[benvinegar]

Problem

The merged 0.24.1 release preparation hit SIGILL in main's qemu-x86_64 -cpu Nehalem dist/hunk --version check. It fails consistently on the new ubuntu-latest image (Ubuntu 26.04 on Azure), despite selecting Bun's baseline runtime. The release workflow uses the same runner and probe, so publication is paused before creating any tag.

The runner's system libraries require x86-64-v3. Ubuntu 26.04 cloud images now enable the amd64v3 variant by default (Ubuntu release notes); CI logs show the amd64v3 package repository. QEMU user-mode emulation loads the host's dynamic linker and libraries into the emulated process. Nehalem cannot execute their AVX-family instructions, regardless of whether Hunk itself is baseline-compatible.

Reproduction and controls

Using the same local dist/hunk throughout:

• Ubuntu 26.04 container with ordinary amd64 libraries: Nehalem runs Hunk 0.24.1 successfully.
• Enable APT::Architecture-Variants "amd64v3";, update/upgrade the same Ubuntu 26.04 container, then install qemu-user: both /bin/true and Hunk fail with SIGILL / exit 132 under Nehalem.
• Ubuntu 24.04 userland: /bin/true and Hunk both pass under Nehalem.
• A tiny static negative-control executable containing an explicit AVX vpxor %ymm0, %ymm0, %ymm0 instruction still fails with exit 132 on that Ubuntu 24.04 probe. The old-CPU check remains effective; its CPU model is not being relaxed.

Fix

• Pin only main's build-bin job and the release matrix's Linux x64 build to ubuntu-24.04.
• Leave both Nehalem commands unchanged. Keep unrelated jobs on their existing runners.
• Add regression coverage against the real workflow YAML for the runner pins, probe command, and release matrix condition.
• Add an empty maintenance Changeset. No application, package-version, runtime, or benchmark-policy changes.

Validation

• New workflow regression tests failed against the original workflows, then passed after the fix.
• bun test ./scripts/quality/baseline-workflows.test.ts ./scripts/build/build-bin.test.ts — 16 pass.
• bun run typecheck — pass.
• bun run test — both full test shards pass.
• bunx oxfmt --check ... and focused oxlint — pass.
• Positive and negative QEMU controls above exercised locally in Docker.
• Full Firecracker install compatibility suite: all 16 scenarios pass on the clean committed PR tip, followed by successful evidence validation. Local evidence: tmp/install-vm/runs/baseline-fix-lBRUXGgZ/result.json, source identity 4a1fafd2c66ed14faec8338836001891c79a9f6eba6a579395ce56c13e4b3413.

The main-only compiled-binary job must run after merge to verify the GitHub runner itself. No tag was created and nothing has been published. Release 0.24.1 remains held pending green validation and maintainer confirmation.

This PR description was generated by Pi using GPT-6.1-sol

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
hunk-web	Ignored	Preview	Oct 24, 2026 6:53pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge.

Summary

Pins the two Linux x64 build jobs that run the Nehalem check to Ubuntu 24.04.

• The baseline CPU checks run on Ubuntu 24.04.

_{Reviews (1) · Last reviewed commit: "fix(ci): keep baseline CPU probes on com..." · Reviewed by Greptile}