24 Commits

Include renames

Author	SHA1	Message	Date
mokhtar	f168247b33	cut: build the release with the official zig tarball, skip hidden bundle files; re-pin 0.0.17 ... The first 0.0.17 cut (run 687) failed verify-pins in CI for two reasons. The asset generator embedded admin/dist/.src-hash, a freshness stamp that CI's artifact copy does not carry; it now skips dotfiles. And the Arch zig package emits different code than the ziglang.org tarball that CI installs, so the cut downloads the pinned tarball (ZIG_TARBALL_SHA256 in gates.yml, the full digest keys the cache) and builds the release with it. flake.nix is re-pinned to the bytes both now produce. The saturated-primary pool test gates its holders on a semaphore instead of sleeps and releases every spawned holder on the way out, so a loaded runner cannot flake it. The package job uploads the payload before the pin check and runs the check when the version or flake.nix changed against the parent. The verify-a-release recipe clones the tag first and builds with the official zig.	2026-09-08 23:57:07 +02:00
mokhtar	22abcd9b7b	release: nix flake with tag-pinned hashes, reproducible tarballs (milestone 40) ... flake.nix fetches the release tarballs and carries their SRI hashes in a generated block. The cut tool builds the release locally with the toolchain gates.yml pins, in a normalized nine-variable environment, writes the hashes into flake.nix, and commits it with build.zig.zon as the single bump commit. The package job verifies the pins on the bump commit and the publish job verifies them again on the tag, before anything is uploaded. The tarballs are written by dist_stage (std.tar.Writer, flate gzip) instead of the runner's tar and gzip, and -ffile-prefix-map keeps checkout paths out of the C objects; two checkouts at different absolute paths produce byte-identical archives. nxdns version, /api/version and the admin footer report the version only: the bump commit cannot know its own sha.	2026-09-08 21:45:22 +02:00
mokhtar	03149b5d65	ci: drop the one-insn-per-tb workaround, the qemu panic is an 11.1.0-only regression ... the bisect proved the runner image's qemu 8.2 was never affected; the hangs this masked were the logger deadlock fixed in f1a85d3. the 10x slowdown it cost also broke the full-batch flush timing test in run 592.	2026-08-23 13:55:22 +02:00
mokhtar	78d688a40f	ci: run the aarch64 suite with one qemu insn per tb, tcg optimization falsely trips the ubsan pointer check	2026-08-23 12:26:05 +02:00
mokhtar	1e97c80f6b	rename web/ to admin/, along with the web-named build and cli identifiers	2026-08-16 00:17:58 +02:00
mokhtar	fc60214b3e	ci: the container gate and the version parse move into a compiled tool	2026-08-15 12:24:05 +02:00
mokhtar	c428bc2398	ci: allow dispatching the gate set, a replaced runner pod kills the job it holds	2026-08-14 02:34:06 +02:00
mokhtar	13458a980e	ci: run the frontend gate on the light runner	2026-08-12 23:46:07 +02:00
mokhtar	e3529e4e61	ci: gates build the web bundle and the dist payload once, pass them between jobs	2026-08-12 20:20:30 +02:00
mokhtar	91a0aa92c6	ci: smoke test runs the container in file mode, surface its logs on failure	2026-08-12 00:15:22 +02:00
mokhtar	1a82b0491a	release: name the image by the public registry host, not the internal server url	2026-08-08 21:14:37 +02:00
mokhtar	d7f63b9f6e	release: move publication orchestration into tools/release.zig, pin rotated subkey	2026-08-08 20:22:04 +02:00
mokhtar	fbd70e6a70	release: refetch the annotated tag object that checkout replaces	2026-08-08 16:03:04 +02:00
mokhtar	75038b61a6	release: pin the artifact-signing subkey fingerprint	2026-08-08 14:44:07 +02:00
mokhtar	cdacc560b7	milestone 14: build, package, sign and publish releases	2026-08-08 12:38:29 +02:00
mokhtar	6c507992e4	milestone 19: hygiene sweep - dead ecs surface, single-source constants, tls classification, frontend state hazards, docker smoke network fix	2026-08-07 20:39:27 +02:00
mokhtar	9b12dbaaa0	ci: deliver the smoke-test config via docker cp instead of a bind mount	2026-08-07 17:55:56 +02:00
mokhtar	ee342c1e69	ci: create the zig fetch tmp dir the package fetcher assumes	2026-08-07 02:01:24 +02:00
mokhtar	9f8a5cd753	milestone 15: make a green run mean a real pass	2026-08-07 01:28:13 +02:00
mokhtar	8c3328562e	milestone 13 discrepancies: redact credentials from urls in logs, metrics and cli output	2026-08-07 00:45:17 +02:00
mokhtar	d522b1f947	milestone 12: performance bench harness, measured docs, aarch64 tests under qemu and no-dist size assert	2026-08-02 16:08:23 +02:00
mokhtar	bdb6ffab7a	milestone 11: systemd and docker packaging, operator and architecture docs, config and api reference, docs drift guards	2026-08-02 15:24:10 +02:00
mokhtar	617cc966a2	milestone 9: react spa admin ui, frontend ci and embedded dist	2026-08-02 13:04:09 +02:00
mokhtar	b960413ea9	gitea ci: blocking test + cross jobs, manual live-tls workflow	2026-07-31 23:59:40 +02:00