CI: Gate on C23 compilers; move older compilers to canaries by flyingrobots · Pull Request #159 · flyingrobots/git-mind

flyingrobots · 2025-09-12T08:32:53Z

CI: Gate on C23 compilers; canaries for older

Summary

Add C23 gating with gcc-14 and clang-20 (required checks)
Add non-blocking canaries: gcc-12, gcc-13, clang-18, clang-19
Refactor gauntlet Dockerfile: add gcc-14 stage; share test runner in base; slim apt installs with --no-install-recommends and cleanup
Add CI strategy doc and align workflows with main

Related Issue

None (infrastructure improvement)

Type of Change

Testing

Local Docker build/tests: ./tools/docker-build.sh and ./tools/docker-test.sh — all unit tests pass
Verified gauntlet images build locally (smoke) and CI jobs pass (gcc-14, clang-20)
CI green on Actions for this PR (gating + canaries)

Checklist

Builds and tests pass locally in Docker
CI green (required checks)
Docs updated (docs/CI_STRATEGY.md)
No secrets committed

Summary by CodeRabbit

Chores
- Restructured CI into must-pass gating (gcc-14, clang-20) and non-blocking canaries (older compilers) for clearer signals.
- Streamlined workflow steps, standardized artifact paths, and clarified log messages.
- Adopted a unified, deterministic Docker-based test runner to speed up and stabilize builds.
Documentation
- Added CI strategy guide detailing gating vs canaries, static analysis policy, build environment, and planned enhancements.

…ing canaries; add docs/CI_STRATEGY.md; add gcc-14 target to gauntlet Dockerfile

coderabbitai · 2025-09-12T08:32:59Z

📝 Walkthrough

Walkthrough

Workflow narrows gating compilers to gcc-14 and clang-20, adds non-blocking canary compilers, and sets minimal workflow permissions. New CI strategy doc added. Dockerfile reorganized around Ubuntu 24.04 base-noble with a shared /test-compiler.sh runner and a new gcc-14 stage.

Changes

Cohort / File(s)	Summary
GitHub Actions workflow `.github/workflows/gauntlet.yml`	Adds `permissions.contents: read`. Renames job `gauntlet` → `gating` (name "C23 Gating Compilers"). Narrows gating matrix to `[gcc-14, clang-20]`. Replaces named checkout/buildx steps with `uses: actions/checkout@v4` and `uses: docker/setup-buildx-action@v3`. Appends "(gating)" to build/run messages. Changes artifact `path` to `build/`. Adds `canary` job "Compat Canaries (non-blocking)" that `needs: [gating]`, `continue-on-error: true`, matrix `[gcc-12, gcc-13, clang-18, clang-19]`, uses similar steps with "(canary)" messaging and uploads `build/` with `retention-days: 7`.
CI strategy docs `docs/CI_STRATEGY.md`	New document describing gating vs. canary workflows, compiler matrices, clang-tidy-20 enforcement with baseline, deterministic Docker builds, Meson/Ninja usage, CRoaring handling, image naming, and future enhancement ideas.
Gauntlet Dockerfile refactor `tools/gauntlet/Dockerfile.gauntlet`	Adds `base-noble` (`FROM ubuntu:24.04 AS base-noble`) with common deps (including `libroaring-dev`) and `/test-compiler.sh` + `CMD`. Adds `gcc-14` stage (`FROM base-noble AS gcc-14`) with `ENV CC=gcc-14` / `CXX=g++-14`. Consolidates testing onto shared runner, removes standalone clang-20 standalone stage, and applies stage declaration formatting changes.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor Dev as Developer
  participant GH as GitHub Actions
  participant Gate as Job: gating (gcc-14, clang-20)
  participant Can as Job: canary (gcc-12, gcc-13, clang-18, clang-19)

  Dev->>GH: Push/PR triggers workflow
  GH->>Gate: Start gating matrix (parallel)
  Note over Gate: Checkout → Setup Buildx → Docker build → Test\nUpload logs to build/
  Gate-->>GH: Results (required)

