diff --git a/.github/workflows/zed-cli-388-github-only-outage.yml b/.github/workflows/zed-cli-388-github-only-outage.yml new file mode 100644 index 0000000..9541141 --- /dev/null +++ b/.github/workflows/zed-cli-388-github-only-outage.yml @@ -0,0 +1,161 @@ +name: zed-cli 388 GitHub-only outage certification + +on: + pull_request: + paths: + - '.github/workflows/zed-cli-388-github-only-outage.yml' + workflow_dispatch: + +permissions: + contents: read + +defaults: + run: + shell: bash + +env: + ZED_CLI_SHA: f3123ebebadaede30da97a31a586288c3b15609d + DEAD_REGISTRY: https://zed-control-plane-intentionally-unavailable.invalid + DEAD_R2: http://127.0.0.1:1 + ZED_PKG_SOURCE_FALLBACK: 'true' + ZED_PKG_R2_PUBLIC_BASE: http://127.0.0.1:1 + +jobs: + github-only-five-language: + name: five ecosystems restore without Zed infrastructure + runs-on: ubuntu-24.04 + timeout-minutes: 45 + steps: + - name: Check out test repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Check out exact zed-cli candidate + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: zed-pkg/zed-cli + ref: ${{ env.ZED_CLI_SHA }} + path: product/zed-cli + fetch-depth: 1 + persist-credentials: false + show-progress: false + + - name: Install pinned Rust toolchain + uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 + with: + toolchain: '1.98.1' + + - name: Build and verify exact candidate + working-directory: product/zed-cli + run: | + set -Eeuo pipefail + test "$(git rev-parse HEAD)" = "$ZED_CLI_SHA" + cargo build --locked --release --bin zed + cargo test --locked source_fallback::tests::smart_http_refs_recover_default_branch_and_peeled_tags -- --nocapture + cargo test --locked source_fallback::tests::github_rest_quota_and_server_failures_are_degradable -- --nocapture + cargo test --locked source_fallback::tests::github_sources_precede_zed_owned_r2_during_fallback -- --nocapture + + - name: Create five-language consumer + run: | + set -Eeuo pipefail + mkdir -p consumer + cat > consumer/.zpkg.toml <<'EOF' + [package] + org = "zed-pkg-test" + name = "zed-cli-388-github-only-consumer" + version = "0.0.0" + description = "Independent GitHub-only recovery certification" + + [package.repository] + vcs = "git" + url = "https://github.com/zed-pkg-test/github-api-fallback-canary" + + [install] + dir = "zed_modules" + adapter = "none" + + [dependencies] + "zed-pkg-test/go-lib" = "=1.0.0" + "zed-pkg-test/python-lib" = "=1.0.0" + "zed-pkg-test/dart-lib" = "=1.0.0" + "zed-pkg-test/node-lib" = "=1.0.0" + "zed-pkg-test/gleam-lib" = "=1.0.0" + EOF + + - name: Resolve and materialize from GitHub with Zed control plane down + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true + ( + cd consumer + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-a" install \ + --install-mode copy --adapter none --allow-ecosystem-mismatch + ) 2>&1 | tee "$RUNNER_TEMP/github-a.log" + test -s consumer/.zpkg.lock + for name in go-lib python-lib dart-lib node-lib gleam-lib; do + grep -R -q "name = \"$name\"" consumer/zed_modules + done + cp consumer/.zpkg.lock "$RUNNER_TEMP/lock-a" + grep -E -q 'using GitHub(-first)? fallback' "$RUNNER_TEMP/github-a.log" + + - name: Re-resolve from an independent empty home + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true + rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-b" + ( + cd consumer + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-b" install \ + --install-mode copy --adapter none --allow-ecosystem-mismatch + ) 2>&1 | tee "$RUNNER_TEMP/github-b.log" + cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock + + - name: Frozen replay from a third empty home + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true + rm -rf consumer/zed_modules "$RUNNER_TEMP/zed-home-frozen" + ( + cd consumer + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-frozen" install --frozen \ + --install-mode copy --adapter none --allow-ecosystem-mismatch + ) 2>&1 | tee "$RUNNER_TEMP/github-frozen.log" + cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock + test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 5 + + - name: Fail closed when source fallback is disabled + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true + rm -rf consumer/zed_modules "$RUNNER_TEMP/zed-home-disabled" + set +e + ( + cd consumer + ZED_PKG_SOURCE_FALLBACK=false "$ZED" --registry "$DEAD_REGISTRY" \ + --home "$RUNNER_TEMP/zed-home-disabled" install --frozen \ + --install-mode copy --adapter none --allow-ecosystem-mismatch + ) >"$RUNNER_TEMP/fallback-disabled.log" 2>&1 + status=$? + set -e + cat "$RUNNER_TEMP/fallback-disabled.log" + test "$status" -ne 0 + + - name: Retain outage evidence + if: ${{ always() }} + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: zed-cli-388-github-only-${{ github.run_id }}-${{ github.run_attempt }} + if-no-files-found: warn + retention-days: 14 + path: | + ${{ runner.temp }}/lock-a + ${{ runner.temp }}/github-a.log + ${{ runner.temp }}/github-b.log + ${{ runner.temp }}/github-frozen.log + ${{ runner.temp }}/fallback-disabled.log + consumer/.zpkg.lock