Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-11-01 06:42:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Continue native Intel admission from retained Pi packages

Browse Source 
Bind the original archive and receipt identities, preserve the cancelled attempt, and emit synchronous stage progress. No shipping source or provider input changes.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip committed 2026-10-07 18:10:21 -05:00
1 parent f88624c7f7
commit c2f1d8471f
2 files changed
+160 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/docker-runner-check.yml
+92 -3
View File
@@ -23,6 +23,10 @@ on:
description: "Verify frozen Pi shipping source on native hosted ARM and Intel Macs; no provider calls"
type: boolean
default: false
verify_pi_intel_continuation:
description: "Continue native Intel admission from immutable retained package artifact 11517098137; no provider calls"
type: boolean
default: false
build_eval_viewer:
description: "Build the canonical eval report viewer on hosted Linux"
type: boolean
@@ -41,8 +45,8 @@ permissions: {}
concurrency:
# Publishing a newer image must not discard an earlier verification's evidence.
group: docker-runner-check-${{ github.event.pull_request.number || github.ref }}-${{ inputs.verify_pi_macos_install && 'mac-install' || inputs.verify_source && 'verification' || inputs.verify_public_install && 'public-install' || inputs.build_eval_viewer && 'viewer' || 'image' }}
cancel-in-progress: ${{ !inputs.verify_pi_macos_install }}
group: docker-runner-check-${{ github.event.pull_request.number || github.ref }}-${{ (inputs.verify_pi_macos_install || inputs.verify_pi_intel_continuation) && 'mac-install' || inputs.verify_source && 'verification' || inputs.verify_public_install && 'public-install' || inputs.build_eval_viewer && 'viewer' || 'image' }}
cancel-in-progress: ${{ !inputs.verify_pi_macos_install && !inputs.verify_pi_intel_continuation }}
jobs:
runner:
@@ -102,7 +106,7 @@ jobs:
echo "target_sha=$target_sha" >> "$GITHUB_OUTPUT"
manual_image:
if: ${{ !inputs.verify_pi_macos_install }}
if: ${{ !inputs.verify_pi_macos_install && !inputs.verify_pi_intel_continuation }}
name: Build and verify on Linux
needs: authorize_manual
# Keep maintainer authorization below; use a native hosted Linux builder.
@@ -299,3 +303,88 @@ jobs:
${{ runner.temp }}/pi-native-install-evidence/archives/*.tgz
retention-days: 14
if-no-files-found: error
pi_native_intel_continuation:
if: github.event_name == 'workflow_dispatch' && inputs.verify_pi_intel_continuation
name: Pi native Intel retained-package admission
needs: authorize_manual
runs-on: macos-15-intel
timeout-minutes: 35
permissions:
contents: read
actions: read
steps:
- name: Authorize an explicit maintainer image build
env:
GH_TOKEN: ${{ github.token }}
REPOSITORY: ${{ github.repository }}
REPOSITORY_ID: ${{ github.repository_id }}
ACTOR_ID: ${{ github.actor_id }}
TRIGGERING_ACTOR: ${{ github.triggering_actor }}
ALLOWED_IDS: ${{ vars.AWS_CI_TRUSTED_USER_IDS }}
run: |
set -euo pipefail
test "$REPOSITORY" = paperclipai/paperclip
test "$REPOSITORY_ID" = 1170821064
jq -e 'type == "array" and length > 0 and all(.[]; type == "number")' <<< "$ALLOWED_IDS" >/dev/null
triggering_id="$(gh api "users/$TRIGGERING_ACTOR" --jq .id)"
for id in "$ACTOR_ID" "$triggering_id"; do
jq -e --argjson id "$id" 'index($id) != null' <<< "$ALLOWED_IDS" >/dev/null
done
- name: Checkout verification orchestration
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
ref: ${{ github.sha }}
path: orchestration
persist-credentials: false
- name: Checkout frozen shipping source
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
ref: 06a3d9739f402baa7f8be7aaa29dda6db7354bfb
path: source
fetch-depth: 0
persist-credentials: false
- name: Verify immutable source ancestry
env:
TARGET_SHA: ${{ needs.authorize_manual.outputs.target_sha }}
ORCHESTRATION_SHA: ${{ github.sha }}
run: |
set -euo pipefail
test "$(git -C source rev-parse HEAD)" = 06a3d9739f402baa7f8be7aaa29dda6db7354bfb
test "$(git -C orchestration rev-parse HEAD)" = "$ORCHESTRATION_SHA"
git -C source merge-base --is-ancestor 06a3d9739f402baa7f8be7aaa29dda6db7354bfb "$TARGET_SHA"
- uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
with:
version: 9.15.4
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
with:
node-version: 24.21.0
package-manager-cache: false
- name: Download immutable retained native Intel packages
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
gh api repos/paperclipai/paperclip/actions/artifacts/11517098137 > "$RUNNER_TEMP/pi-original-artifact.json"
jq -e '.name == "pi-native-install-x64-37694650556" and .expired == false and .digest == "sha256:b6923562c643ce7c970885692c2ce6d939c644ba66212870a7becfe9be454cac"' "$RUNNER_TEMP/pi-original-artifact.json" >/dev/null
gh run download 37694650556 --repo paperclipai/paperclip --name pi-native-install-x64-37694650556 --dir "$RUNNER_TEMP/pi-original-intel"
- name: Complete normal Intel package installation and Pi admission
timeout-minutes: 30
env:
PI_QUALIFICATION_ORCHESTRATION_SHA: ${{ github.sha }}
run: |
set -euo pipefail
node orchestration/scripts/pi-qualification-intel-continuation.mjs "$PWD/source" "$RUNNER_TEMP/pi-original-intel" "$RUNNER_TEMP/pi-native-install-evidence"
- name: Retain native installation evidence and package archives
if: always()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: pi-native-install-x64-continuation-${{ github.run_id }}
path: |
${{ runner.temp }}/pi-native-install-evidence/*.json
${{ runner.temp }}/pi-native-install-evidence/*.log
${{ runner.temp }}/pi-native-install-evidence/archives/*.tgz
${{ runner.temp }}/pi-native-install-evidence/original-build/
${{ runner.temp }}/pi-original-artifact.json
retention-days: 14
if-no-files-found: error