From d556aaab78d2aec7f51ea50fc33f0caa9b471b72 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Wed, 12 Aug 2026 11:04:59 -0700 Subject: [PATCH 01/25] fix(ci): preserve Windows Rust build cache Signed-off-by: Piotr Mlocek --- .github/workflows/windows-msvc.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index 3ad1cc68f0..8893f0684b 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -16,6 +16,11 @@ jobs: targets: x86_64-pc-windows-msvc - name: Cache Rust target and registry uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + env: + # mise exports RUSTC_WRAPPER=sccache, but this workflow intentionally + # does not install sccache. Keep rust-cache's cargo metadata calls + # independent of that unavailable wrapper so target artifacts save. + RUSTC_WRAPPER: "" with: shared-key: windows-msvc-x64 cache-targets: "true" @@ -41,6 +46,10 @@ jobs: targets: aarch64-pc-windows-msvc - name: Cache Rust target and registry uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + env: + # Keep rust-cache's cargo metadata calls independent of the + # unavailable sccache wrapper exported by mise. + RUSTC_WRAPPER: "" with: shared-key: windows-msvc-arm64 cache-targets: "true" From fd50689fb648cfd5fc9b7744933a2e9e4435b649 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Wed, 12 Aug 2026 11:05:49 -0700 Subject: [PATCH 02/25] fix(ci): invalidate empty Windows caches Signed-off-by: Piotr Mlocek --- .github/workflows/windows-msvc.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index 8893f0684b..604cfd61fa 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -22,7 +22,9 @@ jobs: # independent of that unavailable wrapper so target artifacts save. RUSTC_WRAPPER: "" with: - shared-key: windows-msvc-x64 + # v2 invalidates the empty archive produced while cargo metadata + # could not run without sccache. + shared-key: windows-msvc-x64-v2 cache-targets: "true" cache-on-failure: "true" cache-bin: "false" @@ -51,7 +53,7 @@ jobs: # unavailable sccache wrapper exported by mise. RUSTC_WRAPPER: "" with: - shared-key: windows-msvc-arm64 + shared-key: windows-msvc-arm64-v2 cache-targets: "true" cache-on-failure: "true" cache-bin: "false" From b857fdde958891a281aef8675a7c99a63023f961 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Wed, 12 Aug 2026 16:18:51 -0700 Subject: [PATCH 03/25] perf(ci): cache Windows builds with sccache Signed-off-by: Piotr Mlocek --- .../build-openshell-mxc-windows/SKILL.md | 13 ++++--- .../build-openshell-mxc-windows/reference.md | 9 +++-- .github/workflows/windows-msvc.yml | 37 +++++++++++-------- architecture/windows-msvc-build.md | 26 +++++++------ tasks/scripts/windows-msvc.ps1 | 11 +++++- 5 files changed, 59 insertions(+), 37 deletions(-) diff --git a/.agents/skills/build-openshell-mxc-windows/SKILL.md b/.agents/skills/build-openshell-mxc-windows/SKILL.md index 954fcedf2f..a46cb09ab3 100644 --- a/.agents/skills/build-openshell-mxc-windows/SKILL.md +++ b/.agents/skills/build-openshell-mxc-windows/SKILL.md @@ -134,7 +134,7 @@ from this skill. | `Z3_LIBRARY_PATH_OVERRIDE` | unset | Directory containing an x64 system `libz3.lib`; not valid for ARM64. | | `Z3_SYS_Z3_HEADER` | unset | Full `z3.h` path required with a system Z3 library. | | `Z3_SYS_BUNDLED_DIR_OVERRIDE` | pinned source cached under `CARGO_TARGET_DIR` when explicit, otherwise `%LOCALAPPDATA%\OpenShell\cache\z3` | Use an existing Z3 source tree containing `src/api/z3.h`; otherwise the wrapper fetches the pinned revision through Git and sets this automatically. | -| `RUSTC_WRAPPER` | cleared by wrapper | The wrapper clears inherited values because `--skip-tools` does not provision `sccache`. | +| `RUSTC_WRAPPER` | used when available, otherwise cleared | The wrapper resolves the configured executable before entering `cmd.exe`; local `--skip-tools` runs continue without it when unavailable. | Legacy fork variables such as `OPENSHELL_UPSTREAM`, `OPENSHELL_MXC_FORK_DIR`, and `OPENSHELL_MXC_FORK_BRANCH` are no longer part @@ -187,10 +187,11 @@ order: 6. Focused unsupported-driver contract tests. 7. Artifact reporting. -The GitHub Actions jobs use architecture-specific `Swatinem/rust-cache` -entries for the Cargo registry and dependency target artifacts. Failed runs -also save their usable dependency artifacts. The workflow remains manually -dispatched until cache-hit runtimes justify restoring automatic triggers. +The GitHub Actions jobs use architecture-specific GitHub Actions sccache +namespaces for compiler outputs and `Swatinem/rust-cache` entries for Cargo +registry data. They do not transfer Cargo target directories. Failed runs also +save usable cache data. The workflow remains manually dispatched until +cache-hit runtimes justify restoring automatic triggers. The ARM64 check/build steps in this x64-host contract are cross-builds. The wrapper discovers and adds host-native LLVM and Ninja to `PATH`, requires the @@ -207,7 +208,7 @@ commands above on an ARM64 host. The repository-wide `mise run pre-commit` task is also supported on Windows. Its Rust check, Clippy, and test dependencies enter the same MSVC environment -for the native host target and clear inherited `RUSTC_WRAPPER`. Linux glibc +for the native host target and use an available inherited `RUSTC_WRAPPER`. Linux glibc installer tests and Linux service/RPM packaging-asset tests skip explicitly; the Linux build-environment shell-helper test also skips; cross-platform checks continue to run. The blocking Windows Clippy pass excludes unsupported diff --git a/.agents/skills/build-openshell-mxc-windows/reference.md b/.agents/skills/build-openshell-mxc-windows/reference.md index 16b9a48586..14a590456b 100644 --- a/.agents/skills/build-openshell-mxc-windows/reference.md +++ b/.agents/skills/build-openshell-mxc-windows/reference.md @@ -9,7 +9,7 @@ maintaining the existing build-only Windows MSVC lane. |---|---| | `tasks/windows.toml` | Mise task definitions for `windows:*`. | | `tasks/scripts/windows-msvc.ps1` | Visual Studio environment discovery, rustup target setup, Cargo invocation, logs, artifact report. | -| `.github/workflows/windows-msvc.yml` | Manual GitHub Actions x64 job and disabled ARM64 scaffold, each with an architecture-specific Rust dependency cache. | +| `.github/workflows/windows-msvc.yml` | Manual GitHub Actions x64 job and disabled ARM64 scaffold, each with architecture-specific sccache and Cargo registry caches. | | `architecture/windows-msvc-build.md` | Human-readable design contract. | ## Commands @@ -46,9 +46,10 @@ if ($arch -eq [System.Runtime.InteropServices.Architecture]::Arm64) { The native test tasks reject a target that does not match the host architecture. Do not report x64 compatibility-under-emulation coverage from an ARM64 run. -The wrapper adds missing rustup targets and clears inherited -`RUSTC_WRAPPER`. It does not install Visual Studio, Rust, Docker, Kubernetes, -Podman, WSL, Hyper-V, or VM tooling. +The wrapper adds missing rustup targets and uses an inherited `RUSTC_WRAPPER` +when its executable is available. It clears unavailable wrappers so local +`--skip-tools` runs still work. It does not install Visual Studio, Rust, Docker, +Kubernetes, Podman, WSL, Hyper-V, or VM tooling. On Windows, `mise run pre-commit` routes `rust:check`, `rust:lint`, and `test:rust` through this wrapper for the host-native target. The shared task diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index 604cfd61fa..4eaa9d6325 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -4,58 +4,65 @@ on: jobs: x64: runs-on: windows-2025 + env: + SCCACHE_GHA_ENABLED: "true" + SCCACHE_GHA_VERSION: windows-msvc-x64-v1 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: install: false experimental: true + - name: Configure GHA sccache backend + uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - uses: dtolnay/rust-toolchain@master with: toolchain: "1.95.0" targets: x86_64-pc-windows-msvc - name: Cache Rust target and registry uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - env: - # mise exports RUSTC_WRAPPER=sccache, but this workflow intentionally - # does not install sccache. Keep rust-cache's cargo metadata calls - # independent of that unavailable wrapper so target artifacts save. - RUSTC_WRAPPER: "" with: - # v2 invalidates the empty archive produced while cargo metadata - # could not run without sccache. - shared-key: windows-msvc-x64-v2 - cache-targets: "true" + # Keep registry downloads, but let sccache measure compiler reuse + # without a restored target directory masking its effect. + shared-key: windows-msvc-x64-sccache-v1 + cache-targets: "false" cache-on-failure: "true" cache-bin: "false" - run: mise run --skip-tools windows:check:x64 - run: mise run --skip-tools windows:build:x64 - run: mise run --skip-tools windows:test:x64 - run: mise run --skip-tools windows:test:unsupported:x64 + - name: sccache stats + if: always() + run: sccache --show-stats arm64: # TODO: provision a windows-arm64 self-hosted runner runs-on: [self-hosted, windows-arm64] if: false # flip to true once the runner is online + env: + SCCACHE_GHA_ENABLED: "true" + SCCACHE_GHA_VERSION: windows-msvc-arm64-v1 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: install: false experimental: true + - name: Configure GHA sccache backend + uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - uses: dtolnay/rust-toolchain@master with: toolchain: "1.95.0" targets: aarch64-pc-windows-msvc - name: Cache Rust target and registry uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - env: - # Keep rust-cache's cargo metadata calls independent of the - # unavailable sccache wrapper exported by mise. - RUSTC_WRAPPER: "" with: - shared-key: windows-msvc-arm64-v2 - cache-targets: "true" + shared-key: windows-msvc-arm64-sccache-v1 + cache-targets: "false" cache-on-failure: "true" cache-bin: "false" - run: mise run --skip-tools windows:check:arm64 - run: mise run --skip-tools windows:build:arm64 + - name: sccache stats + if: always() + run: sccache --show-stats diff --git a/architecture/windows-msvc-build.md b/architecture/windows-msvc-build.md index 6b0d675a9c..482b019c94 100644 --- a/architecture/windows-msvc-build.md +++ b/architecture/windows-msvc-build.md @@ -54,11 +54,13 @@ creating misleading Windows driver artifacts. ## Mise Lane -The GitHub Actions workflow is manually dispatched. Each architecture restores -and saves a dedicated Rust cache containing the Cargo registry and dependency -build artifacts, including artifacts from failed runs. Keep the workflow manual -until cache-hit runtimes demonstrate that it is suitable for pull requests and -merges to `main`. +The GitHub Actions workflow is manually dispatched. Each architecture uses a +dedicated GitHub Actions sccache namespace for compiler outputs and a separate +Rust cache for Cargo registry data, including data from failed runs. The target +directory is not transferred because sccache provides reusable compiler outputs +without a multi-gigabyte target archive. Keep the workflow manual until +cache-hit runtimes demonstrate that it is suitable for pull requests and merges +to `main`. Windows validation is exposed through `tasks/windows.toml`: @@ -77,8 +79,9 @@ Windows validation is exposed through `tasks/windows.toml`: The Windows tasks call `tasks/scripts/windows-msvc.ps1`. The wrapper discovers Visual Studio's `VsDevCmd.bat` with `vswhere` or by enumerating installed release directories, validates the requested compiler and ARM64 Spectre -libraries, adds rustup MSVC targets, clears inherited `RUSTC_WRAPPER`, and -keeps build artifacts under the normal Cargo target tree. +libraries, adds rustup MSVC targets, uses an inherited `RUSTC_WRAPPER` when its +executable is available, and otherwise clears it before invoking Cargo. Build +artifacts remain under the normal Cargo target tree. On Windows, the generic `rust:check`, `rust:lint`, and `test:rust` tasks call the same wrapper with the host-native MSVC target. The wrapper preserves the Unix Cargo commands on Linux and macOS, excludes unsupported Windows runtime @@ -140,10 +143,11 @@ mise run --skip-tools windows:test:x64 mise run --skip-tools windows:test:unsupported:x64 ``` -The cache is partitioned by architecture so incompatible x64 and ARM64 target -artifacts cannot collide. It does not cache Cargo-installed binaries, which -also keeps the disabled self-hosted ARM64 scaffold from modifying persistent -runner tooling. +The sccache and Cargo registry caches are partitioned by architecture so +incompatible x64 and ARM64 artifacts cannot collide. The workflow does not +cache Cargo target directories or Cargo-installed binaries, which also keeps +the disabled self-hosted ARM64 scaffold from modifying persistent runner +tooling. The local aggregate `windows:ci` task cross-builds ARM64 on an x64 host. The GitHub x64 job currently runs only the x64 tasks, and native ARM64 tests remain diff --git a/tasks/scripts/windows-msvc.ps1 b/tasks/scripts/windows-msvc.ps1 index 0a0410f4ca..6e40738cb2 100644 --- a/tasks/scripts/windows-msvc.ps1 +++ b/tasks/scripts/windows-msvc.ps1 @@ -516,11 +516,20 @@ function Invoke-VsCargo { $targetArch = Get-VsTargetArch $RustTarget $hostArch = Get-HostArch $logPath = Join-Path $LogDir $LogName + $rustcWrapper = "" + if (-not [string]::IsNullOrWhiteSpace($env:RUSTC_WRAPPER)) { + $wrapperCommand = Get-Command $env:RUSTC_WRAPPER -ErrorAction SilentlyContinue + if ($wrapperCommand) { + $rustcWrapper = $wrapperCommand.Source + } else { + Write-Warning "RUSTC_WRAPPER '$env:RUSTC_WRAPPER' was not found; continuing without it." + } + } $environmentSetup = @( "set `"CARGO_TARGET_DIR=$TargetDir`"", "set `"CARGO_BUILD_JOBS=$WindowsBuildJobs`"", "set `"CARGO_INCREMENTAL=0`"", - "set `"RUSTC_WRAPPER=`"" + "set `"RUSTC_WRAPPER=$rustcWrapper`"" ) if ($hostArch -eq "amd64" -and $RustTarget -eq "aarch64-pc-windows-msvc") { # Let cmake-rs select MSVC cl.exe for bundled Z3. AWS-LC selects From a6be636d1d8e938b728febb730d686e962bcd20d Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Wed, 12 Aug 2026 18:51:21 -0700 Subject: [PATCH 04/25] ci(windows): restore target directory caching Signed-off-by: Piotr Mlocek --- .../build-openshell-mxc-windows/SKILL.md | 13 +++---- .../build-openshell-mxc-windows/reference.md | 9 ++--- .github/workflows/windows-msvc.yml | 37 ++++++++----------- architecture/windows-msvc-build.md | 26 ++++++------- tasks/scripts/windows-msvc.ps1 | 11 +----- 5 files changed, 37 insertions(+), 59 deletions(-) diff --git a/.agents/skills/build-openshell-mxc-windows/SKILL.md b/.agents/skills/build-openshell-mxc-windows/SKILL.md index a46cb09ab3..954fcedf2f 100644 --- a/.agents/skills/build-openshell-mxc-windows/SKILL.md +++ b/.agents/skills/build-openshell-mxc-windows/SKILL.md @@ -134,7 +134,7 @@ from this skill. | `Z3_LIBRARY_PATH_OVERRIDE` | unset | Directory containing an x64 system `libz3.lib`; not valid for ARM64. | | `Z3_SYS_Z3_HEADER` | unset | Full `z3.h` path required with a system Z3 library. | | `Z3_SYS_BUNDLED_DIR_OVERRIDE` | pinned source cached under `CARGO_TARGET_DIR` when explicit, otherwise `%LOCALAPPDATA%\OpenShell\cache\z3` | Use an existing Z3 source tree containing `src/api/z3.h`; otherwise the wrapper fetches the pinned revision through Git and sets this automatically. | -| `RUSTC_WRAPPER` | used when available, otherwise cleared | The wrapper resolves the configured executable before entering `cmd.exe`; local `--skip-tools` runs continue without it when unavailable. | +| `RUSTC_WRAPPER` | cleared by wrapper | The wrapper clears inherited values because `--skip-tools` does not provision `sccache`. | Legacy fork variables such as `OPENSHELL_UPSTREAM`, `OPENSHELL_MXC_FORK_DIR`, and `OPENSHELL_MXC_FORK_BRANCH` are no longer part @@ -187,11 +187,10 @@ order: 6. Focused unsupported-driver contract tests. 