diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 142e179bb5..8dfd067f34 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -400,6 +400,21 @@ jobs: name: windows-native-inspection-fixture path: .cache/windows-native-inspection-fixture/ if-no-files-found: error + # The process boundary observations are independent of the addon: they + # report the caller's and child's own token, environment and breakaway + # results from a separate executable. Cross-build it in the lane that + # already has MinGW so the Windows job can observe them too. + - name: Build Windows process boundary fixture + run: | + mkdir -p .cache/windows-process-boundary + x86_64-w64-mingw32-g++ -municode -std=c++17 -O2 -static -Wall -Wextra \ + -o .cache/windows-process-boundary/process-boundary.exe \ + tests/fixtures/windows/processBoundary.cc -ladvapi32 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: windows-process-boundary-fixture + path: .cache/windows-process-boundary/ + if-no-files-found: error - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: windows-native-controls @@ -622,7 +637,16 @@ jobs: src/application/Update.test.ts tests/process-global/updateMaintenance.test.ts tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts - - run: npm run verify:windows-native + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + with: + name: windows-process-boundary-fixture + path: .cache/windows-process-boundary/ + # Passing the fixture adds the breakaway, caller/child token, environment + # semantics and ancestor reparse observations, which the lane skips + # entirely when it is absent. + - run: >- + npm run verify:windows-native -- . + "${{ github.workspace }}\.cache\windows-process-boundary\process-boundary.exe" - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: windows-native-inspection-fixture diff --git a/.github/workflows/real-ghidra-windows.yml b/.github/workflows/real-ghidra-windows.yml index db92cd0f84..ce14932063 100644 --- a/.github/workflows/real-ghidra-windows.yml +++ b/.github/workflows/real-ghidra-windows.yml @@ -36,6 +36,20 @@ jobs: name: real-ghidra-windows-native path: native/windows/build/ if-no-files-found: error + # The boundary observations need a separate Windows executable, which the + # native lane skips when it is absent. Cross-build it here, where MinGW is + # already installed, so the proof run observes them too. + - name: Build Windows process boundary fixture + run: | + mkdir -p .cache/windows-process-boundary + x86_64-w64-mingw32-g++ -municode -std=c++17 -O2 -static -Wall -Wextra \ + -o .cache/windows-process-boundary/process-boundary.exe \ + tests/fixtures/windows/processBoundary.cc -ladvapi32 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: real-ghidra-windows-process-boundary + path: .cache/windows-process-boundary/ + if-no-files-found: error verify: name: Real Ghidra 12.1.4 Windows x64 PE proof @@ -55,7 +69,13 @@ jobs: name: real-ghidra-windows-native path: native/windows/build/ - run: npm run verify:windows-native:artifact - - run: npm run verify:windows-native + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + with: + name: real-ghidra-windows-process-boundary + path: .cache/windows-process-boundary/ + - run: >- + npm run verify:windows-native -- . + "${{ github.workspace }}\.cache\windows-process-boundary\process-boundary.exe" - name: Verify all admitted Windows Ghidra operations env: REA_ANALYSIS_PROVIDER: ghidra diff --git a/native/windows/README.md b/native/windows/README.md index e2543260f0..7432f15fd6 100644 --- a/native/windows/README.md +++ b/native/windows/README.md @@ -163,9 +163,14 @@ V8 heap flags cannot bound (limit notification, peak commit at the limit, all members settled, with the notification present in the first native exit report and the wrapper's exit event), and a control under the same limit that completes normally. -An optional independently built -`tests/fixtures/windows/processBoundary.cc` executable adds breakaway and -caller/child token observations and an in-place ancestor reparse attempt: +A separately built `tests/fixtures/windows/processBoundary.cc` executable adds +breakaway, caller/child token and environment semantics observations and an +in-place ancestor reparse attempt. The lane skips all of them when the +executable is absent, so both Windows workflows cross-build it in the same +MinGW job that builds their artifact and pass it: the capability and package +lane in `.github/workflows/ci.yml`, and the real Ghidra proof run in +`.github/workflows/real-ghidra-windows.yml`. Build it locally with any Windows +C++ compiler, or the same way they do, and pass its path: ```powershell node scripts/verify-windows-native.mjs . C:\fixtures\process-boundary.exe