From 64f265a4cd2a96302437c1e6ab302a40f18c55f8 Mon Sep 17 00:00:00 2001 From: "pithead-developer[bot]" <4933481+pithead-developer[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 00:20:31 -0500 Subject: [PATCH 1/2] chore(ci): refresh shfmt, diff-cover and zizmor pins --- .github/workflows/ci.yml | 6 +++--- .github/workflows/security.yml | 2 +- CONTRIBUTING.md | 5 +++-- Makefile | 2 +- 4 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3ef41f4..3ff31f1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -63,8 +63,8 @@ jobs: env: SHELLCHECK_VERSION: "0.11.0" SHELLCHECK_SHA256: "8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198" - SHFMT_VERSION: "3.13.1" - SHFMT_SHA256: "fb096c5d1ac6beabbdbaa2874d025badb03ee07929f0c9ff67563ce8c75398b1" + SHFMT_VERSION: "3.14.1" + SHFMT_SHA256: "76e77641faa025814b77f153b29796b8e6fa2fca03e0c76a691608b86c7ea7bf" # The file-budget gate's "ceilings only go down" half needs origin/develop to diff the budget # against. Without this it would SKIP that half and still exit 0 — a green that proves less # than it looks like it does — so here it is fatal instead (#407). @@ -143,7 +143,7 @@ jobs: runs-on: ubuntu-24.04 env: # Pin diff-cover (the patch-coverage gate); kcov + jq are pinned inside tests/coverage.sh. - DIFF_COVER_VERSION: "10.5.1" + DIFF_COVER_VERSION: "10.6.0" PATCH_COVERAGE_MIN: "90" # new/changed lines in rigforge.sh + util must be this % covered # Diff the PR against the branch it targets (develop or main). On a push, github.base_ref is empty, # so fall back to the pushed branch itself — that's an empty diff that trivially passes. diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 786cd1f..e030421 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -58,7 +58,7 @@ jobs: name: Workflow audit (zizmor) runs-on: ubuntu-24.04 env: - ZIZMOR_VERSION: "1.29.0" + ZIZMOR_VERSION: "1.30.1" steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 828758d..dce16fb 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -28,8 +28,9 @@ break them gratuitously: make lint # or: make test (lint + the full dependency-free suite) ``` - CI runs the same checks, so a clean local run keeps your PR green. (`make fmt` auto-applies the - `shfmt` formatting.) `make lint` also runs the topology gate and the **file budget gate** below. + CI runs the same checks with pinned tools (shfmt 3.14.1, diff-cover 10.6.0 for patch coverage, + and zizmor 1.30.1 for workflow security), so use matching versions when reproducing a CI finding. + (`make fmt` auto-applies the `shfmt` formatting.) `make lint` also runs the topology gate and the **file budget gate** below. - Update the README or other docs when you change behavior or add options. - New `config.json` keys are lowercase `snake_case`, matching Pithead. The three SCREAMING legacy keys (`ACCESS_TOKEN`, `DONATION`, `HOME_DIR`) are frozen as-is — never rename a shipped key. diff --git a/Makefile b/Makefile index e90926c..4e80d36 100644 --- a/Makefile +++ b/Makefile @@ -67,7 +67,7 @@ dev-setup: ## One-time local toolchain: linters + git hooks (brew or apt; versio else echo "no brew/apt found — install shellcheck, shfmt, jq, yamllint, actionlint, pre-commit manually"; fi pre-commit install @echo "Hooks