[PR #3142] [MERGED] ci(ghidra): compile packaged bridge sources before merge #5639

New issue

Closed

opened 2026-10-31 01:08:11 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:08:11 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3142
Author: @thanvi007
Created: 10/14/2026
Status: ✅ Merged
Merged: 10/15/2026
Merged by: @N0zoM1z0

Base: main ← Head: ci/ghidra-bridge-sources

📝 Commits (7)

175f69c ci(ghidra): compile packaged bridge sources before merge
7e17bf8 fix(ci): remove the bridge compile scratch directory after a failed compile
b045c37 ci(ghidra): validate bridge compilation before integration
8d90a36 chore(ci): refresh bridge follow-up against current main
6bf5dc2 chore(ci): sync final bridge follow-up with main
4fba7fa fix(ghidra): share required source roles and Properties parsing
05232d6 fix(ghidra): close source cohort and SDK qualification contracts

📊 Changes

26 files changed (+762 additions, -158 deletions)

View changed files

📝 .github/workflows/ci.yml (+7 -0)
➕ .github/workflows/ghidra-bridge-sources.yml (+48 -0)
📝 docs/testing.md (+13 -1)
📝 package.json (+1 -0)
📝 scripts/build-ghidra-nativeaot.mjs (+1 -1)
📝 scripts/ci/scopes.mjs (+9 -0)
➕ scripts/verify-ghidra-bridge-sources.mjs (+182 -0)
📝 scripts/verify-packed-bridge.mjs (+4 -5)
📝 scripts/verify-real-ghidra-assertions.mjs (+1 -1)
📝 scripts/verify-real-ghidra-noreturn.mjs (+1 -1)
📝 scripts/verify-real-ghidra-windows.mjs (+1 -1)
📝 scripts/verify-real-ghidra.mjs (+1 -1)
📝 scripts/verify-windows-package.mjs (+4 -1)
📝 src/ghidra/GhidraAnalysisSeeds.ts (+0 -1)
➕ src/ghidra/GhidraBridgeSources.ts (+12 -0)
📝 src/ghidra/GhidraInstallation.test.ts (+4 -2)
📝 src/ghidra/GhidraInstallation.ts (+5 -3)
📝 src/ghidra/GhidraInstallationPolicy.ts (+0 -121)
📝 src/ghidra/GhidraJavaProperties.ts (+10 -7)
📝 src/ghidra/GhidraLauncher.ts (+10 -7)

...and 6 more files

📄 Description

Summary

Closes #2908. Ordinary CI did not compile the packaged Ghidra bridge, allowing missing Java imports to ship. A selected ghidra_bridge lane now compiles the complete packaged Java cohort against a checksum-pinned SDK, without npm dependencies, a runtime build, Ghidra startup or target selection/execution.

One named source manifest is shared by runtime launch/default-path selection, the compiler and both package validators. The directory and manifest must match, catching deleted/renamed scripts and unregistered Java dependencies. The seed-script alias is removed.
The compiler reuses the production Latin-1 Java Properties parser and release policy. The release policy is a dependency-free owner; all existing consumers were migrated, with no compatibility re-export or independent version regex.
CI checks the archive URL/digest pin against that verified version before download, derives its runner JDK from the same owner, and requires the extracted SDK's actual version to match. Changes to the source/release owners select this lane; manifest edits also select Windows package verification.
Compilation uses a quoted argument file, the canonical Java release, -proc:none, a 1GiB heap and bounded waits. Scratch is removed on success/failure. NativeAOT's separately pinned integration and JADX retain their existing scopes.

Validation

Current head 05232d660, integrated main through 633e4ff434. Hosted CI 38781448926 passed all 36 jobs, including Windows, Portable tests and the required gate. Greptile and Codex completed on this head with no remaining findings; four valid follow-up findings were fixed and their controls rerun.

Nine focused files: 378 passed, four native-Windows cases skipped on Linux. Covers selector/required-gate/cache controls, admission, Properties syntax, release policy, launcher, seeds and scratch cleanup. Workflow including artifact preparation: 51.02s wall, child CPU 61.17/19.19s user/system, sampled family RSS 3.13GiB.
Real JDK21.0.12.1 / Ghidra12.1.4: nine sources / 195 jars compile from an isolated workspace without node_modules/build: 3.83s, CPU 6.41/0.35s, peak 335MiB. Actual missing-HashMap compilation fails with file/line/symbol and empty scratch.
Real negative controls: deleting the COM helper let the old check compile eight files; adding a referenced unregistered helper let the next check compile ten files while npm omitted it. Both now fail before javac. Changing the verified owner to12.1.5 previously left12.1.4 SDK compilation green; pin and actual-SDK checks now reject that drift before download/compilation.
A normal npm tarball has all nine sources. Omitting the COM helper passed the old package check and now fails before extraction. The original verifier/package guard also fails eight new regressions while retaining its two old cleanup cases.
Compiled public CLI with actual Ghidra12.1.4 analyzes /bin/true, returns validated upstream Ghidra Evidence, preserves input SHA256 and empties owned tmp. After release extraction, two fresh CLI/provider runs completed: 49.45s / 20.68s, CPU 45.94/3.95s / 33.54/2.16s, peak 1.05GiB / 948MiB. Both use the same build; cache/initialization effects were not isolated, so neither is a speedup claim.
check:ci (eight tasks, 1441 architecture guards), docs:check (five tests), pinned actionlint1.7.7, normal hooks and pre-push passed. All current-head hosted lanes passed; the Windows lane passed without a retry on this head.

Measured commands run serially on two cores, with fresh processes and warm local artifact/OS caches. RSS can miss short/reparented children and count shared pages repeatedly; wrapper CPU excluded. Agent tokens and hosted CPU/peak memory are unmeasured. The official archive is 569,649,598 bytes, SHA256 ddac49f903da9d5bac833e5cc79395098b9c33cfd3279be5f31bd00387d2d4db; current-head hosted download took 3.08s, acquisition/checksum/extraction 5s, and the entire compiler job 21s, without npm ci/build. All nine sources compiled against 195 jars with JDK21.0.12.1. No cache benefit is claimed. Compiler checks establish source compatibility; real-provider coverage is limited to the executed Linux CLI workflow.

