From 8421b101be25d46c0252cb0558098f6d1b36afd6 Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 10:02:23 +0800 Subject: [PATCH 1/8] ci: pin the build tool this package was released against MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pin was several releases behind, so what CI validated was not what the ecosystem resolves. 2026.8.24.6 is the version this package's current contents were released alongside — openkal 0.7.0 and the implementations that follow it. A version verified to build this package, not a measured minimum: the pin exists for reproducibility rather than because an older mcpp is known to fail. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a894f18..ec93ce2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 40 env: - MCPP_VERSION: 2026.8.20.2 + MCPP_VERSION: 2026.8.24.6 XLINGS_VERSION: v2026.8.17.2 XLINGS_NON_INTERACTIVE: '1' steps: @@ -141,7 +141,7 @@ jobs: run: shell: bash env: - MCPP_VERSION: 2026.8.20.2 + MCPP_VERSION: 2026.8.24.6 XLINGS_VERSION: v2026.8.17.2 XLINGS_NON_INTERACTIVE: '1' steps: From 9ea56e550123782ee0f6089b7b3f2ea6f80e3c9b Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 17:09:26 +0800 Subject: [PATCH 2/8] =?UTF-8?q?ci:=20pin=202026.8.25.1=20=E2=80=94=20the?= =?UTF-8?q?=20release=20that=20fixes=20what=202026.8.24.6=20broke?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ec93ce2..fd3a3df 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 40 env: - MCPP_VERSION: 2026.8.24.6 + MCPP_VERSION: 2026.8.25.1 XLINGS_VERSION: v2026.8.17.2 XLINGS_NON_INTERACTIVE: '1' steps: @@ -141,7 +141,7 @@ jobs: run: shell: bash env: - MCPP_VERSION: 2026.8.24.6 + MCPP_VERSION: 2026.8.25.1 XLINGS_VERSION: v2026.8.17.2 XLINGS_NON_INTERACTIVE: '1' steps: From 6bb79dd4832c8e03c52c1883d84117860603a893 Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 19:23:39 +0800 Subject: [PATCH 3/8] ci: validate against the mcpp under review, before it is released MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Several mcpp releases went out green and only then turned this ecosystem red. The engine's own CI cannot see a defect that appears only in a real dependency graph, and this repository could not see the engine until it had been published — so the first place the two met was after the release. `MCPP_SOURCE_REF` (a workflow_dispatch input, or a repository variable) names a branch of mcpp-community/mcpp. When set, every job builds that source with the released mcpp as bootstrap and puts the result first on PATH; when empty the job tests the released pin exactly as before. Also re-pins to 2026.8.25.2, which fixes what this repository last failed on. --- .github/workflows/ci.yml | 66 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 64 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fd3a3df..ffa0eae 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,6 +5,14 @@ on: branches: [main] pull_request: workflow_dispatch: + inputs: + mcpp_ref: + description: "Branch of mcpp-community/mcpp to build and test against (empty = the released pin)" + required: false + default: "" +env: + MCPP_SOURCE_REF: ${{ github.event.inputs.mcpp_ref || vars.MCPP_SOURCE_REF }} + MCPP_SOURCE_REF: ${{ github.event.inputs.mcpp_ref || vars.MCPP_SOURCE_REF }} jobs: build: @@ -12,7 +20,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 40 env: - MCPP_VERSION: 2026.8.25.1 + MCPP_VERSION: 2026.8.25.2 XLINGS_VERSION: v2026.8.17.2 XLINGS_NON_INTERACTIVE: '1' steps: @@ -57,6 +65,33 @@ jobs: done mcpp --version mcpp self config --mirror GLOBAL + # ⭐⭐ CROSS-VALIDATION: BUILD THE mcpp UNDER REVIEW AND USE THAT ONE. + # + # Empty in the ordinary run, so this job keeps testing the RELEASED + # mcpp the pin above names. Set it — `workflow_dispatch` input, or the + # repository variable — and the same job runs against that source. + # + # ⚠️ THIS EXISTS BECAUSE THE ORDER USED TO BE WRONG. Several mcpp + # releases went out green and only then turned this ecosystem red: the + # engine's own CI cannot see a defect that appears only in a real + # dependency graph, and this repository could not see the engine until + # it had been published. Validating before the release closes that gap. + # + # The released mcpp installed just above is the bootstrap that compiles + # it; mcpp builds itself and there is no other