name: Cache lifecycle
on:
workflow_dispatch:
inputs:
commit_sha:
description: Exact main-branch commit and signed candidate to qualify
required: true
type: string
version:
description: Exact stable candidate version to qualify
required: true
type: string
standalone_candidate_run_id:
description: Successful exact-SHA Standalone candidate workflow run ID
required: true
type: string
permissions:
actions: read
contents: read
concurrency:
group: cache-lifecycle-${{ inputs.commit_sha }}
cancel-in-progress: false
jobs:
exact-artifact-cache-lifecycle:
name: exact signed artifact ยท DeepSeek + Gemma + Qwen + Qwen3.8
runs-on: [self-hosted, macOS, ARM64, hf2q-gates]
timeout-minutes: 300
env:
EXPECTED_SHA: ${{ inputs.commit_sha }}
EXPECTED_VERSION: ${{ inputs.version }}
EXPECTED_STANDALONE_CANDIDATE_RUN_ID: ${{ inputs.standalone_candidate_run_id }}
ACCEPTED_QWEN38_MODEL_SHA256: "1ee55c653644d6f645c6b2f39fc56a3ce28093620fd34dd43678875f348f2e1a"
CARGO_TERM_COLOR: always
steps:
- name: Checkout exact candidate
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with:
ref: ${{ inputs.commit_sha }}
fetch-depth: 0
persist-credentials: false
- name: Verify immutable main identity and model paths
shell: bash
env:
DEEPSEEK_MODEL_PATH: ${{ vars.DEEPSEEK4_MODEL_PATH }}
GEMMA_MODEL_PATH: ${{ vars.GEMMA4_MODEL_PATH }}
QWEN_MODEL_PATH: ${{ vars.QWEN36_MODEL_PATH }}
QWEN38_MODEL_PATH: ${{ vars.QWEN38_MODEL_PATH }}
DEEPSEEK_MODEL_SHA256: ${{ vars.DEEPSEEK4_MODEL_SHA256 }}
GEMMA_MODEL_SHA256: ${{ vars.GEMMA4_MODEL_SHA256 }}
QWEN_MODEL_SHA256: ${{ vars.QWEN36_MODEL_SHA256 }}
QWEN38_MODEL_SHA256: ${{ vars.QWEN38_MODEL_SHA256 }}
run: |
set -euo pipefail
actual_sha=$(git rev-parse HEAD)
test "$actual_sha" = "$EXPECTED_SHA"
git fetch origin main
git merge-base --is-ancestor "$actual_sha" origin/main
git diff --exit-code
for model in "$DEEPSEEK_MODEL_PATH" "$GEMMA_MODEL_PATH" \
"$QWEN_MODEL_PATH" "$QWEN38_MODEL_PATH"; do
[[ "$model" != *$'\n'* && "$model" != *$'\r'* ]]
test -f "$model"
done
for digest in "$DEEPSEEK_MODEL_SHA256" "$GEMMA_MODEL_SHA256" \
"$QWEN_MODEL_SHA256" "$QWEN38_MODEL_SHA256"; do
[[ "$digest" =~ ^[0-9a-f]{64}$ ]]
done
test "$QWEN38_MODEL_SHA256" = "$ACCEPTED_QWEN38_MODEL_SHA256"
{
printf 'DEEPSEEK_MODEL=%s\n' "$DEEPSEEK_MODEL_PATH"
printf 'GEMMA_MODEL=%s\n' "$GEMMA_MODEL_PATH"
printf 'QWEN_MODEL=%s\n' "$QWEN_MODEL_PATH"
printf 'QWEN38_MODEL=%s\n' "$QWEN38_MODEL_PATH"
printf 'DEEPSEEK_MODEL_SHA256=%s\n' "$DEEPSEEK_MODEL_SHA256"
printf 'GEMMA_MODEL_SHA256=%s\n' "$GEMMA_MODEL_SHA256"
printf 'QWEN_MODEL_SHA256=%s\n' "$QWEN_MODEL_SHA256"
printf 'QWEN38_MODEL_SHA256=%s\n' "$QWEN38_MODEL_SHA256"
} >> "$GITHUB_ENV"
- name: Toolchain
uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 with:
toolchain: "1.88.0"
- name: Download exact build and signed candidates
shell: bash
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
run_json=$(gh run view "$EXPECTED_STANDALONE_CANDIDATE_RUN_ID" \
--json conclusion,event,workflowName,url)
test "$(jq -r .workflowName <<<"$run_json")" = "Standalone candidate"
test "$(jq -r .event <<<"$run_json")" = "workflow_dispatch"
test "$(jq -r .conclusion <<<"$run_json")" = "success"
input_root="$RUNNER_TEMP/cache-lifecycle-inputs"
mkdir -m 0700 "$input_root"
