Skip to content

Cross-complie atmos - #34

Merged
Nuru (Nuru) merged 1 commit into
masterfrom
cross-compile
Apr 26, 2021
Merged

Cross-complie atmos#34
Nuru (Nuru) merged 1 commit into
masterfrom
cross-compile

Conversation

@Nuru

@Nuru Nuru (Nuru) commented Apr 26, 2021

Copy link
Copy Markdown
Contributor

what

why

  • Make binaries available for other platforms

notes

  • At this time, Windows builds fail due to syscall in k-kinzal/aliases@v0.5.1 being undefined, so we are not yet distributing Windows binaries
  • At this time, builds using go 1.16 fail due to an incompatibility with Variant 0.37.1, so we must use go 1.15 and cannot build binaries for Apple M1 because that requires go 1.16.
  • The preferred way to set the version is by having the go linker set the value of a global variable, but there is currently no way to reference a global go variable inside a variant job.

references

@Nuru Nuru (Nuru) added the patch A minor, backward compatible change label Apr 26, 2021
@Nuru
Nuru (Nuru) requested review from a team as code owners April 26, 2021 04:00
@Nuru
Nuru (Nuru) merged commit 5bc1b64 into master Apr 26, 2021
@Nuru
Nuru (Nuru) deleted the cross-compile branch April 26, 2021 05:04
Erik Osterman (Cloud Posse) (osterman) added a commit that referenced this pull request Jul 13, 2026
@osterman @claude
fix(ci): resolve archive PR CI failures and CodeRabbit findings
da6aec6 
- pkg/cache: bump the exclusive-lock retry budget from 500ms to 2s
  (filelock_unix.go). TestFileCache_ConcurrentAccess was intermittently
  failing on Linux CI with "cache file is locked by another process" -
  10 goroutines contending for the cache directory's single lock file
  could exceed the old 50-retry/10ms budget under normal CI load. Ran
  the test 50x locally with -race after the fix with no failures.
- CI workflow: bump the Windows/macOS "Acceptance tests" step timeout
  from 45m to 60m. Compared successful vs. failed run timings for this
  step: 37m43s vs. 45m06s (timed out) - only ~7 minutes of headroom on
  a step with that much run-to-run variance. 60m matches the Linux
  coverage step's existing budget.
- docs/prd/archive-step.md, website/blog: drop the "still-open" framing
  on the cited archive_file GitHub issues - verified via `gh issue view`
  that all three (hashicorp/terraform#30042, terraform-provider-archive
  #218 and #34) are actually closed. Reworded to cite them as documented
  evidence of the failure mode without asserting current issue-tracker
  status.
- website/docs archive.mdx: scope the byte-identical-output claim to
  mtime: epoch/git only - mtime: filesystem preserves real source mtime
  and permission bits and is not deterministic.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Andriy Knysh (aknysh) added a commit that referenced this pull request Jul 14, 2026
@osterman @claude @aknysh
feat(workflows): add native archive step type for zip/tar packaging (#…
0de155e 
…2730)

* feat(workflows): add native archive step type for zip/tar packaging

Packaging build artifacts (e.g. a Lambda handler.zip) had no native Atmos
primitive; the only option was shelling out to zip/tar, which breaks on
Windows and gives no typed validation. The new `type: archive` step packs
a directory/file into a zip/tar/tgz archive using the Go standard library
only. It reuses the existing `kind: step` hook bridge instead of adding a
dedicated hook kind, so it's usable as a lifecycle hook for free.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(docs): use full atmos.tools URL for /stacks/generate link

lychee's exclude list only whitelists /cli/ and /functions/ root-relative
website paths (the only forms it can't resolve locally); /stacks/generate
isn't covered, so the link checker treated it as a literal repo-relative
file path and failed. Match the convention every other PRD doc uses for
paths outside those two prefixes: a full https://atmos.tools/... URL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(archive): address CodeRabbit review findings on archive step

Fixes several correctness/security issues from PR review: writeZip/writeTar
now write through a temp file and rename atomically, so a failure partway
through (e.g. a source file vanishing mid-run) never truncates or corrupts
the previous archive; action: update no longer downgrades an existing
archive's file permissions to the temp file's default mode; a single-file
source now respects include/exclude filters instead of always being
archived; Run(action, nil) returns a typed validation error instead of
panicking; invalid glob-pattern errors from directory walking are no longer
misclassified as a missing source; and subpath is validated to reject
absolute paths and "."/".." segments, closing a path-traversal vector where
an extracted archive could write outside its target directory.

Also fixes two doc gaps: the step-types summary table and the archive step's
intro paragraph both undersold supported formats as "zip/tar" when tgz is
also supported.

