ci: add CGO-disabled portable SDK cross-build gate - #35
Merged
Conversation
Add a make check-portable target that cross-builds the deliberate public packages (api, artifact, client, inference, openapi, source, trigger) with CGO_ENABLED=0 for the four-platform matrix CI already uses (linux/amd64, linux/arm64, darwin/amd64, darwin/arm64). Surface it as a stable portable-sdk job in migration-gates.yml so every PR proves the public SDK surface stays CGO-free and cross-compilable. A public package that gains a CGO dependency or platform-specific code now fails CI instead of silently breaking pure-Go consumers. Closes #33
This was referenced Aug 28, 2026
The merge retains the published PR history while combining the Issue #33 portable SDK assurance with the lint, readonly-build, coverage, CodeQL, and documentation contracts already merged to main. Constraint: Preserve both current main behavior and the existing check-portable workflow contract. Rejected: Rebase or force-push | Rewriting the published PR branch is unnecessary for conflict resolution. Confidence: high Scope-risk: narrow Tested: make check-portable; targeted tools/release workflow contract tests; actionlint v1.7.12; git diff --check. Not-tested: The full tools/release package is not green on native Windows because three tests fail identically on origin/main due to POSIX executable mode and LF-only workflow matching. Co-authored-by: OmX <omx@oh-my-codex.dev>
The release contract tests now execute the real check-portable Make target through a controlled Go boundary. They verify all four public SDK targets run without CGO and that a failure before the final target makes the gate stop with a nonzero result. Constraint: Keep the production target and package surface unchanged while adding only discriminative regression coverage and its reusable engineering rule. Rejected: Static Makefile string assertions | They would not prove the loop exit status or stop behavior. Confidence: high Scope-risk: narrow Tested: Windows Go compile and skip path; Linux-amd64 test binary under WSL; fail-fast mutation red then restored green; make check-portable; actionlint v1.7.12; git diff --cached --check. Not-tested: The full tools/release package is not green in the native Windows checkout because three tests fail identically on origin/main due to POSIX executable mode and LF-only workflow matching. Co-authored-by: OmX <omx@oh-my-codex.dev>
The success-path assertion now compares target and package sets without treating their order as behavior. The failure-path probe fails on the second invocation, so it remains a non-final failure regardless of how the matrix is reordered. Constraint: Preserve the same four targets, public package coverage, CGO assertion, and fail-fast production behavior. Rejected: Fixed target and package ordering | Harmless reordering would create false failures and could move the injected failure to the final iteration. Confidence: high Scope-risk: narrow Tested: Windows Go compile and skip path; Linux-amd64 WSL behavior tests; order-independent fail-fast mutation red then restored green; git diff --cached --check. Not-tested: Full native Windows tools/release remains subject to the same three origin/main platform-baseline failures already documented on the PR. Co-authored-by: OmX <omx@oh-my-codex.dev>
This was referenced Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a CGO-disabled portable SDK cross-build gate for the deliberate public packages:
make check-portablecross-builds./api/... ./artifact/... ./client/... ./inference/... ./openapi/... ./source/... ./trigger/...withCGO_ENABLED=0for the exact four-platform matrix CI already uses (linux/amd64, linux/arm64, darwin/amd64, darwin/arm64)portable-sdkjob inmigration-gates.ymlruns the target on every PR.github/workflows/README.mddocuments the new gatetools/release/makefile_test.goexecutes the real Make target through a controlled Go boundary, proving the complete matrix and that a non-final build failure stops the gateAGENTS.mdrecords the reusable failure-path verification rule for CI matrix loopsCloses #33 (extracted from #3 WP0-C: "CGO-disabled cross-builds for portable public Client, domain, and generated API packages").
Relationship to #34
#34 implements the same WP0-C item in parallel. Its current Head has evolved since this PR was opened and now also uses explicit per-iteration failure propagation, the same four-platform matrix, public-package wildcards, and
./openapi/...; those are no longer differentiators.The remaining structural differences are:
mainand adds the job to the existing reusablemigration-gates.yml; ci: verify portable public SDK builds #34 is stacked oncodex/wp0-make-contractand adds a separate job directly tomaster.yml.CGO_ENABLED=0, and inject a failure on the second iteration. ci: verify portable public SDK builds #34's current test checks the Makefile contract text.Only one implementation should be retained to avoid duplicate portable SDK gates.
Behavior, API, and compatibility
mainremain unchangedValidation
Current Head
2e47a463446cf044584059dad1c198c03e56d8d3:make check-portablewith Go 1.27 — linux/amd64, linux/arm64, darwin/amd64, and darwin/arm64 all reportOKtools/releasetest binary under WSL — portable matrix, fail-fast, Go compatibility, coverage workflow, immutable-action, and shared-Go-setup contracts pass|| exit 1makesTestCheckPortableStopsAfterTheFirstFailedBuildfail; restoring it makes the test passgo run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12— no findingsgit diff --check— cleanNative Windows
go test ./tools/releasehas three platform-specific failures that reproduce identically onorigin/main(POSIX executable mode and LF-only workflow matching); they are not introduced by this PR. The exact-Head Linux/macOS CI matrix is green.