Skip to content

Commit 29da3e6

Browse files
hyperpolymathcoderabbitai[bot]
hyperpolymath
and
coderabbitai[bot]
authored
Execute CMake and pipeline commands with failure propagation (#64)
Build and run printed instructions and returned success without executing them. Invoke real CMake configuration/build and the pipeline binary, validate manifests, preserve argument boundaries and propagate failures. Regression tests execute CMake and a host C fixture, including missing inputs and deliberate compilation/runtime failures. This validates orchestration; it does not certify generated Halide algorithms or performance claims. Update the shared governance/security workflows to standards fcb566cfb8a86cea2d3666bf65a4f177a49b1313, enable blocking high/critical Hypatia findings, and validate direct/transitive Actions dependencies with gh actions-lock. Live Actions policy checks pass for this repository. Migrate canonical metadata to .machine_readable/descriptiles/ and update live references. Validation: local relevant regression/conformance checks and diff checks; full remote CI and security results must pass before merge. The portfolio report records broader unvalidated areas explicitly. --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
1 parent 5fba9d7 commit 29da3e6

34 files changed

Lines changed: 567 additions & 185 deletions

‎.envrc‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,10 @@ if has guix && [ -f guix.scm ]; then
1212
use guix
1313
fi
1414

15-
# Load Nix flake if flake.nix exists
16-
if has nix && [ -f flake.nix ]; then
17-
fi
18-
1915
# Project environment variables
20-
export PROJECT_NAME="{{PROJECT_NAME}}"
16+
export PROJECT_NAME="halideiser"
2117
export RSR_TIER="infrastructure"
22-
# export DATABASE_URL="..."
23-
# export API_KEY="..."
18+
# Set service credentials in the gitignored .env file when needed.
2419

2520
# Source .env if it exists (gitignored)
2621
dotenv_if_exists

‎.github/GOVERNANCE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ release schedules, contributor access, and community standards.
4444
- ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`.
4545
- ADRs provide a historical record of why decisions were made and what alternatives
4646
were considered.
47-
- See `.machine_readable/META.a2ml` for the machine-readable ADR index.
47+
- See `.machine_readable/descriptiles/META.a2ml` for the machine-readable ADR index.
4848

4949
---
5050

‎.github/pull_request_template.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@
2626

2727
### As Applicable
2828

29-
- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed)
30-
- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations changed)
31-
- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions changed)
29+
- [ ] `.machine_readable/descriptiles/STATE.a2ml` updated (if project state changed)
30+
- [ ] `.machine_readable/descriptiles/ECOSYSTEM.a2ml` updated (if integrations changed)
31+
- [ ] `.machine_readable/descriptiles/META.a2ml` updated (if architectural decisions changed)
3232
- [ ] Documentation updated for user-facing changes
3333
- [ ] `TOPOLOGY.md` updated (if architecture changed)
3434
- [ ] `CHANGELOG` or release notes updated

‎.github/workflows/abi-ffi-gate.yml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,18 @@ jobs:
2222
runs-on: ubuntu-latest
2323
steps:
2424
- uses: actions/checkout@v7.0.1
25+
- name: Install Julia 1.11.5
26+
run: |
27+
curl --proto "=https" --proto-redir "=https" --tlsv1.2 -fsSL https://julialang-s3.julialang.org/bin/linux/x64/1.11/julia-1.11.5-linux-x86_64.tar.gz -o /tmp/julia.tar.gz
28+
# Official julialang-s3.julialang.org/bin/checksums/julia-1.11.5.sha256
29+
echo '723e878c642220cc0251a0e13758c059a389cadc7f01376feaf1ea7388fe8f9c /tmp/julia.tar.gz' | sha256sum --check --strict
30+
tar -xf /tmp/julia.tar.gz -C /tmp
31+
echo "/tmp/julia-1.11.5/bin" >> "$GITHUB_PATH"
2532
- name: Run ABI-FFI gate
26-
run: python3 scripts/abi-ffi-gate.py
33+
run: |
34+
julia --version # confirms the pinned 1.11.5 is on PATH, not the runner default
35+
julia scripts/abi-ffi-gate.jl
36+
bash tests/abi-gate.sh
2737
2838
zig-build:
2939
name: Zig FFI builds + tests (Zig 0.14.0)
@@ -32,7 +42,9 @@ jobs:
3242
- uses: actions/checkout@v7.0.1
3343
- name: Install Zig 0.14.0
3444
run: |
35-
curl -fsSL https://ziglang.org/download/0.14.0/zig-linux-x86_64-0.14.0.tar.xz -o /tmp/zig.tar.xz
45+
curl --proto "=https" --proto-redir "=https" --tlsv1.2 -fsSL https://ziglang.org/download/0.14.0/zig-linux-x86_64-0.14.0.tar.xz -o /tmp/zig.tar.xz
46+
# Official ziglang.org/download/index.json: 0.14.0 / x86_64-linux
47+
echo '473ec26806133cf4d1918caf1a410f8403a13d979726a9045b421b685031a982 /tmp/zig.tar.xz' | sha256sum --check --strict
3648
tar -xf /tmp/zig.tar.xz -C /tmp
3749
echo "/tmp/zig-linux-x86_64-0.14.0" >> "$GITHUB_PATH"
3850
- name: zig test FFI

