Skip to content

Packaging and workflows improvements#218

Merged
Bronek merged 21 commits into
mainfrom
bronek/packaging-improvements
Jun 2, 2026
Merged

Packaging and workflows improvements#218
Bronek merged 21 commits into
mainfrom
bronek/packaging-improvements

Conversation

@Bronek
Copy link
Copy Markdown
Member

@Bronek Bronek commented Jun 1, 2026

  • Add clang + libstdc++ to build workflow (Clang version 21 and 22 only), with workaround in tests/pfn/expected.cpp for validation mode only
  • Refactor package-test-* workflows to use matrix rather than steps
  • Add pre-commit rules with zizmor and actionlint for improved workflow security
  • Pin 3rd party actions in workflows
  • Remove custom catch2_3 dependency from nix
  • Bump pre-commit Docker image from bookworm to trixie
  • Add section on workflows to CONTRIBUTING.md

Bronek added 10 commits June 1, 2026 17:42
actions/checkout@v4 already pins HEAD to github.sha by default
(it sets ref and commit from the event context across push,
pull_request, and workflow_dispatch). The explicit pin in
package-test-nix.yml and build.yml's nixos job was dead weight;
package-test-nix.yml's `?rev=${{ github.sha }}` override still
resolves since github.sha is at HEAD either way.

Assisted-by: Claude:claude-opus-4-7
Switch from the vendored nix/catch2_3.nix to nixpkgs' upstream catch2_3,
overridden with the consumer's stdenv. The override is the important:
Catch2 ships a compiled archive, so its stdlib ABI (libstdc++ vs libc++)
must match libfn's. Rebuilding catch2_3 against the same stdenv which
libfn is built with keeps clang + libc++ working.

Assisted-by: Claude:claude-opus-4-7
libstdc++'s std::expected<void, E> has an _M_unex subobject whose
initialization clang's constexpr evaluator can't track when transitioning
from error to value state (works on libc++, on gcc, and on newer clang).
Four asserts in the void specialization's assign-from-rvalue, assign-from-
const-lvalue, emplace, and swap paths trip it. Gate just those statements
(and at the emplace site the lambda too, since gating its only use would
leave it -Wunused-variable -Werror'd). gcc+libstdc++ and clang+libc++
coverage of these asserts is preserved.

Assisted-by: Claude:claude-opus-4-7
The clang-libstdcxx images (clang built against libstdc++ rather than
libc++) have existed in ci-build.yml for both :21 and :22 since #214,
but were not exercised in build.yml. Now that the constexpr gates for
clang+libstdc++ have landed in tests/pfn/expected.cpp, the lane builds
and tests clean — add both image versions to the matrix to keep that
coverage honest on every PR.

Assisted-by: Claude:claude-opus-4-7
Each used to run three test configurations sequentially in one job
(cxx23, cxx20, cxx20-std23), and vcpkg additionally needed a `vcpkg
remove` step between two of them. Replace with a matrix of mode-named
entries (one per configuration); each job installs fresh and runs one
mode, dropping the inter-step cleanup. For vcpkg's cxx23 mode the
fn_quine binary is run via a separate step gated by
`if: matrix.name == 'cxx23'`. Also expand single line `run: nix ...`
into multiline `run: |`, for improved readability.

Assisted-by: Claude:claude-opus-4-7
The linux and macos jobs each had a "Build and test all" step that
ran only for one chosen compiler+config combination, piggy-backed on
that combo's mode-specific build via `cmake --build . --target clean`
to undo it first. Replace with an `include` entry that gives "all"
its own matrix slot; gate the two test steps with
`if: matrix.mode != 'all'` and `if: matrix.mode == 'all'` respectively.
The clean+rebuild dance goes away, and the prior gcc:14 cxx23 (linux)
or appleclang 15 cxx23 (macos) jobs no longer do double duty.

Assisted-by: Claude:claude-opus-4-7
Capture the four conventions we landed via the recent packaging-
improvements PR: don't pin `ref:` on actions/checkout@v4 without
reason, matrix-ify install/build/test variations instead of running
them sequentially in one job, give the "build everything" run its
own matrix slot (no clean+rebuild dance), and use literal-block
`run: |` with shell `\` continuation for multi-line commands.

Assisted-by: Claude:claude-opus-4-7
GitHub will flip windows-2025's default from VS 2022 to VS 2026 during
the 2026-06-08..15 migration, so the previous `windows-2025` +
"Visual Studio 17 2022" pairing would have silently broken on June 15.
Restructure the windows job around a `vs` axis pairing generator with
runner: VS 2022 → windows-2022 (long-term LTS), VS 2026 →
windows-2025-vs2026 (early-access label today; will alias windows-2025
post-migration, no follow-up edit needed). Mode stays cxx20-only on
Windows; enabling fn / C++23 on VS 2026 is a separate near-term PR.

