fix(doctor): refuse a stale Cargo registry before the gate drops its network - #265
Open
ebursztein wants to merge 6 commits into
Open
ebursztein wants to merge 6 commits into
ebursztein wants to merge 6 commits into
Conversation
…network bootstrap.sh fetched workspace crates once and nothing re-checked them. When Cargo.lock gained utoipa, a focus-test ran for minutes and died in assets.recovery-dependencies inside the no-network sandbox with a wall of "Could not resolve host: index.crates.io". - doctor: new offline check (cargo fetch --locked --offline) with a cargo-fetch fix-registry entry; `just doctor fix` runs cargo fetch --locked, and refuses inside a gate run. bootstrap fetches through that same fix. - gate: sandbox.applied probes the config-owned [sandbox].cargo_offline_probe before wrapping in Bubblewrap/Seatbelt and before starting the release egress helper, refusing with the missing crate and `just doctor fix`. - doctor now names `just doctor fix` instead of the nonexistent doctor-fix.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #265 +/- ##
=========================================
- Coverage 65.4% 65.3% -0.2%
=========================================
Files 1450 1452 +2
Lines 127617 127973 +356
Branches 91731 91872 +141
=========================================
+ Hits 83554 83613 +59
- Misses 39120 39366 +246
- Partials 4943 4994 +51
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
…stry # Conflicts: # build_system/tests/test_ownership.toml
…aits for readiness The bounded wrapper selected its bytecode generation (a SHA-256 of every Python source in the checkout) and then held it by selecting it again, so each bounded command read the tree twice before its child existed. `hold_environment` now takes the environment that was selected: one hash, and the lease always names the generation the child was given. The interrupt test waited a fixed two seconds for the child group; on a loaded CI runner the wrapper's start-up missed that window, and the pipes the failed test left open surfaced in the next test as unraisable ResourceWarnings. It now waits for the child's atomically published pids, bounded only by the wrapper's own timeout, and closes its pipes with a `with`.
…fix/doctor-cargo-registry
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bootstrap.sh fetched workspace crates once and nothing re-checked them. When
Cargo.lock gained utoipa, a focus-test ran for minutes and died in
assets.recovery-dependencies inside the no-network sandbox with a wall of
"Could not resolve host: index.crates.io".
cargo-fetch fix-registry entry;
just doctor fixruns cargo fetch --locked,and refuses inside a gate run. bootstrap fetches through that same fix.
before wrapping in Bubblewrap/Seatbelt and before starting the release
egress helper, refusing with the missing crate and
just doctor fix.just doctor fixinstead of the nonexistent doctor-fix.Found while reproducing the kingslanding reset-burst stall: origin/main's Cargo.lock gained
utoipa, and a sandboxed focus-test died minutes in on a wall ofCould not resolve host: index.crates.io. bootstrap fetched once; nothing re-checked.Behaviour change: every sandboxed gate command now needs
cargoand a complete registry up front (hosted jobs already runcargo fetch --lockedfirst).Tests: 14 new (offline/locked probe, refusal text, no probe when sandbox off/active, real cargo against an empty CARGO_HOME, doctor ordering, bootstrap has no own fetch); ownership + suite registration checked; ruff and capsem-gate lint clean.
🤖 Generated with Claude Code