Now that cspell runs locally via pre-commit, Style/spelling only annotates
unknown words rather than blocking the merge.
Also fix the pre_commit job, which ran "pre-commit run" without --all-files
and so matched zero files on a fresh checkout. Skip the hooks already covered
by the Style/format and Style/lint jobs, and drop the npm install of cspell
now that the hook provides its own.
Avoid the unknown word profraw in CICD.yml and ignore setfacl/profraw
in the workflow spell-checker header.
Signed-off-by: Alex Chen <l46983284@gmail.com>
Some uutests set umask(0777) before spawning the utility. LLVM profile
files created under that umask can be mode 000; later writes fail with
Permission denied on stderr and break exact asserts (e.g. mkfifo).
Prepare the profraw directory with a default owner-write ACL when
setfacl is available (hard-fail under CI), use coverage-%p-%m.profraw,
and install acl on the coverage Ubuntu job.
Signed-off-by: Alex Chen <l46983284@gmail.com>
The failure is not ASLR but a fork() EAGAIN after msys2-runtime upgrade.
When pacman upgrades msys2-runtime mid-session, the shared memory
region size changes (60344 -> 59320). All subsequent fork() calls in
the same bash session fail with 'Resource temporarily unavailable'
(EAGAIN). The bash runner then exits with code 254.
Fix: split the step into two separate bash sessions:
1. pacman upgrade (msys2-runtime gets upgraded, session exits cleanly)
2. make install (starts fresh with the new msys2-runtime, no stale forks)
The Set-ProcessMitigation step is kept as a precaution but the root
cause was the mid-session runtime upgrade, not ASLR.
bash.exe on GitHub Actions Windows runners fails with exit code 254
when Windows Mandatory ASLR (ForceRelocateImages) is enabled. This
causes the Cygwin/MSYS2 make install step to fail consistently on
both PRs and main.
Fix: disable ForceRelocateImages via Set-ProcessMitigation in a
PowerShell step before invoking bash.exe.
See: https://github.com/appveyor/ci/issues/3777
Run on push only for main (PR branches already get a pull_request run
with identical results) and cap the 70-job matrix at 12 concurrent jobs
so the GitHub cache API is not hit by all of them at once.
FixPR.yml had no permissions block, so GITHUB_TOKEN got the repo default.
It commits Cargo.lock back to main, so scope it to contents: write only.
Mirrors the hardening accepted in #12655.
Sylvestre Ledru
renovate[bot]
Eduardo Rodrigues
oech3
Alex Chen
Sylvestre Ledru
Kobi Hikri
mattsu