Repository navigation
Tier 1 and Tier 2 Gates: full matrix, Go 1.21.x, zero leftover, browser pin assertion #54
Description
Parent
Spec: #33 (Baseline release). Section numbers refer to its Implementation Decisions.
What to build
Every push and pull request proves wand on all four Tier 1 platforms with a real browser and -race, on the Go floor on both Linux runners, on the Companion Chromium on linux/amd64, and builds for the three Tier 2 targets; every browser job ends by proving no process was left behind. Spec section 13; ticket #20.
Acceptance criteria
- The pins name a Target Chrome of 153 or later (re-run the Roll tool by hand if needed, as its own roll-titled commit), so linux/arm64 has a downloadable build.
- Tier 1 jobs:
ubuntu-lateston Go stable and 1.21.x,ubuntu-24.04-armon stable and 1.21.x,windows-lateston stable,macos-lateston stable, andubuntu-lateston the Companion Chromium; each runs every package from the workspace root with-race; browsers come through the launcher's own download on every run. - Tier 2 jobs:
macos-15-intelandwindows-11-armnatively, linux/loong64 cross-compiled onubuntu-latest; each runs build, vet andgo test -run '^$'on 1.21.x and stable. - Each Tier 1 job asserts the printed browser version equals the pin, and ends with an
if: always()step that waits up to 30 s and fails on any surviving chrome or chromium process or leftover temporary user-data directory. - All jobs are required status checks on
main; SHA pins,permissions,GOTOOLCHAIN=local, concurrency and artifacts as in the minimal Gate. - Three consecutive green runs on
mainafter the merge.
Blocked by
- User mode on a wand-owned profile directory #47 (User mode on a wand-owned profile directory)
- Test harness: browser resolution in TestMain, WAND_BROWSER_* selection, no flaky skips #53 (Test harness: browser resolution in TestMain, WAND_BROWSER_* selection, no flaky skips)
Activity
Fly-Playgroud commentedon Sep 6, 2026
Input from #36 (minimal Gate, #71). Two runner facts the full matrix inherits from
.github/workflows/gate.yml, beside the SHA pins,permissions,GOTOOLCHAIN=local, concurrency and artifacts this ticket already lists:ubuntu-latest(24.04) confines unprivileged user namespaces through AppArmor, so a Chromium launched without--no-sandboxdies withNo usable sandbox!. The Gate runssudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0before the tests, keeping the sandbox on rather than spreading--no-sandboxover the suite (spec section 12 rules out a test-only browser knob; rod #1070 stays a documented limitation for users).ubuntu-24.04-armwill need the same step; Windows and macOS have no equivalent.go run ./cmd/wand-fetch-browserbeforego test:Browser.Getserializes downloads and validations behind one port lock, and a package suite that starts while another package is still downloading spends its timing budgets behind that lock (TestManagedblew its budget that way). Still no cache action: every run downloads.-count=1is also needed, since setup-go restores the Go build cache andgo testotherwise replays cached results for unchanged packages.Numbers from the linux/amd64 job on Go 1.27.1: about 2.5 minutes in all, 20 s of it the browser download, 1 min 50 s the suite with
-race.Fly-Playgroud commentedon Sep 7, 2026
Landed by #88 (merge 8eba045); #91 (merge 97ecb1e) then limited the Gate's push runs to
main(spec #33, section 13, amended on #33).mainruleset now requires the eleven checks (applied 2026-09-07 with the wand line ofdocs/maintainer-notes.md; a-dry-runafterwards reportsno changes).mainsince the merge: 8eba045 (https://github.com/headlesslab/wand/actions/runs/34089999222) and 97ecb1e (https://github.com/headlesslab/wand/actions/runs/34090574107), both all eleven jobs. The third comes with the next merge, the Roll to Chrome 153 Stable (Roll to Chrome 153 Stable once it ships (2026-09-08) #89) once Chrome for Testing serves it (Stable is still 152.0.7977.82 at 2026-09-07 14:40 UTC+8).lib/cdpleftover directory on Windows, pre-existing).