From 651eacdcb6529d81a37af23ff5dffacf0d92a3e3 Mon Sep 17 00:00:00 2001 From: Magnus Hedemark Date: Wed, 7 Oct 2026 15:35:09 -0400 Subject: [PATCH 1/2] Pin v17 caller to its registry and bound CI observer installation --- .github/workflows/slopsearx-pilot.yml | 4 +- .github/workflows/test.yml | 4 +- docs/V17-HOSTED-SELECTOR.md | 4 +- scripts/central_pilot_admission.py | 2 +- scripts/install_ci_strace.sh | 45 +++++++ tests/test_ci_strace_install.py | 122 ++++++++++++++++++ tests/test_pilot_workflow.py | 2 +- ...test_selected_control_transport_receipt.py | 4 +- 8 files changed, 179 insertions(+), 8 deletions(-) create mode 100644 scripts/install_ci_strace.sh create mode 100644 tests/test_ci_strace_install.py diff --git a/.github/workflows/slopsearx-pilot.yml b/.github/workflows/slopsearx-pilot.yml index 8b880d1..6eb0685 100644 --- a/.github/workflows/slopsearx-pilot.yml +++ b/.github/workflows/slopsearx-pilot.yml @@ -122,10 +122,10 @@ jobs: checks: read pull-requests: read actions: read - uses: groktopus/codereview/.github/workflows/pr-analysis.yml@dd01a24976631c957a34f3ecc80dcb097948e450 + uses: groktopus/codereview/.github/workflows/pr-analysis.yml@b075e50db01154cbd996a5549afef62f065df2d9 with: harness_repository: groktopus/codereview - harness_sha: dd01a24976631c957a34f3ecc80dcb097948e450 + harness_sha: b075e50db01154cbd996a5549afef62f065df2d9 target_repository: magnus919/SlopSearX pull_request_number: ${{ fromJSON(inputs.pull_request_number) }} base_ref: ${{ needs.resolve-target.outputs.base_ref }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 2600fe0..d7ac8fd 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -184,10 +184,10 @@ jobs: with: python-version: '3.13' - name: Install the Linux syscall observer + timeout-minutes: 3 run: | set -euo pipefail - sudo apt-get update - sudo apt-get install --yes strace + bash scripts/install_ci_strace.sh - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 with: name: pr-review-distributions diff --git a/docs/V17-HOSTED-SELECTOR.md b/docs/V17-HOSTED-SELECTOR.md index a2caa31..b522124 100644 --- a/docs/V17-HOSTED-SELECTOR.md +++ b/docs/V17-HOSTED-SELECTOR.md @@ -22,7 +22,9 @@ byte-identical (8,087 bytes, SHA-256 `004df69e267e61f3457099ef2febcadee7bf2378e6f1cc0507f19881adc4e129`). The selected reusable workflow is pinned to the qualified v17-capable runtime -at `dd01a24976631c957a34f3ecc80dcb097948e450`. This makes the v17 input +at `b075e50db01154cbd996a5549afef62f065df2d9`. That commit contains both the manifest engine and the closed contract registry. +Contract resolution runs from the pinned checkout, so qualification must exercise +that exact resolver as well as CLI preparation. This makes the v17 input available to the caller; it does not validate the profile's review quality or establish production behavior. The provider wire quote uses adapter 0.2 and continues to use the same quote/ledger checks before dispatch. Publication diff --git a/scripts/central_pilot_admission.py b/scripts/central_pilot_admission.py index 12ed338..451336c 100644 --- a/scripts/central_pilot_admission.py +++ b/scripts/central_pilot_admission.py @@ -37,7 +37,7 @@ TARGET = "magnus919/SlopSearX" BASE_REF = "main" REUSABLE_PATH = ".github/workflows/pr-analysis.yml" -REUSABLE_SHA = "dd01a24976631c957a34f3ecc80dcb097948e450" +REUSABLE_SHA = "b075e50db01154cbd996a5549afef62f065df2d9" MAX_EVENT_BYTES = 64 * 1024 SHA1 = re.compile(r"^[0-9a-f]{40}$") RUN_ID = re.compile(r"^[1-9][0-9]{0,19}$") diff --git a/scripts/install_ci_strace.sh b/scripts/install_ci_strace.sh new file mode 100644 index 0000000..93ff4c4 --- /dev/null +++ b/scripts/install_ci_strace.sh @@ -0,0 +1,45 @@ +#!/usr/bin/env bash +set -euo pipefail + +if command -v strace >/dev/null 2>&1; then + printf 'Using existing strace: %s\n' "$(command -v strace)" + exit 0 +fi + +for command_name in timeout sudo apt-get; do + if ! command -v "$command_name" >/dev/null 2>&1; then + printf 'Required observer installer command is unavailable: %s\n' "$command_name" >&2 + exit 127 + fi +done + +for attempt in 1 2; do + if timeout --kill-after=5s 60s bash -c ' + set -euo pipefail + sudo apt-get \ + -o Acquire::http::Timeout=15 \ + -o Acquire::https::Timeout=15 \ + -o Acquire::Retries=0 \ + update + sudo apt-get \ + -o Acquire::http::Timeout=15 \ + -o Acquire::https::Timeout=15 \ + -o Acquire::Retries=0 \ + install --yes --no-install-recommends strace + '; then + if command -v strace >/dev/null 2>&1; then + printf 'Installed strace: %s\n' "$(command -v strace)" + exit 0 + fi + printf 'apt completed but strace is not available on PATH\n' >&2 + else + status=$? + printf 'strace installation attempt %s failed (status %s)\n' "$attempt" "$status" >&2 + fi + if [[ "$attempt" -eq 1 ]]; then + sleep 1 + fi +done + +printf 'Unable to install the required Linux syscall observer after two bounded attempts\n' >&2 +exit 1 diff --git a/tests/test_ci_strace_install.py b/tests/test_ci_strace_install.py new file mode 100644 index 0000000..5c4829e --- /dev/null +++ b/tests/test_ci_strace_install.py @@ -0,0 +1,122 @@ +from __future__ import annotations + +import os +import subprocess +from pathlib import Path + +ROOT = Path(__file__).resolve().parents[1] +INSTALLER = ROOT / "scripts/install_ci_strace.sh" + + +def _fake_command(path: Path, name: str, body: str) -> None: + executable = path / name + executable.write_text("#!/usr/bin/env bash\nset -euo pipefail\n" + body, encoding="utf-8") + executable.chmod(0o755) + + +def _fixture(tmp_path: Path, *, fail_first_update: bool = False, always_fail: bool = False, + install_strace: bool = True, existing_strace: bool = False) -> tuple[Path, dict[str, str], Path]: + bin_dir = tmp_path / "bin" + bin_dir.mkdir() + log = tmp_path / "commands.log" + env = { + **os.environ, + "PATH": f"{bin_dir}{os.pathsep}{os.environ['PATH']}", + "FAKE_BIN": str(bin_dir), + "FAKE_LOG": str(log), + "FAKE_FAIL_FIRST_UPDATE": "1" if fail_first_update else "0", + "FAKE_ALWAYS_FAIL": "1" if always_fail else "0", + "FAKE_INSTALL_STRACE": "1" if install_strace else "0", + } + _fake_command( + bin_dir, + "timeout", + 'printf "timeout %s\\n" "$*" >> "$FAKE_LOG"\n' + '[[ "$1" == "--kill-after=5s" ]] && shift\n' + '[[ "$1" == "60s" ]] && shift\n' + 'exec "$@"\n', + ) + _fake_command( + bin_dir, + "sudo", + 'printf "sudo %s\\n" "$*" >> "$FAKE_LOG"\nexec "$@"\n', + ) + _fake_command( + bin_dir, + "apt-get", + 'printf "apt-get %s\\n" "$*" >> "$FAKE_LOG"\n' + 'action="${!#}"\n' + 'if [[ "$FAKE_ALWAYS_FAIL" == "1" ]]; then exit 41; fi\n' + 'if [[ "$action" == "update" ]]; then\n' + ' count=0; [[ -f "$FAKE_LOG.update-count" ]] && count="$(cat "$FAKE_LOG.update-count")"\n' + ' count=$((count + 1)); printf "%s" "$count" > "$FAKE_LOG.update-count"\n' + ' if [[ "$FAKE_FAIL_FIRST_UPDATE" == "1" && "$count" == "1" ]]; then exit 42; fi\n' + 'elif [[ "$action" == "strace" && "$FAKE_INSTALL_STRACE" == "1" ]]; then\n' + ' printf "#!