fix: allow runtime arenas within a finite runner address budget

.github/scripts/record-runner-artifact.tsadded+71-0

Changes to .github/scripts/record-runner-artifact.ts

		@@ -0,0 +1,71 @@
	1	+import assert from 'node:assert/strict'
	2	+import { readdir } from 'node:fs/promises'
	3	+import { join } from 'node:path'
	4	+
	5	+// A normal Linux CI producer, not a local cross-build or an environment dump.
	6	+assert.equal(process.platform, 'linux')
	7	+assert.equal(process.arch, 'x64')
	8	+assert.equal(process.env.GITHUB_ACTIONS, 'true')
	9	+
	10	+function git(...args: string[]): string {
	11	+ const result = Bun.spawnSync(['git', ...args], { stdout: 'pipe', stderr: 'pipe' })
	12	+ assert.equal(result.exitCode, 0, 'Cannot bind the runner artifact to its checkout')
	13	+ return result.stdout.toString().trim()
	14	+}
	15	+
	16	+async function sha256(path: string): Promise<string> {
	17	+ return new Bun.CryptoHasher('sha256').update(await Bun.file(path).arrayBuffer()).digest('hex')
	18	+}
	19	+
	20	+const source = git('rev-parse', 'HEAD')
	21	+assert.match(source, /^[a-f0-9]{40}$/)
	22	+assert.equal(source, process.env.GITHUB_SHA)
	23	+assert.equal(git('status', '--porcelain', '--untracked-files=no'), '', 'The producer checkout changed during the build')
	24	+
	25	+const directory = 'dist/runner/linux-x64'
	26	+assert.deepEqual(await readdir(directory), ['reviewos-runner'], 'Upload only the intended binary and generated public provenance')
	27	+const binary = join(directory, 'reviewos-runner')
	28	+const header = new DataView(await Bun.file(binary).slice(0, 64).arrayBuffer())
	29	+assert.equal(header.byteLength, 64)
	30	+assert.equal(header.getUint32(0, false), 0x7F454C46)
	31	+assert.equal(header.getUint8(4), 2)
	32	+assert.equal(header.getUint8(5), 1)
	33	+assert.equal(header.getUint16(18, true), 62)
	34	+
	35	+const graph: Record<string, string> = {}
	36	+for (const name of ['stacks', '@stacksjs/buddy', '@stacksjs/storage', '@stacksjs/validation', '@stacksjs/cli', '@stacksjs/types', '@stacksjs/stx', '@stacksjs/ts-cloud']) {
	37	+ const metadata = await Bun.file(join('node_modules', name, 'package.json')).json()
	38	+ assert.equal(metadata.name, name)
	39	+ assert.equal(typeof metadata.version, 'string')
	40	+ graph[name] = metadata.version
	41	+}
	42	+
	43	+const buildCommand = await Bun.file('app/Commands/BuildRunner.ts').text()
	44	+assert(buildCommand.includes('--no-compile-autoload-dotenv'))
	45	+assert(buildCommand.includes('--no-compile-autoload-bunfig'))
	46	+const binarySha256 = await sha256(binary)
	47	+const proof = {
	48	+ schema_version: 1,
	49	+ source,
	50	+ source_tree: git('rev-parse', 'HEAD^{tree}'),
	51	+ workflow_run_id: process.env.GITHUB_RUN_ID,
	52	+ workflow_run_attempt: process.env.GITHUB_RUN_ATTEMPT,
	53	+ event: process.env.GITHUB_EVENT_NAME,
	54	+ ref: process.env.GITHUB_REF,
	55	+ bun: Bun.version,
	56	+ target: 'bun-linux-x64',
	57	+ installed_versions: graph,
	58	+ inputs: {
	59	+ package_json: await sha256('package.json'),
	60	+ bun_lock: await sha256('bun.lock'),
	61	+ entrypoint: await sha256('app/Actions/Runner/standalone.ts'),
	62	+ limits: await sha256('app/Actions/Runner/limits.ts'),
	63	+ build_command: await sha256('app/Commands/BuildRunner.ts'),
	64	+ workflow: await sha256('.github/workflows/ci.yml'),
	65	+ },
	66	+ binary: { name: 'reviewos-runner', bytes: Bun.file(binary).size, sha256: binarySha256, format: 'ELF64', architecture: 'x64' },
	67	+ compile_autoload: { dotenv: false, bunfig: false },
	68	+}
	69	+await Bun.write(join(directory, 'provenance.json'), `${JSON.stringify(proof, null, 2)}\n`)
	70	+await Bun.write(join(directory, 'checksums.sha256'), `${binarySha256} reviewos-runner\n`)
	71	+console.log(`Recorded Linux runner ${binarySha256} from ${source}`)