mirror of
https://github.com/morluto/rea.git
synced 2026-10-11 21:39:55 +00:00
Ysopwnable
163ee09a74
* feat(native): inspect recorded crashes through pwntools and pwndbg * fix(native): bind core note semantics to raw owner bytes * fix(native): validate recorded core ABI and evidence scalars * fix(native): require complete recorded note interpretations * fix(native): bind physical core notes to original headers
100 lines
4.3 KiB
YAML
100 lines
4.3 KiB
YAML
name: Real recorded crash evidence
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
pull_request:
|
|
paths:
|
|
- ".github/workflows/real-recorded-crash.yml"
|
|
- "bridge/pwntools/**"
|
|
- "bridge/pwndbg/**"
|
|
- "src/native/pwntools/**"
|
|
- "src/native/pwndbg/**"
|
|
- "src/domain/native/recordedCrash*"
|
|
- "src/application/binaryDiagnostics/**"
|
|
- "src/contracts/native/binaryDiagnosticsToolContracts.ts"
|
|
- "src/contracts/toolEffects.ts"
|
|
- "src/contracts/toolOutputSchemaGroups.ts"
|
|
- "src/composition/binaryDiagnostics.ts"
|
|
- "src/server/registerRecordedCrashTools.ts"
|
|
- "src/server/createServer.ts"
|
|
- "src/server/sessionAvailabilityPolicy.ts"
|
|
- "src/cli/binaryDiagnosticsCommands.ts"
|
|
- "src/cliCommandNames.ts"
|
|
- "src/process/**"
|
|
- "src/artifacts/readStableArtifact*.ts"
|
|
- "src/domain/analysisError*.ts"
|
|
- "scripts/verify-recorded-crash.mjs"
|
|
- "scripts/verify/recorded-crash/**"
|
|
- "scripts/lib/recorded-core-fixtures.py"
|
|
- "scripts/fixtures/recorded-crash.c"
|
|
- "third_party/pwndbg/**"
|
|
- "package.json"
|
|
- "package-lock.json"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: real-recorded-crash-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=768
|
|
HUSKY: "0"
|
|
UV_CONCURRENT_BUILDS: "1"
|
|
UV_CONCURRENT_INSTALLS: "1"
|
|
UV_PYTHON_DOWNLOADS: never
|
|
|
|
jobs:
|
|
real-recorded-crash:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version-file: .nvmrc
|
|
cache: npm
|
|
- run: npm ci
|
|
- name: Install GDB on the disposable CI runner
|
|
shell: bash
|
|
run: |
|
|
sudo apt-get update -qq
|
|
sudo apt-get install --yes --no-install-recommends gdb
|
|
- name: Acquire exact unchanged upstreams in isolated runner storage
|
|
shell: bash
|
|
run: |
|
|
command -v gcc
|
|
command -v gdb
|
|
command -v strace
|
|
core_decoder_root="${RUNNER_TEMP}/rea-core-decoder"
|
|
core_pwndbg_root="${RUNNER_TEMP}/rea-core-pwndbg"
|
|
core_pwndbg_venv="${RUNNER_TEMP}/rea-core-pwndbg-venv"
|
|
python3 -m venv "${core_decoder_root}"
|
|
"${core_decoder_root}/bin/python" -m pip install --disable-pip-version-check \
|
|
'pwntools==4.15.0' 'pyelftools==0.33' 'unicorn==2.1.2' 'uv==0.12.0'
|
|
git init "${core_pwndbg_root}"
|
|
git -C "${core_pwndbg_root}" remote add origin https://github.com/pwndbg/pwndbg.git
|
|
git -C "${core_pwndbg_root}" fetch --depth=1 origin 55596aa676a2756efb8d67034f31675170eabe48
|
|
git -C "${core_pwndbg_root}" checkout --detach FETCH_HEAD
|
|
test "$(git -C "${core_pwndbg_root}" rev-parse HEAD)" = 55596aa676a2756efb8d67034f31675170eabe48
|
|
UV_PROJECT_ENVIRONMENT="${core_pwndbg_venv}" \
|
|
"${core_decoder_root}/bin/uv" sync --project "${core_pwndbg_root}" \
|
|
--frozen --no-editable --no-default-groups --python /usr/bin/python3 --no-managed-python
|
|
test -z "$(git -C "${core_pwndbg_root}" status --porcelain --untracked-files=no)"
|
|
echo "REA_PWNTOOLS_PYTHON=${core_decoder_root}/bin/python" >> "${GITHUB_ENV}"
|
|
echo "REA_PWNDBG_GDB=$(command -v gdb)" >> "${GITHUB_ENV}"
|
|
echo "REA_PWNDBG_GDBINIT=${core_pwndbg_root}/gdbinit.py" >> "${GITHUB_ENV}"
|
|
echo "REA_PWNDBG_VENV_PATH=${core_pwndbg_venv}" >> "${GITHUB_ENV}"
|
|
echo "REA_VERIFY_STRACE_COMMAND=$(command -v strace)" >> "${GITHUB_ENV}"
|
|
- name: Build and install the exact package in isolated runner storage
|
|
shell: bash
|
|
run: |
|
|
npm run build:cached
|
|
npm pack --ignore-scripts --json --pack-destination "${RUNNER_TEMP}" > "${RUNNER_TEMP}/rea-core-pack.json"
|
|
core_package_name=$(node -p 'JSON.parse(require("node:fs").readFileSync(process.argv[1], "utf8"))[0].filename' "${RUNNER_TEMP}/rea-core-pack.json")
|
|
npm install --prefix "${RUNNER_TEMP}/rea-core-installed" --ignore-scripts --no-fund --no-audit "${RUNNER_TEMP}/${core_package_name}"
|
|
- name: Verify installed CLI and MCP against the source-owned recording
|
|
shell: bash
|
|
run: node scripts/verify-recorded-crash.mjs "${RUNNER_TEMP}/rea-core-installed/node_modules/rea-agents/scripts/rea.mjs"
|