‎.github/workflows/actions.lock‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,12 @@ workflows:
1111
- 'actions/cache@v6.1.0'
1212
- 'actions/checkout@v7.0.1'
1313
- 'actions/configure-pages@v6.0.0'
14-
- 'actions/deploy-pages@v5.0.0'
14+
- 'actions/deploy-pages@v5.0.1'
1515
- 'actions/upload-pages-artifact@v5.0.0'
1616
- 'haskell-actions/setup@v2.12.0'
1717
'.github/workflows/codeql.yml':
1818
- 'actions/checkout@v7.0.1'
19-
- 'github/codeql-action@v4.37.7'
19+
- 'github/codeql-action@v4.37.9'
2020
'.github/workflows/dogfood-gate.yml':
2121
- 'actions/checkout@v7.0.1'
2222
'.github/workflows/governance.yml': []
@@ -31,7 +31,7 @@ workflows:
3131
'.github/workflows/release.yml':
3232
- 'actions/checkout@v7.0.1'
3333
- 'actions/upload-artifact@v7.0.1'
34-
- 'softprops/action-gh-release@v3.0.2'
34+
- 'softprops/action-gh-release@v3.0.3'
3535
'.github/workflows/rhodibot.yml':
3636
- 'actions/checkout@v7.0.1'
3737
'.github/workflows/rust-ci.yml': []
@@ -58,9 +58,9 @@ dependencies:
5858
commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
5959
owner_id: 44036562
6060
repo_id: 513659658
61-
'actions/deploy-pages@v5.0.0':
62-
ref: 'v5.0.0'
63-
commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128'
61+
'actions/deploy-pages@v5.0.1':
62+
ref: 'v5.0.1'
63+
commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
6464
owner_id: 44036562
6565
repo_id: 438112499
6666
'actions/download-artifact@v8.0.1':
@@ -90,9 +90,9 @@ dependencies:
9090
commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
9191
owner_id: 47606891
9292
repo_id: 331103973
93-
'github/codeql-action@v4.37.7':
94-
ref: 'v4.37.7'
95-
commit: 'sha1-ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd'
93+
'github/codeql-action@v4.37.9':
94+
ref: 'v4.37.9'
95+
commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938'
9696
owner_id: 9919
9797
repo_id: 259445878
9898
'haskell-actions/setup@v2.12.0':
@@ -110,8 +110,8 @@ dependencies:
110110
commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
111111
owner_id: 18365890
112112
repo_id: 220359305
113-
'softprops/action-gh-release@v3.0.2':
114-
ref: 'v3.0.2'
115-
commit: 'sha1-3d0d9888cb7fd7b750713d6e236d1fcb99157228'
113+
'softprops/action-gh-release@v3.0.3':
114+
ref: 'v3.0.3'
115+
commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64'
116116
owner_id: 2242
117117
repo_id: 204253808

‎.github/workflows/governance.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3-
# This workflow is managed by gh actions-lock.
43
name: Governance
54

65
on:
@@ -16,4 +15,4 @@ permissions:
1615

1716
jobs:
1817
governance:
19-
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
18+
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@469605210e767ee94d1c7a9c13cb6a1d0a78cad1

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3-
# This workflow is managed by gh actions-lock.
43
name: Hypatia Security Scan
54

65
on:
@@ -19,4 +18,6 @@ permissions:
1918

2019
jobs:
2120
scan:
22-
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
21+
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@469605210e767ee94d1c7a9c13cb6a1d0a78cad1
22+
with:
23+
block-on-high: true

‎.github/workflows/instant-sync.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3-
# This workflow is managed by gh actions-lock.
43
# Instant Forge Sync - Triggers propagation to all forges on push/release
54
name: Instant Sync
65

@@ -16,8 +15,13 @@ permissions:
1615
jobs:
1716
dispatch:
1817
runs-on: ubuntu-latest
18+
timeout-minutes: 5
19+
env:
20+
FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
1921
steps:
2022
- name: Trigger Propagation
23+
id: propagate
24+
if: env.FARM_DISPATCH_TOKEN != ''
2125
uses: peter-evans/repository-dispatch@v4.0.1
2226
with:
2327
token: ${{ secrets.FARM_DISPATCH_TOKEN }}
@@ -32,4 +36,5 @@ jobs:
3236
}
3337
3438
- name: Confirm
39+
if: steps.propagate.outcome == 'success'
3540
run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"

‎.github/workflows/rust-ci.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,5 @@ permissions:
1818
jobs:
1919
rust-ci:
2020
uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
21+
with:
22+
enable_audit: true

‎.github/workflows/scorecard.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3-
# This workflow is managed by gh actions-lock.
43
name: OSSF Scorecard
54

65
on:
@@ -14,4 +13,9 @@ permissions:
1413

1514
jobs:
1615
scorecard:
16+
permissions:
17+
actions: read
18+
contents: read
19+
security-events: write
20+
id-token: write
1721
uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a

0 commit comments

Comments
 (0)