From 7342576c018c7427e83b9cba62962c1e51d03088 Mon Sep 17 00:00:00 2001 From: usr-bin-roygbiv Date: Tue, 21 Jul 2026 09:29:28 +0000 Subject: [PATCH 1/8] test(ci): require operator compile headroom --- scripts/cluster-ci/cluster-ci-contract.test.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/cluster-ci/cluster-ci-contract.test.mjs b/scripts/cluster-ci/cluster-ci-contract.test.mjs index b53264d4..7dd22824 100644 --- a/scripts/cluster-ci/cluster-ci-contract.test.mjs +++ b/scripts/cluster-ci/cluster-ci-contract.test.mjs @@ -276,7 +276,7 @@ test("Woodpecker keeps upstream gates and serializes bounded cluster publication ]); assert.equal( steps["cluster-operator-tests"].backend_options.kubernetes.resources.limits.memory, - "2Gi", + "4Gi", ); assert.ok( steps["cluster-chart-tests"].commands.includes("helm lint ../../../deploy/charts/t4-cluster"), From f68284a0b7e90deb8abb6bafff563964090b3d9e Mon Sep 17 00:00:00 2001 From: usr-bin-roygbiv Date: Tue, 21 Jul 2026 09:44:20 +0000 Subject: [PATCH 2/8] fix(ci): give operator compile bounded headroom --- .woodpecker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.woodpecker.yml b/.woodpecker.yml index 09724a03..a4150280 100644 --- a/.woodpecker.yml +++ b/.woodpecker.yml @@ -257,7 +257,7 @@ steps: ephemeral-storage: 256Mi limits: cpu: "1" - memory: 2Gi + memory: 4Gi ephemeral-storage: 2Gi cluster-chart-tests: From 2f68c45371d6b55adc081ec98679818f09a1ec4c Mon Sep 17 00:00:00 2001 From: usr-bin-roygbiv Date: Tue, 21 Jul 2026 10:25:29 +0000 Subject: [PATCH 3/8] fix(ci): retain operator compile workspace --- .woodpecker.yml | 2 +- scripts/cluster-ci/cluster-ci-contract.test.mjs | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.woodpecker.yml b/.woodpecker.yml index a4150280..d099b9da 100644 --- a/.woodpecker.yml +++ b/.woodpecker.yml @@ -258,7 +258,7 @@ steps: limits: cpu: "1" memory: 4Gi - ephemeral-storage: 2Gi + ephemeral-storage: 6Gi cluster-chart-tests: depends_on: [cluster-operator-tests] diff --git a/scripts/cluster-ci/cluster-ci-contract.test.mjs b/scripts/cluster-ci/cluster-ci-contract.test.mjs index 7dd22824..12d0bf2f 100644 --- a/scripts/cluster-ci/cluster-ci-contract.test.mjs +++ b/scripts/cluster-ci/cluster-ci-contract.test.mjs @@ -278,6 +278,12 @@ test("Woodpecker keeps upstream gates and serializes bounded cluster publication steps["cluster-operator-tests"].backend_options.kubernetes.resources.limits.memory, "4Gi", ); + assert.equal( + steps["cluster-operator-tests"].backend_options.kubernetes.resources.limits[ + "ephemeral-storage" + ], + "6Gi", + ); assert.ok( steps["cluster-chart-tests"].commands.includes("helm lint ../../../deploy/charts/t4-cluster"), ); From d4e8024ad8b81640c49f2361ec5eca9b41af040d Mon Sep 17 00:00:00 2001 From: usr-bin-roygbiv Date: Tue, 21 Jul 2026 11:35:35 +0000 Subject: [PATCH 4/8] fix(ci): isolate legacy authority commands --- .woodpecker.yml | 4 ++-- scripts/cluster-ci/cluster-ci-contract.test.mjs | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.woodpecker.yml b/.woodpecker.yml index d099b9da..47dd6234 100644 --- a/.woodpecker.yml +++ b/.woodpecker.yml @@ -120,8 +120,8 @@ steps: depends_on: [legacy-authority-source] image: mirror.gcr.io/oven/bun:1.3.14@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4 commands: - - cd .continuity/omp && bun install --frozen-lockfile - - cd .continuity/omp && bun run build:native + - (cd .continuity/omp && bun install --frozen-lockfile) + - (cd .continuity/omp && bun run build:native) backend_options: kubernetes: serviceAccountName: woodpecker-ci-untrusted diff --git a/scripts/cluster-ci/cluster-ci-contract.test.mjs b/scripts/cluster-ci/cluster-ci-contract.test.mjs index 12d0bf2f..92b772d7 100644 --- a/scripts/cluster-ci/cluster-ci-contract.test.mjs +++ b/scripts/cluster-ci/cluster-ci-contract.test.mjs @@ -263,6 +263,10 @@ test("Woodpecker keeps upstream gates and serializes bounded cluster publication `pipeline 38:64 reproduced unfiltered core workspace traversal as "Failed to find executable flutter": ${command}`, ); } + assert.deepEqual(steps["legacy-authority-build"].commands, [ + "(cd .continuity/omp && bun install --frozen-lockfile)", + "(cd .continuity/omp && bun run build:native)", + ]); assert.ok(steps["legacy-bridge-continuity"].commands.includes("pnpm test:legacy-bridge-continuity")); assert.equal(steps["legacy-bridge-continuity"].environment.T4_OMP_SOURCE_DIR, ".continuity/omp"); assert.ok( From 9d516261837d2f2b25ee962a3e041335c441efb0 Mon Sep 17 00:00:00 2001 From: usr-bin-roygbiv Date: Tue, 21 Jul 2026 12:23:26 +0000 Subject: [PATCH 5/8] fix(ci): provide pinned Rust authority toolchain --- .woodpecker.yml | 5 +++-- .../cluster-ci/cluster-ci-contract.test.mjs | 9 +++++++++ .../install-legacy-authority-toolchain.sh | 20 +++++++++++++++++++ 3 files changed, 32 insertions(+), 2 deletions(-) create mode 100755 scripts/cluster-ci/install-legacy-authority-toolchain.sh diff --git a/.woodpecker.yml b/.woodpecker.yml index 47dd6234..b07f1d5e 100644 --- a/.woodpecker.yml +++ b/.woodpecker.yml @@ -117,9 +117,10 @@ steps: ephemeral-storage: 1Gi legacy-authority-build: - depends_on: [legacy-authority-source] - image: mirror.gcr.io/oven/bun:1.3.14@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4 + depends_on: [legacy-authority-source, bun-runtime] + image: docker.io/library/rust:1.86-slim-bookworm@sha256:57d415bbd61ce11e2d5f73de068103c7bd9f3188dc132c97cef4a8f62989e944 commands: + - sh scripts/cluster-ci/install-legacy-authority-toolchain.sh - (cd .continuity/omp && bun install --frozen-lockfile) - (cd .continuity/omp && bun run build:native) backend_options: diff --git a/scripts/cluster-ci/cluster-ci-contract.test.mjs b/scripts/cluster-ci/cluster-ci-contract.test.mjs index 92b772d7..51c8c918 100644 --- a/scripts/cluster-ci/cluster-ci-contract.test.mjs +++ b/scripts/cluster-ci/cluster-ci-contract.test.mjs @@ -263,7 +263,16 @@ test("Woodpecker keeps upstream gates and serializes bounded cluster publication `pipeline 38:64 reproduced unfiltered core workspace traversal as "Failed to find executable flutter": ${command}`, ); } + assert.deepEqual(steps["legacy-authority-build"].depends_on, [ + "legacy-authority-source", + "bun-runtime", + ]); + assert.equal( + steps["legacy-authority-build"].image, + "docker.io/library/rust:1.86-slim-bookworm@sha256:57d415bbd61ce11e2d5f73de068103c7bd9f3188dc132c97cef4a8f62989e944", + ); assert.deepEqual(steps["legacy-authority-build"].commands, [ + "sh scripts/cluster-ci/install-legacy-authority-toolchain.sh", "(cd .continuity/omp && bun install --frozen-lockfile)", "(cd .continuity/omp && bun run build:native)", ]); diff --git a/scripts/cluster-ci/install-legacy-authority-toolchain.sh b/scripts/cluster-ci/install-legacy-authority-toolchain.sh new file mode 100755 index 00000000..c4e7e0bb --- /dev/null +++ b/scripts/cluster-ci/install-legacy-authority-toolchain.sh @@ -0,0 +1,20 @@ +#!/bin/sh +set -eu + +if [ "$(id -u)" -ne 0 ]; then + echo "legacy authority toolchain setup requires root" >&2 + exit 64 +fi + +test -f .ci/bun +rm -f /etc/apt/sources.list.d/* +printf '%s\n' \ + 'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian/20250721T000000Z bookworm main' \ + 'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian-security/20250721T000000Z bookworm-security main' \ + > /etc/apt/sources.list +apt-get -o Acquire::Check-Valid-Until=false update +apt-get install -y --no-install-recommends ca-certificates git pkg-config libssl-dev +rm -rf /var/lib/apt/lists/* +install -m 0755 .ci/bun /usr/local/bin/bun +test "$(bun --version)" = "1.3.14" +command -v cargo >/dev/null From b424876b5ab05c60965531c308697b61b479d7e2 Mon Sep 17 00:00:00 2001 From: usr-bin-roygbiv Date: Tue, 21 Jul 2026 13:44:39 +0000 Subject: [PATCH 6/8] test(ci): require bounded native linker --- scripts/cluster-ci/cluster-ci-contract.test.mjs | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/scripts/cluster-ci/cluster-ci-contract.test.mjs b/scripts/cluster-ci/cluster-ci-contract.test.mjs index 51c8c918..1422325a 100644 --- a/scripts/cluster-ci/cluster-ci-contract.test.mjs +++ b/scripts/cluster-ci/cluster-ci-contract.test.mjs @@ -242,6 +242,10 @@ function liveClusterResponses() { test("Woodpecker keeps upstream gates and serializes bounded cluster publication", async () => { const pipeline = yaml.load(await readFile(resolve(repoRoot, ".woodpecker.yml"), "utf8")); + const legacyInstaller = await readFile( + resolve(repoRoot, "scripts/cluster-ci/install-legacy-authority-toolchain.sh"), + "utf8", + ); assert.equal(typeof pipeline, "object"); const steps = pipeline.steps; const coreCommands = steps["upstream-core"].commands; @@ -271,6 +275,12 @@ test("Woodpecker keeps upstream gates and serializes bounded cluster publication steps["legacy-authority-build"].image, "docker.io/library/rust:1.86-slim-bookworm@sha256:57d415bbd61ce11e2d5f73de068103c7bd9f3188dc132c97cef4a8f62989e944", ); + assert.equal( + steps["legacy-authority-build"].environment.RUSTFLAGS, + "-C link-arg=-fuse-ld=lld", + ); + assert.match(legacyInstaller, /apt-get install[^\n]*\blld\b/u); + assert.match(legacyInstaller, /command -v ld\.lld >\/dev\/null/u); assert.deepEqual(steps["legacy-authority-build"].commands, [ "sh scripts/cluster-ci/install-legacy-authority-toolchain.sh", "(cd .continuity/omp && bun install --frozen-lockfile)", From f13f9e4ff82707bb2c63bd4f381cd072ca985899 Mon Sep 17 00:00:00 2001 From: usr-bin-roygbiv Date: Tue, 21 Jul 2026 13:58:52 +0000 Subject: [PATCH 7/8] fix(ci): link legacy authority with LLD --- .woodpecker.yml | 2 ++ scripts/cluster-ci/install-legacy-authority-toolchain.sh | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.woodpecker.yml b/.woodpecker.yml index b07f1d5e..10169fda 100644 --- a/.woodpecker.yml +++ b/.woodpecker.yml @@ -119,6 +119,8 @@ steps: legacy-authority-build: depends_on: [legacy-authority-source, bun-runtime] image: docker.io/library/rust:1.86-slim-bookworm@sha256:57d415bbd61ce11e2d5f73de068103c7bd9f3188dc132c97cef4a8f62989e944 + environment: + RUSTFLAGS: "-C link-arg=-fuse-ld=lld" commands: - sh scripts/cluster-ci/install-legacy-authority-toolchain.sh - (cd .continuity/omp && bun install --frozen-lockfile) diff --git a/scripts/cluster-ci/install-legacy-authority-toolchain.sh b/scripts/cluster-ci/install-legacy-authority-toolchain.sh index c4e7e0bb..029ebede 100755 --- a/scripts/cluster-ci/install-legacy-authority-toolchain.sh +++ b/scripts/cluster-ci/install-legacy-authority-toolchain.sh @@ -13,8 +13,9 @@ printf '%s\n' \ 'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian-security/20250721T000000Z bookworm-security main' \ > /etc/apt/sources.list apt-get -o Acquire::Check-Valid-Until=false update -apt-get install -y --no-install-recommends ca-certificates git pkg-config libssl-dev +apt-get install -y --no-install-recommends ca-certificates git lld pkg-config libssl-dev rm -rf /var/lib/apt/lists/* install -m 0755 .ci/bun /usr/local/bin/bun test "$(bun --version)" = "1.3.14" command -v cargo >/dev/null +command -v ld.lld >/dev/null From fa16746212d2dfc4023ccac597de20107d3fdb47 Mon Sep 17 00:00:00 2001 From: usr-bin-roygbiv Date: Tue, 21 Jul 2026 15:08:35 +0000 Subject: [PATCH 8/8] test(ci): require native build headroom --- scripts/cluster-ci/cluster-ci-contract.test.mjs | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/scripts/cluster-ci/cluster-ci-contract.test.mjs b/scripts/cluster-ci/cluster-ci-contract.test.mjs index 1422325a..7efe4a1d 100644 --- a/scripts/cluster-ci/cluster-ci-contract.test.mjs +++ b/scripts/cluster-ci/cluster-ci-contract.test.mjs @@ -281,6 +281,16 @@ test("Woodpecker keeps upstream gates and serializes bounded cluster publication ); assert.match(legacyInstaller, /apt-get install[^\n]*\blld\b/u); assert.match(legacyInstaller, /command -v ld\.lld >\/dev\/null/u); + assert.equal( + steps["legacy-authority-build"].backend_options.kubernetes.resources.limits.memory, + "6Gi", + ); + assert.equal( + steps["legacy-authority-build"].backend_options.kubernetes.resources.limits[ + "ephemeral-storage" + ], + "12Gi", + ); assert.deepEqual(steps["legacy-authority-build"].commands, [ "sh scripts/cluster-ci/install-legacy-authority-toolchain.sh", "(cd .continuity/omp && bun install --frozen-lockfile)",