2 byte-identical, bootstrap executable `9fbef825...`, SDK pin as above. The other four legs are unchanged inputs and were not re-verified artifact by artifact here. -Not covered: pull-request and `push` events on `main` for this leg (the first run was a manual dispatch from the branch; a runner or image change fails closed), Ubuntu 24.04 arm64, other glibc versions, and the `integration.yml` and `release.yml` queues. +Not covered by this dispatch run: pull-request and `push` events for the leg (observed afterwards, see [Current hosted coverage](#current-hosted-coverage-2026-11-11)), Ubuntu 24.04 arm64, other glibc versions, and the `integration.yml` and `release.yml` queues. + +## Current hosted coverage (2026-11-11) + +**Events.** The `linux-arm64` leg (`ubuntu-26.04-arm`) has now passed on every event path that triggers `ci.yml`, each time with all other legs green: + +| Event | Run | Source | Result | +| --- | --- | --- | --- | +| `workflow_dispatch` (branch) | `42931003805` | `f6a41a8` | success, 5 jobs | +| `push` to `main` | `42932786276` | `6201aa6` | success, 5 jobs | +| `pull_request` | `42946566272` | `47c3a03` (PR 1) | success, `changes`, 5 native jobs and `CI gate` | +| `push` to `main` (merge of PR 1) | `42948410361` | `0cf5a77` | success, `CI gate` reported by `github-actions` | + +**Change classification.** `paths-ignore` is replaced by a `changes` job and an always-running `CI gate` (see the [development guide](../guides/development.md#continuous-integration)): +a workflow that never starts leaves a required status check pending, which would block every documentation-only pull request. The classifier was exercised locally on a documentation-only range +(`code=false`), a code range, a mixed range, an unreachable `before` and a manual dispatch (all `code=true`, i.e. the full matrix). Unclassifiable input runs the matrix; skipping requires a proven documentation-only change. + +**Ruleset.** Repository ruleset `27002916` "main requires CI gate" (`active`) targets `refs/heads/main`: required status check `CI gate` from the GitHub Actions app (`integration_id` 15368, not strict), no deletion, no non-fast-forward. +Repository administrators bypass `always` (chosen so that the maintainer's direct documentation commits keep working); pull requests from anyone else cannot merge unless `CI gate` passes. +Two verification pull requests were opened as drafts and closed without merging, with their branches deleted: + +| Pull request | Change | `CI gate` | Merge state | +| --- | --- | --- | --- | +| 2 | one HTML comment in `docs/README.md` | success; `changes` success, the matrix `SKIPPED` | `CLEAN` / `MERGEABLE` | +| 3 | a deliberately failing test in `tools/test_ci_bootstrap.py` | failure; all five native jobs failed | `BLOCKED` | + +**Limits.** The rule's effect on a non-administrator cannot be observed from the administrator account used here: the administrator bypass means a direct push to `main` or a merge of a failing pull request would still be accepted, +so the `BLOCKED` state is evidence of the rule, not of a rejected push. No second account tried to push. Bypass is `always`, not `pull_request`; tightening it later removes direct pushes for the maintainer too. +A pull request needs no review (no approval rule is configured). Required checks apply to `main` only; tags and other branches are unprotected. A runner label or image change fails the leg closed rather than skipping it. +