compiler for it here. + if [ -n "${MCPP_SOURCE_REF:-}" ]; then + src="$RUNNER_TEMP/mcpp-src" + [ -d "$src" ] || git clone --quiet --depth 1 \ + --branch "$MCPP_SOURCE_REF" \ + https://github.com/mcpp-community/mcpp.git "$src" + ( cd "$src" && mcpp build --release ) + built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) + [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } + echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH" + # ⚠️ Reported, because a PATH entry that does not win looks exactly + # like one that does until something built with the wrong engine. + echo "under review: $("$built" --version) (from $MCPP_SOURCE_REF)" + fi - name: Install OVMF and qemu run: sudo apt-get update && sudo apt-get install -y --no-install-recommends ovmf qemu-system-x86 @@ -141,7 +176,7 @@ jobs: run: shell: bash env: - MCPP_VERSION: 2026.8.25.1 + MCPP_VERSION: 2026.8.25.2 XLINGS_VERSION: v2026.8.17.2 XLINGS_NON_INTERACTIVE: '1' steps: @@ -196,6 +231,33 @@ jobs: done mcpp --version mcpp self config --mirror GLOBAL + # ⭐⭐ CROSS-VALIDATION: BUILD THE mcpp UNDER REVIEW AND USE THAT ONE. + # + # Empty in the ordinary run, so this job keeps testing the RELEASED + # mcpp the pin above names. Set it — `workflow_dispatch` input, or the + # repository variable — and the same job runs against that source. + # + # ⚠️ THIS EXISTS BECAUSE THE ORDER USED TO BE WRONG. Several mcpp + # releases went out green and only then turned this ecosystem red: the + # engine's own CI cannot see a defect that appears only in a real + # dependency graph, and this repository could not see the engine until + # it had been published. Validating before the release closes that gap. + # + # The released mcpp installed just above is the bootstrap that compiles + # it; mcpp builds itself and there is no other compiler for it here. + if [ -n "${MCPP_SOURCE_REF:-}" ]; then + src="$RUNNER_TEMP/mcpp-src" + [ -d "$src" ] || git clone --quiet --depth 1 \ + --branch "$MCPP_SOURCE_REF" \ + https://github.com/mcpp-community/mcpp.git "$src" + ( cd "$src" && mcpp build --release ) + built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) + [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } + echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH" + # ⚠️ Reported, because a PATH entry that does not win looks exactly + # like one that does until something built with the wrong engine. + echo "under review: $("$built" --version) (from $MCPP_SOURCE_REF)" + fi - name: The EFI application cross-builds run: | From 5c399bffc6c844a89293f7f0c5802ba741d8babe Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 19:24:40 +0800 Subject: [PATCH 4/8] ci: one MCPP_SOURCE_REF definition, not two --- .github/workflows/ci.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ffa0eae..6785540 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,6 @@ on: default: "" env: MCPP_SOURCE_REF: ${{ github.event.inputs.mcpp_ref || vars.MCPP_SOURCE_REF }} - MCPP_SOURCE_REF: ${{ github.event.inputs.mcpp_ref || vars.MCPP_SOURCE_REF }} jobs: build: From 5c69bb0649cc02e1fb9d788d5842540977b664b0 Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 19:35:41 +0800 Subject: [PATCH 5/8] ci: bootstrap from the index when validating an unreleased mcpp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pin may name the very release the run is validating, which does not exist yet — that is what MCPP_SOURCE_REF is for. Bootstrap from whatever the index has; the build under review replaces it a step later. --- .github/workflows/ci.yml | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6785540..06f2fa9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -54,7 +54,15 @@ jobs: # of the two situations it is. for attempt in 1 2 3 4 5 6; do xlings update > /dev/null 2>&1 || true - if xlings install "mcpp@$MCPP_VERSION" -y -g; then break; fi + if # ⚠️ THE PIN MAY NAME THE RELEASE THIS RUN IS VALIDATING, which does + # not exist yet — that is the whole point of MCPP_SOURCE_REF. Bootstrap + # from whatever the index has; the step below replaces it with the + # build under review, and the pin is what an ordinary run tests. + if [ -n "${MCPP_SOURCE_REF:-}" ]; then + xlings install mcpp -y -g + else + xlings install "mcpp@$MCPP_VERSION" -y -g + fi; then break; fi if [ "$attempt" = 6 ]; then