7. Artifact reporting. -The GitHub Actions jobs use architecture-specific GitHub Actions sccache -namespaces for compiler outputs and `Swatinem/rust-cache` entries for Cargo -registry data. They do not transfer Cargo target directories. Failed runs also -save usable cache data. The workflow remains manually dispatched until -cache-hit runtimes justify restoring automatic triggers. +The GitHub Actions jobs use architecture-specific `Swatinem/rust-cache` +entries for the Cargo registry and dependency target artifacts. Failed runs +also save their usable dependency artifacts. The workflow remains manually +dispatched until cache-hit runtimes justify restoring automatic triggers. The ARM64 check/build steps in this x64-host contract are cross-builds. The wrapper discovers and adds host-native LLVM and Ninja to `PATH`, requires the @@ -208,7 +207,7 @@ commands above on an ARM64 host. The repository-wide `mise run pre-commit` task is also supported on Windows. Its Rust check, Clippy, and test dependencies enter the same MSVC environment -for the native host target and use an available inherited `RUSTC_WRAPPER`. Linux glibc +for the native host target and clear inherited `RUSTC_WRAPPER`. Linux glibc installer tests and Linux service/RPM packaging-asset tests skip explicitly; the Linux build-environment shell-helper test also skips; cross-platform checks continue to run. The blocking Windows Clippy pass excludes unsupported diff --git a/.agents/skills/build-openshell-mxc-windows/reference.md b/.agents/skills/build-openshell-mxc-windows/reference.md index 14a590456b..16b9a48586 100644 --- a/.agents/skills/build-openshell-mxc-windows/reference.md +++ b/.agents/skills/build-openshell-mxc-windows/reference.md @@ -9,7 +9,7 @@ maintaining the existing build-only Windows MSVC lane. |---|---| | `tasks/windows.toml` | Mise task definitions for `windows:*`. | | `tasks/scripts/windows-msvc.ps1` | Visual Studio environment discovery, rustup target setup, Cargo invocation, logs, artifact report. | -| `.github/workflows/windows-msvc.yml` | Manual GitHub Actions x64 job and disabled ARM64 scaffold, each with architecture-specific sccache and Cargo registry caches. | +| `.github/workflows/windows-msvc.yml` | Manual GitHub Actions x64 job and disabled ARM64 scaffold, each with an architecture-specific Rust dependency cache. | | `architecture/windows-msvc-build.md` | Human-readable design contract. | ## Commands @@ -46,10 +46,9 @@ if ($arch -eq [System.Runtime.InteropServices.Architecture]::Arm64) { The native test tasks reject a target that does not match the host architecture. Do not report x64 compatibility-under-emulation coverage from an ARM64 run. -The wrapper adds missing rustup targets and uses an inherited `RUSTC_WRAPPER` -when its executable is available. It clears unavailable wrappers so local -`--skip-tools` runs still work. It does not install Visual Studio, Rust, Docker, -Kubernetes, Podman, WSL, Hyper-V, or VM tooling. +The wrapper adds missing rustup targets and clears inherited +`RUSTC_WRAPPER`. It does not install Visual Studio, Rust, Docker, Kubernetes, +Podman, WSL, Hyper-V, or VM tooling. On Windows, `mise run pre-commit` routes `rust:check`, `rust:lint`, and `test:rust` through this wrapper for the host-native target. The shared task diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index 4eaa9d6325..604cfd61fa 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -4,65 +4,58 @@ on: jobs: x64: runs-on: windows-2025 - env: - SCCACHE_GHA_ENABLED: "true" - SCCACHE_GHA_VERSION: windows-msvc-x64-v1 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: install: false experimental: true - - name: Configure GHA sccache backend - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - uses: dtolnay/rust-toolchain@master with: toolchain: "1.95.0" targets: x86_64-pc-windows-msvc - name: Cache Rust target and registry uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + env: + # mise exports RUSTC_WRAPPER=sccache, but this workflow intentionally + # does not install sccache. Keep rust-cache's cargo metadata calls + # independent of that unavailable wrapper so target artifacts save. + RUSTC_WRAPPER: "" with: - # Keep registry downloads, but let sccache measure compiler reuse - # without a restored target directory masking its effect. - shared-key: windows-msvc-x64-sccache-v1 - cache-targets: "false" + # v2 invalidates the empty archive produced while cargo metadata + # could not run without sccache. + shared-key: windows-msvc-x64-v2 + cache-targets: "true" cache-on-failure: "true" cache-bin: "false" - run: mise run --skip-tools windows:check:x64 - run: mise run --skip-tools windows:build:x64 - run: mise run --skip-tools windows:test:x64 - run: mise run --skip-tools windows:test:unsupported:x64 - - name: sccache stats - if: always() - run: sccache --show-stats arm64: # TODO: provision a windows-arm64 self-hosted runner runs-on: [self-hosted, windows-arm64] if: false # flip to true once the runner is online - env: - SCCACHE_GHA_ENABLED: "true" - SCCACHE_GHA_VERSION: windows-msvc-arm64-v1 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: install: false experimental: true - - name: Configure GHA sccache backend - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - uses: dtolnay/rust-toolchain@master with: toolchain: "1.95.0" targets: aarch64-pc-windows-msvc - name: Cache Rust target and registry uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + env: + # Keep rust-cache's cargo metadata calls independent of the + # unavailable sccache wrapper exported by mise. + RUSTC_WRAPPER: "" with: - shared-key: windows-msvc-arm64-sccache-v1 - cache-targets: "false" + shared-key: windows-msvc-arm64-v2 + cache-targets: "true" cache-on-failure: "true" cache-bin: "false" - run: mise run --skip-tools windows:check:arm64 - run: mise run --skip-tools windows:build:arm64 - - name: sccache stats - if: always() - run: sccache --show-stats diff --git a/architecture/windows-msvc-build.md b/architecture/windows-msvc-build.md index 482b019c94..6b0d675a9c 100644 --- a/architecture/windows-msvc-build.md +++ b/architecture/windows-msvc-build.md @@ -54,13 +54,11 @@ creating misleading Windows driver artifacts. ## Mise Lane -The GitHub Actions workflow is manually dispatched. Each architecture uses a -dedicated GitHub Actions sccache namespace for compiler outputs and a separate -Rust cache for Cargo registry data, including data from failed runs. The target -directory is not transferred because sccache provides reusable compiler outputs -without a multi-gigabyte target archive. Keep the workflow manual until -cache-hit runtimes demonstrate that it is suitable for pull requests and merges -to `main`. +The GitHub Actions workflow is manually dispatched. Each architecture restores +and saves a dedicated Rust cache containing the Cargo registry and dependency +build artifacts, including artifacts from failed runs. Keep the workflow manual +until cache-hit runtimes demonstrate that it is suitable for pull requests and +merges to `main`. Windows validation is exposed through `tasks/windows.toml`: @@ -79,9 +77,8 @@ Windows validation is exposed through `tasks/windows.toml`: The Windows tasks call `tasks/scripts/windows-msvc.ps1`. The wrapper discovers Visual Studio's `VsDevCmd.bat` with `vswhere` or by enumerating installed release directories, validates the requested compiler and ARM64 Spectre -libraries, adds rustup MSVC targets, uses an inherited `RUSTC_WRAPPER` when its -executable is available, and otherwise clears it before invoking Cargo. Build -artifacts remain under the normal Cargo target tree. +libraries, adds rustup MSVC targets, clears inherited `RUSTC_WRAPPER`, and +keeps build artifacts under the normal Cargo target tree. On Windows, the generic `rust:check`, `rust:lint`, and `test:rust` tasks call the same wrapper with the host-native MSVC target. The wrapper preserves the Unix Cargo commands on Linux and macOS, excludes unsupported Windows runtime @@ -143,11 +140,10 @@ mise run --skip-tools windows:test:x64 mise run --skip-tools windows:test:unsupported:x64 ``` -The sccache and Cargo registry caches are partitioned by architecture so -incompatible x64 and ARM64 artifacts cannot collide. The workflow does not -cache Cargo target directories or Cargo-installed binaries, which also keeps -the disabled self-hosted ARM64 scaffold from modifying persistent runner -tooling. +The cache is partitioned by architecture so incompatible x64 and ARM64 target +artifacts cannot collide. It does not cache Cargo-installed binaries, which +also keeps the disabled self-hosted ARM64 scaffold from modifying persistent +runner tooling. The local aggregate `windows:ci` task cross-builds ARM64 on an x64 host. The GitHub x64 job currently runs only the x64 tasks, and native ARM64 tests remain diff --git a/tasks/scripts/windows-msvc.ps1 b/tasks/scripts/windows-msvc.ps1 index 6e40738cb2..0a0410f4ca 100644 --- a/tasks/scripts/windows-msvc.ps1 +++ b/tasks/scripts/windows-msvc.ps1 @@ -516,20 +516,11 @@ function Invoke-VsCargo { $targetArch = Get-VsTargetArch $RustTarget $hostArch = Get-HostArch $logPath = Join-Path $LogDir $LogName - $rustcWrapper = "" - if (-not [string]::IsNullOrWhiteSpace($env:RUSTC_WRAPPER)) { - $wrapperCommand = Get-Command $env:RUSTC_WRAPPER -ErrorAction SilentlyContinue - if ($wrapperCommand) { - $rustcWrapper = $wrapperCommand.Source - } else { - Write-Warning "RUSTC_WRAPPER '$env:RUSTC_WRAPPER' was not found; continuing without it." - } - } $environmentSetup = @( "set `"CARGO_TARGET_DIR=$TargetDir`"", "set `"CARGO_BUILD_JOBS=$WindowsBuildJobs`"", "set `"CARGO_INCREMENTAL=0`"", - "set `"RUSTC_WRAPPER=$rustcWrapper`"" + "set `"RUSTC_WRAPPER=`"" ) if ($hostArch -eq "amd64" -and $RustTarget -eq "aarch64-pc-windows-msvc") { # Let cmake-rs select MSVC cl.exe for bundled Z3. AWS-LC selects From c2554cb6d3551266b9565b9fa0ffe0ba27bb1c34 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 09:53:10 -0700 Subject: [PATCH 05/25] perf(ci): use prebuilt Z3 on Windows Signed-off-by: Piotr Mlocek --- .../build-openshell-mxc-windows/SKILL.md | 29 ++-- .../build-openshell-mxc-windows/reference.md | 9 +- .github/workflows/windows-msvc.yml | 11 +- Cargo.lock | 101 +++++++++++++ architecture/windows-msvc-build.md | 32 ++-- crates/openshell-prover/Cargo.toml | 1 + crates/openshell-server/Cargo.toml | 1 + tasks/scripts/windows-msvc.ps1 | 137 ++---------------- 8 files changed, 151 insertions(+), 170 deletions(-) diff --git a/.agents/skills/build-openshell-mxc-windows/SKILL.md b/.agents/skills/build-openshell-mxc-windows/SKILL.md index 954fcedf2f..4235c7cc53 100644 --- a/.agents/skills/build-openshell-mxc-windows/SKILL.md +++ b/.agents/skills/build-openshell-mxc-windows/SKILL.md @@ -113,7 +113,7 @@ The lane targets a Windows host with Visual Studio Build Tools and rustup. | Visual C++ ARM64 tools | `vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.ARM64 -property installationPath` | Required for native ARM64 check, build, and tests and for x64-to-ARM64 check/build. Tests always require a native runner. | | Visual C++ ARM64 Spectre-mitigated libraries | `vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Runtimes.ARM64.Spectre -property installationPath` | Required by `regorus` through `msvc_spectre_libs`; the build fails when the selected MSVC toolset lacks `lib\spectre\arm64`. | | Visual C++ Clang tools | `vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Llvm.Clang -property installationPath` | Provides host-native `libclang.dll` for `bindgen` and `clang-cl.exe` for ARM64 crypto dependencies such as `ring` and `aws-lc-sys`. On ARM64, the wrapper uses `VC\Tools\Llvm\Arm64\bin`. | -| Visual C++ CMake tools | `vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.CMake.Project -property installationPath` | Provides CMake and Ninja. The x64-to-ARM64 path adds Ninja to `PATH` for native dependencies but keeps bundled Z3 on CMake's Visual Studio ARM64 generator with native MSVC `cl.exe`. | +| Visual C++ CMake tools | `vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.CMake.Project -property installationPath` | Provides CMake and Ninja for native dependencies. The x64-to-ARM64 path adds Ninja to `PATH`; Z3 uses an architecture-specific prebuilt release. | | Windows SDK | `where.exe rc.exe` from a Developer PowerShell | Install an SDK containing target libraries and ARM64 tools. | | Rust via rustup | `rustc --version` | Add each target being validated: `x86_64-pc-windows-msvc` and/or `aarch64-pc-windows-msvc`. The wrapper also adds the selected target. | | mise | `mise --version` | Used as a task runner only. | @@ -133,7 +133,8 @@ from this skill. | `CARGO_TARGET_DIR` | `target` under repo root | Override Cargo output location. Use a short absolute path when x64-to-ARM64 builds approach Windows path-length limits. | | `Z3_LIBRARY_PATH_OVERRIDE` | unset | Directory containing an x64 system `libz3.lib`; not valid for ARM64. | | `Z3_SYS_Z3_HEADER` | unset | Full `z3.h` path required with a system Z3 library. | -| `Z3_SYS_BUNDLED_DIR_OVERRIDE` | pinned source cached under `CARGO_TARGET_DIR` when explicit, otherwise `%LOCALAPPDATA%\OpenShell\cache\z3` | Use an existing Z3 source tree containing `src/api/z3.h`; otherwise the wrapper fetches the pinned revision through Git and sets this automatically. | +| `Z3_SYS_Z3_VERSION` | `4.16.0` | Pinned official prebuilt Z3 release selected by the wrapper. | +| `READ_ONLY_GITHUB_TOKEN` | unset | Optional token for the Z3 release lookup; GitHub Actions supplies `github.token`. | | `RUSTC_WRAPPER` | cleared by wrapper | The wrapper clears inherited values because `--skip-tools` does not provision `sccache`. | Legacy fork variables such as `OPENSHELL_UPSTREAM`, @@ -195,9 +196,7 @@ dispatched until cache-hit runtimes justify restoring automatic triggers. The ARM64 check/build steps in this x64-host contract are cross-builds. The wrapper discovers and adds host-native LLVM and Ninja to `PATH`, requires the ARM64 compiler and Spectre-mitigated libraries, lets ARM64 crypto crates select -`clang-cl`, and keeps bundled Z3 on native MSVC `cl.exe` with CMake's Visual -Studio ARM64 generator. Z3 does not use Ninja because `z3-sys 0.10.9` passes -the MSBuild-only `-m` argument. +`clang-cl`, and downloads the official prebuilt ARM64 Z3 static library. On ARM64 hosts, validate the native ARM64 check, build, and test path. The wrapper rejects test targets that do not match the host architecture, so x64 @@ -291,19 +290,13 @@ Useful log files: | `test-x86_64-pc-windows-msvc-unsupported-*.log` | Focused unsupported-driver contract output. | | `test-aarch64-pc-windows-msvc-unsupported-*.log` | Focused native ARM64 contract output. | -The first bundled-Z3 check or test can spend several minutes in CMake/MSBuild -without much console output because Cargo output is redirected to the log. Look -for native `MSBuild.exe` workers before treating the process as stalled. The -wrapper fetches the pinned Z3 source through Git before Cargo starts. It caches -under an explicitly configured `CARGO_TARGET_DIR`, or under the current user's -local application data directory when Cargo uses its default target tree. -Concurrent commands publish the validated source through an atomic directory -rename, so x64 and ARM64 validation can share the cache safely. The wrapper does -not rely on the rate-limited GitHub Contents API used by `z3-sys`. A failed -fetch reports the partial checkout path for diagnosis. The artifact report -computes SHA256 through .NET directly and does not rely on the -`Get-FileHash` module being available inside the mise-launched Windows -PowerShell process. +The first check downloads the pinned official Z3 archive for the target +architecture through `z3-sys`. GitHub Actions authenticates the lookup with its +read-only