also looking at this
fix(native): preserve workspace sources and native overlay lifecycle
#384
20 files
+500
-227
Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.
| @@ -179,14 +179,26 @@ jobs: | ||
| 179 | 179 | steps: |
| 180 | 180 | - uses: actions/checkout@v6 |
| 181 | 181 | |
| 182 | - name: Inspect source after checkout | |
| 183 | shell: pwsh | |
| 184 | run: ./scripts/inspect-windows-source.ps1 -Stage checkout | |
| 185 | ||
| 182 | 186 | - name: Setup Pantry (provides Bun and Zig) |
| 183 | 187 | uses: pantry-pm/pantry/packages/action@ae59a7b7fc5f4e6f7b8041a75e6b5772680bebdf # v0.11.101 |
| 184 | 188 | with: |
| 185 | 189 | version: '0.11.101' |
| 186 | 190 | |
| 191 | - name: Inspect source after provisioning | |
| 192 | shell: pwsh | |
| 193 | run: ./scripts/inspect-windows-source.ps1 -Stage provisioning | |
| 194 | ||
| 187 | 195 | - name: First-party Zig dependencies |
| 188 | 196 | uses: ./.github/actions/first-party-zig-deps |
| 189 | 197 | |
| 198 | - name: Inspect source after dependencies | |
| 199 | shell: pwsh | |
| 200 | run: ./scripts/inspect-windows-source.ps1 -Stage dependencies | |
| 201 | ||
| 190 | 202 | - name: Build Windows CLI |
| 191 | 203 | # scripts/zig.ts resolves the actual managed binary from pantry.lock, |
| 192 | 204 | # including its adjacent standard library on Windows. |
| @@ -0,0 +1,31 @@ | ||
| 1 | param([Parameter(Mandatory = $true)][string]$Stage) | |
| 2 | ||
| 3 | $source = Join-Path $PSScriptRoot '../packages/zig/build.zig' | |
| 4 | $present = Test-Path -LiteralPath $source | |
| 5 | $metadata = @{ | |
| 6 | stage = $Stage | |
| 7 | source = $source | |
| 8 | present = $present | |
| 9 | tracked = (& git ls-files --stage -- packages/zig/build.zig) | |
| 10 | status = (& git status --porcelain -- packages/zig/build.zig) | |
| 11 | } | |
| 12 | if ($present) { | |
| 13 | $metadata.sha256 = (Get-FileHash -LiteralPath $source -Algorithm SHA256).Hash | |
| 14 | $metadata.attributes = (Get-Item -LiteralPath $source).Attributes.ToString() | |
| 15 | } | |
| 16 | $metadata | ConvertTo-Json -Compress | |
| 17 | ||
| 18 | if (-not $present -and (Get-Command Get-MpThreatDetection -ErrorAction SilentlyContinue)) { | |
| 19 | try { | |
| 20 | Get-MpThreatDetection | Where-Object { $_.Resources -match 'build\.zig' } | ForEach-Object { | |
| 21 | @{ | |
| 22 | threatId = $_.ThreatID | |
| 23 | actionSucceeded = $_.ActionSuccess | |
| 24 | detectedAt = $_.InitialDetectionTime | |
| 25 | resources = @($_.Resources | Where-Object { $_ -match 'build\.zig' }) | |
| 26 | } | ConvertTo-Json -Compress | |
| 27 | } | |
| 28 | } catch { | |
| 29 | Write-Output "Source security-event inspection unavailable: $($_.Exception.Message)" | |
| 30 | } | |
| 31 | } | |
| @@ -7,7 +7,7 @@ import { cpus } from 'node:os' | ||
| 7 | 7 | const source = resolve(import.meta.dir, '..') |
| 8 | 8 | const zig = resolveZig(source) |
| 9 | 9 | const trackedBuild = join(source, 'packages/zig/build.zig') |
| 10 | console.log('Tracked core project:', JSON.stringify({ file: trackedBuild, exists: existsSync(trackedBuild), sha256: createHash('sha256').update(readFileSync(trackedBuild)).digest('hex'), bun: Bun.version, executable: process.execPath, cpu: cpus()[0]?.model, platform: process.platform })) | |
| 10 | console.log('Tracked core project:', JSON.stringify({ file: trackedBuild, exists: existsSync(trackedBuild), sha256: existsSync(trackedBuild) ? createHash('sha256').update(readFileSync(trackedBuild)).digest('hex') : null, bun: Bun.version, executable: process.execPath, cpu: cpus()[0]?.model, platform: process.platform })) | |
| 11 | 11 | const zigLibrary = join(dirname(realpathSync(zig.path)), 'lib/std/zig.zig') |
| 12 | 12 | console.log('Pinned compiler bytes:', JSON.stringify({ executable: zig.path, sha256: createHash('sha256').update(readFileSync(zig.path)).digest('hex'), library: zigLibrary, librarySha256: existsSync(zigLibrary) ? createHash('sha256').update(readFileSync(zigLibrary)).digest('hex') : null })) |
| 13 | 13 | // Keep the fixture on the checkout's volume. Hosted Windows keeps the |