gh run download "$EXPECTED_STANDALONE_CANDIDATE_RUN_ID" \
--name "standalone-candidate-build-$EXPECTED_SHA" \
--dir "$input_root/standalone-candidate-build-$EXPECTED_SHA"
gh run download "$EXPECTED_STANDALONE_CANDIDATE_RUN_ID" \
--name "standalone-candidate-signed-$EXPECTED_SHA" \
--dir "$input_root/standalone-candidate-signed-$EXPECTED_SHA"
- name: Bind the signed artifact to the packed source and proof
shell: bash
run: |
set -euo pipefail
build_root="$RUNNER_TEMP/cache-lifecycle-inputs/standalone-candidate-build-$EXPECTED_SHA"
signed_root="$RUNNER_TEMP/cache-lifecycle-inputs/standalone-candidate-signed-$EXPECTED_SHA"
build_receipt="$build_root/build.json"
signed_receipt="$signed_root/proof.json"
test -z "$(find "$build_root" "$signed_root" -type l -print -quit)"
test "$(find "$build_root" -mindepth 1 -maxdepth 1 -print | wc -l | tr -d ' ')" = 4
test "$(find "$signed_root" -mindepth 1 -maxdepth 1 -print | wc -l | tr -d ' ')" = 8
crate_sha=$(jq -er .crate_sha256 "$build_receipt")
binary_sha=$(jq -er .asset.sha256 "$signed_receipt")
jq -e \
--arg source_sha "$EXPECTED_SHA" \
--arg version "$EXPECTED_VERSION" \
--arg binary_sha "$binary_sha" '
.kind == "hf2q.standalone-apple-release-proof"
and .schema_version == 1
and .source_sha == $source_sha
and .version == $version
and .target == "aarch64-apple-darwin"
and .asset.name == "hf2q-aarch64-apple-darwin"
and .asset.sha256 == $binary_sha
and .signing.authority == "Developer ID Application"
and .signing.hardened_runtime == true
and .signing.secure_timestamp == true
and .notarization.status == "Accepted"
and .notarization.standalone_ticket_stapled == false
and .verification.codesign == "accepted"
and .verification.online_notarization == "accepted"
and .verification.notary_ticket_cdhash_matches == true
' "$signed_receipt" >/dev/null
for pair in \
"notary-submission.json:.notarization.submission_sha256" \
"notary-wait.json:.notarization.wait_sha256" \
"notary-log.json:.notarization.log_sha256" \
"codesign.txt:.verification.codesign_log_sha256" \
"notarization-check.txt:.verification.online_notarization_log_sha256"; do
file=${pair%%:*}
selector=${pair#*:}
test "$(shasum -a 256 "$signed_root/$file" | awk '{print $1}')" = \
"$(jq -er "$selector" "$signed_receipt")"
done
signed_binary="$signed_root/hf2q-aarch64-apple-darwin"
chmod 0555 "$signed_binary"
test "$(shasum -a 256 "$signed_binary" | awk '{print $1}')" = "$binary_sha"
test "$(stat -f '%z' "$signed_binary")" = "$(jq -er .asset.size "$signed_receipt")"
test "$(/usr/bin/lipo -archs "$signed_binary")" = arm64
test "$(/usr/bin/vtool -show-build "$signed_binary" | awk '$1 == "minos" {print $2}')" = 14.0
/usr/bin/codesign --verify --strict --all-architectures "$signed_binary"
/usr/bin/codesign --verify --strict --all-architectures \
--check-notarization --test-requirement '=notarized' "$signed_binary"
codesign_info=$(/usr/bin/codesign --display --verbose=4 "$signed_binary" 2>&1)
test "$(grep -c '^CDHash=' <<<"$codesign_info")" = 1
signed_cdhash=$(sed -n 's/^CDHash=//p' <<<"$codesign_info")
test "$signed_cdhash" = "$(jq -er .signing.cdhash "$signed_receipt")"
jq -e --arg cdhash "$signed_cdhash" '
.status == "Accepted"
and ((.issues // []) | length) == 0
