mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
zlareb1andClaude Opus 4.8
ff5822848c
Address review: amd_cfi omits -DBUILD_STANDALONE_KEEPER=1 (which amd_release sets), so it does not build the standalone clickhouse-keeper executable, and the integration jobs (requires=[CH_AMD_CFI], the self-extracting clickhouse binary) exercise Keeper via `clickhouse keeper` mode rather than the standalone binary. Rather than claim full release-artifact coverage, state the scope explicitly: the job covers the monolithic clickhouse binary only; Keeper coordination code is still CFI-covered through `clickhouse keeper` mode. Standalone-keeper coverage would need -DBUILD_STANDALONE_KEEPER=1 plus surfacing that artifact to the jobs; that is out of scope for this weekly bug-finding job. Addresses review comment on https://github.com/ClickHouse/ClickHouse/pull/100419 Co-Authored-By: Claude Opus 4.8 <[email protected]>
51 lines
2.0 KiB
Python
51 lines
2.0 KiB
Python
from praktika import Workflow
|
|
|
|
from ci.defs.defs import BASE_BRANCH, DOCKERS, SECRETS, ArtifactConfigs
|
|
from ci.defs.job_configs import JobConfigs
|
|
|
|
# Weekly Control-Flow Integrity (CFI) check.
|
|
# Builds the monolithic ClickHouse binary with Clang CFI (cfi-vcall, cfi-derived-cast)
|
|
# using the release compile profile (ThinLTO + -fwhole-program-vtables) and runs
|
|
# integration and stress tests against it. A CFI violation traps (SIGILL) and aborts the
|
|
# server, which surfaces as a job failure; -DSPLIT_DEBUG_SYMBOLS=ON keeps the core-dump
|
|
# stack trace pointing at the offending virtual call or bad cast.
|
|
#
|
|
# Scope: this covers the single self-extracting `clickhouse` binary only. It is not a
|
|
# full release-artifact build -- it omits -DBUILD_STANDALONE_KEEPER=1, so the standalone
|
|
# `clickhouse-keeper` executable is not built; integration tests exercise Keeper via
|
|
# `clickhouse keeper` mode (the same coordination code linked into the monolith), not
|
|
# the standalone binary.
|
|
#
|
|
# The stateless functional suite is intentionally excluded: its exact-output assertions
|
|
# produce build-profile false positives (e.g. query-profiler symbolization) and pick up
|
|
# master-flaky tests, none of which are CFI violations, so they would keep the job red
|
|
# for non-CFI reasons. Adding stateless later would need a curated no-cfi skip set, the
|
|
# way asan/tsan/msan carry per-build skips.
|
|
#
|
|
# Runs every Monday at 03:00 UTC.
|
|
workflow = Workflow.Config(
|
|
name="WeeklyCFI",
|
|
event=Workflow.Event.SCHEDULE,
|
|
branches=[BASE_BRANCH],
|
|
jobs=[
|
|
*JobConfigs.cfi_build_job,
|
|
*JobConfigs.cfi_integration_jobs,
|
|
*JobConfigs.cfi_stress_job,
|
|
],
|
|
artifacts=[
|
|
*ArtifactConfigs.clickhouse_binaries,
|
|
*ArtifactConfigs.clickhouse_debians,
|
|
],
|
|
dockers=DOCKERS,
|
|
secrets=SECRETS,
|
|
enable_cache=True,
|
|
enable_report=True,
|
|
enable_cidb=True,
|
|
cron_schedules=["0 3 * * 1"],
|
|
pre_hooks=["python3 ./ci/jobs/scripts/workflow_hooks/store_data.py"],
|
|
)
|
|
|
|
WORKFLOWS = [
|
|
workflow,
|
|
]
|