edde746
e9a213807f
The plane added three runtime libraries that bundle-libs.sh deliberately does not bundle, so they have to be declared per distro by hand - and two hand-maintained lists drifting apart is the failure this guard exists to prevent. check_linux_package_deps.py parses the runner's CMake for every pkg-config module it links, follows target_link_libraries to prove each one actually reaches the binary, and requires a package name for it in every distro's depends list. It fails closed on the shapes a naive parser gets wrong: a pkg_check_modules call naming several modules, options preceding the module name, and version constraints like mpv>=0.40 that would otherwise be read as a package nobody ships. The smoke job builds the three packages and reads the dependencies back out of the artifacts, deriving what to expect from build-packages.py rather than restating it - so a library is declared once and verified everywhere. That job is off by default, which is exactly why it must not carry its own copy of the list. The Linux native job names libwayland-dev and libegl-dev instead of riding GTK's and epoxy's transitive dev dependencies, matching the CMake comment's own rationale. In CI the host-dependency guard runs once: the named step covers the staged bundle, and build-packages.py's internal run - which exists for by-hand packaging - is skipped. The smoke job also drops patchelf, which nothing invokes.
38 lines
1.4 KiB
Bash
38 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Workflow and script regression guards.
|
|
#
|
|
# Single source of truth for the guard roster, shared by the "Verify workflow
|
|
# and script guards" step in .github/workflows/ci.yml and section 4 of
|
|
# scripts/ci_checks.sh. The checkers are named explicitly because a few of them
|
|
# belong to other jobs (check_bun_audit.py needs Bun, check_codegen.py runs via
|
|
# codegen.sh, and linux/packaging/check-bundle-host-deps.py and
|
|
# check-package-deps.py need a built bundle and built packages, so both run in
|
|
# the linux-packages job and again in the release build), but their regression
|
|
# tests are discovered by glob so a newly added scripts/test_*.py is picked up
|
|
# automatically instead of having to be remembered in two places.
|
|
set -euo pipefail
|
|
shopt -s nullglob
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$ROOT_DIR"
|
|
|
|
for checker in \
|
|
scripts/check_build_workflow.py \
|
|
scripts/check_apple_spm_locks.py \
|
|
scripts/check_tvos_test_wiring.py \
|
|
scripts/check_shrinker_rules.py \
|
|
scripts/verify_runtime_inputs.py \
|
|
scripts/check_workflow_security.py \
|
|
scripts/check_workflow_action_pins.py \
|
|
scripts/check_container_image_pins.py \
|
|
scripts/check_update_packages_workflow.py \
|
|
scripts/check_linux_package_deps.py \
|
|
scripts/check_windows_installer.py \
|
|
scripts/check_windows_msix.py; do
|
|
python3 "$checker"
|
|
done
|
|
|
|
for guard_test in scripts/test_*.py; do
|
|
python3 "$guard_test"
|
|
done
|