workflow token; local users can set `READ_ONLY_GITHUB_TOKEN` if an +unauthenticated lookup is rate-limited. Cargo stores the extracted library in +its target tree, so the Windows target cache reuses it. The artifact report +computes SHA256 through .NET directly and does not rely on the `Get-FileHash` +module being available inside the mise-launched Windows PowerShell process. ## Common Fix Patterns diff --git a/.agents/skills/build-openshell-mxc-windows/reference.md b/.agents/skills/build-openshell-mxc-windows/reference.md index 16b9a48586..7327ea8748 100644 --- a/.agents/skills/build-openshell-mxc-windows/reference.md +++ b/.agents/skills/build-openshell-mxc-windows/reference.md @@ -67,11 +67,10 @@ file. For ARM64, verify the Visual Studio instance contains the ARM64 MSVC tools, ARM64 Spectre-mitigated libraries, Clang tools, CMake tools, and a Windows SDK. Clang supplies host-native `libclang.dll` for `bindgen` and `clang-cl.exe` for -ARM64 crypto dependencies such as `ring` and `aws-lc-sys`. Native ARM64 uses -the normal bundled-Z3 CMake path. An x64-to-ARM64 check/build discovers and -adds host-native Ninja to `PATH`, while the crypto crates select `clang-cl`. -Bundled Z3 uses CMake's Visual Studio ARM64 generator with native MSVC `cl.exe` -because `z3-sys 0.10.9` passes the MSBuild-only `-m` argument. Use a short +ARM64 crypto dependencies such as `ring` and `aws-lc-sys`. Native and +x64-to-ARM64 builds use the official prebuilt Z3 4.16.0 static library for the +target architecture. An x64-to-ARM64 check/build discovers and adds host-native +Ninja to `PATH`, while the crypto crates select `clang-cl`. Use a short `CARGO_TARGET_DIR` if Windows path-length limits are reached. ## Unsupported Driver Rules diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index 604cfd61fa..970160c0be 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -4,6 +4,8 @@ on: jobs: x64: runs-on: windows-2025 + env: + READ_ONLY_GITHUB_TOKEN: ${{ github.token }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 @@ -22,9 +24,8 @@ jobs: # independent of that unavailable wrapper so target artifacts save. RUSTC_WRAPPER: "" with: - # v2 invalidates the empty archive produced while cargo metadata - # could not run without sccache. - shared-key: windows-msvc-x64-v2 + # Keep the prebuilt-Z3 experiment isolated from earlier target caches. + shared-key: windows-msvc-x64-prebuilt-z3-v1 cache-targets: "true" cache-on-failure: "true" cache-bin: "false" @@ -36,6 +37,8 @@ jobs: # TODO: provision a windows-arm64 self-hosted runner runs-on: [self-hosted, windows-arm64] if: false # flip to true once the runner is online + env: + READ_ONLY_GITHUB_TOKEN: ${{ github.token }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 @@ -53,7 +56,7 @@ jobs: # unavailable sccache wrapper exported by mise. RUSTC_WRAPPER: "" with: - shared-key: windows-msvc-arm64-v2 + shared-key: windows-msvc-arm64-prebuilt-z3-v1 cache-targets: "true" cache-on-failure: "true" cache-bin: "false" diff --git a/Cargo.lock b/Cargo.lock index 90240d6b3a..ab73cb3b95 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -880,6 +880,15 @@ dependencies = [ "either", ] +[[package]] +name = "bzip2" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f3a53fac24f34a81bc9954b5d6cfce0c21e18ec6959f44f56e8e90e4bb7c346c" +dependencies = [ + "libbz2-rs-sys", +] + [[package]] name = "capctl" version = "0.2.4" @@ -1135,6 +1144,12 @@ dependencies = [ "unicode-xid", ] +[[package]] +name = "constant_time_eq" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b" + [[package]] name = "core-foundation" version = "0.10.1" @@ -1467,6 +1482,12 @@ version = "0.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "092966b41edc516079bdf31ec78a2e0588d1d0c08f78b91d8307215928642b2b" +[[package]] +name = "deflate64" +version = "0.1.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ac6b926516df9c60bfa16e107b21086399f8285a44ca9711344b9e553c5146e2" + [[package]] name = "delegate" version = "0.13.5" @@ -1609,6 +1630,7 @@ dependencies = [ "const-oid 0.10.2", "crypto-common 0.2.2", "ctutils", + "zeroize", ] [[package]] @@ -1916,6 +1938,7 @@ checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c" dependencies = [ "crc32fast", "miniz_oxide", + "zlib-rs", ] [[package]] @@ -2492,6 +2515,7 @@ dependencies = [ "tokio", "tokio-rustls", "tower-service", + "webpki-roots", ] [[package]] @@ -3195,6 +3219,12 @@ version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2" +[[package]] +name = "libbz2-rs-sys" +version = "0.2.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "34b357333733e8260735ba5894eb928c02ecc69c78715f01a8019e7fa7f2db4c" + [[package]] name = "libc" version = "0.2.189" @@ -3298,6 +3328,15 @@ version = "0.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154" +[[package]] +name = "lzma-rust2" +version = "0.16.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ca93e534d1142d1d0dcca6d25fe302508a5dfb40b302802904577725ea0b695b" +dependencies = [ + "sha2 0.11.0", +] + [[package]] name = "matchers" version = "0.2.0" @@ -5076,6 +5115,12 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" +[[package]] +name = "ppmd-rust" +version = "1.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "efca4c95a19a79d1c98f791f10aebd5c1363b473244630bb7dbde1dc98455a24" + [[package]] name = "ppv-lite86" version = "0.2.21" @@ -5651,6 +5696,7 @@ dependencies = [ "wasm-bindgen", "wasm-bindgen-futures", "web-sys", + "webpki-roots", ] [[package]] @@ -7142,6 +7188,7 @@ checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c" dependencies = [ "deranged", "itoa", + "js-sys", "num-conv", "powerfmt", "serde_core", @@ -7646,6 +7693,12 @@ dependencies = [ "thiserror 2.0.18", ] +[[package]] +name = "typed-path" +version = "0.12.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e" + [[package]] name = "typenum" version = "1.20.1" @@ -8709,7 +8762,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c18b0a91a13522d21b3414847667de2b2056a721a3edcb5b6ee6858352d58db4" dependencies = [ "pkg-config", + "reqwest 0.12.28", + "serde_json", "z3-src", + "zip", ] [[package]] @@ -8806,12 +8862,57 @@ dependencies = [ "syn 2.0.117", ] +[[package]] +name = "zip" +version = "8.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b" +dependencies = [ + "aes", + "bzip2", + "constant_time_eq", + "crc32fast", + "deflate64", + "flate2", + "getrandom 0.4.2", + "hmac 0.13.0", + "indexmap", + "lzma-rust2", + "memchr", + "pbkdf2", + "ppmd-rust", + "sha1 0.11.0", + "time", + "typed-path", + "zeroize", + "zopfli", + "zstd", +] + +[[package]] +name = "zlib-rs" +version = "0.6.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b142a20ec14a91d5bc708c1dc21b080c550113d8aa77afa29635673a65dd02c5" + [[package]] name = "zmij" version = "1.0.21" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa" +[[package]] +name = "zopfli" +version = "0.8.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249" +dependencies = [ + "bumpalo", + "crc32fast", + "log", + "simd-adler32", +] + [[package]] name = "zstd" version = "0.13.3" diff --git a/architecture/windows-msvc-build.md b/architecture/windows-msvc-build.md index 6b0d675a9c..59d84491ec 100644 --- a/architecture/windows-msvc-build.md +++ b/architecture/windows-msvc-build.md @@ -90,20 +90,16 @@ packaging-asset tests; its cross-platform Python, Markdown, license, and documentation checks still run. Test tasks require the Rust target architecture to match the Windows host, so an ARM64 test result is native coverage rather than x64 emulation coverage. -By default it enables bundled Z3 for reproducible Windows builds. When +By default it enables the `z3-sys` prebuilt-release feature and pins Z3 4.16.0. +On a clean target directory, `z3-sys` downloads the official static library for +the selected Windows architecture instead of compiling Z3 through +CMake/MSBuild. GitHub Actions supplies its read-only workflow token for the +release lookup, and the Cargo target cache preserves the extracted library for +subsequent runs. When `Z3_LIBRARY_PATH_OVERRIDE` points at a directory containing `libz3.lib`, the wrapper uses that system Z3 instead and requires `Z3_SYS_Z3_HEADER` to point at -the full path to `z3.h`. For bundled builds, the wrapper fetches the Z3 source -revision pinned by `z3-sys` through Git and sets -`Z3_SYS_BUNDLED_DIR_OVERRIDE`. When `CARGO_TARGET_DIR` is explicit, the wrapper -uses it for the source cache. Otherwise, it caches under the current user's -local application data directory, outside the checkout. Publishing uses an -atomic directory rename so concurrent x64 and ARM64 commands can share the -cache safely. This keeps downloaded sources outside the checkout by default and -avoids the unauthenticated GitHub API lookup in the `z3-sys` build script, which -can fail with HTTP 403 when a shared runner or developer network exhausts its -API rate limit. An explicitly set `Z3_SYS_BUNDLED_DIR_OVERRIDE` remains -supported and must contain `src/api/z3.h`. +the full path to `z3.h`. Local clean builds use the unauthenticated GitHub API +unless `READ_ONLY_GITHUB_TOKEN` is set. The lane uses `mise run --skip-tools windows:*` because Windows Rust comes from rustup and linking comes from Visual Studio Build Tools. Mise orchestrates the @@ -114,17 +110,15 @@ Spectre-mitigated libraries, host-native Clang tools, CMake tools, and an ARM64-capable Windows SDK. Clang provides `libclang.dll` for `bindgen` and `clang-cl.exe` for ARM64 crypto dependencies. During x64-to-ARM64 check/build, the wrapper discovers and adds the Visual Studio-bundled Ninja to `PATH` for -native dependencies. It lets `cmake-rs` select the Visual Studio ARM64 -generator with native MSVC `cl.exe` for bundled Z3 so the Z3 build does not -inherit the crypto crates' compiler requirement. Z3 stays on the Visual Studio -generator because `z3-sys` emits an MSBuild-only `-m` argument that Ninja -rejects. Artifact hashing uses .NET SHA256 directly because module autoloading -in the mise-launched Windows PowerShell process is not guaranteed. +native dependencies. Z3 uses the official prebuilt ARM64 static library, so it +does not inherit compiler settings from those native dependencies. Artifact +hashing uses .NET SHA256 directly because module autoloading in the +mise-launched Windows PowerShell process is not guaranteed. The wrapper defaults Cargo compilation to four jobs. Set `OPENSHELL_WINDOWS_BUILD_JOBS` to a positive integer to override that limit. A host-local mutex serializes wrapper-owned Cargo commands so concurrent -pre-commit tasks do not multiply the process count while bundled Z3 compiles. +pre-commit tasks do not multiply the compiler process count. The wrapper does not set `CL` or `_CL_`: those variables are also consumed by `clang-cl`, where MSVC's `/MP` option can be interpreted as an input file and break ARM64 crypto dependency builds. diff --git a/crates/openshell-prover/Cargo.toml b/crates/openshell-prover/Cargo.toml index ee815f3a3f..b620280e46 100644 --- a/crates/openshell-prover/Cargo.toml +++ b/crates/openshell-prover/Cargo.toml @@ -12,6 +12,7 @@ repository.workspace = true [features] bundled-z3 = ["z3/bundled"] +prebuilt-z3 = ["z3/gh-release"] [dependencies] z3 = { workspace = true } diff --git a/crates/openshell-server/Cargo.toml b/crates/openshell-server/Cargo.toml index 898eef334d..3ceef6ba39 100644 --- a/crates/openshell-server/Cargo.toml +++ b/crates/openshell-server/Cargo.toml @@ -119,6 +119,7 @@ default = ["telemetry"] ## that contains no telemetry endpoint, HTTP client, or emission code. telemetry = ["openshell-core/telemetry"] bundled-z3 = ["openshell-prover/bundled-z3"] +prebuilt-z3 = ["openshell-prover/prebuilt-z3"] test-support = [] [dev-dependencies] diff --git a/tasks/scripts/windows-msvc.ps1 b/tasks/scripts/windows-msvc.ps1 index 0a0410f4ca..a4a3e2a14a 100644 --- a/tasks/scripts/windows-msvc.ps1 +++ b/tasks/scripts/windows-msvc.ps1 @@ -32,24 +32,11 @@ if (-not (Test-Path $LogDir)) { } $LogDir = (Resolve-Path $LogDir).Path -$TargetDirWasConfigured = -not [string]::IsNullOrWhiteSpace($env:CARGO_TARGET_DIR) $TargetDir = $env:CARGO_TARGET_DIR -if (-not $TargetDirWasConfigured) { +if ([string]::IsNullOrWhiteSpace($TargetDir)) { $TargetDir = Join-Path $RepoRoot "target" } -$BundledZ3CacheRoot = $TargetDir -if (-not $TargetDirWasConfigured) { - $userCacheRoot = [Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData) - if ([string]::IsNullOrWhiteSpace($userCacheRoot)) { - $userCacheRoot = $env:LOCALAPPDATA - } - if ([string]::IsNullOrWhiteSpace($userCacheRoot)) { - $userCacheRoot = [IO.Path]::GetTempPath() - } - $BundledZ3CacheRoot = Join-Path $userCacheRoot "OpenShell\cache\z3" -} - $BuildJobsValue = $env:OPENSHELL_WINDOWS_BUILD_JOBS if ([string]::IsNullOrWhiteSpace($BuildJobsValue)) { $BuildJobsValue = $env:CARGO_BUILD_JOBS @@ -66,14 +53,11 @@ $WindowsCargoMutex = [System.Threading.Mutex]::new($false, "Local\OpenShellWindo $UnsupportedDriverPackageExcludes = "--exclude openshell-driver-docker --exclude openshell-driver-kubernetes --exclude openshell-driver-kubernetes-secrets --exclude openshell-driver-podman --exclude openshell-driver-vault --exclude openshell-driver-vm --exclude openshell-sandbox --exclude openshell-supervisor-network --exclude openshell-supervisor-process --exclude openshell-vfio" $WindowsClippyPackageExcludes = $UnsupportedDriverPackageExcludes $WindowsClippyLintArgs = "-D warnings -A dead-code -A unused-imports -A clippy::unused-async" -$BundledZ3WorkspaceFeatures = "--features openshell-prover/bundled-z3" -$BundledZ3ServerFeatures = "--features openshell-server/bundled-z3,openshell-prover/bundled-z3" -$BundledZ3Repository = "https://github.com/Z3Prover/z3.git" -$BundledZ3SysVersion = "0.11.0" -# This is the matching Z3 4.16.0 source revision. Update both pins together. -$BundledZ3Revision = "ddb49568d3520e99799e364fb22f35fc67d887b1" -$Z3WorkspaceFeatures = $BundledZ3WorkspaceFeatures -$Z3ServerFeatures = $BundledZ3ServerFeatures +$PrebuiltZ3WorkspaceFeatures = "--features openshell-prover/prebuilt-z3" +$PrebuiltZ3ServerFeatures = "--features openshell-server/prebuilt-z3,openshell-prover/prebuilt-z3" +$PrebuiltZ3Version = "4.16.0" +$Z3WorkspaceFeatures = $PrebuiltZ3WorkspaceFeatures +$Z3ServerFeatures = $PrebuiltZ3ServerFeatures function Get-VsInstallRoots { $programFiles = @( @@ -367,109 +351,14 @@ function Resolve-Z3HeaderPath([string] $HeaderPath) { return (Resolve-Path $HeaderPath).Path } -function Assert-BundledZ3Source([string] $SourcePath, [string] $ExpectedRevision) { - if (-not (Test-Path $SourcePath -PathType Container)) { - throw "Bundled Z3 source directory does not exist: $SourcePath" - } - - $header = Join-Path $SourcePath "src\api\z3.h" - if (-not (Test-Path $header -PathType Leaf)) { - throw "Bundled Z3 source directory does not contain src\api\z3.h: $SourcePath" - } - - if (-not [string]::IsNullOrWhiteSpace($ExpectedRevision)) { - $actualRevision = (& git -C $SourcePath rev-parse HEAD 2>$null) - if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($actualRevision)) { - throw "Could not verify the bundled Z3 source revision at: $SourcePath" - } - if ($actualRevision.Trim() -ne $ExpectedRevision) { - throw "Bundled Z3 source revision mismatch at ${SourcePath}: expected $ExpectedRevision, found $($actualRevision.Trim())" - } - } - - return (Resolve-Path $SourcePath).Path -} - -function Resolve-BundledZ3Source { - if (-not [string]::IsNullOrWhiteSpace($env:Z3_SYS_BUNDLED_DIR_OVERRIDE)) { - return Assert-BundledZ3Source $env:Z3_SYS_BUNDLED_DIR_OVERRIDE "" - } - - $cargoLock = Get-Content (Join-Path $RepoRoot "Cargo.lock") -Raw - $packagePattern = '(?ms)^\[\[package\]\]\s+name = "z3-sys"\s+version = "([^"]+)"' - $packageMatches = [regex]::Matches($cargoLock, $packagePattern) - if ($packageMatches.Count -ne 1 -or $packageMatches[0].Groups[1].Value -ne $BundledZ3SysVersion) { - throw "Bundled Z3 source pin expects z3-sys $BundledZ3SysVersion. Update the version and revision pins for the z3-sys version in Cargo.lock." - } - - $revisionPrefix = $BundledZ3Revision.Substring(0, 12) - $sourcePath = Join-Path $BundledZ3CacheRoot "z3-source-$revisionPrefix" - if (Test-Path $sourcePath) { - return Assert-BundledZ3Source $sourcePath $BundledZ3Revision - } - - if (-not (Get-Command git.exe -ErrorAction SilentlyContinue)) { - throw "Bundled Z3 source preparation requires git.exe on PATH." - } - if (-not (Test-Path $BundledZ3CacheRoot -PathType Container)) { - New-Item -ItemType Directory -Force -Path $BundledZ3CacheRoot | Out-Null - } - - $stagingPath = "$sourcePath.partial-$([guid]::NewGuid().ToString('N'))" - Write-Host "==> Fetching bundled Z3 source" - Write-Host " repository: $BundledZ3Repository" - Write-Host " revision: $BundledZ3Revision" - Write-Host " cache: $sourcePath" - - & git init --quiet $stagingPath - if ($LASTEXITCODE -ne 0) { - throw "git init failed while preparing bundled Z3 source at: $stagingPath" - } - & git -C $stagingPath remote add origin $BundledZ3Repository - if ($LASTEXITCODE -ne 0) { - throw "git remote add failed while preparing bundled Z3 source at: $stagingPath" - } - & git -C $stagingPath fetch --quiet --depth 1 origin $BundledZ3Revision - if ($LASTEXITCODE -ne 0) { - throw "git fetch failed for bundled Z3 revision $BundledZ3Revision. Partial source remains at: $stagingPath" - } - & git -C $stagingPath checkout --quiet --detach FETCH_HEAD - if ($LASTEXITCODE -ne 0) { - throw "git checkout failed for bundled Z3 revision $BundledZ3Revision. Partial source remains at: $stagingPath" - } - - Assert-BundledZ3Source $stagingPath $BundledZ3Revision | Out-Null - try { - # Directory.Move is an atomic rename on the same volume and, unlike - # Move-Item, fails when the destination already exists. A concurrent - # x64/ARM64 invocation can therefore win publication without the loser - # nesting its staging directory inside the shared cache. - [IO.Directory]::Move($stagingPath, $sourcePath) - } catch { - if (-not (Test-Path $sourcePath -PathType Container)) { - throw - } - Write-Host "==> Reusing bundled Z3 source published by another process" - } finally { - if (Test-Path $stagingPath -PathType Container) { - try { - Remove-Item -LiteralPath $stagingPath -Recurse -Force - } catch { - Write-Warning "Could not remove redundant bundled Z3 staging directory: $stagingPath" - } - } - } - return Assert-BundledZ3Source $sourcePath $BundledZ3Revision -} - function Configure-Z3 { if ([string]::IsNullOrWhiteSpace($env:Z3_LIBRARY_PATH_OVERRIDE)) { - Write-Host "==> Z3: bundled" - $env:Z3_SYS_BUNDLED_DIR_OVERRIDE = Resolve-BundledZ3Source - Write-Host " Z3_SYS_BUNDLED_DIR_OVERRIDE=$env:Z3_SYS_BUNDLED_DIR_OVERRIDE" + Write-Host "==> Z3: prebuilt release" + $env:Z3_SYS_Z3_VERSION = $PrebuiltZ3Version + Write-Host " Z3_SYS_Z3_VERSION=$env:Z3_SYS_Z3_VERSION" return [pscustomobject]@{ - WorkspaceFeatures = $BundledZ3WorkspaceFeatures - ServerFeatures = $BundledZ3ServerFeatures + WorkspaceFeatures = $PrebuiltZ3WorkspaceFeatures + ServerFeatures = $PrebuiltZ3ServerFeatures } } @@ -523,8 +412,8 @@ function Invoke-VsCargo { "set `"RUSTC_WRAPPER=`"" ) if ($hostArch -eq "amd64" -and $RustTarget -eq "aarch64-pc-windows-msvc") { - # Let cmake-rs select MSVC cl.exe for bundled Z3. AWS-LC selects - # clang-cl inside its own ARM64 build script. + # Native ARM64 dependencies select their own compilers. Clear inherited + # overrides so AWS-LC can select clang-cl inside its build script. $environmentSetup += @( "set `"CC=`"", "set `"CXX=`"", From 6c7b08dab6de3f9f7599ebfa92f34e67f9bf0766 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 12:52:22 -0700 Subject: [PATCH 06/25] perf(ci): layer sccache on Windows target cache Signed-off-by: Piotr Mlocek --- .../build-openshell-mxc-windows/SKILL.md | 14 +++++----- .../build-openshell-mxc-windows/reference.md | 5 ++-- .github/workflows/windows-msvc.yml | 27 +++++++++++++++---- architecture/windows-msvc-build.md | 13 +++++++-- tasks/scripts/windows-msvc.ps1 | 11 +++++++- 5 files changed, 54 insertions(+), 16 deletions(-) diff --git a/.agents/skills/build-openshell-mxc-windows/SKILL.md b/.agents/skills/build-openshell-mxc-windows/SKILL.md index 4235c7cc53..0b3e1c2d43 100644 --- a/.agents/skills/build-openshell-mxc-windows/SKILL.md +++ b/.agents/skills/build-openshell-mxc-windows/SKILL.md @@ -135,7 +135,7 @@ from this skill. | `Z3_SYS_Z3_HEADER` | unset | Full `z3.h` path required with a system Z3 library. | | `Z3_SYS_Z3_VERSION` | `4.16.0` | Pinned official prebuilt Z3 release selected by the wrapper. | | `READ_ONLY_GITHUB_TOKEN` | unset | Optional token for the Z3 release lookup; GitHub Actions supplies `github.token`. | -| `RUSTC_WRAPPER` | cleared by wrapper | The wrapper clears inherited values because `--skip-tools` does not provision `sccache`. | +| `RUSTC_WRAPPER` | inherited | The wrapper resolves an available command to an absolute path. If it is unavailable, the wrapper warns and continues without compiler caching. | Legacy fork variables such as `OPENSHELL_UPSTREAM`, `OPENSHELL_MXC_FORK_DIR`, and `OPENSHELL_MXC_FORK_BRANCH` are no longer part @@ -188,10 +188,11 @@ order: 6. Focused unsupported-driver contract tests. 7. Artifact reporting. -The GitHub Actions jobs use architecture-specific `Swatinem/rust-cache` -entries for the Cargo registry and dependency target artifacts. Failed runs -also save their usable dependency artifacts. The workflow remains manually -dispatched until cache-hit runtimes justify restoring automatic triggers. +The GitHub Actions jobs layer architecture-specific `Swatinem/rust-cache` +entries for Cargo registry and dependency target artifacts with sccache's GHA +backend for cacheable Rust compiler outputs. Failed runs also save their usable +dependency artifacts. The workflow remains manually dispatched until cache-hit +runtimes justify restoring automatic triggers. The ARM64 check/build steps in this x64-host contract are cross-builds. The wrapper discovers and adds host-native LLVM and Ninja to `PATH`, requires the @@ -206,7 +207,8 @@ commands above on an ARM64 host. The repository-wide `mise run pre-commit` task is also supported on Windows. Its Rust check, Clippy, and test dependencies enter the same MSVC environment -for the native host target and clear inherited `RUSTC_WRAPPER`. Linux glibc +for the native host target and use an inherited compiler wrapper when it is +available. Linux glibc installer tests and Linux service/RPM packaging-asset tests skip explicitly; the Linux build-environment shell-helper test also skips; cross-platform checks continue to run. The blocking Windows Clippy pass excludes unsupported diff --git a/.agents/skills/build-openshell-mxc-windows/reference.md b/.agents/skills/build-openshell-mxc-windows/reference.md index 7327ea8748..b50bdf8701 100644 --- a/.agents/skills/build-openshell-mxc-windows/reference.md +++ b/.agents/skills/build-openshell-mxc-windows/reference.md @@ -46,8 +46,9 @@ if ($arch -eq [System.Runtime.InteropServices.Architecture]::Arm64) { The native test tasks reject a target that does not match the host architecture. Do not report x64 compatibility-under-emulation coverage from an ARM64 run. -The wrapper adds missing rustup targets and clears inherited -`RUSTC_WRAPPER`. It does not install Visual Studio, Rust, Docker, Kubernetes, +The wrapper adds missing rustup targets and preserves an inherited +`RUSTC_WRAPPER` when the command is available. Otherwise, it warns and clears +the setting. It does not install Visual Studio, Rust, Docker, Kubernetes, Podman, WSL, Hyper-V, or VM tooling. On Windows, `mise run pre-commit` routes `rust:check`, `rust:lint`, and diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index 970160c0be..5d67bfb348 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -6,12 +6,18 @@ jobs: runs-on: windows-2025 env: READ_ONLY_GITHUB_TOKEN: ${{ github.token }} + SCCACHE_GHA_ENABLED: "true" + SCCACHE_GHA_VERSION: windows-msvc-x64-prebuilt-z3-v2 + SCCACHE_CLIENT_SIDE: "1" + SCCACHE_BASEDIRS: ${{ github.workspace }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: install: false experimental: true + - name: Configure GHA sccache backend + uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - uses: dtolnay/rust-toolchain@master with: toolchain: "1.95.0" @@ -19,9 +25,8 @@ jobs: - name: Cache Rust target and registry uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 env: - # mise exports RUSTC_WRAPPER=sccache, but this workflow intentionally - # does not install sccache. Keep rust-cache's cargo metadata calls - # independent of that unavailable wrapper so target artifacts save. + # Keep rust-cache's cargo metadata calls independent of the compiler + # wrapper; build steps still inherit sccache from the job. RUSTC_WRAPPER: "" with: # Keep the prebuilt-Z3 experiment isolated from earlier target caches. @@ -33,18 +38,27 @@ jobs: - run: mise run --skip-tools windows:build:x64 - run: mise run --skip-tools windows:test:x64 - run: mise run --skip-tools windows:test:unsupported:x64 + - name: sccache stats + if: always() + run: sccache --show-stats arm64: # TODO: provision a windows-arm64 self-hosted runner runs-on: [self-hosted, windows-arm64] if: false # flip to true once the runner is online env: READ_ONLY_GITHUB_TOKEN: ${{ github.token }} + SCCACHE_GHA_ENABLED: "true" + SCCACHE_GHA_VERSION: windows-msvc-arm64-prebuilt-z3-v2 + SCCACHE_CLIENT_SIDE: "1" + SCCACHE_BASEDIRS: ${{ github.workspace }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: install: false experimental: true + - name: Configure GHA sccache backend + uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - uses: dtolnay/rust-toolchain@master with: toolchain: "1.95.0" @@ -52,8 +66,8 @@ jobs: - name: Cache Rust target and registry uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 env: - # Keep rust-cache's cargo metadata calls independent of the - # unavailable sccache wrapper exported by mise. + # Keep rust-cache's cargo metadata calls independent of the compiler + # wrapper; build steps still inherit sccache from the job. RUSTC_WRAPPER: "" with: shared-key: windows-msvc-arm64-prebuilt-z3-v1 @@ -62,3 +76,6 @@ jobs: cache-bin: "false" - run: mise run --skip-tools windows:check:arm64 - run: mise run --skip-tools windows:build:arm64 + - name: sccache stats + if: always() + run: sccache --show-stats diff --git a/architecture/windows-msvc-build.md b/architecture/windows-msvc-build.md index 59d84491ec..4981dfa39e 100644 --- a/architecture/windows-msvc-build.md +++ b/architecture/windows-msvc-build.md @@ -77,8 +77,10 @@ Windows validation is exposed through `tasks/windows.toml`: The Windows tasks call `tasks/scripts/windows-msvc.ps1`. The wrapper discovers Visual Studio's `VsDevCmd.bat` with `vswhere` or by enumerating installed release directories, validates the requested compiler and ARM64 Spectre -libraries, adds rustup MSVC targets, clears inherited `RUSTC_WRAPPER`, and -keeps build artifacts under the normal Cargo target tree. +libraries, adds rustup MSVC targets, preserves an inherited `RUSTC_WRAPPER` +when the command is available, and keeps build artifacts under the normal +Cargo target tree. If the wrapper command is unavailable, it warns and clears +the setting so local builds continue without compiler caching. On Windows, the generic `rust:check`, `rust:lint`, and `test:rust` tasks call the same wrapper with the host-native MSVC target. The wrapper preserves the Unix Cargo commands on Linux and macOS, excludes unsupported Windows runtime @@ -101,6 +103,13 @@ wrapper uses that system Z3 instead and requires `Z3_SYS_Z3_HEADER` to point at the full path to `z3.h`. Local clean builds use the unauthenticated GitHub API unless `READ_ONLY_GITHUB_TOKEN` is set. +GitHub Actions layers the Cargo target cache with sccache's GitHub Actions +backend. The target cache lets Cargo skip intact dependency builds; sccache +recovers cacheable Rust compiler outputs when source changes invalidate part of +that target tree. CI enables client-side mode and normalizes the checkout root +for stable compiler cache keys. The target-cache action runs its metadata step +with `RUSTC_WRAPPER` cleared so cache maintenance does not depend on sccache. + The lane uses `mise run --skip-tools windows:*` because Windows Rust comes from rustup and linking comes from Visual Studio Build Tools. Mise orchestrates the tasks; it does not own the Windows toolchain. diff --git a/tasks/scripts/windows-msvc.ps1 b/tasks/scripts/windows-msvc.ps1 index a4a3e2a14a..071b37d18b 100644 --- a/tasks/scripts/windows-msvc.ps1 +++ b/tasks/scripts/windows-msvc.ps1 @@ -405,11 +405,20 @@ function Invoke-VsCargo { $targetArch = Get-VsTargetArch $RustTarget $hostArch = Get-HostArch $logPath = Join-Path $LogDir $LogName + $rustcWrapper = "" + if (-not [string]::IsNullOrWhiteSpace($env:RUSTC_WRAPPER)) { + $wrapperCommand = Get-Command $env:RUSTC_WRAPPER -ErrorAction SilentlyContinue + if ($wrapperCommand) { + $rustcWrapper = $wrapperCommand.Source + } else { + Write-Warning "RUSTC_WRAPPER '$env:RUSTC_WRAPPER' was not found; continuing without it." + } + } $environmentSetup = @( "set `"CARGO_TARGET_DIR=$TargetDir`"", "set `"CARGO_BUILD_JOBS=$WindowsBuildJobs`"", "set `"CARGO_INCREMENTAL=0`"", - "set `"RUSTC_WRAPPER=`"" + "set `"RUSTC_WRAPPER=$rustcWrapper`"" ) if ($hostArch -eq "amd64" -and $RustTarget -eq "aarch64-pc-windows-msvc") { # Native ARM64 dependencies select their own compilers. Clear inherited From 727745a2a6d822f0df39b14b574a651806740d57 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 13:28:43 -0700 Subject: [PATCH 07/25] ci(windows): split PR checks from main validation Signed-off-by: Piotr Mlocek --- .../build-openshell-mxc-windows/SKILL.md | 14 +++-- .../build-openshell-mxc-windows/reference.md | 2 +- .github/workflows/windows-msvc.yml | 55 +++++++++++++++++-- architecture/windows-msvc-build.md | 30 +++++++--- 4 files changed, 79 insertions(+), 22 deletions(-) diff --git a/.agents/skills/build-openshell-mxc-windows/SKILL.md b/.agents/skills/build-openshell-mxc-windows/SKILL.md index 0b3e1c2d43..26ac433083 100644 --- a/.agents/skills/build-openshell-mxc-windows/SKILL.md +++ b/.agents/skills/build-openshell-mxc-windows/SKILL.md @@ -28,7 +28,7 @@ The Windows build lane is implemented by these tracked files: | `tasks/windows.toml` | Mise task entry points for `windows:*` commands. | | `tasks/rust.toml`, `tasks/test.toml`, and `tasks/markdown.toml` | Windows routing for compiler-bearing checks, explicit Unix-only test skips, and Markdown dependency setup. | | `tasks/scripts/windows-msvc.ps1` | PowerShell wrapper that enters the Visual Studio developer environment and invokes Cargo. | -| `.github/workflows/windows-msvc.yml` | Manually dispatched GitHub Actions jobs with architecture-specific Rust caches for x64 and future ARM64 Windows validation. | +| `.github/workflows/windows-msvc.yml` | PR/merge-queue checks and full main/manual GitHub Actions jobs with architecture-specific Rust caches for x64 and future ARM64 Windows validation. | | `architecture/windows-msvc-build.md` | Design notes and validation contract. | | `.agents/skills/build-openshell-mxc-windows/` | This skill and companion reference material. | @@ -191,8 +191,10 @@ order: The GitHub Actions jobs layer architecture-specific `Swatinem/rust-cache` entries for Cargo registry and dependency target artifacts with sccache's GHA backend for cacheable Rust compiler outputs. Failed runs also save their usable -dependency artifacts. The workflow remains manually dispatched until cache-hit -runtimes justify restoring automatic triggers. +dependency artifacts. Pull-request mirrors and merge queues run the x64 check; +pushes to `main` and manual dispatches run x64 check, release build, and full +workspace tests. Main uses the same cache namespaces and keeps both layers warm +for pull requests. The ARM64 check/build steps in this x64-host contract are cross-builds. The wrapper discovers and adds host-native LLVM and Ninja to `PATH`, requires the @@ -260,9 +262,9 @@ The focused contract tasks for either native architecture run: windows_builtin_compute_drivers_report_unsupported ``` -These tests are also included in the full x64 workspace test run; the focused -task intentionally re-runs them so unsupported Windows behavior is visible in -the CI report. +These tests are also included in the full x64 workspace test run. The focused +task is available for local diagnosis; GitHub Actions does not re-run it after +the full suite. ## Test Accounting Guidance diff --git a/.agents/skills/build-openshell-mxc-windows/reference.md b/.agents/skills/build-openshell-mxc-windows/reference.md index b50bdf8701..8bc011109e 100644 --- a/.agents/skills/build-openshell-mxc-windows/reference.md +++ b/.agents/skills/build-openshell-mxc-windows/reference.md @@ -9,7 +9,7 @@ maintaining the existing build-only Windows MSVC lane. |---|---| | `tasks/windows.toml` | Mise task definitions for `windows:*`. | | `tasks/scripts/windows-msvc.ps1` | Visual Studio environment discovery, rustup target setup, Cargo invocation, logs, artifact report. | -| `.github/workflows/windows-msvc.yml` | Manual GitHub Actions x64 job and disabled ARM64 scaffold, each with an architecture-specific Rust dependency cache. | +| `.github/workflows/windows-msvc.yml` | PR/merge-queue x64 checks, full main/manual validation, and a disabled ARM64 scaffold with architecture-specific Rust caches. | | `architecture/windows-msvc-build.md` | Human-readable design contract. | ## Commands diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index 5d67bfb348..d9d6d43e19 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -1,8 +1,43 @@ name: Windows MSVC (build-only) + on: + merge_group: + types: [checks_requested] + push: + branches: + - main + - "pull-request/[0-9]+" workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +env: + CARGO_INCREMENTAL: "0" + jobs: + pr_metadata: + name: Resolve PR metadata + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: read + outputs: + should_run: ${{ github.ref == 'refs/heads/main' || steps.gate.outputs.should_run == 'true' }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - id: gate + if: github.ref != 'refs/heads/main' + uses: ./.github/actions/pr-gate + x64: + needs: pr_metadata + if: needs.pr_metadata.outputs.should_run == 'true' runs-on: windows-2025 env: READ_ONLY_GITHUB_TOKEN: ${{ github.token }} @@ -34,15 +69,20 @@ jobs: cache-targets: "true" cache-on-failure: "true" cache-bin: "false" - - run: mise run --skip-tools windows:check:x64 - - run: mise run --skip-tools windows:build:x64 - - run: mise run --skip-tools windows:test:x64 - - run: mise run --skip-tools windows:test:unsupported:x64 + - name: Check + run: mise run --skip-tools windows:check:x64 + - name: Build release binaries + if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' + run: mise run --skip-tools windows:build:x64 + - name: Test + if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' + run: mise run --skip-tools windows:test:x64 - name: sccache stats if: always() run: sccache --show-stats arm64: # TODO: provision a windows-arm64 self-hosted runner + needs: pr_metadata runs-on: [self-hosted, windows-arm64] if: false # flip to true once the runner is online env: @@ -74,8 +114,11 @@ jobs: cache-targets: "true" cache-on-failure: "true" cache-bin: "false" - - run: mise run --skip-tools windows:check:arm64 - - run: mise run --skip-tools windows:build:arm64 + - name: Check + run: mise run --skip-tools windows:check:arm64 + - name: Build release binaries + if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' + run: mise run --skip-tools windows:build:arm64 - name: sccache stats if: always() run: sccache --show-stats diff --git a/architecture/windows-msvc-build.md b/architecture/windows-msvc-build.md index 4981dfa39e..875f89bae4 100644 --- a/architecture/windows-msvc-build.md +++ b/architecture/windows-msvc-build.md @@ -54,11 +54,13 @@ creating misleading Windows driver artifacts. ## Mise Lane -The GitHub Actions workflow is manually dispatched. Each architecture restores -and saves a dedicated Rust cache containing the Cargo registry and dependency -build artifacts, including artifacts from failed runs. Keep the workflow manual -until cache-hit runtimes demonstrate that it is suitable for pull requests and -merges to `main`. +The GitHub Actions workflow checks x64 Windows compilation for pull-request +mirror branches and merge queues. Pushes to `main` and manual dispatches also +build the release binaries and run the full x64 workspace test suite. Each +architecture restores and saves a dedicated Rust cache containing the Cargo +registry and dependency build artifacts, including artifacts from failed runs. +The full run on `main` uses the same cache namespaces as pull requests, keeping +both the Cargo target cache and sccache warm for subsequent checks. Windows validation is exposed through `tasks/windows.toml`: @@ -134,23 +136,33 @@ break ARM64 crypto dependency builds. ## CI Shape -The x64 GitHub Actions job runs on `windows-2025` and executes: +The x64 GitHub Actions job runs on `windows-2025`. Pull-request mirrors and +merge queues execute: + +```powershell +mise run --skip-tools windows:check:x64 +``` + +Pushes to `main` and manual dispatches execute: ```powershell mise run --skip-tools windows:check:x64 mise run --skip-tools windows:build:x64 mise run --skip-tools windows:test:x64 -mise run --skip-tools windows:test:unsupported:x64 ``` +The full workspace test includes the unsupported-driver contract test, so CI +does not run the focused test task a second time. The focused task remains +available for local diagnosis. + The cache is partitioned by architecture so incompatible x64 and ARM64 target artifacts cannot collide. It does not cache Cargo-installed binaries, which also keeps the disabled self-hosted ARM64 scaffold from modifying persistent runner tooling. The local aggregate `windows:ci` task cross-builds ARM64 on an x64 host. The -GitHub x64 job currently runs only the x64 tasks, and native ARM64 tests remain -exclusive to an ARM64 runner. +GitHub x64 job runs only the x64 tasks, and native ARM64 tests remain exclusive +to an ARM64 runner. The ARM64 job is scaffolded but disabled until a Windows ARM64 runner is available. Once enabled, it should run check, release build, native workspace From 76d4f00e4bee4dc09197928520cb87abfb4ce2e3 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 16:23:12 -0700 Subject: [PATCH 08/25] ci(windows): separate checks builds and cache seeding Signed-off-by: Piotr Mlocek --- .../build-openshell-mxc-windows/SKILL.md | 11 +- .../build-openshell-mxc-windows/reference.md | 2 +- .github/workflows/windows-msvc.yml | 101 ++++++++++++++++-- architecture/windows-msvc-build.md | 30 +++--- 4 files changed, 117 insertions(+), 27 deletions(-) diff --git a/.agents/skills/build-openshell-mxc-windows/SKILL.md b/.agents/skills/build-openshell-mxc-windows/SKILL.md index 26ac433083..e0899381ce 100644 --- a/.agents/skills/build-openshell-mxc-windows/SKILL.md +++ b/.agents/skills/build-openshell-mxc-windows/SKILL.md @@ -28,7 +28,7 @@ The Windows build lane is implemented by these tracked files: | `tasks/windows.toml` | Mise task entry points for `windows:*` commands. | | `tasks/rust.toml`, `tasks/test.toml`, and `tasks/markdown.toml` | Windows routing for compiler-bearing checks, explicit Unix-only test skips, and Markdown dependency setup. | | `tasks/scripts/windows-msvc.ps1` | PowerShell wrapper that enters the Visual Studio developer environment and invokes Cargo. | -| `.github/workflows/windows-msvc.yml` | PR/merge-queue checks and full main/manual GitHub Actions jobs with architecture-specific Rust caches for x64 and future ARM64 Windows validation. | +| `.github/workflows/windows-msvc.yml` | PR/merge-queue lint and test, main cache seeding, and dependent binary-build jobs with architecture-specific Rust caches for x64 and future ARM64 Windows validation. | | `architecture/windows-msvc-build.md` | Design notes and validation contract. | | `.agents/skills/build-openshell-mxc-windows/` | This skill and companion reference material. | @@ -191,10 +191,11 @@ order: The GitHub Actions jobs layer architecture-specific `Swatinem/rust-cache` entries for Cargo registry and dependency target artifacts with sccache's GHA backend for cacheable Rust compiler outputs. Failed runs also save their usable -dependency artifacts. Pull-request mirrors and merge queues run the x64 check; -pushes to `main` and manual dispatches run x64 check, release build, and full -workspace tests. Main uses the same cache namespaces and keeps both layers warm -for pull requests. +dependency artifacts. Pull-request mirrors and merge queues run Windows Clippy +and Rust tests. Pushes to `main` and manual dispatches run the same lint and +test commands in a cache-seed job, followed by a dependent release-binary build +job. The seed and PR jobs use the same cache namespaces. The binaries are not +uploaded or published. The ARM64 check/build steps in this x64-host contract are cross-builds. The wrapper discovers and adds host-native LLVM and Ninja to `PATH`, requires the diff --git a/.agents/skills/build-openshell-mxc-windows/reference.md b/.agents/skills/build-openshell-mxc-windows/reference.md index 8bc011109e..b616b95ec7 100644 --- a/.agents/skills/build-openshell-mxc-windows/reference.md +++ b/.agents/skills/build-openshell-mxc-windows/reference.md @@ -9,7 +9,7 @@ maintaining the existing build-only Windows MSVC lane. |---|---| | `tasks/windows.toml` | Mise task definitions for `windows:*`. | | `tasks/scripts/windows-msvc.ps1` | Visual Studio environment discovery, rustup target setup, Cargo invocation, logs, artifact report. | -| `.github/workflows/windows-msvc.yml` | PR/merge-queue x64 checks, full main/manual validation, and a disabled ARM64 scaffold with architecture-specific Rust caches. | +| `.github/workflows/windows-msvc.yml` | PR/merge-queue x64 lint and test, main/manual cache seeding followed by binary builds, and a disabled ARM64 scaffold with architecture-specific Rust caches. | | `architecture/windows-msvc-build.md` | Human-readable design contract. | ## Commands diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index d9d6d43e19..b1ac10e60d 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -35,9 +35,13 @@ jobs: if: github.ref != 'refs/heads/main' uses: ./.github/actions/pr-gate - x64: + pr-check-x64: + name: PR lint and test (x64) needs: pr_metadata - if: needs.pr_metadata.outputs.should_run == 'true' + if: >- + needs.pr_metadata.outputs.should_run == 'true' && + github.ref != 'refs/heads/main' && + github.event_name != 'workflow_dispatch' runs-on: windows-2025 env: READ_ONLY_GITHUB_TOKEN: ${{ github.token }} @@ -69,17 +73,98 @@ jobs: cache-targets: "true" cache-on-failure: "true" cache-bin: "false" - - name: Check - run: mise run --skip-tools windows:check:x64 + - name: Lint + run: mise run --skip-tools rust:lint + - name: Test + run: mise run --skip-tools test:rust + - name: sccache stats + if: always() + run: sccache --show-stats + + cache-seed-x64: + name: Seed cache (x64) + needs: pr_metadata + if: >- + needs.pr_metadata.outputs.should_run == 'true' && + (github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch') + runs-on: windows-2025 + env: + READ_ONLY_GITHUB_TOKEN: ${{ github.token }} + SCCACHE_GHA_ENABLED: "true" + SCCACHE_GHA_VERSION: windows-msvc-x64-prebuilt-z3-v2 + SCCACHE_CLIENT_SIDE: "1" + SCCACHE_BASEDIRS: ${{ github.workspace }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 + with: + install: false + experimental: true + - name: Configure GHA sccache backend + uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + - uses: dtolnay/rust-toolchain@master + with: + toolchain: "1.95.0" + targets: x86_64-pc-windows-msvc + - name: Cache Rust target and registry + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + env: + RUSTC_WRAPPER: "" + with: + shared-key: windows-msvc-x64-prebuilt-z3-v1 + cache-targets: "true" + cache-on-failure: "true" + cache-bin: "false" + - name: Lint + run: mise run --skip-tools rust:lint + - name: Test + run: mise run --skip-tools test:rust + - name: sccache stats + if: always() + run: sccache --show-stats + + build-x64: + name: Build binaries (x64) + needs: [pr_metadata, cache-seed-x64] + if: >- + always() && + needs.pr_metadata.outputs.should_run == 'true' && + needs.cache-seed-x64.result == 'success' && + (github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch') + runs-on: windows-2025 + env: + READ_ONLY_GITHUB_TOKEN: ${{ github.token }} + SCCACHE_GHA_ENABLED: "true" + SCCACHE_GHA_VERSION: windows-msvc-x64-prebuilt-z3-v2 + SCCACHE_CLIENT_SIDE: "1" + SCCACHE_BASEDIRS: ${{ github.workspace }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 + with: + install: false + experimental: true + - name: Configure GHA sccache backend + uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + - uses: dtolnay/rust-toolchain@master + with: + toolchain: "1.95.0" + targets: x86_64-pc-windows-msvc + - name: Cache Rust target and registry + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + env: + RUSTC_WRAPPER: "" + with: + shared-key: windows-msvc-x64-prebuilt-z3-v1 + cache-targets: "true" + cache-on-failure: "true" + cache-bin: "false" - name: Build release binaries - if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' run: mise run --skip-tools windows:build:x64 - - name: Test - if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' - run: mise run --skip-tools windows:test:x64 - name: sccache stats if: always() run: sccache --show-stats + arm64: # TODO: provision a windows-arm64 self-hosted runner needs: pr_metadata diff --git a/architecture/windows-msvc-build.md b/architecture/windows-msvc-build.md index 875f89bae4..96d1a08989 100644 --- a/architecture/windows-msvc-build.md +++ b/architecture/windows-msvc-build.md @@ -54,13 +54,17 @@ creating misleading Windows driver artifacts. ## Mise Lane -The GitHub Actions workflow checks x64 Windows compilation for pull-request -mirror branches and merge queues. Pushes to `main` and manual dispatches also -build the release binaries and run the full x64 workspace test suite. Each -architecture restores and saves a dedicated Rust cache containing the Cargo +The GitHub Actions workflow runs x64 Windows Clippy and Rust tests for +pull-request mirror branches and merge queues. On pushes to `main`, a cache-seed +job runs the same lint and test commands before a dependent job builds the +release binaries. Manual dispatches exercise the same seed-then-build path. +The binaries remain CI validation artifacts and are not uploaded or published. + +Each job restores and saves a dedicated Rust cache containing the Cargo registry and dependency build artifacts, including artifacts from failed runs. -The full run on `main` uses the same cache namespaces as pull requests, keeping -both the Cargo target cache and sccache warm for subsequent checks. +The seed job and pull-request job use the same Cargo target and sccache +namespaces. The release build waits for the seed job, then restores its newly +warmed cache rather than compiling concurrently from a cold cache. Windows validation is exposed through `tasks/windows.toml`: @@ -136,23 +140,23 @@ break ARM64 crypto dependency builds. ## CI Shape -The x64 GitHub Actions job runs on `windows-2025`. Pull-request mirrors and +The x64 GitHub Actions jobs run on `windows-2025`. Pull-request mirrors and merge queues execute: ```powershell -mise run --skip-tools windows:check:x64 +mise run --skip-tools rust:lint +mise run --skip-tools test:rust ``` -Pushes to `main` and manual dispatches execute: +Pushes to `main` and manual dispatches first seed the shared caches with those +same lint and test commands. After the seed succeeds, a separate job executes: ```powershell -mise run --skip-tools windows:check:x64 mise run --skip-tools windows:build:x64 -mise run --skip-tools windows:test:x64 ``` -The full workspace test includes the unsupported-driver contract test, so CI -does not run the focused test task a second time. The focused task remains +The server test-support suite includes the unsupported-driver contract test, so +CI does not run the focused test task a second time. The focused task remains available for local diagnosis. The cache is partitioned by architecture so incompatible x64 and ARM64 target From 901db0653ed13af5322fe480c613d6bcaacf0822 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 16:26:57 -0700 Subject: [PATCH 09/25] fix(ci): simplify Windows build dependency Signed-off-by: Piotr Mlocek --- .github/workflows/windows-msvc.yml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index b1ac10e60d..0101f27ef7 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -125,12 +125,8 @@ jobs: build-x64: name: Build binaries (x64) - needs: [pr_metadata, cache-seed-x64] - if: >- - always() && - needs.pr_metadata.outputs.should_run == 'true' && - needs.cache-seed-x64.result == 'success' && - (github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch') + needs: cache-seed-x64 + if: needs.cache-seed-x64.result == 'success' runs-on: windows-2025 env: READ_ONLY_GITHUB_TOKEN: ${{ github.token }} From 35dff96b815aa69bf4766669c3a1c8de46d5638d Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 16:28:36 -0700 Subject: [PATCH 10/25] fix(ci): rely on Windows job dependency status Signed-off-by: Piotr Mlocek --- .github/workflows/windows-msvc.