/bin/sh\\nexit 0\\n" > "$FAKE_BIN/strace"; chmod +x "$FAKE_BIN/strace"\n' + 'fi\n', + ) + if existing_strace: + _fake_command(bin_dir, "strace", "exit 0\n") + return bin_dir, env, log + + +def _run(env: dict[str, str]) -> subprocess.CompletedProcess[str]: + return subprocess.run( + ["bash", str(INSTALLER)], env=env, capture_output=True, text=True, timeout=10, check=False + ) + + +def test_installer_uses_existing_strace_without_apt_or_sudo(tmp_path: Path): + _, env, log = _fixture(tmp_path, existing_strace=True) + + completed = _run(env) + + assert completed.returncode == 0 + assert "Using existing strace:" in completed.stdout + assert not log.exists() + + +def test_installer_retries_once_with_bounded_apt_options_and_requires_strace(tmp_path: Path): + _, env, log = _fixture(tmp_path, fail_first_update=True) + + completed = _run(env) + + assert completed.returncode == 0 + assert "attempt 1 failed" in completed.stderr + assert "Installed strace:" in completed.stdout + lines = log.read_text(encoding="utf-8").splitlines() + assert sum(line.startswith("timeout ") for line in lines) == 2 + apt_lines = [line for line in lines if line.startswith("apt-get ")] + assert len(apt_lines) == 3 + assert sum(line.endswith(" update") for line in apt_lines) == 2 + assert sum(" install --yes --no-install-recommends strace" in line for line in apt_lines) == 1 + assert all("Acquire::http::Timeout=15" in line for line in apt_lines) + assert all("Acquire::https::Timeout=15" in line for line in apt_lines) + assert all("Acquire::Retries=0" in line for line in apt_lines) + assert all("--kill-after=5s 60s" in line for line in lines if line.startswith("timeout ")) + + +def test_installer_fails_after_two_attempts_when_apt_cannot_complete(tmp_path: Path): + _, env, log = _fixture(tmp_path, always_fail=True) + + completed = _run(env) + + assert completed.returncode != 0 + assert "after two bounded attempts" in completed.stderr + lines = log.read_text(encoding="utf-8").splitlines() + assert sum(line.startswith("timeout ") for line in lines) == 2 + assert sum(line.startswith("apt-get ") and line.endswith(" update") for line in lines) == 2 + + +def test_installer_does_not_succeed_when_apt_returns_without_strace(tmp_path: Path): + _, env, log = _fixture(tmp_path, install_strace=False) + + completed = _run(env) + + assert completed.returncode != 0 + assert "apt completed but strace is not available" in completed.stderr + assert "after two bounded attempts" in completed.stderr + lines = log.read_text(encoding="utf-8").splitlines() + assert sum(line.startswith("timeout ") for line in lines) == 2 + apt_lines = [line for line in lines if line.startswith("apt-get ")] + assert sum(" install --yes --no-install-recommends strace" in line for line in apt_lines) == 2 diff --git a/tests/test_pilot_workflow.py b/tests/test_pilot_workflow.py index b617797..d7348f7 100644 --- a/tests/test_pilot_workflow.py +++ b/tests/test_pilot_workflow.py @@ -9,7 +9,7 @@ import pytest WORKFLOW = Path(__file__).parents[1] / ".github/workflows/slopsearx-pilot.yml" -PIN = "dd01a24976631c957a34f3ecc80dcb097948e450" +PIN = "b075e50db01154cbd996a5549afef62f065df2d9" SECRETS = ( "LLM_BASE_URL", "LLM_MODEL", diff --git a/tests/test_selected_control_transport_receipt.py b/tests/test_selected_control_transport_receipt.py index bb8468a..d2dd776 100644 --- a/tests/test_selected_control_transport_receipt.py +++ b/tests/test_selected_control_transport_receipt.py @@ -755,7 +755,9 @@ def test_secretless_ci_runs_opt_in_roundtrip_against_the_built_wheel(): job = workflow.split(" transport-receipt-roundtrip:", 