mirror of
https://github.com/stablyai/orca.git
synced 2026-10-19 08:03:13 +00:00
OrcaWinandm4air
d0d6977644
* feat(orcad): run orcad itself on Windows hosts (W2) * test(orcad): load the ConPTY smoke's addon from out/orcad so the temp slot can be removed * test(orcad): skip the foreign-uid lock case when running as root --------- Co-authored-by: m4air <m4air@Mac.localdomain>
89 lines
3.6 KiB
YAML
89 lines
3.6 KiB
YAML
name: Relay Windows process-tree addons
|
|
|
|
# Why a reusable workflow: every desktop package ships relays for Windows SSH hosts,
|
|
# but only a Windows runner can compile the addon that launches a relay outside
|
|
# sshd's job. macOS and Linux packaging jobs download this artifact into
|
|
# .build/windows-process-tree before `pnpm build:release` stages it.
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
ref:
|
|
description: Commit or tag to build; must match what the packaging job checks out.
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
# Why windows-2022: windows-latest moved to VS 2026 before node-gyp could detect
|
|
# it. GitHub-hosted, so release-cut's SignPath provenance rule still holds.
|
|
runs-on: windows-2022
|
|
timeout-minutes: 30
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
ref: ${{ inputs.ref }}
|
|
persist-credentials: false
|
|
|
|
# Plain setup rather than a composite action: `uses: ./` resolves from the
|
|
# checked-out ref, which may be a release tag that predates the action.
|
|
- name: Setup pnpm
|
|
uses: pnpm/setup@v2
|
|
with:
|
|
install: false
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: package.json
|
|
cache: pnpm
|
|
cache-dependency-path: pnpm-lock.yaml
|
|
|
|
# Why host-only: the addon is compiled from the patched source pnpm
|
|
# materializes, and arm64 cross-compiles through node-gyp --arch.
|
|
- name: Install dependencies
|
|
uses: nick-fields/retry@v4
|
|
with:
|
|
timeout_minutes: 10
|
|
max_attempts: 3
|
|
retry_wait_seconds: 30
|
|
command: pnpm install --frozen-lockfile
|
|
|
|
# The build script refuses unpatched source and checks each output's PE
|
|
# machine, ReadProcessMemory import, and spawnOutsideJob export.
|
|
- name: Build Windows process-table addons for the relay
|
|
shell: bash
|
|
run: |
|
|
node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=x64
|
|
node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=arm64
|
|
|
|
# orcad's instance lock and stop proof read one PID's creation time through this addon on
|
|
# Windows SSH hosts; prove the x64 binary this runner can load answers it, and answers
|
|
# nothing for a PID that does not exist rather than a stale or zero time.
|
|
- name: Assert the addon reads process creation time
|
|
shell: bash
|
|
run: |
|
|
node -e "
|
|
const { assertWindowsProcessTreeCreationTime } = require('./config/scripts/windows-process-tree-creation-time.cjs')
|
|
const addon = require('./.build/windows-process-tree/x64/windows-process-tree.node')
|
|
assertWindowsProcessTreeCreationTime({ module: addon })
|
|
const own = addon.getProcessCreationTime(process.pid)
|
|
const started = Date.now() - process.uptime() * 1000
|
|
if (typeof own !== 'number' || Math.abs(own - started) > 5000) throw new Error('creation time ' + own + ' vs ' + started)
|
|
if (addon.getProcessCreationTime(0x7ffffff0) !== undefined) throw new Error('a missing PID must read undefined')
|
|
console.log('creation time ok:', own)
|
|
"
|
|
|
|
- name: Upload relay addons
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: relay-windows-process-tree
|
|
path: .build/windows-process-tree/
|
|
if-no-files-found: error
|
|
retention-days: 7
|
|
# A rerun attempt re-uploads under the same name, which is otherwise refused.
|
|
overwrite: true
|