Summary
Atrinik Classic PR atrinik/classic#478 moves generated SPIR-V, DXIL, and MSL binaries out of Git and Git LFS. Builds now compile one checksum-locked shader cohort and embed it at build/package time.
The current governed images leave two infrastructure gaps:
./atrinik build classic-client --profile ... --test uses the pinned classic-build:1.2.3 image, which contains neither dxc nor spirv-cross; the wrapper build therefore stops during CMake configuration unless it can receive an externally generated cohort.linux-build:1.3.0@sha256:260658d2709e993b41148a9d8f724c2d2f7f1fd93543a139b00d139b10e7f31a returns HTTP 401 to anonymous pulls. A pull-request workflow cannot safely expose a private package token to PR-controlled workflow/script bytes, so Classic's hosted Lavapipe coverage must currently skip and codecov/patch remains below target.
Repository package access granted to atrinik/classic is sufficient for trusted authentication, but it does not provide a fork-safe PR boundary.
Requested outcome
- Provide the Classic wrapper build with the locked shader tools, preferably by adding qualified
dxc and spirv-cross versions to the governed Classic build image (or an equally deterministic wrapper-compatible cohort input).
- Make the non-confidential pinned GPU coverage image anonymously pullable, or publish an equivalent public immutable image for fork-safe PR coverage.
- Pin every added tool/image input, preserve licenses, and update image metadata/tests and supply-chain evidence.
The Classic lock currently qualifies DirectXShaderCompiler v1.9.2607 at commit 0d3ee6b551b8fa768fbf825300ebab81047ef6a8 and SPIRV-Cross commit 9c3c8e2cefdd8194b193bb8ed2fdff4d5527e382.
Validation
- The locked Classic shader producer reproduces all 18 expected artifacts byte-for-byte.
- Classic's full offline coverage/release/sanitizer client CI path passes when given the generated cohort.
- The exact final PR head passes its shader producer and client consumer jobs; the GPU coverage step records an explicit skip because the public pull fails.
This issue is follow-up infrastructure work; it must not close or merge Classic issue #477 or PR #478 automatically.
Summary
Atrinik Classic PR atrinik/classic#478 moves generated SPIR-V, DXIL, and MSL binaries out of Git and Git LFS. Builds now compile one checksum-locked shader cohort and embed it at build/package time.
The current governed images leave two infrastructure gaps:
./atrinik build classic-client --profile ... --testuses the pinnedclassic-build:1.2.3image, which contains neitherdxcnorspirv-cross; the wrapper build therefore stops during CMake configuration unless it can receive an externally generated cohort.linux-build:1.3.0@sha256:260658d2709e993b41148a9d8f724c2d2f7f1fd93543a139b00d139b10e7f31areturns HTTP 401 to anonymous pulls. A pull-request workflow cannot safely expose a private package token to PR-controlled workflow/script bytes, so Classic's hosted Lavapipe coverage must currently skip andcodecov/patchremains below target.Repository package access granted to
atrinik/classicis sufficient for trusted authentication, but it does not provide a fork-safe PR boundary.Requested outcome
dxcandspirv-crossversions to the governed Classic build image (or an equally deterministic wrapper-compatible cohort input).The Classic lock currently qualifies DirectXShaderCompiler
v1.9.2607at commit0d3ee6b551b8fa768fbf825300ebab81047ef6a8and SPIRV-Cross commit9c3c8e2cefdd8194b193bb8ed2fdff4d5527e382.Validation
This issue is follow-up infrastructure work; it must not close or merge Classic issue #477 or PR #478 automatically.