From 39f559e37065d83f7f0888daacfc0243219b0fea Mon Sep 17 00:00:00 2001 From: cppbear Date: Fri, 9 Oct 2026 01:12:19 +0800 Subject: [PATCH 1/3] ci: check Docker builds and tool installation on relevant changes --- .github/workflows/docker.yml | 90 ++++++++++++++++++++++++++++++++++++ README.md | 2 + docs/build-validation.md | 6 ++- 3 files changed, 97 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/docker.yml diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml new file mode 100644 index 0000000000..e80735866b --- /dev/null +++ b/.github/workflows/docker.yml @@ -0,0 +1,90 @@ +name: Docker checks + +on: + push: + branches: [main] + paths: + - 'docker/**' + - '.github/workflows/docker.yml' + - 'install.sh' + - '**/rust-toolchain.toml' + - '**/Cargo.toml' + - '**/Cargo.lock' + - '**/build.rs' + - 'build-utils/**' + - '.cargo/**' + pull_request: + paths: + - 'docker/**' + - '.github/workflows/docker.yml' + - 'install.sh' + - '**/rust-toolchain.toml' + - '**/Cargo.toml' + - '**/Cargo.lock' + - '**/build.rs' + - 'build-utils/**' + - '.cargo/**' + workflow_dispatch: + inputs: + full_pipeline: + description: Run the minimal offline pipeline after installation + type: boolean + default: false + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + docker-build-and-install: + runs-on: ubuntu-24.04 + timeout-minutes: 30 + steps: + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false + - name: Check Docker script syntax + run: bash -n docker/docker-build docker/docker-run + - name: Set up Buildx + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + - name: Build and load the image + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 + with: + context: ./docker + platforms: linux/amd64 + tags: palm:ci + load: true + push: false + cache-from: type=gha,scope=palm-docker-amd64 + cache-to: type=gha,mode=max,scope=palm-docker-amd64 + - name: Check the container environment and install PALM + env: + FULL_PIPELINE: ${{ inputs.full_pipeline || false }} + run: | + docker run --rm -i \ + --mount "type=bind,source=$GITHUB_WORKSPACE,target=/checkout,readonly" \ + --env FULL_PIPELINE \ + palm:ci bash -se <<'CONTAINER' + python3 --version + palm_toolchain=$(python3 -c 'import tomllib; print(tomllib.load(open("/checkout/rust-toolchain.toml", "rb"))["toolchain"]["channel"])') + rustup run "$palm_toolchain" rustc --version + rustup component list --toolchain "$palm_toolchain" --installed + cargo llvm-cov --version | grep -Fx 'cargo-llvm-cov 0.6.16' + + palm_work=$(mktemp -d /tmp/palm-docker-check.XXXXXX) + cp -R /checkout/. "$palm_work/" + cd "$palm_work" + export CARGO_TARGET_DIR="$palm_work/target" + ./install.sh + cargo brinfo --help + cargo call-chain --help + focxt --help + utgen --help + + if [[ "$FULL_PIPELINE" == "true" ]]; then + python3 scripts/check_minimal.py --bin-dir "$HOME/.cargo/bin" + fi + CONTAINER diff --git a/README.md b/README.md index eb4dab51cc..bd602bd740 100644 --- a/README.md +++ b/README.md @@ -94,6 +94,8 @@ Run `docker/docker-build` to prepare an image with the pinned analysis toolchain Run `docker/docker-run` to open a shell in the repository mounted at `/home/palm/palm`, then follow [Installation](#installation). The container is removed when the shell exits; files written in the mounted repository remain on the host. Use working copies of target crates as described above. +The [Docker CI workflow](.github/workflows/docker.yml) checks image construction and tool installation when Docker or build-environment files change. Its manual `full_pipeline` option also runs the minimal offline pipeline inside the container; see [CI scope](docs/build-validation.md#ci-and-further-checks). + ## Development checks From the repository root, using the pinned toolchain: diff --git a/docs/build-validation.md b/docs/build-validation.md index 11083331a7..7cb1168839 100644 --- a/docs/build-validation.md +++ b/docs/build-validation.md @@ -47,8 +47,12 @@ Model configuration is loaded only when generation or repair starts. See the [ru ## CI and Further Checks -The [CI workflow](../.github/workflows/ci.yml) checks builds, ordinary tests, CLI entry points, installer syntax/help, and example metadata on Linux. It also runs the [minimal pipeline and related regressions](minimal-pipeline.md) and [Bytes analysis checks](bytes-analysis.md). Actual tool installation and Docker image validation are separate checks. +The [native CI workflow](../.github/workflows/ci.yml) checks builds, ordinary tests, CLI entry points, installer syntax/help, and example metadata on Linux. It also runs the [minimal pipeline and related regressions](minimal-pipeline.md) and [Bytes analysis checks](bytes-analysis.md). Changes limited to READMEs and the documentation paths selected in the workflow receive a patch whitespace check. Other changes and manual workflow runs execute the full offline suite. A documentation-only CI result does not imply that Rust tests ran. +The independent [Docker checks workflow](../.github/workflows/docker.yml) builds a Linux AMD64 image, checks its Python, compiler, and coverage tools, installs all four PALM tool packages, and checks their command entry points. It runs for changes to Docker files, toolchain files, Cargo manifests/lockfiles, build scripts, build-utils, root Cargo configuration, the installer, or its own workflow. Ordinary Rust logic and documentation changes do not trigger it. The image uses BuildKit's GitHub Actions layer cache and is loaded only into the runner's local Docker engine. + +To run the minimal offline pipeline in the container as well, select **Docker checks → Run workflow** in GitHub Actions and enable `full_pipeline`. This uses the installed tool binaries and fixed local responses. Docker checks run independently of native CI, have a 30-minute job limit, and cancel superseded runs for the same PR or branch. + The offline checks use temporary target copies and local model responses. They cover the scenarios documented in each guide; they do not measure model quality, provide general crash recovery, or establish support for arbitrary Rust projects. From 9793065afb4312e2e3e000fce917002f6f8161d4 Mon Sep 17 00:00:00 2001 From: cppbear Date: Fri, 9 Oct 2026 01:13:40 +0800 Subject: [PATCH 2/3] ci: use major-version action tags --- .github/workflows/ci.yml | 2 +- .github/workflows/docker.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 01f3866d5b..a9607cc610 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: env: CARGO_TERM_COLOR: always steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@v4 with: persist-credentials: false fetch-depth: 0 diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index e80735866b..5ed0c9e855 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -43,15 +43,15 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 30 steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@v4 with: persist-credentials: false - name: Check Docker script syntax run: bash -n docker/docker-build docker/docker-run - name: Set up Buildx - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + uses: docker/setup-buildx-action@v4 - name: Build and load the image - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 + uses: docker/build-push-action@v7 with: context: ./docker platforms: linux/amd64 From d608510d5e7b2158db8130d8b9843e311b825f6a Mon Sep 17 00:00:00 2001 From: cppbear Date: Fri, 9 Oct 2026 01:19:09 +0800 Subject: [PATCH 3/3] ci: exclude Markdown from Docker check triggers --- .github/workflows/docker.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 5ed0c9e855..6f8eed8d5e 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -13,6 +13,7 @@ on: - '**/build.rs' - 'build-utils/**' - '.cargo/**' + - '!**/*.md' pull_request: paths: - 'docker/**' @@ -24,6 +25,7 @@ on: - '**/build.rs' - 'build-utils/**' - '.cargo/**' + - '!**/*.md' workflow_dispatch: inputs: full_pipeline: