docs(mac-vz): day 4 sign-off — DAY_4.md + Anders handoff + gate re-ba… #87
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Linux-untouched gate (Vz backend) | |
| # Enforces the Linux-untouched guarantee from docs/vz-backend/PLAN.md: | |
| # Phase 1+ Vz-backend commits must not modify the four protected crates | |
| # (elastos-crosvm, elastos-runtime, elastos-common, elastos-compute). | |
| # | |
| # Runs `scripts/check-linux-untouched.sh` against the Phase 0 baseline | |
| # (commit a65dad3 — the last commit before Vz work began). The script | |
| # itself documents how to adjust the base ref locally. | |
| # | |
| # Anchors: | |
| # - docs/vz-backend/PLAN.md → "Linux-untouched: explicit guarantees" | |
| # - PRINCIPLES.md #10 "One Canonical Path" | |
| # - scripts/check-linux-untouched.sh | |
| on: | |
| push: | |
| branches: ["sash/**", "vz/**"] | |
| pull_request: | |
| branches: [main] | |
| # Phase 5 Day 5 — allow manual one-shot triggers from the | |
| # Actions UI so operators can re-run the gate after rebasing | |
| # without pushing a new commit. Matches the trigger surface | |
| # of the new mac-vz.yml workflow. | |
| workflow_dispatch: {} | |
| jobs: | |
| linux-untouched: | |
| name: Protected crates not modified vs Vz baseline | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # Full history needed for `git merge-base` to find the | |
| # divergence point against the baseline commit. | |
| fetch-depth: 0 | |
| - name: Run protected-paths gate | |
| env: | |
| # Re-baselined 2026-05-28 onto Day-4-of-the-v0.3.0-rebase HEAD | |
| # (`65f5f05`), the rebase's final-state commit. Earlier | |
| # baselines: | |
| # - Phase 0 (`a65dad3`): pre-Vz baseline on the original | |
| # sash/local-test branch, unreachable from the rebased | |
| # branch (rooted on PR #2 / v0.3.0 main). | |
| # - Day 2 (`ded1333`): first Mac-VZ-rebase commit on | |
| # sash/local-test-v030; protected-crate cfg-gating and | |
| # the new elastos-vz crate land here. | |
| # - Day 4 (`65f5f05`, this baseline): rebase complete. | |
| # The carrier-bridge fuzz harness is restored, the v0.3.0 | |
| # `carrier_invoke` ABI is in carrier_bridge.rs, the | |
| # principal-aware localhost-fs scoping is wired through. | |
| # Day 3+4 commits only touch elastos-server (NOT | |
| # protected), so the gate keeps enforcing "no future | |
| # commit modifies elastos-crosvm / elastos-runtime / | |
| # elastos-common / elastos-compute beyond what the | |
| # rebase already shipped." See | |
| # docs/mac-vz/v030-rebase/DAY_4.md. | |
| VZ_BACKEND_BASELINE: 65f5f05 | |
| run: | | |
| set -euo pipefail | |
| # Make sure the baseline commit is reachable in the checkout. | |
| # Shallow clones don't always have it; `fetch-depth: 0` above | |
| # asks for the full history but defend against any quirks. | |
| if ! git cat-file -e "${VZ_BACKEND_BASELINE}^{commit}" 2>/dev/null; then | |
| git fetch origin "${VZ_BACKEND_BASELINE}" || true | |
| fi | |
| chmod +x scripts/check-linux-untouched.sh | |
| scripts/check-linux-untouched.sh "${VZ_BACKEND_BASELINE}" |