Gate publishing on a smoke test, and listen to JoltPhysicsC - #9
Merged
Conversation
The CD published on its own every month. `publish-enabled` read `!inputs.skip-assets-publishing`, and a scheduled run has no inputs to negate, so the expression evaluated true: the cron pushed to nuget.org without anybody looking, and did so exactly when the generated API had moved and the risk was highest. Nothing verified the package before that. The CD proves it builds; it links nothing, loads nothing and calls nothing, so a package carrying the wrong natives, or none at all for a runtime identifier, is indistinguishable from a good one until somebody installs it. So publishing moves behind a gate. The CD packs with `publish-enabled: false`, a new smoke job installs that exact artifact on the five identifiers a runner can execute and drops a sphere onto a floor through the native library, and only if every leg passes does the publish job start. The three are chained by `needs` inside one run, which sidesteps correlating runs and artifacts across workflows. The scenario is the HelloWorld sample, with two differences that matter: it references the package rather than the project, so the runtimes/ layout and the native library resolution are part of what is under test, and it asserts rather than prints -- the sphere has to fall, has to settle, and has to settle on the floor rather than through it. It is also capped at 600 steps, because a binding that never settles should fail the job rather than hang it. Five of the ten identifiers, and the gap is stated in the workflow rather than left to be discovered: android, iOS and browser-wasm ship in the package and no runner can execute a console application on them. The repository_dispatch trigger closes the other half. The cron fired day 1 at 03:00 and JoltPhysicsC's porter runs day 2 at 05:00, so the monthly look happened 26 hours before there was anything to find, and cutting the release is a manual step after that -- a version of JoltPhysics took two months to arrive rather than one. The cron stays as a safety net, so a lost dispatch delays the chain instead of stopping it forever.
Contributor
API gate: additiveEvery symbol that existed still exists, unchanged. Nothing that compiled before stops compiling.
Enum and constant values are part of the measured surface: a renumbering keeps compiling and sends the wrong number to the driver, so it counts as a removal. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two problems, one shape.
The CD published unattended.
publish-enabledread!inputs.skip-assets-publishing, and a scheduled run has no inputs to negate, so it evaluated true. The monthly cron pushed to nuget.org on its own, and only when the generated API had changed — the moment with the most risk.Nothing ran the package first. The CD proves it builds. It links nothing and calls nothing, so a package with the wrong natives, or none for a runtime identifier, looks exactly like a good one.
What changes
cd→smoke→publish, chained byneedsin a single run. The CD packs withpublish-enabled: false; the smoke job installs that exact artifact and drops a sphere onto a floor through the native library; publish starts only if every leg is green.The test references the package, not the project, so
runtimes/and the native library resolution are part of what is tested. It asserts rather than prints — the sphere must fall, must settle, and must settle on the floor — and caps at 600 steps so a binding that never settles fails rather than hangs.Five of the ten identifiers. android, iOS and browser-wasm ship in the package and no runner can execute a console app on them; the workflow says so rather than leaving it to be discovered.
And the trigger
repository_dispatch: [upstream-released], sent by JoltPhysicsC when it cuts a release. The cron fired day 1 at 03:00 and the porter runs day 2 at 05:00, so the monthly look happened 26 hours early — a version took two months to arrive rather than one. The cron stays as a safety net.Verified locally against the published 2026.8.4.12 on win-x64:
Same structure merged in Cesium.NET, where the five legs are green in CI.