installed. CI-pinned versions to match (ci.yml/security.yml are the source of truth):" - @echo " shellcheck 0.11.0 · yamllint 1.38.0 · actionlint 1.7.7 · markdownlint-cli2 $(MARKDOWNLINT_VERSION) · gitleaks 8.30.1" + @echo " shellcheck 0.11.0 · yamllint 1.38.0 · actionlint 1.7.12 · markdownlint-cli2 $(MARKDOWNLINT_VERSION) · gitleaks 8.30.1" ci: lint-all test-suite ## Everything CI runs that can run locally (adds the container e2e when Docker is up) @if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then $(MAKE) test-e2e; else echo "docker unavailable — skipped the container e2e (CI runs it)"; fi From feef108b34b9818efbcdd0d574f895e103bb41ac Mon Sep 17 00:00:00 2001 From: "pithead-developer[bot]" <4933481+pithead-developer[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 00:24:29 -0500 Subject: [PATCH 2/2] style(tests): apply shfmt 3.14.1 subshell spacing --- tests/run.sh | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/tests/run.sh b/tests/run.sh index 2e3bb37..77ab4d3 100644 --- a/tests/run.sh +++ b/tests/run.sh @@ -3727,7 +3727,7 @@ cp "$ROOT/VERSION" "$NOB/" cat >"$NOB/config.json" <&1))" +out="$( (cd "$NOB" && PATH="$STUBS:$PATH" STUB_UNAME_S=Darwin HOME="$NOB" RIGFORGE_HOME="$PWD" bash "$SCRIPT" start &1) )" assert_rc "macOS start with no built worker fails" "$?" "1" assert_contains "macOS start with no worker points at setup" "$out" "Run 'setup' first" @@ -3753,7 +3753,7 @@ assert_contains "start reports login-agent control" "$out" "login agent" : >"$LCL" out="$(mac_lr bash "$SCRIPT" stop)" assert_contains "stop delegates to launchctl when enabled" "$(cat "$LCL")" "[launchctl] stop" -out="$( (cd "$MC" && PATH="$STUBS:$PATH" STUB_UNAME_S=Darwin HOME="$MC" CALL_LOG="$LCL" STUB_LAUNCHD_PID=4321 RIGFORGE_HOME="$PWD" bash "$SCRIPT" status &1))" +out="$( (cd "$MC" && PATH="$STUBS:$PATH" STUB_UNAME_S=Darwin HOME="$MC" CALL_LOG="$LCL" STUB_LAUNCHD_PID=4321 RIGFORGE_HOME="$PWD" bash "$SCRIPT" status &1) )" assert_contains "status reads the launchd PID" "$out" "pid 4321" out="$(mac_lr bash "$SCRIPT" disable)" assert_rc "macOS disable exits 0" "$?" "0" @@ -4643,7 +4643,7 @@ out="$(run_pool_doctor n "" '_tcp_probe() { return 1; }')" assert_contains "pool: stopped + unreachable pool -> warn (#343)" "$out" "pool h:3333 is unreachable" assert_contains "pool: unreachable pool counts as an issue (#343)" "$out" "issue(s) found" # The real probe against a loopback port nothing listens on: refused, so rc != 0, instantly. -prb="$( (source "$SCRIPT" && set +e && _tcp_probe 127.0.0.1 1 && echo open || echo closed))" +prb="$( (source "$SCRIPT" && set +e && _tcp_probe 127.0.0.1 1 && echo open || echo closed) )" assert_eq "tcp probe: closed loopback port reads closed (#343)" "$prb" "closed" # #201: NPS regression detection — an EPYC reporting ONE NUMA node is NPS1 (a BIOS reset ate the @@ -4671,8 +4671,8 @@ bd_nps() { ( assert_eq "bios detect: NPS1 EPYC pending (#201)" "$(bd_nps "$NPS/one" "AMD EPYC 7642 48-Core Processor")" "pending" assert_eq "bios detect: NPS4 EPYC ok (#201)" "$(bd_nps "$NPS/four" "AMD EPYC 7642 48-Core Processor")" "ok" assert_eq "bios detect: desktop unknown — never listed (#201)" "$(bd_nps "$NPS/one" "Generic CPU")" "unknown" -assert_contains "bios menu: NPS