ci: adopt the fleet reusable workflow - #7
Open
h4x0r wants to merge 2 commits into
Open
Conversation
Replace the hand-maintained ci.yml with a call to
SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml, pinned to
619094ad54edc586f5c2733358e00326b30790bd, keeping the repo-specific
coverage, corpus and geiger jobs verbatim.
msrv-check: test -- the old MSRV job ran `cargo test` at 1.85, not a bare
build; the input default would verify strictly less.
coverage-gate: "off" -- the old coverage gate cannot be expressed through the
shared workflow's single `all-features` input, because the old test job runs
--all-features while the old coverage job deliberately does not. Measured on
this tree with the shared gate's own per-line rules:
--workspace --ignore-filename-regex '/tests/|/fuzz/' -> 0 uncovered
--workspace --all-features --ignore-filename-regex '/tests/|/fuzz/' -> 3 uncovered
(core/src/vfs.rs:64,:90,:91 -- behind the `vfs` feature, which the
existing gate never compiles)
Switching to the shared gate would therefore go red on lines no gate has ever
asked anyone to cover. That migration is a coverage decision and belongs in
its own PR.
qemu-utils stays inside the coverage and corpus jobs, where it is actually
used; it is deliberately not passed as `system-packages`, since the test job
never had it.
The Coverage and Corpus jobs both failed at "Install qemu-utils". Not a flake,
and not a missing package -- the runner image ships a pre-baked apt list
pinning an exact .deb version, and Ubuntu had since superseded it:
E: Failed to fetch .../qemu-utils_8.2.2+ds-0ubuntu1.17_amd64.deb
404 Not Found [IP: 40.81.13.82 80]
E: Unable to fetch some archives, maybe run apt-get update or try with
--fix-missing?
apt names the fix in its own error text. Both install sites now refresh the
lists first.
This is a time bomb rather than an intermittent failure: it stays green until
the package gets a security update, then fails on every run until the runner
image is rebuilt -- which reads like infrastructure flakiness and invites a
re-run instead of a fix.
Verified locally in a container rather than by re-running CI. On ubuntu:24.04,
installing with the image's shipped apt state fails ("E: Unable to locate
package qemu-utils") and the same install succeeds after apt-get update. The
container reproduces the class -- apt cannot install against stale or absent
lists -- while CI hit the specific form of it, a pinned version that 404s.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace the hand-maintained ci.yml with a call to
SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml, pinned to
619094ad54edc586f5c2733358e00326b30790bd, keeping the repo-specific
coverage, corpus and geiger jobs verbatim.
msrv-check: test -- the old MSRV job ran
cargo testat 1.85, not a barebuild; the input default would verify strictly less.
coverage-gate: "off" -- the old coverage gate cannot be expressed through the
shared workflow's single
all-featuresinput, because the old test job runs--all-features while the old coverage job deliberately does not. Measured on
this tree with the shared gate's own per-line rules:
--workspace --ignore-filename-regex '/tests/|/fuzz/' -> 0 uncovered
--workspace --all-features --ignore-filename-regex '/tests/|/fuzz/' -> 3 uncovered
(core/src/vfs.rs:64,:90,:91 -- behind the
vfsfeature, which theexisting gate never compiles)
Switching to the shared gate would therefore go red on lines no gate has ever
asked anyone to cover. That migration is a coverage decision and belongs in
its own PR.
qemu-utils stays inside the coverage and corpus jobs, where it is actually
used; it is deliberately not passed as
system-packages, since the test jobnever had it.
🤖 Generated with Claude Code