Assisted-by: Claude:claude-opus-4-7
libfn is header-only (`package_type = "header-library"`) and conan's
`settings` (`os`, `arch`, `compiler`, `build_type`) only ever fed into
`check_min_cppstd` inside `validate()` — and the binary identity was
already cleared via `self.info.clear()` in `package_id()`. Drop both
the `settings` declaration and the now-unreachable `validate()` method
(plus the `check_min_cppstd` import). The C++20/23 minimums are still
enforced by libfn's CMake side via `target_compile_features(...
cxx_std_{20,23})` on `include_pfn`/`include_fn`, so a too-old consumer
compiler fails at CMake configure rather than at `conan install` — a
few seconds later but with an equally clear error.

Assisted-by: Claude:claude-opus-4-7
@codecov
Copy link
Copy Markdown

codecov Bot commented Jun 1, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@augmentcode
Copy link
Copy Markdown

augmentcode Bot commented Jun 1, 2026

🤖 Augment PR Summary

Summary: This PR tightens packaging verification and CI supply-chain hygiene by pinning GitHub Actions, expanding build matrices, and parameterizing CI images.

Changes:

  • Pins third-party actions (checkout/docker/pages/codecov/fossa/etc.) to immutable commit SHAs and adds weekly Dependabot updates for GitHub Actions (including local composite actions).
  • Adds zizmor + actionlint pre-commit hooks and introduces a baseline .github/zizmor.yml configuration.
  • Extends the main build workflow with clang-libstdcxx container variants and introduces dedicated mode: all matrix rows to run full build+test without clean/rebuild.
  • Refactors Conan/Nix/vcpkg package-test workflows into explicit matrix entries covering C++23, C++20, and “C++20 build with C++23 compiler” scenarios.
  • Parameterizes the docs CI image build with DEBIAN_VERSION and JAVA_VERSION, and updates the pre-commit image to include shellcheck.
  • Simplifies Nix packaging by switching from a repo-local Catch2 derivation to nixpkgs’ catch2_3 rebuilt with the consumer’s stdenv.

Technical Notes: Conan’s early C++ standard validation is removed for the header-only package; the enforced language version now comes from the CMake configuration.

🤖 Was this summary useful? React with 👍 or 👎

Copy link
Copy Markdown

@augmentcode augmentcode Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. 2 suggestions posted.

Fix All in Augment

Comment augment review to trigger a new review at any time.

Comment thread conanfile.py
Comment thread .github/workflows/package-test-vcpkg.yml Outdated
@Bronek
Copy link
Copy Markdown
Member Author

Bronek commented Jun 1, 2026

augment review

Copy link
Copy Markdown

@augmentcode augmentcode Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. 1 suggestion posted.

Fix All in Augment

Comment augment review to trigger a new review at any time.

Comment thread tests/pfn/expected.cpp
constexpr T a = fn(T(unexpect, Error::file_not_found));
static_assert(a.error() == Error::file_not_found);

#if !(defined(__clang__) && defined(__GLIBCXX__) && defined(PFN_TEST_VALIDATION))
Copy link
Copy Markdown

@augmentcode augmentcode Bot Jun 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tests/pfn/expected.cpp:4187 — This new #if !(defined(__clang__) && defined(__GLIBCXX__) && defined(PFN_TEST_VALIDATION)) skip looks like a compiler/stdlib-specific workaround; consider adding a brief comment (or issue link) explaining the underlying failure so it’s clear why these constexpr assertions are omitted on that configuration.

Severity: low

Other Locations
  • tests/pfn/expected.cpp:4481
  • tests/pfn/expected.cpp:4549
  • tests/pfn/expected.cpp:4838

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 66de0d7

Bronek added 3 commits June 2, 2026 18:06
ENV declarations moved past intervening RUNs that don't depend on them,
so local rebuilds with different ENV values reuse cached layers. ci-docs
also exposes DEBIAN_VERSION and JAVA_VERSION as build args — it was the
only image with hard-coded Debian release because the JDK package name
ties it to a specific Debian.

Assisted-by: Claude:claude-opus-4-7
@Bronek
Copy link
Copy Markdown
Member Author

Bronek commented Jun 2, 2026

augment review

Copy link
Copy Markdown

@augmentcode augmentcode Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. 1 suggestion posted.

Fix All in Augment

Comment augment review to trigger a new review at any time.

matrix:
include:
- name: cxx23
options: '-o "&:disable_cxx23=False" -s "compiler.cppstd=23"'
Copy link
Copy Markdown

@augmentcode augmentcode Bot Jun 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

matrix.options includes embedded shell quotes (e.g. -s "compiler.cppstd=23"), but when injected via ${{ matrix.options }} those quotes won’t be re-parsed by bash, so Conan can receive literal-quote arguments and fail to parse settings/options.

Severity: medium

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 3b94f8b

Bronek added 8 commits June 2, 2026 21:00
Assisted-by: Claude:claude-opus-4-7
Assisted-by: Claude:claude-opus-4-7
Assisted-by: Claude:claude-opus-4-7
Assisted-by: Claude:claude-opus-4-7
Assisted-by: Claude:claude-opus-4-7
Assisted-by: Claude:claude-opus-4-7
@Bronek
Copy link
Copy Markdown
Member Author

Bronek commented Jun 2, 2026

augment review

@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Jun 2, 2026

Copy link
Copy Markdown

@augmentcode augmentcode Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

@Bronek Bronek merged commit b88c5d4 into main Jun 2, 2026
92 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant