Repository navigation
完善原生检查、WASM快检与逐语言生产验收 #421
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: codeguard | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| msrv: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install the declared minimum Rust in this CI runner | |
| run: rustup toolchain install 1.85.0 --profile minimal | |
| - name: Check default and WASM targets with actual Rust 1.85 | |
| run: | | |
| cargo +1.85.0 check --locked --workspace --all-targets | |
| cargo +1.85.0 check --locked --workspace --all-targets --features wasm-precheck | |
| gate: | |
| # ubuntu-latest 预装稳定版 Rust；Cargo.toml 声明 rust-version = 1.85 / edition = 2024。 | |
| runs-on: ubuntu-latest | |
| env: | |
| # Linux 完整 DWARF 测试制品会超出 SDK 的 256 MiB 宿主制品读取预算。 | |
| # 仅去掉测试调试符号；保留 debug assertions 和产品读取上限。 | |
| CARGO_PROFILE_TEST_DEBUG: "0" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Check out corpus evidence source | |
| # 固定语料按 sha256 校验来自插件仓的真实文件（provenance.source_ref = | |
| # codeguard-plugin@9e4adb1），因此必须把该 commit 检出到兄弟目录； | |
| # 只建空目录不够，会因摘要不匹配而失败。 | |
| run: | | |
| git clone --quiet https://github.com/full-stack-plugins/codeguard-plugin.git ../codeguard-plugin | |
| git -C ../codeguard-plugin checkout --quiet 9e4adb1 | |
| # 语料仍绑定历史9e4adb1；源码审计另绑定最新插件提交，两者不能混用。 | |
| # 固定提交尚未在插件远端可达时先明确失败，避免构建之后才发现缺源码。 | |
| git -C ../codeguard-plugin cat-file -e 'dec5f9d1361eefff493e120b4278939a243814a9^{commit}' || { | |
| echo 'Pinned plugin audit source dec5f9d is unavailable; publish its reviewed Git branch before source audit.' >&2 | |
| exit 1 | |
| } | |
| - name: Verify crate layering debt does not grow | |
| run: python3 scripts/check_layering.py | |
| - name: Build workspace | |
| run: cargo build --workspace --all-targets | |
| - name: Verify canonical legacy identities and archived migration audit | |
| run: | | |
| cargo test --locked -p codeguard-adapters --test legacy_registry_identity | |
| cargo test --locked -p codeguard-cli --example audit_legacy_registry | |
| cargo run --locked -p codeguard-cli --example audit_legacy_registry -- --check tests/acceptance/evidence/legacy-registry-audit-2026-10-06.json | |
| cargo test --locked -p codeguard-cli --example audit_legacy_source -- --include-ignored | |
| cargo run --locked -p codeguard-cli --example audit_legacy_source -- --check-source ../codeguard-plugin | |
| - name: Preserve the binary without WASM for package rejection | |
| run: cp target/debug/codeguard "$RUNNER_TEMP/codeguard-no-wasm" | |
| - name: Verify grammar inventory before parser and package checks | |
| run: | | |
| # 清单文案及来源投影错误先报告，避免到完整 suite 末段才失败。 | |
| # 两种构建均须保留零资格、未执行和真实方言限制；不放宽资格或原生义务。 | |
| cargo test --locked -p codeguard-cli --test grammar_status_cli | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --test grammar_status_cli | |
| - name: Verify Linux WASM worker resource boundary | |
| run: | | |
| # 帮助目录须保留当前构建特性；默认 suite 无法证明 WASM 入口状态。 | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --test help_command_contract --test rules_list_cli --test version_cli --test rust_lint_cli --test rust_lint_input_stability --test check_all_rust_native --test rust_project_syntax --test rust_native_hook --test ruby_lint_cli --test check_all_ruby --test ruby_native_hook --test ruby_project_version --test shell_lint_cli --test shell_workbench --test check_all_shell --test shell_native_hook --test hook_failed_write_options --test go_native_hook --test cfquery_postgres_dialect --test cfquery_structure | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --test workspace_msrv --test crate_boundaries | |
| cargo test -p codeguard-runtime --features wasm-precheck --test process_contract | |
| cargo test -p codeguard-runtime --features wasm-precheck --test wasm_grammar_load --test wasm_recovery_scan --test wasm_empty_block_scan --test wasm_root_child_scan --test dart_upstream_corpus | |
| cargo test -p codeguard-cli --features wasm-precheck --test syntax_worker_candidate --test grammar_probe_cli --test check_python_structure --test check_go_package_structure --test go_syntax_fallback_candidate --test python_structural_syntax --test python_syntax_fallback_candidate --test grammar_probe_cli --test grammar_route --test zig_lint_cli --test typescript_syntax_fallback_candidate --test java_syntax_fallback_candidate --test java_native_differential --test kotlin_native_differential --test kotlin_lint_cli --test kotlin_syntax_task_verify --test kotlin_native_first --test erlang_native_differential --test erlang_lint_cli --test erlang_native_discovery --test check_all_erlang --test erlang_syntax_task_verify --test erlang_native_workbench --test swift_native_differential --test swift_lint_cli --test check_all_swift --test swift_native_hook --test swift_native_workbench --test swift_syntax_task_verify --test check_all_eslint --test hook_execute_cli --test claude_hook_cli --test hook_syntax_tasks --test syntax_task_verify --test zig_native_cli --test zig_native_discovery --test check_all_zig --test zig_native_hook --test zig_native_workbench --test zig_native_first_resolution --test task_resolution_service | |
| # 原生限定关闭服务在 WASM 构建下也须实际运行，默认 suite 不涵盖所有历史来源。 | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --test erlang_task_resolution_service --test swift_task_resolution_service --test kotlin_task_resolution_service --test go_task_resolution_service --test rust_task_resolution_service --test ruby_task_resolution_service --test shell_task_resolution_service --test check_language_selection | |
| cargo test --locked -p codeguard-cli --lib --features wasm-precheck selected_compiler_does_not_hide_unobserved_files_with_wasm | |
| # 32 份 WASM 的批次和单项目回归各自独占候选阶段预算，避免测试进程互相争抢内存与 CPU。 | |
| cargo test -p codeguard-cli --features wasm-precheck --test check_all_grammar_candidates -- --test-threads=1 | |
| - name: Replay every fixed grammar and retain per-language evidence | |
| run: | | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --test grammar_evaluation --test grammar_native_differential --test javascript_native_differential --test ruby_native_differential --test go_native_differential --test rust_formatter_differential --test go_package_structure | |
| # C/C++明确标准的原生边界与受控错版本回放必须在WASM构建下验收。 | |
| # Ubuntu宿主Clang不冒充固定AppleClang21；实际条件目标另需显式已有工具。 | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --test clang_lint_cli --test c_family_comments_cli --test c_family_comments_workbench --test c_family_native_replay | |
| # 固定 Rustfmt 解析器的协议反例；不把 CI 预装版本当作指定原生版本。 | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --lib rustfmt_syntax_probe | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --lib python_syntax_probe | |
| # Go双制品、整文件与取消反例使用受控SDK；真实版本需显式选择。 | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --lib go_syntax_probe | |
| # Ruby 固定版本的真实对照需显式工具；普通输出边界反例在 Linux 运行。 | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --lib ruby_syntax_probe | |
| # Node 版本不匹配时不借用宿主版本；受控隔离/执行中取消反例仍在 Linux 实际运行。 | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --lib javascript_syntax_probe | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --lib grammar_native_checker | |
| # 此测试确认全部 worker 实际运行并保留逐语言 JSON；已知语法差异保留为数据， | |
| # 不断言成正确行为，也不把工具不可用的 358 项 unknown 当回放成功。 | |
| # 0.1 协议与历史报告由上面的普通测试保留兼容；当前回放显式分离语料来源。 | |
| cargo test --locked -p codeguard-cli --features wasm-precheck --test grammar_evaluation \ | |
| replay_expanded_cohorts_and_archive_current_evidence -- \ | |
| --ignored --exact --nocapture --test-threads=1 | |
| - name: Verify the local npm package contains a running WASM worker | |
| run: | | |
| cargo build --locked -p codeguard-cli --features wasm-precheck | |
| CODEGUARD_NO_WASM_BIN="$RUNNER_TEMP/codeguard-no-wasm" \ | |
| CODEGUARD_WASM_BIN="$PWD/target/debug/codeguard" \ | |
| node --test tests/npm_pack_wasm.test.mjs | |
| # 独占打包输出与 npm 缓存，不与上面的全量 grammar 包测试并发。 | |
| CODEGUARD_WASM_BIN="$PWD/target/debug/codeguard" \ | |
| node --test tests/npm_pack_repair.test.mjs | |
| # 安装后的原生首次发现不依赖 WASM 任务；真实 OTP 目标须显式选择。 | |
| CODEGUARD_WASM_BIN="$PWD/target/debug/codeguard" \ | |
| node --test tests/npm_pack_erlang_repair.test.mjs | |
| CODEGUARD_WASM_BIN="$PWD/target/debug/codeguard" \ | |
| node --test tests/npm_pack_ruby_repair.test.mjs | |
| CODEGUARD_WASM_BIN="$PWD/target/debug/codeguard" \ | |
| node --test tests/npm_pack_shell_repair.test.mjs | |
| CODEGUARD_WASM_BIN="$PWD/target/debug/codeguard" \ | |
| node --test tests/npm_pack_go_syntax_repair.test.mjs | |
| CODEGUARD_WASM_BIN="$PWD/target/debug/codeguard" \ | |
| node --test tests/npm_pack_rust_syntax_repair.test.mjs | |
| - name: Run test suite | |
| run: cargo test --workspace --all-targets | |
| - name: Explain remaining layering debt | |
| if: always() | |
| run: python3 scripts/check_layering.py --explain |