mirror of
https://github.com/luxfi/precompile.git
synced 2026-09-24 00:26:21 +00:00
zeekayandHanzo Dev
1e5aebe404
hanzo-build-linux-amd64, lux-build-linux-amd64, zoo-build-linux-amd64 and every other org-prefixed spelling all meant the same machine. Which org a job belongs to does not change which host can build it, so the org bought one pool name per org per arch and each could go stale on its own -- the evo host alone answered to fourteen names for one label. One vocabulary now: linux-amd64, linux-arm64, macos-arm64, win-amd64. The generic labels every plain workflow uses (ubuntu-latest, self-hosted) are untouched, so naive CI keeps working. Co-authored-by: Hanzo Dev <[email protected]>
101 lines
3.6 KiB
YAML
101 lines
3.6 KiB
YAML
name: CI
|
|
|
|
# Build, vet and test the precompile suite on the native runners
|
|
# (git.hanzo.ai → git-runner).
|
|
#
|
|
# This replaces .github/workflows/ci.yml, whose jobs named
|
|
# `runs-on: lux-build-amd64`. No runner on this forge carries that label — the
|
|
# pools are `lux-build-linux-<arch>` — and a job naming a label nothing carries
|
|
# does not fail, it waits.
|
|
#
|
|
# The sibling checkouts also had to change. The old workflow pulled luxfi/mlx
|
|
# and PQClean/PQClean with `actions/checkout` + `repository:`, which resolves
|
|
# against GITHUB_SERVER_URL — here that is git.hanzo.ai, where PQClean/PQClean
|
|
# does not exist. They are cloned from github.com explicitly instead, so the
|
|
# source is stated rather than inferred from whichever forge is running the job.
|
|
#
|
|
# luxfi/accel v1.1.3+ auto-discovers the lux-gpu substrate (header +
|
|
# libluxgpu_hqc.a) by probing the standard install prefixes, so building and
|
|
# installing mlx to /usr/local is all that is needed — no CGO_CFLAGS,
|
|
# no CGO_LDFLAGS, no MLX_ROOT.
|
|
|
|
on:
|
|
push:
|
|
branches: [main, dev]
|
|
tags: ['v*']
|
|
pull_request:
|
|
branches: [main, dev]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# A newer commit makes the older run irrelevant.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
GOWORK: off
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: [linux-amd64]
|
|
timeout-minutes: 120
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache-dependency-path: go.sum
|
|
|
|
- name: Clone the lux-gpu and PQClean sources
|
|
run: |
|
|
set -euo pipefail
|
|
git clone --depth 1 --branch main https://github.com/luxfi/mlx mlx-sibling
|
|
# PQClean is upstream. We consume only hqc-{128,192,256}, which are
|
|
# stable, so tracking master is fine for CI.
|
|
git clone --depth 1 --branch master https://github.com/PQClean/PQClean pqclean-sibling
|
|
|
|
- name: Build + install lux-gpu (CPU-only, no GPU device required)
|
|
working-directory: mlx-sibling
|
|
run: |
|
|
set -euo pipefail
|
|
# mlx's CMake silently disables luxgpu_hqc when the PQClean source is
|
|
# unavailable and then `make luxgpu_hqc` fails with 'No rule to make
|
|
# target luxgpu_hqc'. Point it at the sibling clone so the HQC kernel
|
|
# target is created.
|
|
cmake -S . -B build \
|
|
-DCMAKE_BUILD_TYPE=Release \
|
|
-DCMAKE_INSTALL_PREFIX=/usr/local \
|
|
-DLUX_GPU_BUILD_CUDA=OFF \
|
|
-DLUX_GPU_BUILD_METAL=OFF \
|
|
-DLUX_HQC_PQCLEAN_DIR="${GITHUB_WORKSPACE}/pqclean-sibling/crypto_kem"
|
|
cmake --build build --target luxgpu_hqc luxgpu_core_static --parallel
|
|
sudo cmake --install build
|
|
pkg-config --modversion lux-gpu
|
|
pkg-config --cflags --libs lux-gpu
|
|
|
|
- run: make build
|
|
- run: make test
|
|
- run: make vet
|
|
|
|
# The heavy tests skip under -short, so the fast job above never runs them.
|
|
# Left unrun they are not tests; the FHE comparison suite sat unexecuted in
|
|
# CI while it was failing half its runs locally.
|
|
- run: make test-long
|
|
|
|
govulncheck:
|
|
runs-on: [linux-amd64]
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
- run: go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
# Advisory: reports findings without gating the merge. Kept as it was —
|
|
# turning it blocking is a policy decision, not a migration.
|
|
- run: govulncheck ./... || true
|