Tighten the clean-machine comments
Compress the comment blocks across the clean-machine workflows and scripts. The explanations of why each check is written the way it is stay; the padding, restatement and duplication go. No code or workflow logic changes.
This commit is contained in:
danielhanchen
parent
90ec9462a0
commit
231fcc3cf0
4 changed files with 224 additions and 253 deletions
68
.github/scripts/clean-machine-env.sh
vendored
68
.github/scripts/clean-machine-env.sh
vendored
|
|
@ -2,25 +2,20 @@
|
|||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
|
||||
#
|
||||
# Simulate a virgin developer machine on a GitHub-hosted runner, so the installer
|
||||
# is exercised the way a real user's brand-new Mac / PC exercises it.
|
||||
# Simulate a virgin developer machine on a GitHub-hosted runner. Two modes, because
|
||||
# "the tool is absent" and "the installer never called the tool" cannot be simulated
|
||||
# by the same mechanism:
|
||||
#
|
||||
# Two modes, because "the tool is absent" and "the installer never called the tool"
|
||||
# CANNOT be simulated by the same mechanism:
|
||||
# mask Make the toolchain genuinely ABSENT: scrub PATH to OS defaults and (with
|
||||
# --remove) move the real toolchain aside, so `command -v git` correctly
|
||||
# FAILS, as on a clean Mac. A failing "poison shim" would do the opposite --
|
||||
# `command -v` finds it and reports the tool as present -- so no shims here.
|
||||
# trace Leave the toolchain working but route it through logging wrappers that log
|
||||
# the call then exec the real binary, proving whether the installer ever
|
||||
# REACHES for a compiler/git without changing behaviour.
|
||||
#
|
||||
# mask Make the toolchain genuinely ABSENT. Scrubs PATH down to the OS
|
||||
# defaults and (with --remove) moves the real toolchain aside. After
|
||||
# this, `command -v git` correctly FAILS, which is what a clean Mac does.
|
||||
# A failing "poison shim" on PATH would do the opposite -- `command -v`
|
||||
# finds it and reports the tool as present -- so shims are NOT used here.
|
||||
#
|
||||
# trace Leave the toolchain working, but route it through logging wrappers that
|
||||
# record the invocation and then exec the real binary. Proves whether the
|
||||
# installer ever REACHES for a compiler/git, without changing behaviour.
|
||||
#
|
||||
# Writes shell exports to $CLEAN_ENV_FILE (default ./clean-machine.env) for the
|
||||
# caller to `source`. Nothing is exported globally, so other workflow steps
|
||||
# (checkout, upload-artifact) keep a normal environment.
|
||||
# Writes shell exports to $CLEAN_ENV_FILE (default ./clean-machine.env) to `source`;
|
||||
# nothing is exported globally, so other steps keep a normal environment.
|
||||
#
|
||||
# Usage:
|
||||
# bash .github/scripts/clean-machine-env.sh mask [--remove]
|
||||
|
|
@ -55,8 +50,8 @@ TOOLS="xcode-select xcrun clang clang++ cc c++ gcc g++ git cmake make brew ninja
|
|||
note() { echo "[clean-machine] $*"; }
|
||||
|
||||
# ── PATH scrub ────────────────────────────────────────────────────────────────
|
||||
# Keep only OS-default system dirs. Drops Homebrew, the hosted Python toolcache,
|
||||
# setup-* shims, pipx, cargo, and every other preinstalled developer dir.
|
||||
# Keep only OS-default system dirs: drops Homebrew, the hosted Python toolcache,
|
||||
# setup-* shims, pipx, cargo and every other preinstalled developer dir.
|
||||
scrub_path() {
|
||||
local keep out=""
|
||||
if [ "$OS" = "Darwin" ]; then
|
||||
|
|
@ -76,11 +71,9 @@ if [ "$MODE" = "mask" ]; then
|
|||
NEWPATH="$(scrub_path)"
|
||||
{
|
||||
echo "export PATH='$NEWPATH'"