  GH->>Can: Start canary matrix (needs: gating), continue-on-error
  Note over Can: Checkout → Setup Buildx → Docker build → Test\nUpload logs to build/ (retention 7d)
  Can-->>GH: Results (informational)

  GH-->>Dev: Report statuses — gating required, canaries non-blocking

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title Check	✅ Passed	The title succinctly and accurately summarizes the primary change: gating CI on modern C23 compilers while moving older compilers to non-blocking canaries. It directly matches the changeset (gating: gcc-14 and clang-20; canaries: gcc-12, gcc-13, clang-18, clang-19) and is concise and specific. There are no extraneous details or emojis.
Description Check	✅ Passed	The PR description maps well to the repository template: it explains the change, provides a Related Issue section (marked "None"), marks Type of Change checkboxes, documents testing (local and CI), and includes a checklist, so it is mostly complete and informative. Minor cosmetic deviations exist (the header uses "Summary" rather than the template's "Description" and there is no "Fixes #" line, which is acceptable if no issue applies). Overall the description contains the required information and supports review.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch ci-c23-gating

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…: contents: read)

…o base; fix AS casing

coderabbitai

Actionable comments posted: 7

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (5)

tools/gauntlet/Dockerfile.gauntlet (4)
20-43: Normalize Dockerfile syntax and slim images.

Use uppercase AS to satisfy linters.

Add --no-install-recommends and clean apt lists in all RUN apt-get blocks.

Example (apply similarly to gcc-12/13, clang-18/19/20 stages):
-FROM base as gcc-12
+FROM base AS gcc-12
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     software-properties-common \
     wget \
     gnupg && \
     add-apt-repository ppa:ubuntu-toolchain-r/test -y && \
     apt-get update && \
-    apt-get install -y gcc-12 g++-12
+    apt-get install -y gcc-12 g++-12 && \
+    rm -rf /var/lib/apt/lists/*
92-133: Avoid redefining the final default stage solely for script; inherit from base instead.

If you keep a default image, derive it from clang-20 but do not duplicate script/CMD there after moving them to base. Otherwise remove the trailing default stage to avoid confusion.
-# Default to clang-20 for standalone usage
-FROM clang-20
-
-# Simple test script that works with any compiler
-... long script creation ...
-WORKDIR /workspace
-CMD ["/test-compiler.sh"]
+# Default to clang-20 for standalone usage (inherits script/CMD from base)
+FROM clang-20
1-132: Optional: HEALTHCHECK and non-root.

Add a simple HEALTHCHECK (e.g., $CC --version) to appease CKV_DOCKER_2.

Non-root user improves hardening (CKV_DOCKER_3), but beware mounted volume perms on GitHub runners. If you switch to USER ci, also run docker with --user or adjust ownership of /workspace.

1-92: Move test runner, WORKDIR and CMD into the base stage so all compiler stages inherit them.
The /test-compiler.sh creation plus WORKDIR /workspace and CMD are only present in the clang-20 final stage (lines 96–132); move that RUN (script creation) and the WORKDIR/CMD into the base stage immediately after the package installation (meson) and remove the final-stage block.
.github/workflows/gauntlet.yml (1)
1-8: Add minimal GITHUB_TOKEN permissions.

Harden the workflow per CodeQL suggestion.
 name: GNU CRY GAUNTLET
 
 on:
   push:
     branches: [ main ]
   pull_request:
     branches: [ main ]
+
+permissions:
+  contents: read

📜 Review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c0cff2f and 21492ed.

📒 Files selected for processing (3)

.github/workflows/gauntlet.yml (1 hunks)
docs/CI_STRATEGY.md (1 hunks)
tools/gauntlet/Dockerfile.gauntlet (2 hunks)

🧰 Additional context used

🪛 markdownlint-cli2 (0.17.2)

docs/CI_STRATEGY.md

4-4: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below