1)[1] assert "needs: build" in job assert "runs-on: ubuntu-latest" in job - assert "sudo apt-get install --yes strace" in job + assert "- name: Install the Linux syscall observer\n timeout-minutes: 3" in job + assert "bash scripts/install_ci_strace.sh" in job + assert "continue-on-error" not in job assert "actions/download-artifact" in job and "pr-review-distributions" in job assert 'pip install "$ROUNDTRIP_DIST"/*.whl pytest' in job assert "RUN_INSTALLED_LOOPBACK_TRANSPORT_VALIDATOR_TEST: '1'" in job From 42802b3786d9c51ad761c68050584d4b4dca2259 Mon Sep 17 00:00:00 2001 From: Magnus Hedemark Date: Wed, 7 Oct 2026 15:44:26 -0400 Subject: [PATCH 2/2] Isolate installer tests from host strace and command search paths --- tests/test_ci_strace_install.py | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/tests/test_ci_strace_install.py b/tests/test_ci_strace_install.py index 5c4829e..4c2bd39 100644 --- a/tests/test_ci_strace_install.py +++ b/tests/test_ci_strace_install.py @@ -1,6 +1,7 @@ from __future__ import annotations import os +import shutil import subprocess from pathlib import Path @@ -10,18 +11,29 @@ def _fake_command(path: Path, name: str, body: str) -> None: executable = path / name - executable.write_text("#!/usr/bin/env bash\nset -euo pipefail\n" + body, encoding="utf-8") + executable.write_text("#!/bin/bash\nset -euo pipefail\n" + body, encoding="utf-8") executable.chmod(0o755) def _fixture(tmp_path: Path, *, fail_first_update: bool = False, always_fail: bool = False, - install_strace: bool = True, existing_strace: bool = False) -> tuple[Path, dict[str, str], Path]: + install_strace: bool = True, existing_strace: bool = False, + host_strace_canary: bool = False) -> tuple[Path, dict[str, str], Path]: bin_dir = tmp_path / "bin" bin_dir.mkdir() + for name in ("bash", "cat", "chmod", "sleep"): + trusted_tool = shutil.which(name, path=os.defpath) + if trusted_tool is None: + raise RuntimeError(f"required test utility is unavailable: {name}") + (bin_dir / name).symlink_to(trusted_tool) + host_bin = tmp_path / "host-bin" + host_bin.mkdir() + if host_strace_canary: + _fake_command(host_bin, "strace", "printf 'host strace canary\\n'\n") log = tmp_path / "commands.log" env = { **os.environ, - "PATH": f"{bin_dir}{os.pathsep}{os.environ['PATH']}", + "PATH": str(bin_dir), + "HOST_STRACE_CANARY": str(host_bin / "strace"), "FAKE_BIN": str(bin_dir), "FAKE_LOG": str(log), "FAKE_FAIL_FIRST_UPDATE": "1" if fail_first_update else "0", @@ -61,8 +73,11 @@ def _fixture(tmp_path: Path, *, fail_first_update: bool = False, always_fail: bo def _run(env: dict[str, str]) -> subprocess.CompletedProcess[str]: + trusted_bash = shutil.which("bash", path=os.defpath) + if trusted_bash is None: + raise RuntimeError("required test utility is unavailable: bash") return subprocess.run( - ["bash", str(INSTALLER)], env=env, capture_output=True, text=True, timeout=10, check=False + [trusted_bash, str(INSTALLER)], env=env, capture_output=True, text=True, timeout=10, check=False ) @@ -77,7 +92,9 @@ def test_installer_uses_existing_strace_without_apt_or_sudo(tmp_path: Path): def test_installer_retries_once_with_bounded_apt_options_and_requires_strace(tmp_path: Path): - _, env, log = _fixture(tmp_path, fail_first_update=True) + _, env, log = _fixture(tmp_path, fail_first_update=True, host_strace_canary=True) + assert Path(env["HOST_STRACE_CANARY"]).is_file() + assert str(Path(env["HOST_STRACE_CANARY"]).parent) not in env["PATH"].split(os.pathsep) completed = _run(env)