fix(committee): container mount escape, streaming-window order, cance… #230
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | |
| # This workflow calls the main distribution pipeline from DuckDB to build, test and (optionally) release the extension | |
| # | |
| name: Main Extension Distribution Pipeline | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || '' }}-${{ github.base_ref || '' }}-${{ github.ref != 'refs/heads/main' && github.sha || '' }} | |
| cancel-in-progress: true | |
| # jobs: | |
| # duckdb-stable-build: | |
| # name: Build extension binaries | |
| # uses: duckdb/extension-ci-tools/.github/workflows/_extension_distribution.yml@v1.5.3 | |
| # with: | |
| # duckdb_version: v1.5.3 | |
| # ci_tools_version: v1.5.3 | |
| # extension_name: vgi | |
| jobs: | |
| header-hygiene: | |
| name: Header hygiene (fan-out guardrail) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Enforce heavy-include denylist on hub headers | |
| # Fails if a guarded hub header (see GUARDED_HEADERS in the script / | |
| # CLAUDE.md "Header hygiene") transitively pulls in the Arrow umbrella. | |
| # Pure source scan — no build needed. | |
| run: python3 scripts/header_reach.py --check | |
| duckdb-stable-build: | |
| name: Build extension binaries | |
| uses: Query-farm-haybarn/haybarn-extension-ci-tools/.github/workflows/_extension_distribution.yml@haybarn | |
| secrets: | |
| vcpkg_token: ${{ secrets.HAYBARN_VCPKG_TOKEN }} | |
| with: | |
| duckdb_version: haybarn-v1.5.3-rc10 | |
| ci_tools_version: haybarn | |
| override_ci_tools_repository: 'Query-farm-haybarn/haybarn-extension-ci-tools' | |
| extension_name: vgi | |
| use_prebuilt_images: true | |
| use_prebuilt_wasm_image: true | |
| prebuilt_image_tag: v1.5.3 | |
| extra_toolchains: parser_tools | |
| # Run the SQL integration suite against the built extension. CI previously only | |
| # built + checked header hygiene, so the 200+ .test integration files never ran | |
| # (they require VGI_TEST_WORKER + the sibling vgi-python fixture workers, which | |
| # the build job doesn't provide). This job closes that gap using the LAUNCHER | |
| # transport (`make test_launcher`): one warm shared worker per argv, no per-test | |
| # cold start, so the whole suite runs serially-but-fast. vgi-python is public, | |
| # so no token is needed to check it out. | |
| integration-tests: | |
| name: Integration tests (launcher transport) | |
| needs: duckdb-stable-build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout extension | |
| uses: actions/checkout@v4 | |
| with: | |
| # Need the extension-ci-tools submodule so the Makefile's `include` | |
| # resolves; recursive keeps it robust against nested includes. | |
| submodules: recursive | |
| - name: Checkout vgi-python (fixture workers) | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: Query-farm/vgi-python | |
| path: vgi-python | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| - name: Sync vgi-python | |
| run: uv sync --project vgi-python | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: artifacts | |
| - name: Stage the unittest binary where make test_launcher expects it | |
| run: | | |
| set -euo pipefail | |
| # The distribution build compiles test/unittest (the SQL-logic-test | |
| # runner). Locate the Linux build among the downloaded artifacts and | |
| # stage it at build/release/test/unittest. Prefer a linux_amd64 path so | |
| # we never pick a macOS/Windows sibling that won't run on this runner. | |
| bin="$(find artifacts -type f -name unittest -path '*linux*amd64*' | head -n1)" | |
| if [ -z "$bin" ]; then | |
| bin="$(find artifacts -type f -name unittest | head -n1)" | |
| fi | |
| if [ -z "$bin" ]; then | |
| echo "::error::No 'unittest' binary found in build artifacts. make test_launcher needs build/release/test/unittest; ensure the distribution build uploads it." | |
| find artifacts -maxdepth 4 -type f | sort | |
| exit 1 | |
| fi | |
| echo "Using unittest binary: $bin" | |
| mkdir -p build/release/test | |
| cp "$bin" build/release/test/unittest | |
| chmod +x build/release/test/unittest | |
| - name: Run launcher-transport integration suite | |
| env: | |
| # The Makefile prefixes each of these with `launch:` for test_launcher, | |
| # so the launcher spawns `uv run … <fixture-worker>` per unique argv. | |
| VGI_TEST_WORKER: uv run --project ${{ github.workspace }}/vgi-python vgi-fixture-worker | |
| VGI_VERSIONED_WORKER: uv run --project ${{ github.workspace }}/vgi-python vgi-fixture-versioned-worker | |
| VGI_VERSIONED_TABLES_WORKER: uv run --project ${{ github.workspace }}/vgi-python vgi-fixture-versioned-tables-worker | |
| VGI_ATTACH_OPTIONS_WORKER: uv run --project ${{ github.workspace }}/vgi-python vgi-fixture-attach-options-worker | |
| VGI_BAD_PROTOCOL_WORKER: uv run --project ${{ github.workspace }}/vgi-python vgi-fixture-bad-protocol-worker | |
| VGI_BAD_ENUM_WORKER: uv run --project ${{ github.workspace }}/vgi-python vgi-fixture-bad-enum-worker | |
| VGI_SIMPLE_WRITABLE_WORKER: uv run --project ${{ github.workspace }}/vgi-python vgi-fixture-simple-writable-worker | |
| run: make test_launcher |