item names the CBS path (#201)" "$( (source "$SCRIPT" && _bios_menu generic numa_nps perf))" "NPS4" -assert_contains "bios menu: generic power_boost speaks EPYC too (#201)" "$( (source "$SCRIPT" && _bios_menu generic power_boost perf))" "cTDP" +assert_contains "bios menu: NPS item names the CBS path (#201)" "$( (source "$SCRIPT" && _bios_menu generic numa_nps perf) )" "NPS4" +assert_contains "bios menu: generic power_boost speaks EPYC too (#201)" "$( (source "$SCRIPT" && _bios_menu generic power_boost perf) )" "cTDP" # --------------------------------------------------------------------------- # Guided BIOS flow (#80): detect -> guide -> save -> re-verify, against the #78 firmware fixtures. @@ -5324,7 +5324,7 @@ mkdir -p "$UNN/etc/systemd/system" cat >"$UNN/config.json" <&1))" +out="$(printf 'n\n' | (cd "$UNN" && PATH="$STUBS:$PATH" SYSTEMD_DIR="$UNN/etc/systemd/system" RIGFORGE_HOME="$PWD" bash "$SCRIPT" uninstall 2>&1) )" assert_rc "uninstall 'n' exits 0" "$?" "0" assert_contains "uninstall 'n' reports it aborted" "$out" "Aborted" assert_eq "uninstall 'n' left the service unit in place" "$([ -f "$UNN/etc/systemd/system/xmrig.service" ] && echo present || echo gone)" "present" @@ -6501,11 +6501,11 @@ assert_contains "no headroom, no ceiling -> plain requirement, unchanged (#328 x echo "== black-box: appliance mode (pithead#797 R1) ==" AP="$(mktemp -d "$SANDBOX/appliance.XXXXXX")" -out="$( (unset SYSTEMD_DIR && RIGFORGE_APPLIANCE=1 && source "$SCRIPT" && printf '%s|%s' "$SYSTEMD_DIR" "$ENABLE_RUNTIME"))" +out="$( (unset SYSTEMD_DIR && RIGFORGE_APPLIANCE=1 && source "$SCRIPT" && printf '%s|%s' "$SYSTEMD_DIR" "$ENABLE_RUNTIME") )" assert_eq "flag presets /run/systemd/system + --runtime (#797)" "$out" "/run/systemd/system|--runtime" -out="$( (unset SYSTEMD_DIR && source "$SCRIPT" && printf '%s|%s' "$SYSTEMD_DIR" "$ENABLE_RUNTIME"))" +out="$( (unset SYSTEMD_DIR && source "$SCRIPT" && printf '%s|%s' "$SYSTEMD_DIR" "$ENABLE_RUNTIME") )" assert_eq "no flag: /etc/systemd/system + persistent enable (#797)" "$out" "/etc/systemd/system|" -out="$( (SYSTEMD_DIR="$AP/custom-sd" && RIGFORGE_APPLIANCE=1 && source "$SCRIPT" && printf '%s' "$SYSTEMD_DIR"))" +out="$( (SYSTEMD_DIR="$AP/custom-sd" && RIGFORGE_APPLIANCE=1 && source "$SCRIPT" && printf '%s' "$SYSTEMD_DIR") )" assert_eq "explicit SYSTEMD_DIR still wins under the flag (#797)" "$out" "$AP/custom-sd" # Baked dependencies are verified against a restricted fixture PATH. @@ -6929,7 +6929,7 @@ out="$(cd "$FR" && PATH="$STUBS:$PATH" RIGFORGE_HOME="$PWD" bash "$SCRIPT" resto assert_rc "restore without an archive fails" "$?" "1" out="$(cd "$FR" && PATH="$STUBS:$PATH" RIGFORGE_HOME="$PWD" bash "$SCRIPT" restore -y "$BK/nope.tar.gz" &1)" assert_rc "restore of a missing archive fails" "$?" "1" -out="$(printf 'n\n' | (cd "$FR" && PATH="$STUBS:$PATH" RIGFORGE_HOME="$PWD" bash "$SCRIPT" restore "$ARCHIVE" 2>&1))" +out="$(printf 'n\n' | (cd "$FR" && PATH="$STUBS:$PATH" RIGFORGE_HOME="$PWD" bash "$SCRIPT" restore "$ARCHIVE" 2>&1) )" assert_rc "restore cancels cleanly on 'n'" "$?" "0" assert_contains "restore cancel message" "$out" "cancelled" # A bad archive must fail LOUDLY and leave the existing good config.json untouched — a silent clobber here