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index 0101f27ef7..60b7a31408 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -126,7 +126,6 @@ jobs: build-x64: name: Build binaries (x64) needs: cache-seed-x64 - if: needs.cache-seed-x64.result == 'success' runs-on: windows-2025 env: READ_ONLY_GITHUB_TOKEN: ${{ github.token }} From 8e3a099ef7e5fb8c410e501aec7431a9fed9a55b Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 16:33:37 -0700 Subject: [PATCH 11/25] fix(ci): use valid opt-in Windows ARM runner Signed-off-by: Piotr Mlocek --- .agents/skills/build-openshell-mxc-windows/SKILL.md | 2 +- .agents/skills/build-openshell-mxc-windows/reference.md | 2 +- .github/workflows/windows-msvc.yml | 6 +++--- architecture/windows-msvc-build.md | 8 ++++---- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.agents/skills/build-openshell-mxc-windows/SKILL.md b/.agents/skills/build-openshell-mxc-windows/SKILL.md index e0899381ce..6552cb762a 100644 --- a/.agents/skills/build-openshell-mxc-windows/SKILL.md +++ b/.agents/skills/build-openshell-mxc-windows/SKILL.md @@ -28,7 +28,7 @@ The Windows build lane is implemented by these tracked files: | `tasks/windows.toml` | Mise task entry points for `windows:*` commands. | | `tasks/rust.toml`, `tasks/test.toml`, and `tasks/markdown.toml` | Windows routing for compiler-bearing checks, explicit Unix-only test skips, and Markdown dependency setup. | | `tasks/scripts/windows-msvc.ps1` | PowerShell wrapper that enters the Visual Studio developer environment and invokes Cargo. | -| `.github/workflows/windows-msvc.yml` | PR/merge-queue lint and test, main cache seeding, and dependent binary-build jobs with architecture-specific Rust caches for x64 and future ARM64 Windows validation. | +| `.github/workflows/windows-msvc.yml` | PR/merge-queue lint and test, main cache seeding, dependent binary-build jobs, and opt-in hosted ARM64 validation with architecture-specific Rust caches. | | `architecture/windows-msvc-build.md` | Design notes and validation contract. | | `.agents/skills/build-openshell-mxc-windows/` | This skill and companion reference material. | diff --git a/.agents/skills/build-openshell-mxc-windows/reference.md b/.agents/skills/build-openshell-mxc-windows/reference.md index b616b95ec7..194aa8aaee 100644 --- a/.agents/skills/build-openshell-mxc-windows/reference.md +++ b/.agents/skills/build-openshell-mxc-windows/reference.md @@ -9,7 +9,7 @@ maintaining the existing build-only Windows MSVC lane. |---|---| | `tasks/windows.toml` | Mise task definitions for `windows:*`. | | `tasks/scripts/windows-msvc.ps1` | Visual Studio environment discovery, rustup target setup, Cargo invocation, logs, artifact report. | -| `.github/workflows/windows-msvc.yml` | PR/merge-queue x64 lint and test, main/manual cache seeding followed by binary builds, and a disabled ARM64 scaffold with architecture-specific Rust caches. | +| `.github/workflows/windows-msvc.yml` | PR/merge-queue x64 lint and test, main/manual cache seeding followed by binary builds, and opt-in hosted ARM64 validation with architecture-specific Rust caches. | | `architecture/windows-msvc-build.md` | Human-readable design contract. | ## Commands diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index 60b7a31408..fc4c97bfb0 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -161,10 +161,10 @@ jobs: run: sccache --show-stats arm64: - # TODO: provision a windows-arm64 self-hosted runner + # Keep native ARM64 validation opt-in until its runtime and cost are measured. needs: pr_metadata - runs-on: [self-hosted, windows-arm64] - if: false # flip to true once the runner is online + runs-on: windows-11-arm + if: vars.ENABLE_WINDOWS_ARM64 == 'true' env: READ_ONLY_GITHUB_TOKEN: ${{ github.token }} SCCACHE_GHA_ENABLED: "true" diff --git a/architecture/windows-msvc-build.md b/architecture/windows-msvc-build.md index 96d1a08989..81645c46e0 100644 --- a/architecture/windows-msvc-build.md +++ b/architecture/windows-msvc-build.md @@ -168,10 +168,10 @@ The local aggregate `windows:ci` task cross-builds ARM64 on an x64 host. The GitHub x64 job runs only the x64 tasks, and native ARM64 tests remain exclusive to an ARM64 runner. -The ARM64 job is scaffolded but disabled until a Windows ARM64 runner is -available. Once enabled, it should run check, release build, native workspace -tests, and the focused unsupported-driver contracts for -`aarch64-pc-windows-msvc`. +The ARM64 job uses the hosted `windows-11-arm` runner but remains disabled +unless the repository variable `ENABLE_WINDOWS_ARM64` is set to `true`. Before +enabling it, measure the native runner and extend it to follow the same +lint/test seed and dependent-build split as x64. ## Validation Contract From 57d67d0e55c4a32032409212acf2c40844c347e9 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 16:35:21 -0700 Subject: [PATCH 12/25] ci(windows): keep ARM64 validation local Signed-off-by: Piotr Mlocek --- .../build-openshell-mxc-windows/SKILL.md | 2 +- .../build-openshell-mxc-windows/reference.md | 2 +- .github/workflows/windows-msvc.yml | 43 ------------------- architecture/windows-msvc-build.md | 13 +++--- 4 files changed, 7 insertions(+), 53 deletions(-) diff --git a/.agents/skills/build-openshell-mxc-windows/SKILL.md b/.agents/skills/build-openshell-mxc-windows/SKILL.md index 6552cb762a..9c62488577 100644 --- a/.agents/skills/build-openshell-mxc-windows/SKILL.md +++ b/.agents/skills/build-openshell-mxc-windows/SKILL.md @@ -28,7 +28,7 @@ The Windows build lane is implemented by these tracked files: | `tasks/windows.toml` | Mise task entry points for `windows:*` commands. | | `tasks/rust.toml`, `tasks/test.toml`, and `tasks/markdown.toml` | Windows routing for compiler-bearing checks, explicit Unix-only test skips, and Markdown dependency setup. | | `tasks/scripts/windows-msvc.ps1` | PowerShell wrapper that enters the Visual Studio developer environment and invokes Cargo. | -| `.github/workflows/windows-msvc.yml` | PR/merge-queue lint and test, main cache seeding, dependent binary-build jobs, and opt-in hosted ARM64 validation with architecture-specific Rust caches. | +| `.github/workflows/windows-msvc.yml` | PR/merge-queue x64 lint and test, main cache seeding, and dependent x64 binary-build jobs. ARM64 remains a local task until it gets a native workflow. | | `architecture/windows-msvc-build.md` | Design notes and validation contract. | | `.agents/skills/build-openshell-mxc-windows/` | This skill and companion reference material. | diff --git a/.agents/skills/build-openshell-mxc-windows/reference.md b/.agents/skills/build-openshell-mxc-windows/reference.md index 194aa8aaee..e17e0005a3 100644 --- a/.agents/skills/build-openshell-mxc-windows/reference.md +++ b/.agents/skills/build-openshell-mxc-windows/reference.md @@ -9,7 +9,7 @@ maintaining the existing build-only Windows MSVC lane. |---|---| | `tasks/windows.toml` | Mise task definitions for `windows:*`. | | `tasks/scripts/windows-msvc.ps1` | Visual Studio environment discovery, rustup target setup, Cargo invocation, logs, artifact report. | -| `.github/workflows/windows-msvc.yml` | PR/merge-queue x64 lint and test, main/manual cache seeding followed by binary builds, and opt-in hosted ARM64 validation with architecture-specific Rust caches. | +| `.github/workflows/windows-msvc.yml` | PR/merge-queue x64 lint and test plus main/manual cache seeding followed by x64 binary builds. ARM64 remains local-only until it gets a native workflow. | | `architecture/windows-msvc-build.md` | Human-readable design contract. | ## Commands diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index fc4c97bfb0..45abac5c67 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -159,46 +159,3 @@ jobs: - name: sccache stats if: always() run: sccache --show-stats - - arm64: - # Keep native ARM64 validation opt-in until its runtime and cost are measured. - needs: pr_metadata - runs-on: windows-11-arm - if: vars.ENABLE_WINDOWS_ARM64 == 'true' - env: - READ_ONLY_GITHUB_TOKEN: ${{ github.token }} - SCCACHE_GHA_ENABLED: "true" - SCCACHE_GHA_VERSION: windows-msvc-arm64-prebuilt-z3-v2 - SCCACHE_CLIENT_SIDE: "1" - SCCACHE_BASEDIRS: ${{ github.workspace }} - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 - with: - install: false - experimental: true - - name: Configure GHA sccache backend - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - - uses: dtolnay/rust-toolchain@master - with: - toolchain: "1.95.0" - targets: aarch64-pc-windows-msvc - - name: Cache Rust target and registry - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - env: - # Keep rust-cache's cargo metadata calls independent of the compiler - # wrapper; build steps still inherit sccache from the job. - RUSTC_WRAPPER: "" - with: - shared-key: windows-msvc-arm64-prebuilt-z3-v1 - cache-targets: "true" - cache-on-failure: "true" - cache-bin: "false" - - name: Check - run: mise run --skip-tools windows:check:arm64 - - name: Build release binaries - if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' - run: mise run --skip-tools windows:build:arm64 - - name: sccache stats - if: always() - run: sccache --show-stats diff --git a/architecture/windows-msvc-build.md b/architecture/windows-msvc-build.md index 81645c46e0..80296e439e 100644 --- a/architecture/windows-msvc-build.md +++ b/architecture/windows-msvc-build.md @@ -159,19 +159,16 @@ The server test-support suite includes the unsupported-driver contract test, so CI does not run the focused test task a second time. The focused task remains available for local diagnosis. -The cache is partitioned by architecture so incompatible x64 and ARM64 target -artifacts cannot collide. It does not cache Cargo-installed binaries, which -also keeps the disabled self-hosted ARM64 scaffold from modifying persistent -runner tooling. +The hosted workflow uses an x64-specific cache namespace and does not cache +Cargo-installed binaries. The local aggregate `windows:ci` task cross-builds ARM64 on an x64 host. The GitHub x64 job runs only the x64 tasks, and native ARM64 tests remain exclusive to an ARM64 runner. -The ARM64 job uses the hosted `windows-11-arm` runner but remains disabled -unless the repository variable `ENABLE_WINDOWS_ARM64` is set to `true`. Before -enabling it, measure the native runner and extend it to follow the same -lint/test seed and dependent-build split as x64. +GitHub Actions currently runs only x64. ARM64 remains available through the +local `windows:*:arm64` tasks and requires a separate native workflow when the +project is ready to enable hosted ARM64 validation. ## Validation Contract From 84a69910e0f6407d33c1362ca6edff44fe214a5e Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 16:45:08 -0700 Subject: [PATCH 13/25] fix(ci): install Clippy for Windows validation Signed-off-by: Piotr Mlocek --- .github/workflows/windows-msvc.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index 45abac5c67..f3ac980f82 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -61,6 +61,7 @@ jobs: with: toolchain: "1.95.0" targets: x86_64-pc-windows-msvc + components: clippy - name: Cache Rust target and registry uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 env: @@ -106,6 +107,7 @@ jobs: with: toolchain: "1.95.0" targets: x86_64-pc-windows-msvc + components: clippy - name: Cache Rust target and registry uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 env: From d479bf2387b16a3a6712af63873b303d0bb0c8fe Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 17:01:23 -0700 Subject: [PATCH 14/25] ci(windows): focus platform lint coverage Signed-off-by: Piotr Mlocek --- .../build-openshell-mxc-windows/SKILL.md | 10 ++++---- .../build-openshell-mxc-windows/reference.md | 2 +- .github/workflows/windows-msvc.yml | 24 +++++++++++++++---- architecture/windows-msvc-build.md | 13 +++++----- deny.toml | 1 + 5 files changed, 34 insertions(+), 16 deletions(-) diff --git a/.agents/skills/build-openshell-mxc-windows/SKILL.md b/.agents/skills/build-openshell-mxc-windows/SKILL.md index 9c62488577..c155f79913 100644 --- a/.agents/skills/build-openshell-mxc-windows/SKILL.md +++ b/.agents/skills/build-openshell-mxc-windows/SKILL.md @@ -191,11 +191,11 @@ order: The GitHub Actions jobs layer architecture-specific `Swatinem/rust-cache` entries for Cargo registry and dependency target artifacts with sccache's GHA backend for cacheable Rust compiler outputs. Failed runs also save their usable -dependency artifacts. Pull-request mirrors and merge queues run Windows Clippy -and Rust tests. Pushes to `main` and manual dispatches run the same lint and -test commands in a cache-seed job, followed by a dependent release-binary build -job. The seed and PR jobs use the same cache namespaces. The binaries are not -uploaded or published. +dependency artifacts. Pull-request mirrors and merge queues run Clippy for the +Windows-sensitive sandbox, core, and CLI crates plus Rust tests. Pushes to +`main` and manual dispatches run the same lint and test commands in a cache-seed +job, followed by a dependent release-binary build job. The seed and PR jobs use +the same cache namespaces. The binaries are not uploaded or published. The ARM64 check/build steps in this x64-host contract are cross-builds. The wrapper discovers and adds host-native LLVM and Ninja to `PATH`, requires the diff --git a/.agents/skills/build-openshell-mxc-windows/reference.md b/.agents/skills/build-openshell-mxc-windows/reference.md index e17e0005a3..b798c071f7 100644 --- a/.agents/skills/build-openshell-mxc-windows/reference.md +++ b/.agents/skills/build-openshell-mxc-windows/reference.md @@ -9,7 +9,7 @@ maintaining the existing build-only Windows MSVC lane. |---|---| | `tasks/windows.toml` | Mise task definitions for `windows:*`. | | `tasks/scripts/windows-msvc.ps1` | Visual Studio environment discovery, rustup target setup, Cargo invocation, logs, artifact