Three review comments proposing a destination-then-source format-inference
fallback were not applied — the documented contract in
docs/prd/archive-step.md is destination-only for pack actions and
source-only for extract, not a fallback chain, so the "bug" was based on a
misreading of ambiguous PR description wording, not an actual gap.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(schema): add archive step fields to atmos-manifest JSON schema

TestSchemaCoversWorkflowStepFields was failing in CI: the archive step's
format/destination/subpath/include/exclude fields were missing from the
published workflow_step schema, which would reject valid workflow files
annotated with the $schema. action/source were already covered since the
archive step reuses those existing fields.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* test(archive): raise patch coverage for the archive step and package

Codecov flagged the archive-step PR's patch coverage at 74.4% (target 85%).
Adds targeted tests for previously-uncovered branches: format inference
across all tar.bz2/tar.xz/tar extension aliases, Run() with an unknown
action, update()'s own validation/MkdirAll error paths, destinationMode and
atomicRewrite's direct error paths (stat failures, CreateTemp failure, a
failing write callback, a rename-over-non-empty-directory failure), missing
source entries fed straight into updateZip/updateTar, corrupt existing
archives on update, single-file sources with an invalid glob pattern, a
generic (non-glob) directory-walk failure, and every template-resolution
error path in the archive step handler (source/destination/format/subpath/
include/exclude) plus a combined include+exclude success case. Raises
pkg/archive from 83.7% to 93.0% and pkg/runner/step/archive.go to 100%.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(archive): add opt-in reproducible archive output

Shell/stdlib zip and tar both bake in real file mtime and permission
bits, so identical source content produces different archive bytes on
every rebuild — the same non-determinism long reported against
Terraform's archive_file provider. Add reproducible: epoch|git,
backed by go-git commit history (no shelling out to git log), plus
permission-bit normalization. Opt-in and off by default so existing
workflows are unaffected.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(archive): address CodeRabbit findings on reproducible archives

- lastCommitForPrefix silently fell back to the fixed epoch when source
  was the repository root (filepath.Rel returns "." there, which never
  matches a real git path); match every path in that case.
- Validate rejected a templated reproducible field before resolution,
  so a template resolving to a valid mode still failed early. Move the
  check to after vars.Resolve, in resolveArchiveOptions.
- Note in the blog post that reproducible only normalizes the replace
  path, matching the caveat already in the step reference doc.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(archive): skip non-directory-path tests on Windows

TestDestinationMode's "stat error other than not-exist" case and
TestCopyUnchangedTarEntries_OpenFailure both fail on Windows: they use
a file-as-directory-component trick to force a stat/open error, but
Windows reports that as ERROR_PATH_NOT_FOUND (which os.IsNotExist
treats as true), not POSIX's distinct ENOTDIR — so the code under
test correctly treats it as "doesn't exist" and returns no error.
Skip on Windows, matching the existing TestAtomicRewrite_RenameFailure
precedent for the same class of platform difference.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* refactor(archive): rename reproducible field to mtime, tighten docs

Renames the archive step's opt-in reproducible: epoch|git field to
mtime: filesystem|epoch|git, naming it after the mechanism it controls
(the per-entry timestamp stamped into the archive) rather than an
opinionated outcome word, and making the default an explicit value
instead of an implicit empty string.

Also tightens the PRD and blog post: the archive_file dependency-ordering
claim now cites the actual upstream Terraform issues and explains the
missing-reference root cause instead of reading as an unqualified
strawman, and both docs now state explicitly that action: replace is
idempotent while action: update is not, rather than implying it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(ci): resolve archive PR CI failures and CodeRabbit findings

- pkg/cache: bump the exclusive-lock retry budget from 500ms to 2s
  (filelock_unix.go). TestFileCache_ConcurrentAccess was intermittently
  failing on Linux CI with "cache file is locked by another process" -
  10 goroutines contending for the cache directory's single lock file
  could exceed the old 50-retry/10ms budget under normal CI load. Ran
  the test 50x locally with -race after the fix with no failures.
- CI workflow: bump the Windows/macOS "Acceptance tests" step timeout
  from 45m to 60m. Compared successful vs. failed run timings for this
  step: 37m43s vs. 45m06s (timed out) - only ~7 minutes of headroom on
  a step with that much run-to-run variance. 60m matches the Linux
  coverage step's existing budget.
- docs/prd/archive-step.md, website/blog: drop the "still-open" framing
  on the cited archive_file GitHub issues - verified via `gh issue view`
  that all three (hashicorp/terraform#30042, terraform-provider-archive
  #218 and #34) are actually closed. Reworded to cite them as documented
  evidence of the failure mode without asserting current issue-tracker
  status.
- website/docs archive.mdx: scope the byte-identical-output claim to
  mtime: epoch/git only - mtime: filesystem preserves real source mtime
  and permission bits and is not deterministic.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* test(archive): use os.Chmod to make the mtime-normalization assertion meaningful

os.WriteFile's requested mode is subject to the process umask, so under the
common 0o022 umask the source file already landed at 0o644 on disk - the
same value the test asserts on the archived entry. That made the assertion
pass trivially without proving normalization actually ran. os.Chmod bypasses
umask, guaranteeing the source is genuinely 0o664 before archiving.

Addresses a CodeRabbit finding on PR #2730; verified against current code
that the other four open findings on that review pass no longer apply (format
inference from source is by design reserved for the not-yet-implemented
extract action per the PRD, and the tar.go permission-stripping concern is
already handled by atomicRewrite's destinationMode() chmod).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aknysh Andriy Knysh (aknysh) aknysh approved these changes
@osterman Erik Osterman (Cloud Posse) (osterman) Awaiting requested review from osterman
@Gowiem Matt Gowie (Gowiem) Awaiting requested review from Gowiem

Assignees

No one assigned

Labels

patch A minor, backward compatible change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Nuru @aknysh