diff --git a/.github/taskgate-allow.txt b/.github/taskgate-allow.txt new file mode 100644 index 0000000..c30de2d --- /dev/null +++ b/.github/taskgate-allow.txt @@ -0,0 +1,25 @@ +# What taskgate allows on purpose (go tool taskgate -allow, from task lint). Each line is a key and +# its why: a workflow step that is not one `task `, as //; a task's shell +# over twelve lines, as :; a script a task runs that is a program - over forty lines of +# shell, or deciding anything by GITHUB_OUTPUT, GITHUB_ENV or jq - by its path. The list may shrink +# and may not grow: a line that matches nothing fails too. +# +# Every line here was over the limit when go-tools set it, and is work owed: what decides goes to Go +# with a test, what drives tools in order stays shell once it is short. +Taskfile.yml:coverage # formats the coverage profile for the run's summary: Go +Taskfile.yml:release:version # decides the next CalVer from the tags: Go +Taskfile.yml:release:notes # writes the release's notes from git and the pins: Go +Taskfile.yml:release:sign # drives cosign over the release's files: shell, once shorter +Taskfile.yml:shell # assembles a spin-machine boot with a shell for a person: spin-machine's own flags +Taskfile.yml:lab:unpack # fetches and unpacks a release for the lab: shell, once shorter +Taskfile.yml:lab:place # lays the lab's tree out from a release: Go, beside hack/machine place +Taskfile.yml:lab:vars # decides the lab's variables from its inputs: Go +Taskfile.yml:lab:about # reports the run and its host on the summary: Go, with report:runner +Taskfile.yml:report:runner # reports what the host can measure: Go +Taskfile.yml:report:compare # compares two runs' numbers: Go +boot/Taskfile.yml:previous # fetches the previous release for boot:compat: shell, once shorter +boot/Taskfile.yml:here # builds this tree's release for boot:compat: shell, once shorter +qemu/Taskfile.yml:verify # asserts the QEMU tree's devices and files: Go, with a test +hack/release # assembles and refuses a release tarball: Go, with a test +hack/fingerprint-diff # decides by jq which fingerprint inputs changed: Go, beside machine.Spec.Fingerprint +image/build.sh # builds the base image and asserts it carries no identity: shell that drives mkfs, its assertions Go diff --git a/Taskfile.yml b/Taskfile.yml index 8c58273..a54b737 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -224,7 +224,7 @@ tasks: - go tool testquality ./... - go tool refs - go tool mutate -stale-exempts - - go tool taskgate + - go tool taskgate -allow .github/taskgate-allow.txt - go tool sfw check - task: lint:workflows diff --git a/go.mod b/go.mod index ec93e61..53dee1a 100644 --- a/go.mod +++ b/go.mod @@ -19,7 +19,7 @@ tool ( ) require ( - github.com/spin-stack/go-tools v0.0.0-20261024191920-5824d9a153be + github.com/spin-stack/go-tools v0.0.0-20261029182133-98ef7f26cc6d golang.org/x/sys v0.49.0 ) diff --git a/go.sum b/go.sum index e6064d2..8281609 100644 --- a/go.sum +++ b/go.sum @@ -241,8 +241,8 @@ github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spiffe/go-spiffe/v2 v2.8.1 h1:eXZMLsu+3MLEPJyGJkolqtVrteZfQdUpOWj6LTiDl/E= github.com/spiffe/go-spiffe/v2 v2.8.1/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U= -github.com/spin-stack/go-tools v0.0.0-20261024191920-5824d9a153be h1:NzmdrDxCGDUvuXDP4TLz7FVJlB71bLI1fFue8MuqL44= -github.com/spin-stack/go-tools v0.0.0-20261024191920-5824d9a153be/go.mod h1:AjnMnKNXxvNt1n0zTkHpABmBd+NnNBqdRMSwmYu885Y= +github.com/spin-stack/go-tools v0.0.0-20261029182133-98ef7f26cc6d h1:ptkFQULaFS5j5woTE8Z0NfVPNEp8d/UgS3eVIFEYGoI= +github.com/spin-stack/go-tools v0.0.0-20261029182133-98ef7f26cc6d/go.mod h1:AjnMnKNXxvNt1n0zTkHpABmBd+NnNBqdRMSwmYu885Y= github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= diff --git a/versions.yaml b/versions.yaml index 56c1dcb..4e04dd2 100644 --- a/versions.yaml +++ b/versions.yaml @@ -28,6 +28,7 @@ # digest the tag's digest now: the version stays, the image moves # today today's date # kernel-stable the newest release of the same stable series +# kernel-mainline the newest series Linus released, its first tarball # tags the highest version-numbered tag of a git repository # branch the commit the version's branch is at now # commit @@ -70,15 +71,14 @@ source: https://cdn.kernel.org/pub/linux/kernel/v{major}.x/linux-{version}.tar.xz version: 7.3 pin: 87363c24f10e06321eb362765521094e94471f6bff8bce2d6b3e40f39f004953 - track: kernel-stable + track: kernel-mainline note: >- kernel/Dockerfile. A new kernel for every guest's next boot; checkpoints keep resuming, each on the kernel it was saved with (machine.Spec.Fingerprint). The configuration is kernel/config--x86_64: rename it to the new version in the same commit, then - `task kernel:build`, `task boot:bench`. A series that is over is a decision, not a bump. - Pinned at 7.3's release candidates, from git.kernel.org, until 7.3.0 is out: the bump to it - moves source back to cdn.kernel.org's .tar.xz. Until then `task versions` reports the 7.3 - series as over, because kernel.org lists no stable 7.3.y yet. + `task kernel:build`, `task boot:bench`. Mainline, the series' first tarball, as spin-ami's + host kernel: a bump is the next series, whose config is checked as above, and no stable + release of one is taken. - name: debian kind: image