Original contributor: @claudetrail2026-droid. The user delegated follow-up implementation, technical review, ready-for-review update and merge. Assistant technical review is reported; a separate human reread is not claimed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3142 **Author:** [@thanvi007](https://github.com/thanvi007) **Created:** 10/14/2026 **Status:** ✅ Merged **Merged:** 10/15/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `ci/ghidra-bridge-sources` --- ### 📝 Commits (7) - [`175f69c`](https://github.com/morluto/rea/commit/175f69c349acfe4e38df2c2062d677062bea62b0) ci(ghidra): compile packaged bridge sources before merge - [`7e17bf8`](https://github.com/morluto/rea/commit/7e17bf8edfe4c678ace3c9de32a11600ec21ef62) fix(ci): remove the bridge compile scratch directory after a failed compile - [`b045c37`](https://github.com/morluto/rea/commit/b045c370398e34d6bffb7cb4555eafed543d0e6f) ci(ghidra): validate bridge compilation before integration - [`8d90a36`](https://github.com/morluto/rea/commit/8d90a36aa085bfdab8a54de5528ac0cfaa739a2a) chore(ci): refresh bridge follow-up against current main - [`6bf5dc2`](https://github.com/morluto/rea/commit/6bf5dc289ca6eef4a0c4ddd97512b6bb03a6463d) chore(ci): sync final bridge follow-up with main - [`4fba7fa`](https://github.com/morluto/rea/commit/4fba7fa8e416b4abd8f71722ab1fe1bf1bfdd4bb) fix(ghidra): share required source roles and Properties parsing - [`05232d6`](https://github.com/morluto/rea/commit/05232d660c18b48632d95689be4b84211b18ed50) fix(ghidra): close source cohort and SDK qualification contracts ### 📊 Changes **26 files changed** (+762 additions, -158 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+7 -0) ➕ `.github/workflows/ghidra-bridge-sources.yml` (+48 -0) 📝 `docs/testing.md` (+13 -1) 📝 `package.json` (+1 -0) 📝 `scripts/build-ghidra-nativeaot.mjs` (+1 -1) 📝 `scripts/ci/scopes.mjs` (+9 -0) ➕ `scripts/verify-ghidra-bridge-sources.mjs` (+182 -0) 📝 `scripts/verify-packed-bridge.mjs` (+4 -5) 📝 `scripts/verify-real-ghidra-assertions.mjs` (+1 -1) 📝 `scripts/verify-real-ghidra-noreturn.mjs` (+1 -1) 📝 `scripts/verify-real-ghidra-windows.mjs` (+1 -1) 📝 `scripts/verify-real-ghidra.mjs` (+1 -1) 📝 `scripts/verify-windows-package.mjs` (+4 -1) 📝 `src/ghidra/GhidraAnalysisSeeds.ts` (+0 -1) ➕ `src/ghidra/GhidraBridgeSources.ts` (+12 -0) 📝 `src/ghidra/GhidraInstallation.test.ts` (+4 -2) 📝 `src/ghidra/GhidraInstallation.ts` (+5 -3) 📝 `src/ghidra/GhidraInstallationPolicy.ts` (+0 -121) 📝 `src/ghidra/GhidraJavaProperties.ts` (+10 -7) 📝 `src/ghidra/GhidraLauncher.ts` (+10 -7) _...and 6 more files_ </details> ### 📄 Description ## Summary Closes #2908. Ordinary CI did not compile the packaged Ghidra bridge, allowing missing Java imports to ship. A selected `ghidra_bridge` lane now compiles the complete packaged Java cohort against a checksum-pinned SDK, without npm dependencies, a runtime build, Ghidra startup or target selection/execution. - One named source manifest is shared by runtime launch/default-path selection, the compiler and both package validators. The directory and manifest must match, catching deleted/renamed scripts and unregistered Java dependencies. The seed-script alias is removed. - The compiler reuses the production Latin-1 Java Properties parser and release policy. The release policy is a dependency-free owner; all existing consumers were migrated, with no compatibility re-export or independent version regex. - CI checks the archive URL/digest pin against that verified version before download, derives its runner JDK from the same owner, and requires the extracted SDK's actual version to match. Changes to the source/release owners select this lane; manifest edits also select Windows package verification. - Compilation uses a quoted argument file, the canonical Java release, `-proc:none`, a 1GiB heap and bounded waits. Scratch is removed on success/failure. NativeAOT's separately pinned integration and JADX retain their existing scopes. ## Validation Current head `05232d660`, integrated main through `633e4ff434`. Hosted CI [38781448926](https://github.com/morluto/rea/actions/runs/38781448926) passed all **36 jobs**, including Windows, Portable tests and the required gate. Greptile and Codex completed on this head with no remaining findings; four valid follow-up findings were fixed and their controls rerun. - Nine focused files: **378 passed, four native-Windows cases skipped on Linux**. Covers selector/required-gate/cache controls, admission, Properties syntax, release policy, launcher, seeds and scratch cleanup. Workflow including artifact preparation: **51.02s wall**, child CPU **61.17/19.19s user/system**, sampled family RSS **3.13GiB**. - Real JDK21.0.12.1 / Ghidra12.1.4: **nine sources / 195 jars** compile from an isolated workspace without node_modules/build: **3.83s**, CPU **6.41/0.35s**, peak **335MiB**. Actual missing-HashMap compilation fails with file/line/symbol and empty scratch. - Real negative controls: deleting the COM helper let the old check compile eight files; adding a referenced unregistered helper let the next check compile ten files while npm omitted it. Both now fail before javac. Changing the verified owner to12.1.5 previously left12.1.4 SDK compilation green; pin and actual-SDK checks now reject that drift before download/compilation. - A normal npm tarball has all nine sources. Omitting the COM helper passed the old package check and now fails before extraction. The original verifier/package guard also fails eight new regressions while retaining its two old cleanup cases. - Compiled public CLI with actual Ghidra12.1.4 analyzes `/bin/true`, returns validated upstream Ghidra Evidence, preserves input SHA256 and empties owned tmp. After release extraction, two fresh CLI/provider runs completed: **49.45s / 20.68s**, CPU **45.94/3.95s / 33.54/2.16s**, peak **1.05GiB / 948MiB**. Both use the same build; cache/initialization effects were not isolated, so neither is a speedup claim. - `check:ci` (eight tasks, 1441 architecture guards), `docs:check` (five tests), pinned actionlint1.7.7, normal hooks and pre-push passed. All current-head hosted lanes passed; the Windows lane passed without a retry on this head. Measured commands run serially on two cores, with fresh processes and warm local artifact/OS caches. RSS can miss short/reparented children and count shared pages repeatedly; wrapper CPU excluded. Agent tokens and hosted CPU/peak memory are unmeasured. The official archive is **569,649,598 bytes**, SHA256 `ddac49f903da9d5bac833e5cc79395098b9c33cfd3279be5f31bd00387d2d4db`; current-head hosted download took **3.08s**, acquisition/checksum/extraction **5s**, and the entire compiler job **21s**, without npm ci/build. All nine sources compiled against 195 jars with JDK21.0.12.1. No cache benefit is claimed. Compiler checks establish source compatibility; real-provider coverage is limited to the executed Linux CLI workflow. Original contributor: @claudetrail2026-droid. The user delegated follow-up implementation, technical review, ready-for-review update and merge. Assistant technical review is reported; a separate human reread is not claimed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:08:11 +00:00