ReviewOS

zig-utils/zig-js

ci: classify the two compiler-pressure build commands in dependency inventory

#987
Closed glennmichael123 opened this 9 days ago ·
9 days ago

Reproduction

At main bcc32b71, zig build dependency-audit exits 1:

dependency audit: system command '/usr/bin/env' occurs 42 times, expected 40

Measured locally with Zig 0.17.0-dev.1441 under the shared 3072 MB guard (peak 267 MB). The gate uses only the standard library, not the local GC shim.

Cause and scope

Commit 0ef07820 added two build-system commands invoking the existing home-tool-runtime dependency: the self-test and collector for tools/compiler-pressure-benchmark.ts. The dependency inventory still records 40 calls. Both use the same owned runner and classification; no new dependency policy exception is needed.

Definition of done

  • Review both command additions and update only the corresponding inventory count to 42.
  • Run the complete dependency audit successfully; retain fail-closed checking.
  • No engine changes or conformance claims beyond 0 test262 flips (inventory-only).

Related: #462, #985. This is separate from runtime-coordination implementation work.

9 days ago

Landed on main in b66eb53b (fix(ci): classify new repository tooling dependencies (#987)), authored and committed as the configured user without trailers.

The full audit exposed more than the first reported count: after fixing env 40 -> 42, it failed on TypeScript scripts 69 -> 71. Reviewed the two added tools and classified both with narrow existing-policy contracts: the compiler-pressure collector (#985) and CLDR collation generator (#977). No network permissions, dependency policy, runtime code, or guard behavior changed.

Validation:

  • Before: complete dependency-audit exits 1 (42 env calls, expected 40).
  • Intermediate: exits 1 (71 TypeScript scripts, expected 69).
  • After: exits 0; 16 classified edges, 0 migration targets, 65 classified repository tools.
  • Docs link check passes; deterministic docs build passes, 51 pages.
  • Shared guard preserved at 3072 MB; peaks 267 MB initial audit, 8 MB corrected audit, 316 MB docs gates.
  • flips 0 test262 cases; inventory-only, no corpus rerun for this change.

This resolves the dependency-audit failure only, not the unrelated runtime or benchmark CI failures. Related dependency-policy/tool-contract tracking: #462 and #497.

Sign in to comment on this issue.