echo "::error::mcpp@$MCPP_VERSION never appeared in the index (6 attempts over 5 minutes). If it was just released, the pointer has not propagated; if the pin names a version that was never published, it never will." exit 1 @@ -220,7 +228,15 @@ jobs: # of the two situations it is. for attempt in 1 2 3 4 5 6; do xlings update > /dev/null 2>&1 || true - if xlings install "mcpp@$MCPP_VERSION" -y -g; then break; fi + if # ⚠️ THE PIN MAY NAME THE RELEASE THIS RUN IS VALIDATING, which does + # not exist yet — that is the whole point of MCPP_SOURCE_REF. Bootstrap + # from whatever the index has; the step below replaces it with the + # build under review, and the pin is what an ordinary run tests. + if [ -n "${MCPP_SOURCE_REF:-}" ]; then + xlings install mcpp -y -g + else + xlings install "mcpp@$MCPP_VERSION" -y -g + fi; then break; fi if [ "$attempt" = 6 ]; then echo "::error::mcpp@$MCPP_VERSION never appeared in the index (6 attempts over 5 minutes). If it was just released, the pointer has not propagated; if the pin names a version that was never published, it never will." exit 1 From 713b38ed5cf613ab7ad2c239e40b27b383be84ab Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 19:44:00 +0800 Subject: [PATCH 6/8] ci: the clone's workspace pin does not decide which mcpp builds it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `.xlings.json` at mcpp's root pins the mcpp that compiles mcpp, and that pin does not move when mcpp is released — a build inside the checkout obeys it and installs a version the index may no longer carry. What this step wants is the source compiled by the mcpp installed a moment earlier. --- .github/workflows/ci.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 06f2fa9..9acdfdd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -91,6 +91,18 @@ jobs: [ -d "$src" ] || git clone --quiet --depth 1 \ --branch "$MCPP_SOURCE_REF" \ https://github.com/mcpp-community/mcpp.git "$src" + # ⚠️ THE CLONE'S OWN WORKSPACE PIN MUST NOT DECIDE WHICH mcpp + # BUILDS IT. `.xlings.json` at mcpp's root pins the mcpp that + # compiles mcpp, and that pin does not move when mcpp is released — + # so a build inside the checkout obeys it and tries to install a + # version the index may no longer carry: + # + # [error] xlings: version '2026.8.17.1' not found for 'mcpp' + # available: 2026.8.25.1 + # + # What is wanted here is the source compiled by the mcpp installed + # above, which is exactly what removing the file leaves. + rm -f "$src/.xlings.json" ( cd "$src" && mcpp build --release ) built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } @@ -265,6 +277,18 @@ jobs: [ -d "$src" ] || git clone --quiet --depth 1 \ --branch "$MCPP_SOURCE_REF" \ https://github.com/mcpp-community/mcpp.git "$src" + # ⚠️ THE CLONE'S OWN WORKSPACE PIN MUST NOT DECIDE WHICH mcpp + # BUILDS IT. `.xlings.json` at mcpp's root pins the mcpp that + # compiles mcpp, and that pin does not move when mcpp is released — + # so a build inside the checkout obeys it and tries to install a + # version the index may no longer carry: + # + # [error] xlings: version '2026.8.17.1' not found for 'mcpp' + # available: 2026.8.25.1 + # + # What is wanted here is the source compiled by the mcpp installed + # above, which is exactly what removing the file leaves. + rm -f "$src/.xlings.json" ( cd "$src" && mcpp build --release ) built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } From 212b0249c10f35df29d0c3c739590f859ba3eb77 Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 19:48:38 +0800 Subject: [PATCH 7/8] ci: note why the fresh clone needs no mtime sort MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The mcpp side of this cross-validation had to sort by mtime — its target/ is restored from a cache and `find … | head -1` returned a binary an earlier push had left, with the right version string and the wrong code. Here $src is a fresh clone, so the plain form is correct; `-printf` is a GNU extension and one of the runners reaching this line is macOS. --- .github/workflows/ci.