Repository navigation
100 lines (93 loc) · 3.72 KB
/
Copy pathci.yml
File metadata and controls
100 lines (93 loc) · 3.72 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
name: CI
on:
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
test:
name: tests · ${{ matrix.os }} · ${{ matrix.python }}
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
python: ["3.13t", "3.14t", "3.14"]
include:
# 3.15 is still an alpha, so it is not always in the setup-python
# manifest. It is the control that proves the generator fix landed,
# so it is worth having when available and not worth failing over.
- os: ubuntu-latest
python: "3.15t"
optional: true
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
id: setup
continue-on-error: ${{ matrix.optional == true }}
with:
python-version: ${{ matrix.python }}
allow-prereleases: true
- name: Show interpreter
if: steps.setup.outcome == 'success'
run: |
python -VV
python -c "import sys,sysconfig;print('free-threaded:',bool(sysconfig.get_config_var('Py_GIL_DISABLED')));print('gil enabled :',sys._is_gil_enabled() if hasattr(sys,'_is_gil_enabled') else True)"
- name: Install
if: steps.setup.outcome == 'success'
run: |
python -m pip install --upgrade pip
python -m pip install -e . pytest
- name: Test
if: steps.setup.outcome == 'success'
run: python -m pytest tests/ -q
- name: Self-scan (the tool must not trip on its own source)
if: steps.setup.outcome == 'success'
run: python -m ftaudit.cli scan src/ftaudit --fail-on high
reproduce:
# The findings were originally measured on macOS/arm64 only. This job runs
# the same reproducers on Linux and Windows so the evidence is not
# single-platform. It reports rather than gates: these scripts exit non-zero
# precisely when they observe the bug they are meant to observe.
name: reproducers · ${{ matrix.os }} · ${{ matrix.python }}
runs-on: ${{ matrix.os }}
continue-on-error: true
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest]
python: ["3.13t", "3.14t"]
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python }}
- run: python -m pip install --upgrade pip && python -m pip install -e . pyyaml certifi werkzeug sympy
- name: CPython shared-generator crash (GIL off)
shell: bash
run: |
crashes=0
for i in $(seq 1 20); do
python findings/reproducers/gen_concurrent_next.py >/dev/null 2>&1 || crashes=$((crashes+1))
done
echo "GIL off : $crashes/20 runs crashed" | tee -a "$GITHUB_STEP_SUMMARY"
- name: CPython shared-generator crash (GIL on — control)
shell: bash
env:
PYTHON_GIL: "1"
run: |
crashes=0
for i in $(seq 1 20); do
python findings/reproducers/gen_concurrent_next.py >/dev/null 2>&1 || crashes=$((crashes+1))
done
echo "GIL on : $crashes/20 runs crashed" | tee -a "$GITHUB_STEP_SUMMARY"
- name: Library race reproducers
shell: bash
run: |
for r in sympy_dummy_index pyyaml_add_constructor werkzeug_logger_init certifi_where_init; do
echo "--- $r ---" | tee -a "$GITHUB_STEP_SUMMARY"
python "findings/reproducers/$r.py" 2>&1 | tail -4 | tee -a "$GITHUB_STEP_SUMMARY" || true
done
- name: Which dependencies re-enable the GIL
shell: bash
run: python -m ftaudit.cli gilcheck --installed 2>&1 | tee -a "$GITHUB_STEP_SUMMARY" || true