github-mirrors/netris-nestri
1
0
Fork 0
mirror of https://github.com/nestriness/nestri.git synced 2026-09-19 09:15:19 +03:00
Code Issues Packages Projects Releases Wiki Activity

ci(nesdoctor): cross-compile the Intel Mac target, and tag to a draft

Browse Source 
Two things a dispatch on 2026-09-02 exposed.

`macos-13` is being retired and the x86_64-apple-darwin job sat queued
indefinitely waiting for a runner, while the other three targets built and
smoke-tested in under three minutes. A release should not have that as a
dependency, so Intel macOS is now cross-compiled from the arm64 runner.

The cost is real and is stated rather than hidden: an x86_64 binary cannot be
executed on an arm64 runner without Rosetta, which these images do not carry,
so it is the one target whose smoke test cannot run. The matrix carries an
explicit `smoke` flag, the step is gated on it, and the generated release notes
say which binary is unexercised. Fabricating a pass for it would have been
easy and worse.

And a tag now produces a **draft** release rather than a published one. The
binaries get attached and the notes get written, then a person reads both and
presses publish -- which is the only step in this pipeline that cannot be
undone in public.

For the record, from the successful three: the musl smoke test measured the
network from inside the static binary -- `up=1635Mbps rtt=2ms bloat=+0ms
grade=A` -- so `ring` and the platform verifier do resolve root certificates in
a fully static build. That was the one thing about this release nobody could
have known without running it.
This commit is contained in:
Wanjohi
2026-09-02 13:05:53 +03:00
parent d01e4a180e
commit 09b9472134
1 changed files with 24 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
.github/workflows/release-nesdoctor.yml vendored
View File

@@ -32,17 +32,29 @@ jobs:
- os: ubuntu-latest
target: x86_64-unknown-linux-musl
bin: nesdoctor
smoke: true
- os: windows-latest
target: x86_64-pc-windows-msvc
bin: nesdoctor.exe
smoke: true
- os: macos-latest
target: aarch64-apple-darwin
bin: nesdoctor
# Intel Macs are still most of the installed base and they are
# clients, which is a category we want answers from.
- os: macos-13
smoke: true
# Intel Macs are still a large installed base and they are clients,
# which is a category we want answers from. Cross-compiled from the
# arm64 runner rather than built on `macos-13`: that runner is being
# retired and a dispatch on 2026-09-02 sat queued indefinitely
# waiting for one, which is not a dependency a release should have.
#
# The cost is honest and stated: an x86_64 binary cannot be executed
# on an arm64 runner without Rosetta, which these images do not
# carry, so this is the one target whose smoke test cannot run. It
# ships cross-compiled and unexercised, and the release notes say so.
- os: macos-latest
target: x86_64-apple-darwin
bin: nesdoctor
smoke: false
steps:
- uses: actions/checkout@v4
@@ -71,6 +83,7 @@ jobs:
# anybody runs this for, silently and only for other people. Running the
# real thing here catches that class of failure before a tag exists.
- name: Smoke test — the whole run, network included
if: matrix.smoke
shell: bash
run: |
set -euo pipefail
@@ -136,6 +149,10 @@ jobs:
- uses: softprops/action-gh-release@v2
with:
# A draft, always. The binaries are attached and the notes are
# written, and a person reads both and presses publish -- which is
# the only step in this pipeline that is irreversible in public.
draft: true
files: dist/*
generate_release_notes: true
body: |
@@ -151,6 +168,10 @@ jobs:
`SHA256SUMS`, and run it. On macOS and Linux you will need
`chmod +x` first. Source is in `apps/nesdoctor`.
The Intel macOS binary is cross-compiled and is the one target CI
cannot execute to test. Every other binary here was run by the
workflow that built it.
The number worth running it for is **added latency under load**.
Everybody knows their download speed; almost nobody has seen this
one, and for anything interactive it is the figure that decides it.