Illia Polosukhin d3c5d24898 ci: static pre-push checks — include_str/Docker-COPY + hermetic env (#6018) (#6022) ...

* ci: add static pre-push checks — include_str/Docker-COPY + hermetic env (#6018)

Categorized main-branch CI history showed the deterministic (non-flaky)
breakages share one trait: a cheap static check would catch them, but the
pre-push gate ran none. Adds three checks mapped to the failure classes.

1. include_str! path + Docker-COPY coverage (scripts/ci/check-include-str-paths.sh)
   Every include_str!("…") target must exist AND be present in the build
   context of each Dockerfile that compiles the referencing crate. Guards the
   #5603 Docker outage class (host build passes, Docker build fails because a
   repo-root prompts/ dir was never COPYd). Excludes #[cfg(test)] includes and
   COPY . . images; attributes per-Dockerfile so Dockerfile.reborn is never
   blamed for a src/ prompt it doesn't compile.
   This surfaced a real latent bug: Dockerfile.test builds --bin ironclaw but
   omitted COPY prompts/ / profiles/ / providers.json (all required by prod
   consts) — fixed here.

2. Hermetic env guard (scripts/ci/check-hermetic-env.sh)
   Delta + function-scoped (git diff -W): flags only newly-added raw
   std::env::set_var/remove_var whose enclosing function lacks an env lock
   guard (lock_env/lock_runtime_env/ENV_MUTEX/EnvGuard). Targets the #6015
   coverage-flake class and Rust 1.82 set_var UB. Quiet on the ~700 existing
   sites; honors // env-hermetic: for genuine single-threaded cases.

3. libsql-only clippy leg
   Added to the pre-push strict branch and quality_gate_strict.sh. Catches the
   cfg/dead_code class (#5840 Prebuilt) that default-feature clippy misses.

Wiring: checks 1 & 2 run on every pre-push (no compile); check 3 under
IRONCLAW_STRICT_LINT. New required code_style.yml `static-checks` job runs
check 1 + both self-test suites (14 cases) server-side.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci: harden static pre-push checks per PR #6022 review

Addresses review findings on the include_str/Docker-COPY and hermetic-env
static checks. Each fix ships with a regression case in the self-tests.

check-include-str-paths.sh:
- cfg_test_spans: stop a braceless `#[cfg(test)]` item (e.g. `use x;`) at
  the first `;` instead of running forward to the next unrelated `{`, which
  swallowed real code and hid its include_str! calls (false negative).
- Track full normalized COPY paths and add an `is_covered` nested-path
  check so a narrowed `COPY crates/foo/` covers crates/foo but not sibling
  crates (previously top-segment matching treated all of crates/ as copied).
- Scan the repo-root build.rs (cargo build compiles it too) and flag
  include_str! targets that resolve outside the repo — they exist on the
  host but no Docker COPY can ever include them.

check-hermetic-env.sh:
- Prefer GITHUB_BASE_REF for base-ref resolution so the check works on a
  shallow CI checkout that lacks origin/main.
- Drop `|| true` on the git diff so a diff failure aborts instead of
  silently yielding an empty diff that bypasses the guard.
- Strip `//` comments before the guard-token test so a bare `// EnvGuard`
  comment no longer exempts an adjacent raw set_var.

code_style.yml:
- Broaden the has_code predicate to cover scripts/ci/, .githooks/, and all
  Dockerfile* so changes to the guardrails themselves run static-checks
  instead of being skipped (and accepted by the rollup).
- Run check-hermetic-env.sh against the actual PR diff, not just the
  synthetic self-tests, fetching the PR base tip first.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-13 20:09:35 -07:00

9.7 KiB

Executable File

Raw Permalink Blame History

View Raw