|
||||
# DEVELOPER_DIR must be UNSET, not pointed at a fake path: `xcode-select -p`
|
||||
# honours DEVELOPER_DIR and prints it verbatim with exit 0, so setting it to a
|
||||
# nonexistent dir makes the probe SUCCEED -- the exact opposite of a clean Mac,
|
||||
# where DEVELOPER_DIR is unset and the missing /var/db/xcode_select_link is what
|
||||
# makes `xcode-select -p` fail.
|
||||
# UNSET, not a fake path: `xcode-select -p` honours DEVELOPER_DIR and prints it
|
||||
# verbatim with exit 0, so a nonexistent dir makes the probe SUCCEED. On a clean
|
||||
# Mac it is unset and the missing xcode_select_link is what makes the probe fail.
|
||||
echo "unset DEVELOPER_DIR || true"
|
||||
echo "unset SDKROOT CC CXX CFLAGS CXXFLAGS LDFLAGS CMAKE_GENERATOR CMAKE_PREFIX_PATH || true"
|
||||
echo "export HOMEBREW_NO_AUTO_UPDATE=1"
|
||||
|
|
@ -88,11 +81,10 @@ if [ "$MODE" = "mask" ]; then
|
|||
} >> "$ENV_FILE"
|
||||
|
||||
if [ "$REMOVE" = "1" ] && [ "$OS" = "Darwin" ]; then
|
||||
# Best-effort real removal. Each step is independent and recorded in
|
||||
# restore.sh so an `if: always()` step can put the runner back.
|
||||
# /var/db/xcode_select_link is exactly what `xcode-select -p` reads, so
|
||||
# removing it reproduces a virgin Mac's gate precisely. `xcode-select --reset`
|
||||
# is NOT enough: it can reselect a full Xcode.app.
|
||||
# Best-effort real removal; each step is independent and recorded in restore.sh
|
||||
# so an `if: always()` step can put the runner back. xcode_select_link is exactly
|
||||
# what `xcode-select -p` reads, so removing it reproduces a virgin Mac's gate.
|
||||
# `xcode-select --reset` is NOT enough: it can reselect a full Xcode.app.
|
||||
if [ -e /var/db/xcode_select_link ]; then
|
||||
if sudo rm -f /var/db/xcode_select_link 2>/dev/null; then
|
||||
note "removed /var/db/xcode_select_link"
|
||||
|
|
@ -101,8 +93,8 @@ if [ "$MODE" = "mask" ]; then
|
|||
note "WARN could not remove /var/db/xcode_select_link"
|
||||
fi
|
||||
fi
|
||||
# Moving the CLT dir aside turns /usr/bin/{cc,clang,git} into dead shims, so
|
||||
# the run also proves the install needs no compiler at all.
|
||||
# Moving the CLT dir aside turns /usr/bin/{cc,clang,git} into dead shims, so the
|
||||
# run also proves the install needs no compiler at all.
|
||||
if [ -d /Library/Developer/CommandLineTools ]; then
|
||||
if sudo mv /Library/Developer/CommandLineTools /Library/Developer/CommandLineTools.masked 2>/dev/null; then
|
||||
note "moved CommandLineTools aside"
|
||||
|
|
@ -111,11 +103,11 @@ if [ "$MODE" = "mask" ]; then
|
|||
note "WARN could not move CommandLineTools"
|
||||
fi
|
||||
fi
|
||||
# Xcode.app must go too. With the select link removed AND CommandLineTools moved,
|
||||
# `xcode-select -p` does not fail -- it falls through to whatever Xcode bundle the
|
||||
# runner image ships (observed: /Applications/Xcode_16.4.app/Contents/Developer),
|
||||
# which re-arms /usr/bin/git and /usr/bin/cc and silently un-cleans the machine.
|
||||
# A rename is instant regardless of bundle size: same filesystem, no copy.
|
||||
# Xcode.app must go too: with the link removed AND CommandLineTools moved,
|
||||
# `xcode-select -p` still does not fail, it falls through to the image's Xcode
|
||||
# bundle (observed: /Applications/Xcode_16.4.app/Contents/Developer), which
|
||||
# re-arms /usr/bin/{git,cc} and silently un-cleans the machine. A rename is
|
||||
# instant regardless of bundle size: same filesystem, no copy.
|
||||
for app in /Applications/Xcode*.app; do
|
||||
[ -d "$app" ] || continue
|
||||
if sudo mv "$app" "${app}.masked" 2>/dev/null; then
|
||||
|
|
@ -143,8 +135,8 @@ if [ "$MODE" = "trace" ]; then
|
|||
for tool in $TOOLS; do
|
||||
real="$(command -v "$tool" 2>/dev/null || true)"
|
||||
[ -n "$real" ] || continue
|
||||
# Wrapper logs the call then execs the REAL binary, so behaviour is unchanged
|
||||
# and the trace answers "did the installer reach for this?" honestly.
|
||||
# Logs the call then execs the REAL binary: behaviour unchanged, so the trace
|
||||
# answers "did the installer reach for this?" honestly.
|
||||
cat > "$BIN/$tool" <<WRAP
|
||||
#!/bin/sh
|
||||
printf '%s\t%s\n' "$tool" "\$*" >> "$TRACE"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue