perf(ci): parallelize jobs, prebuilt Docker image, caching and shallow clone

.devcontainer/Dockerfile

@@ -29,20 +29,19 @@ RUN apt-get update && apt-get upgrade -y && \
     python3-setuptools \
     uuid-dev \
     libgnutls28-dev \
+    libssl-dev \
     swig \
     libgtest-dev \
     doxygen \
     graphviz \
     lcov \
-    qemu-system-x86 \
     qemu-system-arm \
     qemu-system-misc \
     gdb-multiarch \
     gcc-14 g++-14 \
     gcc-14-riscv64-linux-gnu g++-14-riscv64-linux-gnu \
     gcc-14-aarch64-linux-gnu g++-14-aarch64-linux-gnu \
-    gcc-14-arm-linux-gnueabihf g++-14-arm-linux-gnueabihf \
-    gcc-14-x86-64-linux-gnu g++-14-x86-64-linux-gnu && \
+    gcc-14-arm-linux-gnueabihf g++-14-arm-linux-gnueabihf && \
     update-alternatives \
       --install /usr/bin/gcc gcc /usr/bin/gcc-14 100 \
       --slave   /usr/bin/g++ g++ /usr/bin/g++-14 \
@@ -56,16 +55,14 @@ RUN apt-get update && apt-get upgrade -y && \
       --install /usr/bin/aarch64-linux-gnu-gcc aarch64-linux-gnu-gcc \
                 /usr/bin/aarch64-linux-gnu-gcc-14 100 \
       --slave   /usr/bin/aarch64-linux-gnu-g++ aarch64-linux-gnu-g++ \
-                /usr/bin/aarch64-linux-gnu-g++-14 && \
+                /usr/bin/aarch64-linux-gnu-g++-14 \
+      --slave   /usr/bin/aarch64-linux-gnu-cpp aarch64-linux-gnu-cpp \
+                /usr/bin/aarch64-linux-gnu-cpp-14 && \
     update-alternatives \
       --install /usr/bin/arm-linux-gnueabihf-gcc arm-linux-gnueabihf-gcc \
                 /usr/bin/arm-linux-gnueabihf-gcc-14 100 \
       --slave   /usr/bin/arm-linux-gnueabihf-g++ arm-linux-gnueabihf-g++ \
                 /usr/bin/arm-linux-gnueabihf-g++-14 && \
-    update-alternatives \
-      --install /usr/bin/x86_64-linux-gnu-gcc x86_64-linux-gnu-gcc \
-                /usr/bin/x86_64-linux-gnu-gcc-14 100 \
-      --slave   /usr/bin/x86_64-linux-gnu-g++ x86_64-linux-gnu-g++ \
-                /usr/bin/x86_64-linux-gnu-g++-14 && \
     apt-get autoremove -y && apt-get clean -y && \
-    rm -rf /var/lib/apt/lists/*
+    rm -rf /var/lib/apt/lists/* && \
+    mkdir -p /srv/tftp

.devcontainer/devcontainer.json

@@ -18,8 +18,7 @@
 				"plorefice.devicetree",
 				"zixuanwang.linkerscript",
 				"dan-c-underwood.arm",
-				"zhwu95.riscv",
-				"13xforever.language-x86-64-assembly"
+				"zhwu95.riscv"
 			]
 		}
 	}

.github/workflows/dev-image.yml

@@ -0,0 +1,48 @@
+# Copyright The SimpleKernel Contributors
+
+name: dev-image
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - '.devcontainer/Dockerfile'
+      - '.github/workflows/dev-image.yml'
+  workflow_dispatch:
+
+env:
+  IMAGE: ghcr.io/simple-xx/simplekernel-dev
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .devcontainer
+          file: .devcontainer/Dockerfile
+          push: true
+          tags: |
+            ${{ env.IMAGE }}:latest
+            ${{ env.IMAGE }}:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/workflow.yml

@@ -3,54 +3,132 @@
 name: build
 
 on:
-  - push
-  - pull_request
-  - release
+  push:
+  pull_request:
+  release:
+    types: [published]
+
+# Cancel in-progress runs for the same branch/PR
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # PR: 3 runs for speed; push/release: 10 runs for stability
+  SYSTEM_TEST_RUNS: ${{ github.event_name == 'pull_request' && 3 || 10 }}
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
+  build-riscv64:
+    runs-on: ubuntu-24.04-arm
     permissions:
-      contents: write
+      contents: read
       packages: read
-      statuses: write
+    container:
+      image: ghcr.io/simple-xx/simplekernel-dev:latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          fetch-depth: 0
-          submodules: recursive
+          fetch-depth: 1
 
-      - name: x86_64
-        uses: devcontainers/ci@v0.3
+      - name: Shallow submodule init
+        run: git submodule update --init --recursive --depth 1
+
+      - name: Cache CMake build (riscv64)
+        uses: actions/cache@v4
         with:
-          runCmd: |
-            cmake --preset=build_x86_64
-            cmake --build build_x86_64 --target SimpleKernel unit-test coverage docs
+          path: build_riscv64/
+          key: cmake-riscv64-${{ runner.arch }}-${{ hashFiles('CMakeLists.txt', 'cmake/**', 'src/**') }}
+          restore-keys: |
+            cmake-riscv64-${{ runner.arch }}-
+
+      - name: Configure & Build
+        run: |
+          cmake --preset=build_riscv64
+          cmake --build build_riscv64 --target SimpleKernel docs
+
+      - name: System Test
+        run: |
+          for i in $(seq 1 $SYSTEM_TEST_RUNS); do
+            echo "=== riscv64 System Test Run $i/$SYSTEM_TEST_RUNS ==="
+            if ! timeout 300 cmake --build build_riscv64 --target system_test_run; then
+              echo "riscv64 system test run $i/$SYSTEM_TEST_RUNS FAILED"
+              exit 1
+            fi
+            echo "riscv64 system test run $i/$SYSTEM_TEST_RUNS passed"
+          done
 
-      - name: riscv64
-        uses: devcontainers/ci@v0.3
+      - name: Upload docs artifact
+        if: github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v4
         with:
-          runCmd: |
-            cmake --preset=build_riscv64
-            cmake --build build_riscv64 --target SimpleKernel
+          name: docs-html
+          path: docs/html/
+          retention-days: 1
 
-      - name: aarch64
-        uses: devcontainers/ci@v0.3
+  build-aarch64:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
+      packages: read
+    container:
+      image: ghcr.io/simple-xx/simplekernel-dev:latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
         with:
-          runCmd: |
-            cmake --preset=build_aarch64
-            cmake --build build_aarch64 --target SimpleKernel
+          fetch-depth: 1
+
+      - name: Shallow submodule init
+        run: git submodule update --init --recursive --depth 1
+
+      - name: Cache CMake build (aarch64)
+        uses: actions/cache@v4
+        with:
+          path: build_aarch64/
+          key: cmake-aarch64-${{ runner.arch }}-${{ hashFiles('CMakeLists.txt', 'cmake/**', 'src/**') }}
+          restore-keys: |
+            cmake-aarch64-${{ runner.arch }}-
+
+      - name: Configure & Build
+        run: |
+          cmake --preset=build_aarch64 -DQEMU_NORMAL_WORLD_DEV_PATH=null -DQEMU_SECURE_WORLD_DEV_PATH=null
+          cmake --build build_aarch64 --target SimpleKernel unit-test coverage
+
+      - name: System Test
+        run: |
+          for i in $(seq 1 $SYSTEM_TEST_RUNS); do
+            echo "=== aarch64 System Test Run $i/$SYSTEM_TEST_RUNS ==="
+            timeout 300 cmake --build build_aarch64 --target system_test_run > /tmp/st_out_$i.txt 2>&1 || true
+            cat /tmp/st_out_$i.txt
+            if ! grep -q "Failed: 0" /tmp/st_out_$i.txt; then
+              echo "aarch64 system test run $i/$SYSTEM_TEST_RUNS FAILED"
+              exit 1
+            fi
+            echo "aarch64 system test run $i/$SYSTEM_TEST_RUNS passed"
+          done
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v4
         with:
-          files: ${{ github.workspace }}/build_x86_64/coverage/coverage.info
+          files: ${{ github.workspace }}/build_aarch64/coverage/coverage.info
           verbose: true
 
-      - name: Publish
-        if: github.ref == 'refs/heads/main'
-        uses: peaceiris/actions-gh-pages@v3
+  publish:
+    needs: [build-riscv64, build-aarch64]
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download docs artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: docs-html
+          path: docs/html/
+
+      - name: Deploy to GitHub Pages
+        uses: peaceiris/actions-gh-pages@v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ${{ github.workspace }}/docs/html
+          publish_dir: docs/html/

.gitignore

@@ -16,3 +16,4 @@ Doxyfile
 *.elf
 .pre-commit-config.yaml
 .worktrees/
+.claude

AGENTS.md

@@ -1,7 +1,7 @@
 # AGENTS.md — SimpleKernel
 
 ## OVERVIEW
-Interface-driven OS kernel for AI-assisted learning. C++23/C23, freestanding, no RTTI/exceptions. Three architectures: x86_64, riscv64, aarch64. Headers define contracts (Doxygen @pre/@post), AI generates .cpp implementations, tests verify compliance.
+Interface-driven OS kernel for AI-assisted learning. C++23/C23, freestanding, no RTTI/exceptions. Two architectures: riscv64, aarch64. Headers define contracts (Doxygen @pre/@post), AI generates .cpp implementations, tests verify compliance.
 
 ## STRUCTURE
 ```
@@ -72,7 +72,7 @@ cmake/                # Toolchain files, build helpers
 ## COMMANDS
 ```bash
 git submodule update --init --recursive   # First clone setup
-cmake --preset build_{riscv64|aarch64|x86_64}
+cmake --preset build_{riscv64|aarch64}
 cd build_{arch} && make SimpleKernel       # Build kernel (NOT 'make kernel')
 make run                                   # Run in QEMU
 make debug                                 # GDB on localhost:1234
@@ -83,7 +83,7 @@ pre-commit run --all-files                 # Format check
 
 ## NOTES
 - Interface-driven: headers are contracts, .cpp files are implementations AI generates
-- Boot chains differ: x86_64 (U-Boot), riscv64 (U-Boot SPL→OpenSBI→U-Boot), aarch64 (U-Boot→ATF→OP-TEE)
+- Boot chains differ: riscv64 (U-Boot SPL→OpenSBI→U-Boot), aarch64 (U-Boot→ATF→OP-TEE)
 - aarch64 needs two serial terminal tasks (::54320, ::54321) before `make run`
 - Unit tests only run on host arch (`build_{arch}` on {arch} host)
 - Git commits: `<type>(<scope>): <subject>` with `--signoff`

CMakePresets.json

@@ -77,15 +77,15 @@
         },
         "QEMU_DEBUG_FLAGS": {
           "type": "STRING",
-          "value": "-S;-gdb;tcp::1234;-d;int,cpu_reset,guest_errors"
+          "value": "-S;-gdb;tcp::1234;-d;cpu_reset,guest_errors"
         },
         "QEMU_COMMON_FLAG": {
           "type": "STRING",
-          "value": "-nographic;-serial;stdio;-monitor;telnet::2333,server,nowait;-m;1024M;-smp;2;-d;guest_errors,int,cpu_reset"
+          "value": "-nographic;-serial;stdio;-monitor;telnet::2333,server,nowait;-m;1024M;-smp;2;-d;guest_errors,cpu_reset"
         },
         "QEMU_DEVICE_FLAGS": {
           "type": "STRING",
-          "value": "-global;virtio-mmio.force-legacy=false;-netdev;user,id=net0,tftp=/srv/tftp;-device;e1000,netdev=net0;-device;virtio-gpu-device"
+          "value": "-global;virtio-mmio.force-legacy=false;-netdev;user,id=net0,tftp=/srv/tftp;-device;virtio-net-device,netdev=net0;-device;virtio-gpu-device"
         },
         "KERNEL_ELF_OUTPUT_NAME": {
           "type": "STRING",
@@ -105,43 +105,6 @@
         }
       }
     },
-    {
-      "name": "build_x86_64",
-      "hidden": false,
-      "inherits": [
-        "configurePresets_base"
-      ],
-      "displayName": "build x86_64 kernel",
-      "description": "build x86_64 kernel",
-      "toolchainFile": "${sourceDir}/cmake/x86_64-gcc.cmake",
-      "binaryDir": "${sourceDir}/build_x86_64",
-      "cacheVariables": {
-        "CMAKE_SYSTEM_PROCESSOR": {
-          "type": "STRING",
-          "value": "x86_64"
-        },
-        "EXECUTABLE_OUTPUT_PATH": {
-          "type": "STRING",
-          "value": "${sourceDir}/build_x86_64/bin"
-        },
-        "LIBRARY_OUTPUT_PATH": {
-          "type": "STRING",
-          "value": "${sourceDir}/build_x86_64/lib"
-        },
-        "QEMU_MACHINE_FLAGS": {
-          "type": "STRING",
-          "value": "-drive;file=${sourceDir}/build_x86_64/bin/rootfs.img,if=none,format=raw,id=hd0;-device;virtio-blk-device,drive=hd0"
-        },
-        "SIMPLEKERNEL_EARLY_CONSOLE_BASE": {
-          "type": "STRING",
-          "value": "0"
-        },
-        "SIMPLEKERNEL_PER_CPU_ALIGN_SIZE": {
-          "type": "STRING",
-          "value": "128"
-        }
-      }
-    },
     {
       "name": "build_riscv64",
       "hidden": false,