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9acdfdd..a5b540e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -104,6 +104,11 @@ jobs: # above, which is exactly what removing the file leaves. rm -f "$src/.xlings.json" ( cd "$src" && mcpp build --release ) + # ⭐ `$src` is a FRESH clone each run, so `target/` holds exactly what + # this step just built and there is no earlier fingerprint directory + # to pick by mistake. `-printf` would be the safer form on a cached + # tree and is a GNU extension this must not use — one of the runners + # that reaches this line is macOS. built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH" @@ -290,6 +295,11 @@ jobs: # above, which is exactly what removing the file leaves. rm -f "$src/.xlings.json" ( cd "$src" && mcpp build --release ) + # ⭐ `$src` is a FRESH clone each run, so `target/` holds exactly what + # this step just built and there is no earlier fingerprint directory + # to pick by mistake. `-printf` would be the safer form on a cached + # tree and is a GNU extension this must not use — one of the runners + # that reaches this line is macOS. built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH" From f1f31684c4f554712cbd66ef540a479442b7b40b Mon Sep 17 00:00:00 2001 From: sunrisepeak Date: Tue, 25 Aug 2026 20:10:14 +0800 Subject: [PATCH 8/8] ci: find the built mcpp by either spelling, on every runner MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The matrix reaches Windows and macOS. Measured on the Windows row: `Finished release [optimized] in 173.44s` followed by "mcpp did not build" — the build had succeeded and the search was looking for a name that filesystem does not use. --- .github/workflows/ci.yml | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a5b540e..c82717b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -104,12 +104,18 @@ jobs: # above, which is exactly what removing the file leaves. rm -f "$src/.xlings.json" ( cd "$src" && mcpp build --release ) - # ⭐ `$src` is a FRESH clone each run, so `target/` holds exactly what - # this step just built and there is no earlier fingerprint directory - # to pick by mistake. `-printf` would be the safer form on a cached - # tree and is a GNU extension this must not use — one of the runners - # that reaches this line is macOS. - built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) + # ⚠️ BOTH SPELLINGS, AND NO `-perm`. The matrix reaches Windows and + # macOS runners too: on Windows the artefact is `mcpp.exe`, and + # `-perm -u+x` is not a question that filesystem answers the way this + # expects. Measured: `Finished release [optimized] in 173.44s` + # followed by "mcpp did not build" — the build had succeeded and the + # search was looking for the wrong name. + # + # `$src` is a FRESH clone each run, so `target/` holds exactly what + # this step just built; `-printf` would be the safer form on a cached + # tree and is a GNU extension this must not use. + built=$(find "$src/target" -type f \ + \( -name mcpp -o -name mcpp.exe \) | head -1) [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH" # ⚠️ Reported, because a PATH entry that does not win looks exactly @@ -295,12 +301,18 @@ jobs: # above, which is exactly what removing the file leaves. rm -f "$src/.xlings.json" ( cd "$src" && mcpp build --release ) - # ⭐ `$src` is a FRESH clone each run, so `target/` holds exactly what - # this step just built and there is no earlier fingerprint directory - # to pick by mistake. `-printf` would be the safer form on a cached - # tree and is a GNU extension this must not use — one of the runners - # that reaches this line is macOS. - built=$(find "$src/target" -type f -name mcpp -perm -u+x | head -1) + # ⚠️ BOTH SPELLINGS, AND NO `-perm`. The matrix reaches Windows and + # macOS runners too: on Windows the artefact is `mcpp.exe`, and + # `-perm -u+x` is not a question that filesystem answers the way this + # expects. Measured: `Finished release [optimized] in 173.44s` + # followed by "mcpp did not build" — the build had succeeded and the + # search was looking for the wrong name. + # + # `$src` is a FRESH clone each run, so `target/` holds exactly what + # this step just built; `-printf` would be the safer form on a cached + # tree and is a GNU extension this must not use. + built=$(find "$src/target" -type f \ + \( -name mcpp -o -name mcpp.exe \) | head -1) [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; } echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH" # ⚠️ Reported, because a PATH entry that does not win looks exactly