78 lines
3.5 KiB
YAML
78 lines
3.5 KiB
YAML
name: Real recorded crash evidence
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
workflow_call:
|
|
inputs:
|
|
build_cache_artifact:
|
|
description: Portable build cache artifact from the calling CI run.
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=768
|
|
HUSKY: "0"
|
|
UV_CONCURRENT_BUILDS: "1"
|
|
UV_CONCURRENT_INSTALLS: "1"
|
|
UV_PYTHON_DOWNLOADS: never
|
|
|
|
jobs:
|
|
real-recorded-crash:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version-file: .nvmrc
|
|
cache: npm
|
|
- run: npm ci
|
|
- uses: ./.github/actions/portable-build-cache
|
|
with:
|
|
build_cache_artifact: ${{ inputs.build_cache_artifact }}
|
|
- name: Install GDB on the disposable CI runner
|
|
shell: bash
|
|
run: |
|
|
sudo apt-get update -qq
|
|
sudo apt-get install --yes --no-install-recommends gdb
|
|
- name: Acquire exact unchanged upstreams in isolated runner storage
|
|
shell: bash
|
|
run: |
|
|
command -v gcc
|
|
command -v gdb
|
|
command -v strace
|
|
core_decoder_root="${RUNNER_TEMP}/rea-core-decoder"
|
|
core_pwndbg_root="${RUNNER_TEMP}/rea-core-pwndbg"
|
|
core_pwndbg_venv="${RUNNER_TEMP}/rea-core-pwndbg-venv"
|
|
python3 -m venv "${core_decoder_root}"
|
|
"${core_decoder_root}/bin/python" -m pip install --disable-pip-version-check \
|
|
'pwntools==4.15.0' 'pyelftools==0.33' 'unicorn==2.1.2' 'uv==0.12.0'
|
|
git init "${core_pwndbg_root}"
|
|
git -C "${core_pwndbg_root}" remote add origin https://github.com/pwndbg/pwndbg.git
|
|
git -C "${core_pwndbg_root}" fetch --depth=1 origin 55596aa676a2756efb8d67034f31675170eabe48
|
|
git -C "${core_pwndbg_root}" checkout --detach FETCH_HEAD
|
|
test "$(git -C "${core_pwndbg_root}" rev-parse HEAD)" = 55596aa676a2756efb8d67034f31675170eabe48
|
|
UV_PROJECT_ENVIRONMENT="${core_pwndbg_venv}" \
|
|
"${core_decoder_root}/bin/uv" sync --project "${core_pwndbg_root}" \
|
|
--frozen --no-editable --no-default-groups --python /usr/bin/python3 --no-managed-python
|
|
test -z "$(git -C "${core_pwndbg_root}" status --porcelain --untracked-files=no)"
|
|
echo "REA_PWNTOOLS_PYTHON=${core_decoder_root}/bin/python" >> "${GITHUB_ENV}"
|
|
echo "REA_PWNDBG_GDB=$(command -v gdb)" >> "${GITHUB_ENV}"
|
|
echo "REA_PWNDBG_GDBINIT=${core_pwndbg_root}/gdbinit.py" >> "${GITHUB_ENV}"
|
|
echo "REA_PWNDBG_VENV_PATH=${core_pwndbg_venv}" >> "${GITHUB_ENV}"
|
|
echo "REA_VERIFY_STRACE_COMMAND=$(command -v strace)" >> "${GITHUB_ENV}"
|
|
- name: Build and install the exact package in isolated runner storage
|
|
shell: bash
|
|
run: |
|
|
npm run build:cached
|
|
npm pack --ignore-scripts --json --pack-destination "${RUNNER_TEMP}" > "${RUNNER_TEMP}/rea-core-pack.json"
|
|
core_package_name=$(node -p 'JSON.parse(require("node:fs").readFileSync(process.argv[1], "utf8"))[0].filename' "${RUNNER_TEMP}/rea-core-pack.json")
|
|
npm install --prefix "${RUNNER_TEMP}/rea-core-installed" --ignore-scripts --no-fund --no-audit "${RUNNER_TEMP}/${core_package_name}"
|
|
- name: Verify installed CLI and MCP against the source-owned recording
|
|
shell: bash
|
|
run: node scripts/verify-recorded-crash.mjs "${RUNNER_TEMP}/rea-core-installed/node_modules/rea-agents/scripts/rea.mjs"
|