report. | -| `.github/workflows/windows-msvc.yml` | PR/merge-queue x64 lint and test plus main/manual cache seeding followed by x64 binary builds. ARM64 remains local-only until it gets a native workflow. | +| `.github/workflows/windows-msvc.yml` | PR/merge-queue lint for Windows-sensitive crates and x64 tests plus identical main/manual cache seeding followed by x64 binary builds. ARM64 remains local-only until it gets a native workflow. | | `architecture/windows-msvc-build.md` | Human-readable design contract. | ## Commands diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index f3ac980f82..e2650d28f1 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -74,8 +74,16 @@ jobs: cache-targets: "true" cache-on-failure: "true" cache-bin: "false" - - name: Lint - run: mise run --skip-tools rust:lint + - name: Lint Windows-sensitive crates + # Formatting is target-independent and already checked by the Linux jobs. + # Keep this guard focused on Windows cfgs, matching the macOS lane. + run: >- + cargo clippy + -p openshell-sandbox + -p openshell-core + -p openshell-cli + --all-targets + -- -D warnings - name: Test run: mise run --skip-tools test:rust - name: sccache stats @@ -117,8 +125,16 @@ jobs: cache-targets: "true" cache-on-failure: "true" cache-bin: "false" - - name: Lint - run: mise run --skip-tools rust:lint + - name: Lint Windows-sensitive crates + # Keep the seed workload identical to the pull-request workload so its + # target and compiler caches are reusable by subsequent pull requests. + run: >- + cargo clippy + -p openshell-sandbox + -p openshell-core + -p openshell-cli + --all-targets + -- -D warnings - name: Test run: mise run --skip-tools test:rust - name: sccache stats diff --git a/architecture/windows-msvc-build.md b/architecture/windows-msvc-build.md index 80296e439e..b6ba8ef6af 100644 --- a/architecture/windows-msvc-build.md +++ b/architecture/windows-msvc-build.md @@ -54,11 +54,12 @@ creating misleading Windows driver artifacts. ## Mise Lane -The GitHub Actions workflow runs x64 Windows Clippy and Rust tests for -pull-request mirror branches and merge queues. On pushes to `main`, a cache-seed -job runs the same lint and test commands before a dependent job builds the -release binaries. Manual dispatches exercise the same seed-then-build path. -The binaries remain CI validation artifacts and are not uploaded or published. +The GitHub Actions workflow runs Clippy for the Windows-sensitive sandbox, +core, and CLI crates plus Rust tests for pull-request mirror branches and merge +queues. On pushes to `main`, a cache-seed job runs the same lint and test +commands before a dependent job builds the release binaries. Manual dispatches +exercise the same seed-then-build path. The binaries remain CI validation +artifacts and are not uploaded or published. Each job restores and saves a dedicated Rust cache containing the Cargo registry and dependency build artifacts, including artifacts from failed runs. @@ -144,7 +145,7 @@ The x64 GitHub Actions jobs run on `windows-2025`. Pull-request mirrors and merge queues execute: ```powershell -mise run --skip-tools rust:lint +cargo clippy -p openshell-sandbox -p openshell-core -p openshell-cli --all-targets -- -D warnings mise run --skip-tools test:rust ``` diff --git a/deny.toml b/deny.toml index c4dab12334..3f0cf87ba8 100644 --- a/deny.toml +++ b/deny.toml @@ -41,6 +41,7 @@ allow = [ "BSD-2-Clause", "BSD-3-Clause", "BSL-1.0", + "bzip2-1.0.6", "ISC", "Zlib", "0BSD", From 03bc040a9d94a23ce71795ceab8b8d1b4e7983d8 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 17:05:28 -0700 Subject: [PATCH 15/25] docs(licenses): explain bzip2 allowance Signed-off-by: Piotr Mlocek --- deny.toml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/deny.toml b/deny.toml index 3f0cf87ba8..0a8de7976b 100644 --- a/deny.toml +++ b/deny.toml @@ -41,6 +41,8 @@ allow = [ "BSD-2-Clause", "BSD-3-Clause", "BSL-1.0", + # Permissive, non-copyleft license pulled in by the prebuilt Z3 archive + # path (z3-sys -> zip -> bzip2); compatible with this Apache-2.0 project. "bzip2-1.0.6", "ISC", "Zlib", From 4f826d3ef7688fce33a19e5fc427941f1cf842bd Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 17:07:54 -0700 Subject: [PATCH 16/25] ci(windows): simplify workflow name Signed-off-by: Piotr Mlocek --- .github/workflows/windows-msvc.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index e2650d28f1..e709bf2c00 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -1,4 +1,4 @@ -name: Windows MSVC (build-only) +name: Windows MSVC on: merge_group: From 7627759bae9a2a0cc799bc92e080634b349e5996 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 17:14:58 -0700 Subject: [PATCH 17/25] fix(windows): allow async platform stub Signed-off-by: Piotr Mlocek --- crates/openshell-bootstrap/src/build_windows.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/openshell-bootstrap/src/build_windows.rs b/crates/openshell-bootstrap/src/build_windows.rs index 93af1345d3..0be12cd82c 100644 --- a/crates/openshell-bootstrap/src/build_windows.rs +++ b/crates/openshell-bootstrap/src/build_windows.rs @@ -9,7 +9,7 @@ use std::path::Path; use miette::Result; // Keep this stub's signature aligned with the supported-platform implementation. -#[allow(clippy::implicit_hasher)] +#[allow(clippy::implicit_hasher, clippy::unused_async)] pub async fn build_local_image( _dockerfile_path: &Path, _tag: &str, From 1e3d897b11aa42126dec43a15533ee2b6300e94d Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 17:22:44 -0700 Subject: [PATCH 18/25] fix(network): make file fingerprints portable Signed-off-by: Piotr Mlocek --- .../src/identity.rs | 38 +++++++++---------- 1 file changed, 17 insertions(+), 21 deletions(-) diff --git a/crates/openshell-supervisor-network/src/identity.rs b/crates/openshell-supervisor-network/src/identity.rs index 5e89c35031..0861f0096c 100644 --- a/crates/openshell-supervisor-network/src/identity.rs +++ b/crates/openshell-supervisor-network/src/identity.rs @@ -18,55 +18,51 @@ use std::path::{Path, PathBuf}; use std::sync::Mutex; use tracing::debug; -#[derive(Clone)] +#[derive(Clone, PartialEq)] struct FileFingerprint { len: u64, + #[cfg(unix)] mtime_sec: i64, + #[cfg(unix)] mtime_nsec: i64, + #[cfg(unix)] ctime_sec: i64, + #[cfg(unix)] ctime_nsec: i64, #[cfg(unix)] dev: u64, #[cfg(unix)] ino: u64, + #[cfg(not(unix))] + modified: Option, + #[cfg(not(unix))] + created: Option, } impl FileFingerprint { fn from_metadata(metadata: &Metadata) -> Self { Self { len: metadata.len(), + #[cfg(unix)] mtime_sec: metadata.mtime(), + #[cfg(unix)] mtime_nsec: metadata.mtime_nsec(), + #[cfg(unix)] ctime_sec: metadata.ctime(), + #[cfg(unix)] ctime_nsec: metadata.ctime_nsec(), #[cfg(unix)] dev: metadata.dev(), #[cfg(unix)] ino: metadata.ino(), + #[cfg(not(unix))] + modified: metadata.modified().ok(), + #[cfg(not(unix))] + created: metadata.created().ok(), } } } -impl PartialEq for FileFingerprint { - fn eq(&self, other: &Self) -> bool { - self.len == other.len - && self.mtime_sec == other.mtime_sec - && self.mtime_nsec == other.mtime_nsec - && self.ctime_sec == other.ctime_sec - && self.ctime_nsec == other.ctime_nsec - && { - #[cfg(unix)] - { - self.dev == other.dev && self.ino == other.ino - } - #[cfg(not(unix))] - { - true - } - } - } -} - #[derive(Clone)] struct CachedBinary { hash: String, From dc6a4716fd0a40f3cffdd55962e66998a109e7d7 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 17:28:45 -0700 Subject: [PATCH 19/25] ci(windows): lint supported deliverables Signed-off-by: Piotr Mlocek --- .../build-openshell-mxc-windows/SKILL.md | 8 ++-- .../build-openshell-mxc-windows/reference.md | 2 +- .github/workflows/windows-msvc.yml | 10 +++-- architecture/windows-msvc-build.md | 14 +++---- .../openshell-bootstrap/src/build_windows.rs | 2 +- .../src/identity.rs | 38 ++++++++++--------- 6 files changed, 41 insertions(+), 33 deletions(-) diff --git a/.agents/skills/build-openshell-mxc-windows/SKILL.md b/.agents/skills/build-openshell-mxc-windows/SKILL.md index c155f79913..1fd8d4323a 100644 --- a/.agents/skills/build-openshell-mxc-windows/SKILL.md +++ b/.agents/skills/build-openshell-mxc-windows/SKILL.md @@ -192,10 +192,10 @@ The GitHub Actions jobs layer architecture-specific `Swatinem/rust-cache` entries for Cargo registry and dependency target artifacts with sccache's GHA backend for cacheable Rust compiler outputs. Failed runs also save their usable dependency artifacts. Pull-request mirrors and merge queues run Clippy for the -Windows-sensitive sandbox, core, and CLI crates plus Rust tests. Pushes to -`main` and manual dispatches run the same lint and test commands in a cache-seed -job, followed by a dependent release-binary build job. The seed and PR jobs use -the same cache namespaces. The binaries are not uploaded or published. +Windows gateway, core, and CLI crates plus Rust tests. Pushes to `main` and +manual dispatches run the same lint and test commands in a cache-seed job, +followed by a dependent release-binary build job. The seed and PR jobs use the +same cache namespaces. The binaries are not uploaded or published. The ARM64 check/build steps in this x64-host contract are cross-builds. The wrapper discovers and adds host-native LLVM and Ninja to `PATH`, requires the diff --git a/.agents/skills/build-openshell-mxc-windows/reference.md b/.agents/skills/build-openshell-mxc-windows/reference.md index b798c071f7..f2979fa19b 100644 --- a/.agents/skills/build-openshell-mxc-windows/reference.md +++ b/.agents/skills/build-openshell-mxc-windows/reference.md @@ -9,7 +9,7 @@ maintaining the existing build-only Windows MSVC lane. |---|---| | `tasks/windows.toml` | Mise task definitions for `windows:*`. | | `tasks/scripts/windows-msvc.ps1` | Visual Studio environment discovery, rustup target setup, Cargo invocation, logs, artifact report. | -| `.github/workflows/windows-msvc.yml` | PR/merge-queue lint for Windows-sensitive crates and x64 tests plus identical main/manual cache seeding followed by x64 binary builds. ARM64 remains local-only until it gets a native workflow. | +| `.github/workflows/windows-msvc.yml` | PR/merge-queue lint for the Windows gateway, core, and CLI crates plus x64 tests; main/manual runs seed the same caches before x64 binary builds. ARM64 remains local-only until it gets a native workflow. | | `architecture/windows-msvc-build.md` | Human-readable design contract. | ## Commands diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index e709bf2c00..f4d3543a35 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -76,13 +76,15 @@ jobs: cache-bin: "false" - name: Lint Windows-sensitive crates # Formatting is target-independent and already checked by the Linux jobs. - # Keep this guard focused on Windows cfgs, matching the macOS lane. + # Keep this guard focused on the gateway and CLI deliverables plus core. run: >- cargo clippy - -p openshell-sandbox + -p openshell-server -p openshell-core -p openshell-cli --all-targets + --no-deps + --features openshell-prover/prebuilt-z3 -- -D warnings - name: Test run: mise run --skip-tools test:rust @@ -130,10 +132,12 @@ jobs: # target and compiler caches are reusable by subsequent pull requests. run: >- cargo clippy - -p openshell-sandbox + -p openshell-server -p openshell-core -p openshell-cli --all-targets + --no-deps + --features openshell-prover/prebuilt-z3 -- -D warnings - name: Test run: mise run --skip-tools test:rust diff --git a/architecture/windows-msvc-build.md b/architecture/windows-msvc-build.md index b6ba8ef6af..1eec6316be 100644 --- a/architecture/windows-msvc-build.md +++ b/architecture/windows-msvc-build.md @@ -54,12 +54,12 @@ creating misleading Windows driver artifacts. ## Mise Lane -The GitHub Actions workflow runs Clippy for the Windows-sensitive sandbox, -core, and CLI crates plus Rust tests for pull-request mirror branches and merge -queues. On pushes to `main`, a cache-seed job runs the same lint and test -commands before a dependent job builds the release binaries. Manual dispatches -exercise the same seed-then-build path. The binaries remain CI validation -artifacts and are not uploaded or published. +The GitHub Actions workflow runs Clippy for the Windows gateway, core, and CLI +crates plus Rust tests for pull-request mirror branches and merge queues. On +pushes to `main`, a cache-seed job runs the same lint and test commands before a +dependent job builds the release binaries. Manual dispatches exercise the same +seed-then-build path. The binaries remain CI validation artifacts and are not +uploaded or published. Each job restores and saves a dedicated Rust cache containing the Cargo registry and dependency build artifacts, including artifacts from failed runs. @@ -145,7 +145,7 @@ The x64 GitHub Actions jobs run on `windows-2025`. Pull-request mirrors and merge queues execute: ```powershell -cargo clippy -p openshell-sandbox -p openshell-core -p openshell-cli --all-targets -- -D warnings +cargo clippy -p openshell-server -p openshell-core -p openshell-cli --all-targets --no-deps --features openshell-prover/prebuilt-z3 -- -D warnings mise run --skip-tools test:rust ``` diff --git a/crates/openshell-bootstrap/src/build_windows.rs b/crates/openshell-bootstrap/src/build_windows.rs index 0be12cd82c..93af1345d3 100644 --- a/crates/openshell-bootstrap/src/build_windows.rs +++ b/crates/openshell-bootstrap/src/build_windows.rs @@ -9,7 +9,7 @@ use std::path::Path; use miette::Result; // Keep this stub's signature aligned with the supported-platform implementation. -#[allow(clippy::implicit_hasher, clippy::unused_async)] +#[allow(clippy::implicit_hasher)] pub async fn build_local_image( _dockerfile_path: &Path, _tag: &str, diff --git a/crates/openshell-supervisor-network/src/identity.rs b/crates/openshell-supervisor-network/src/identity.rs index 0861f0096c..5e89c35031 100644 --- a/crates/openshell-supervisor-network/src/identity.rs +++ b/crates/openshell-supervisor-network/src/identity.rs @@ -18,51 +18,55 @@ use std::path::{Path, PathBuf}; use std::sync::Mutex; use tracing::debug; -#[derive(Clone, PartialEq)] +#[derive(Clone)] struct FileFingerprint { len: u64, - #[cfg(unix)] mtime_sec: i64, - #[cfg(unix)] mtime_nsec: i64, - #[cfg(unix)] ctime_sec: i64, - #[cfg(unix)] ctime_nsec: i64, #[cfg(unix)] dev: u64, #[cfg(unix)] ino: u64, - #[cfg(not(unix))] - modified: Option, - #[cfg(not(unix))] - created: Option, } impl FileFingerprint { fn from_metadata(metadata: &Metadata) -> Self { Self { len: metadata.len(), - #[cfg(unix)] mtime_sec: metadata.mtime(), - #[cfg(unix)] mtime_nsec: metadata.mtime_nsec(), - #[cfg(unix)] ctime_sec: metadata.ctime(), - #[cfg(unix)] ctime_nsec: metadata.ctime_nsec(), #[cfg(unix)] dev: metadata.dev(), #[cfg(unix)] ino: metadata.ino(), - #[cfg(not(unix))] - modified: metadata.modified().ok(), - #[cfg(not(unix))] - created: metadata.created().ok(), } } } +impl PartialEq for FileFingerprint { + fn eq(&self, other: &Self) -> bool { + self.len == other.len + && self.mtime_sec == other.mtime_sec + && self.mtime_nsec == other.mtime_nsec + && self.ctime_sec == other.ctime_sec + && self.ctime_nsec == other.ctime_nsec + && { + #[cfg(unix)] + { + self.dev == other.dev && self.ino == other.ino + } + #[cfg(not(unix))] + { + true + } + } + } +} + #[derive(Clone)] struct CachedBinary { hash: String, From e982628388f77e07833e315c574e9f254ec987bb Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Thu, 13 Aug 2026 17:40:08 -0700 Subject: [PATCH 20/25] ci(windows): allow platform-gated lint Signed-off-by: Piotr Mlocek --- .github/workflows/windows-msvc.yml | 4 ++-- architecture/windows-msvc-build.