[PARKED — v0.3.2+ track] Mac VZ branch refresh against v0.3.0 (rebase complete, not for v0.3.1 merge) #80
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Linux-untouched gate (Vz backend) | |
| # Enforces the Linux-untouched guarantee from docs/vz-backend/PLAN.md: | |
| # Phase 1+ Vz-backend commits must not modify the four protected crates | |
| # (elastos-crosvm, elastos-runtime, elastos-common, elastos-compute). | |
| # | |
| # Runs `scripts/check-linux-untouched.sh` against the Phase 0 baseline | |
| # (commit a65dad3 — the last commit before Vz work began). The script | |
| # itself documents how to adjust the base ref locally. | |
| # | |
| # Anchors: | |
| # - docs/vz-backend/PLAN.md → "Linux-untouched: explicit guarantees" | |
| # - PRINCIPLES.md #10 "One Canonical Path" | |
| # - scripts/check-linux-untouched.sh | |
| on: | |
| push: | |
| branches: ["sash/**", "vz/**"] | |
| pull_request: | |
| branches: [main] | |
| # Phase 5 Day 5 — allow manual one-shot triggers from the | |
| # Actions UI so operators can re-run the gate after rebasing | |
| # without pushing a new commit. Matches the trigger surface | |
| # of the new mac-vz.yml workflow. | |
| workflow_dispatch: {} | |
| jobs: | |
| linux-untouched: | |
| name: Protected crates not modified vs Vz baseline | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # Full history needed for `git merge-base` to find the | |
| # divergence point against the baseline commit. | |
| fetch-depth: 0 | |
| - name: Run protected-paths gate | |
| env: | |
| # Re-baselined 2026-05-28 onto Day-2-of-the-v0.3.0-rebase | |
| # HEAD (`ded1333`). Until that point this gate compared | |
| # against the original Phase 0 sash/local-test baseline | |
| # `a65dad3`, which is unreachable from the rebased branch | |
| # (the new branch is rooted on PR #2 / v0.3.0 main, not on | |
| # sash/local-test). `ded1333` is the first Mac-VZ-rebase | |
| # commit, after which the elastos-crosvm cfg-gating and the | |
| # new elastos-vz crate are in place — i.e. the legitimate | |
| # "Phase 0" of the rebased Mac VZ branch. Day 3+ commits | |
| # only touch elastos-server (NOT protected), so this gate | |
| # continues to enforce "no Mac-VZ-rebase work modifies | |
| # elastos-crosvm / elastos-runtime / elastos-common / | |
| # elastos-compute beyond what Day 2 already shipped." | |
| # See docs/mac-vz/v030-rebase/DAY_2.md. | |
| VZ_BACKEND_BASELINE: ded1333 | |
| run: | | |
| set -euo pipefail | |
| # Make sure the baseline commit is reachable in the checkout. | |
| # Shallow clones don't always have it; `fetch-depth: 0` above | |
| # asks for the full history but defend against any quirks. | |
| if ! git cat-file -e "${VZ_BACKEND_BASELINE}^{commit}" 2>/dev/null; then | |
| git fetch origin "${VZ_BACKEND_BASELINE}" || true | |
| fi | |
| chmod +x scripts/check-linux-untouched.sh | |
| scripts/check-linux-untouched.sh "${VZ_BACKEND_BASELINE}" |