and any(.ticketContents[]?;
.digestAlgorithm == "SHA-256" and .cdhash == $cdhash)
' "$signed_root/notary-log.json" >/dev/null
test "$("$signed_binary" --version)" = \
"hf2q $EXPECTED_VERSION"
packed_build_root=$(mktemp -d "/private/var/tmp/hf2q-packed-build.XXXXXX")
printf 'PACKED_BUILD_ROOT=%s\n' "$packed_build_root" >> "$GITHUB_ENV"
crate="$build_root/hf2q-${EXPECTED_VERSION}.crate"
test "$(shasum -a 256 "$crate" | awk '{print $1}')" = "$crate_sha"
/usr/bin/tar -xzf "$crate" -C "$packed_build_root"
package_root=$(cd "$packed_build_root/hf2q-${EXPECTED_VERSION}" && pwd -P)
dependency_provenance_dir="$build_root/dependency-provenance"
trusted_verifier="$GITHUB_WORKSPACE/scripts/verify_release_dependency_provenance.sh"
test -f "$trusted_verifier"
bash "$trusted_verifier" verify \
"$dependency_provenance_dir" "$package_root/Cargo.lock"
release_evidence="$RUNNER_TEMP/cache-lifecycle/standalone"
mkdir -p "$release_evidence"
sealed_binary="$release_evidence/hf2q-aarch64-apple-darwin"
"$package_root/scripts/seal_release_binary.sh" \
"$signed_binary" "$sealed_binary" "$binary_sha"
for evidence in proof.json notary-submission.json notary-wait.json notary-log.json \
codesign.txt notarization-check.txt hf2q-aarch64-apple-darwin.sha256; do
cp "$signed_root/$evidence" "$release_evidence/$evidence"
done
{
printf 'PACKAGE_ROOT=%s\n' "$package_root"
printf 'HF2Q_BIN=%s\n' "$sealed_binary"
printf 'EXPECTED_BINARY_SHA256=%s\n' "$binary_sha"
printf 'CRATE_SHA256=%s\n' "$crate_sha"
printf 'DEPENDENCY_PROVENANCE_DIR=%s\n' "$dependency_provenance_dir"
} >> "$GITHUB_ENV"
- name: Run guarded cross-family cache lifecycle gate
shell: bash
env:
OUT_ROOT: ${{ runner.temp }}/cache-lifecycle
run: |
set -euo pipefail
cd "$PACKAGE_ROOT"
exec scripts/run_release_gate_process_group.sh env \
EXPECTED_SHA="$EXPECTED_SHA" \
CRATE_SHA256="$CRATE_SHA256" \
DEPENDENCY_PROVENANCE_DIR="$DEPENDENCY_PROVENANCE_DIR" \
HF2Q_BIN="$HF2Q_BIN" \
EXPECTED_BINARY_SHA256="$EXPECTED_BINARY_SHA256" \
DEEPSEEK_MODEL="$DEEPSEEK_MODEL" \
GEMMA_MODEL="$GEMMA_MODEL" \
QWEN_MODEL="$QWEN_MODEL" \
QWEN38_MODEL="$QWEN38_MODEL" \
DEEPSEEK_MODEL_SHA256="$DEEPSEEK_MODEL_SHA256" \
GEMMA_MODEL_SHA256="$GEMMA_MODEL_SHA256" \
QWEN_MODEL_SHA256="$QWEN_MODEL_SHA256" \
QWEN38_MODEL_SHA256="$QWEN38_MODEL_SHA256" \
HF2Q_MODEL_VERIFICATION_CACHE_DIR="$RUNNER_TOOL_CACHE/hf2q-model-verification" \
OUT_ROOT="$OUT_ROOT" \
scripts/run_agentic_cache_release_gate.sh
- name: Upload exact-artifact receipts and signed binary
if: always()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 with:
name: cache-lifecycle-${{ inputs.commit_sha }}
path: ${{ runner.temp }}/cache-lifecycle
if-no-files-found: error
retention-days: 30
- name: Clean external packed build root
if: always()
shell: bash
run: |
set -euo pipefail
packed_build_root=${PACKED_BUILD_ROOT:-}
[[ -n "$packed_build_root" ]] || exit 0
case "$packed_build_root" in
/private/var/tmp/hf2q-packed-build.*)
suffix=${packed_build_root#/private/var/tmp/hf2q-packed-build.}
[[ -n "$suffix" && "$suffix" != */* ]] || exit 1
;;
*)
echo "refusing unsafe packed-build cleanup: $packed_build_root" >&2
exit 1
;;
esac
[[ -d "$packed_build_root" && ! -L "$packed_build_root" ]] || exit 0
rm -rf -- "$packed_build_root"