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index f4d3543a35..149ade26e7 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -85,7 +85,7 @@ jobs: --all-targets --no-deps --features openshell-prover/prebuilt-z3 - -- -D warnings + -- -D warnings -A dead-code -A unused-imports -A clippy::unused-async - name: Test run: mise run --skip-tools test:rust - name: sccache stats @@ -138,7 +138,7 @@ jobs: --all-targets --no-deps --features openshell-prover/prebuilt-z3 - -- -D warnings + -- -D warnings -A dead-code -A unused-imports -A clippy::unused-async - name: Test run: mise run --skip-tools test:rust - name: sccache stats diff --git a/architecture/windows-msvc-build.md b/architecture/windows-msvc-build.md index 1eec6316be..f5701e4962 100644 --- a/architecture/windows-msvc-build.md +++ b/architecture/windows-msvc-build.md @@ -145,7 +145,7 @@ The x64 GitHub Actions jobs run on `windows-2025`. Pull-request mirrors and merge queues execute: ```powershell -cargo clippy -p openshell-server -p openshell-core -p openshell-cli --all-targets --no-deps --features openshell-prover/prebuilt-z3 -- -D warnings +cargo clippy -p openshell-server -p openshell-core -p openshell-cli --all-targets --no-deps --features openshell-prover/prebuilt-z3 -- -D warnings -A dead-code -A unused-imports -A clippy::unused-async mise run --skip-tools test:rust ``` From 0ec78d9c5e69e1ae8b6a8c43782aca9465b689b2 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Tue, 18 Aug 2026 16:34:34 -0700 Subject: [PATCH 21/25] chore(ci): align Windows cache action with main Signed-off-by: Piotr Mlocek --- .github/workflows/windows-msvc.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index 149ade26e7..bc20b1ab76 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -119,7 +119,7 @@ jobs: targets: x86_64-pc-windows-msvc components: clippy - name: Cache Rust target and registry - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 env: RUSTC_WRAPPER: "" with: @@ -168,7 +168,7 @@ jobs: toolchain: "1.95.0" targets: x86_64-pc-windows-msvc - name: Cache Rust target and registry - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 env: RUSTC_WRAPPER: "" with: From c80a5ad2debf1fabeabe1684779ddc206aad4ccb Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Tue, 1 Sep 2026 16:03:03 -0700 Subject: [PATCH 22/25] fix(ci): align Windows validation with prerequisites Signed-off-by: Piotr Mlocek --- .../build-openshell-mxc-windows/SKILL.md | 2 +- .../build-openshell-mxc-windows/reference.md | 2 +- .github/workflows/windows-msvc.yml | 32 +++++-------------- architecture/windows-msvc-build.md | 6 ++-- 4 files changed, 13 insertions(+), 29 deletions(-) diff --git a/.agents/skills/build-openshell-mxc-windows/SKILL.md b/.agents/skills/build-openshell-mxc-windows/SKILL.md index 1fd8d4323a..cf12156056 100644 --- a/.agents/skills/build-openshell-mxc-windows/SKILL.md +++ b/.agents/skills/build-openshell-mxc-windows/SKILL.md @@ -192,7 +192,7 @@ The GitHub Actions jobs layer architecture-specific `Swatinem/rust-cache` entries for Cargo registry and dependency target artifacts with sccache's GHA backend for cacheable Rust compiler outputs. Failed runs also save their usable dependency artifacts. Pull-request mirrors and merge queues run Clippy for the -Windows gateway, core, and CLI crates plus Rust tests. Pushes to `main` and +Windows-supported workspace and e2e crates plus Rust tests. Pushes to `main` and manual dispatches run the same lint and test commands in a cache-seed job, followed by a dependent release-binary build job. The seed and PR jobs use the same cache namespaces. The binaries are not uploaded or published. diff --git a/.agents/skills/build-openshell-mxc-windows/reference.md b/.agents/skills/build-openshell-mxc-windows/reference.md index f2979fa19b..b442d8f5b1 100644 --- a/.agents/skills/build-openshell-mxc-windows/reference.md +++ b/.agents/skills/build-openshell-mxc-windows/reference.md @@ -9,7 +9,7 @@ maintaining the existing build-only Windows MSVC lane. |---|---| | `tasks/windows.toml` | Mise task definitions for `windows:*`. | | `tasks/scripts/windows-msvc.ps1` | Visual Studio environment discovery, rustup target setup, Cargo invocation, logs, artifact report. | -| `.github/workflows/windows-msvc.yml` | PR/merge-queue lint for the Windows gateway, core, and CLI crates plus x64 tests; main/manual runs seed the same caches before x64 binary builds. ARM64 remains local-only until it gets a native workflow. | +| `.github/workflows/windows-msvc.yml` | PR/merge-queue lint for the Windows-supported workspace and e2e crates plus x64 tests; main/manual runs seed the same caches before x64 binary builds. ARM64 remains local-only until it gets a native workflow. | | `architecture/windows-msvc-build.md` | Human-readable design contract. | ## Commands diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index bc20b1ab76..bffb1850d3 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -74,18 +74,10 @@ jobs: cache-targets: "true" cache-on-failure: "true" cache-bin: "false" - - name: Lint Windows-sensitive crates - # Formatting is target-independent and already checked by the Linux jobs. - # Keep this guard focused on the gateway and CLI deliverables plus core. - run: >- - cargo clippy - -p openshell-server - -p openshell-core - -p openshell-cli - --all-targets - --no-deps - --features openshell-prover/prebuilt-z3 - -- -D warnings -A dead-code -A unused-imports -A clippy::unused-async + - name: Lint Windows-supported crates + # rust:lint enters the native MSVC environment and excludes only the + # runtime packages that Windows does not support. + run: mise run --skip-tools rust:lint - name: Test run: mise run --skip-tools test:rust - name: sccache stats @@ -107,7 +99,7 @@ jobs: SCCACHE_BASEDIRS: ${{ github.workspace }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: install: false experimental: true @@ -127,18 +119,10 @@ jobs: cache-targets: "true" cache-on-failure: "true" cache-bin: "false" - - name: Lint Windows-sensitive crates + - name: Lint Windows-supported crates # Keep the seed workload identical to the pull-request workload so its # target and compiler caches are reusable by subsequent pull requests. - run: >- - cargo clippy - -p openshell-server - -p openshell-core - -p openshell-cli - --all-targets - --no-deps - --features openshell-prover/prebuilt-z3 - -- -D warnings -A dead-code -A unused-imports -A clippy::unused-async + run: mise run --skip-tools rust:lint - name: Test run: mise run --skip-tools test:rust - name: sccache stats @@ -157,7 +141,7 @@ jobs: SCCACHE_BASEDIRS: ${{ github.workspace }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: install: false experimental: true diff --git a/architecture/windows-msvc-build.md b/architecture/windows-msvc-build.md index f5701e4962..30d9037449 100644 --- a/architecture/windows-msvc-build.md +++ b/architecture/windows-msvc-build.md @@ -54,8 +54,8 @@ creating misleading Windows driver artifacts. ## Mise Lane -The GitHub Actions workflow runs Clippy for the Windows gateway, core, and CLI -crates plus Rust tests for pull-request mirror branches and merge queues. On +The GitHub Actions workflow runs Clippy for the Windows-supported workspace and +e2e crates plus Rust tests for pull-request mirror branches and merge queues. On pushes to `main`, a cache-seed job runs the same lint and test commands before a dependent job builds the release binaries. Manual dispatches exercise the same seed-then-build path. The binaries remain CI validation artifacts and are not @@ -145,7 +145,7 @@ The x64 GitHub Actions jobs run on `windows-2025`. Pull-request mirrors and merge queues execute: ```powershell -cargo clippy -p openshell-server -p openshell-core -p openshell-cli --all-targets --no-deps --features openshell-prover/prebuilt-z3 -- -D warnings -A dead-code -A unused-imports -A clippy::unused-async +mise run --skip-tools rust:lint mise run --skip-tools test:rust ``` From 5dd3496ac46a25c13130ad289479af3bb50ed8cf Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Tue, 1 Sep 2026 16:05:53 -0700 Subject: [PATCH 23/25] ci(windows): pin Rust toolchain action Signed-off-by: Piotr Mlocek --- .github/workflows/windows-msvc.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index bffb1850d3..e78c6c77f1 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -57,7 +57,7 @@ jobs: experimental: true - name: Configure GHA sccache backend uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - - uses: dtolnay/rust-toolchain@master + - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master with: toolchain: "1.95.0" targets: x86_64-pc-windows-msvc @@ -105,7 +105,7 @@ jobs: experimental: true - name: Configure GHA sccache backend uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - - uses: dtolnay/rust-toolchain@master + - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master with: toolchain: "1.95.0" targets: x86_64-pc-windows-msvc @@ -147,7 +147,7 @@ jobs: experimental: true - name: Configure GHA sccache backend uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - - uses: dtolnay/rust-toolchain@master + - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master with: toolchain: "1.95.0" targets: x86_64-pc-windows-msvc From 822f29137eec4d5fe27fb2f38318d5a371880c04 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Tue, 1 Sep 2026 16:30:41 -0700 Subject: [PATCH 24/25] fix(ci): use enterprise-approved Windows actions Signed-off-by: Piotr Mlocek --- .github/workflows/windows-msvc.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index e78c6c77f1..7f48b70250 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -51,13 +51,13 @@ jobs: SCCACHE_BASEDIRS: ${{ github.workspace }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 with: install: false experimental: true - name: Configure GHA sccache backend uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master + - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable with: toolchain: "1.95.0" targets: x86_64-pc-windows-msvc @@ -99,13 +99,13 @@ jobs: SCCACHE_BASEDIRS: ${{ github.workspace }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 with: install: false experimental: true - name: Configure GHA sccache backend uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master + - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable with: toolchain: "1.95.0" targets: x86_64-pc-windows-msvc @@ -141,13 +141,13 @@ jobs: SCCACHE_BASEDIRS: ${{ github.workspace }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 with: install: false experimental: true - name: Configure GHA sccache backend uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master + - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable with: toolchain: "1.95.0" targets: x86_64-pc-windows-msvc From 5ece42d86dcc1bca8c9dc7dabbab79ea3c0cf49c Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Tue, 1 Sep 2026 18:20:09 -0700 Subject: [PATCH 25/25] fix(windows): restore strict MSVC validation Signed-off-by: Piotr Mlocek --- crates/openshell-driver-mxc/src/driver.rs | 6 ++-- crates/openshell-driver-mxc/src/grpc.rs | 40 +++++++++++++++++----- crates/openshell-server/src/config_file.rs | 4 +-- 3 files changed, 37 insertions(+), 13 deletions(-) diff --git a/crates/openshell-driver-mxc/src/driver.rs b/crates/openshell-driver-mxc/src/driver.rs index 1ded7130c4..1f248d2d18 100644 --- a/crates/openshell-driver-mxc/src/driver.rs +++ b/crates/openshell-driver-mxc/src/driver.rs @@ -294,7 +294,7 @@ impl MxcComputeBackend { } } - fn validate_sandbox_fields(&self, sandbox: &DriverSandbox) -> Result<(), tonic::Status> { + fn validate_sandbox_fields(sandbox: &DriverSandbox) -> Result<(), tonic::Status> { if let Some(spec) = &sandbox.spec { if effective_driver_gpu_count(driver_gpu_requirements( spec.resource_requirements.as_ref(), @@ -335,7 +335,7 @@ impl MxcComputeBackend { } pub fn validate_sandbox_create(&self, sandbox: &DriverSandbox) -> Result<(), tonic::Status> { - self.validate_sandbox_fields(sandbox)?; + Self::validate_sandbox_fields(sandbox)?; let policy = sandbox.spec.as_ref().and_then(|spec| spec.policy.as_ref()); self.map_sandbox_policy(&sandbox.id, policy)?; Ok(()) @@ -356,7 +356,7 @@ impl MxcComputeBackend { pub async fn create_sandbox(&self, sandbox: &DriverSandbox) -> Result<(), tonic::Status> { let sandbox_id = sandbox.id.clone(); - self.validate_sandbox_fields(sandbox)?; + Self::validate_sandbox_fields(sandbox)?; let sandbox_config = sandbox_config(sandbox)?; // Policy translation is deterministic and side-effect free. Do it before diff --git a/crates/openshell-driver-mxc/src/grpc.rs b/crates/openshell-driver-mxc/src/grpc.rs index 0fa23f7ac9..1dc66f9dda 100644 --- a/crates/openshell-driver-mxc/src/grpc.rs +++ b/crates/openshell-driver-mxc/src/grpc.rs @@ -9,14 +9,15 @@ use crate::driver::MxcComputeBackend; use futures::{Stream, StreamExt}; use openshell_core::proto::compute::v1::{ - CreateSandboxRequest, CreateSandboxResponse, DeleteSandboxRequest, DeleteSandboxResponse, - DeleteWorkspaceRequest, DeleteWorkspaceResponse, EnsureWorkspaceRequest, - EnsureWorkspaceResponse, GetCapabilitiesRequest, GetCapabilitiesResponse, - GetGatewayListenerRequirementsRequest, GetGatewayListenerRequirementsResponse, - GetSandboxRequest, GetSandboxResponse, ListSandboxesRequest, ListSandboxesResponse, - StartSandboxRequest, StartSandboxResponse, StopSandboxRequest, StopSandboxResponse, - ValidateSandboxCreateRequest, ValidateSandboxCreateResponse, WatchSandboxesEvent, - WatchSandboxesRequest, compute_driver_server::ComputeDriver, + AuthenticateSandboxRequest, AuthenticateSandboxResponse, CreateSandboxRequest, + CreateSandboxResponse, DeleteSandboxRequest, DeleteSandboxResponse, DeleteWorkspaceRequest, + DeleteWorkspaceResponse, EnsureWorkspaceRequest, EnsureWorkspaceResponse, + GetCapabilitiesRequest, GetCapabilitiesResponse, GetGatewayListenerRequirementsRequest, + GetGatewayListenerRequirementsResponse, GetSandboxRequest, GetSandboxResponse, + ListSandboxesRequest, ListSandboxesResponse, StartSandboxRequest, StartSandboxResponse, + StopSandboxRequest, StopSandboxResponse, ValidateSandboxCreateRequest, + ValidateSandboxCreateResponse, WatchSandboxesEvent, WatchSandboxesRequest, + compute_driver_server::ComputeDriver, }; use std::pin::Pin; use tonic::{Request, Response, Status}; @@ -34,6 +35,15 @@ impl ComputeDriverService { #[tonic::async_trait] impl ComputeDriver for ComputeDriverService { + async fn authenticate_sandbox( + &self, + _request: Request, + ) -> Result, Status> { + Err(Status::unimplemented( + "MXC driver does not authenticate sandbox credentials", + )) + } + async fn get_capabilities( &self, _request: Request, @@ -192,6 +202,20 @@ mod tests { assert!(error.message().contains("does not support restarting")); } + #[tokio::test] + async fn sandbox_authentication_is_not_supported() { + let service = + ComputeDriverService::new(MxcComputeBackend::new(MxcComputeConfig::default())); + + let error = service + .authenticate_sandbox(Request::new(AuthenticateSandboxRequest::default())) + .await + .expect_err("MXC must not advertise sandbox credential authentication"); + + assert_eq!(error.code(), tonic::Code::Unimplemented); + assert!(error.message().contains("does not authenticate")); + } + #[tokio::test] async fn workspace_lifecycle_is_an_idempotent_no_op() { let service = diff --git a/crates/openshell-server/src/config_file.rs b/crates/openshell-server/src/config_file.rs index 65709748b1..ef6f9a3f37 100644 --- a/crates/openshell-server/src/config_file.rs +++ b/crates/openshell-server/src/config_file.rs @@ -332,7 +332,7 @@ pub enum ConfigFileError { Parse { path: PathBuf, #[source] - source: toml::de::Error, + source: Box, }, #[error( "unsupported gateway config version {version}; this build only supports version {SCHEMA_VERSION}" @@ -387,7 +387,7 @@ pub fn load(path: &Path) -> Result { } let file: ConfigFile = toml::from_str(&contents).map_err(|source| ConfigFileError::Parse { path: path.to_path_buf(), - source, + source: Box::new(source), })?; if let Some(version) = file.openshell.version