Skip to content

fix release build version stamping and smoke runtime install #868

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
i386 merged 1 commit into from
Jun 18, 2026
Merged

fix release build version stamping and smoke runtime install #868

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions scripts/build-linux.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,12 @@ stamp_build_version() {
return 0
fi

if [[ "${MESH_LLM_BUILD_PROFILE:-debug}" == "release" ]]; then
export MESH_LLM_BUILD_VERSION="$release_version"
echo "Using release MESH_LLM_BUILD_VERSION: $MESH_LLM_BUILD_VERSION"
return 0
fi

if ! sha="$(git -C "$REPO_ROOT" rev-parse --short=6 HEAD 2>/dev/null)"; then
echo "Warning: unable to derive build version; git SHA unavailable." >&2
unset MESH_LLM_BUILD_VERSION || true
Expand Down
6 changes: 6 additions & 0 deletions scripts/build-mac.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,12 @@ stamp_build_version() {
return 0
fi

if [[ "$build_profile" == "release" ]]; then
export MESH_LLM_BUILD_VERSION="$release_version"
echo "Using release MESH_LLM_BUILD_VERSION: $MESH_LLM_BUILD_VERSION"
return 0
fi

if ! sha="$(git -C "$REPO_ROOT" rev-parse --short=6 HEAD 2>/dev/null)"; then
echo "Warning: unable to derive build version; git SHA unavailable." >&2
unset MESH_LLM_BUILD_VERSION || true
Expand Down
24 changes: 3 additions & 21 deletions scripts/build-release.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,6 @@ append_rustflag() {
stamp_build_version() {
local release_version=""
local pkgid=""
local sha=""
local dirty_suffix=""
local status_output=""

if [[ -n "${MESH_LLM_BUILD_VERSION:-}" ]]; then
echo "Using preset MESH_LLM_BUILD_VERSION: $MESH_LLM_BUILD_VERSION"
Expand All @@ -42,24 +39,9 @@ stamp_build_version() {
return 0
fi

if ! sha="$(git -C "$REPO_ROOT" rev-parse --short=6 HEAD 2>/dev/null)"; then
echo "Warning: unable to derive build version; git SHA unavailable." >&2
unset MESH_LLM_BUILD_VERSION || true
return 0
fi
sha="$(printf '%s' "$sha" | tr '[:lower:]' '[:upper:]')"

if ! status_output="$(git -C "$REPO_ROOT" status --porcelain --untracked-files=all 2>/dev/null)"; then
echo "Warning: unable to derive build version; git status unavailable." >&2
unset MESH_LLM_BUILD_VERSION || true
return 0
fi
if [[ -n "$status_output" ]]; then
dirty_suffix=".dirty"
fi

export MESH_LLM_BUILD_VERSION="${release_version}+g${sha}${dirty_suffix}"
echo "Derived MESH_LLM_BUILD_VERSION: $MESH_LLM_BUILD_VERSION"
export MESH_LLM_BUILD_VERSION="$release_version"
echo "Using release MESH_LLM_BUILD_VERSION: $MESH_LLM_BUILD_VERSION"
return 0
}

configure_lld_linker() {
Expand Down
6 changes: 6 additions & 0 deletions scripts/build-windows.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -218,6 +218,12 @@ function Set-BuildVersionStamp {
return
}

if ($buildProfile -eq "release") {
$env:MESH_LLM_BUILD_VERSION = $releaseVersion
Write-Host "Using release MESH_LLM_BUILD_VERSION: $($env:MESH_LLM_BUILD_VERSION)"
return
}

$sha = $null
try {
$sha = (& git -C $repoRoot rev-parse --short=6 HEAD 2>$null).Trim()
Expand Down
40 changes: 36 additions & 4 deletions scripts/ci-install-native-runtime.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,41 @@ native_runtime_dir="$(scripts/ci-prepare-native-runtime.sh "$OUT_DIR" "$BACKEND"
echo "Installing CI native runtime:" >&2
echo " runtime: $native_runtime_dir" >&2
echo " cache: $RUNTIME_CACHE" >&2
MESH_LLM_NATIVE_RUNTIME_CACHE_DIR="$RUNTIME_CACHE" \
"$MESH_LLM" runtime install \
--bundle-dir "$native_runtime_dir" \
--cache-dir "$RUNTIME_CACHE" >&2
python3 - "$native_runtime_dir" "$RUNTIME_CACHE" <<'PY'
import json
import shutil
import sys
from pathlib import Path

source = Path(sys.argv[1])
cache = Path(sys.argv[2])
manifest_path = source / "manifest.json"

with manifest_path.open("r", encoding="utf-8") as fh:
manifest = json.load(fh)

runtime = manifest["runtime"]
runtime_id = runtime["id"]
mesh_version = runtime.get("mesh_version") or "unknown"

@coderabbitai coderabbitai Bot Jun 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fail fast when mesh_version is missing instead of defaulting to "unknown"

On Line 42, falling back to "unknown" hides manifest contract breaks and can install into the wrong cache subtree (<cache>/unknown/<runtime_id>). This should error immediately so CI fails at root cause.

Proposed fix 
-mesh_version = runtime.get("mesh_version") or "unknown"
+mesh_version = runtime.get("mesh_version")
+if mesh_version is None:
+    raise SystemExit(f"native runtime mesh_version is missing in {manifest_path}")
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/ci-install-native-runtime.sh` at line 42, The mesh_version assignment
on line 42 currently defaults to "unknown" when the value is missing from the
runtime dictionary, which masks manifest contract breaks and causes incorrect
cache directory usage. Remove the fallback to "unknown" and instead raise an
error or exception immediately when mesh_version is not found in the runtime
object, so the CI fails at the root cause rather than silently continuing with
an invalid version identifier.

libraries = runtime.get("libraries") or []
if not runtime_id.strip():
raise SystemExit(f"native runtime id is empty in {manifest_path}")
if not mesh_version.strip():
raise SystemExit(f"native runtime mesh_version is empty in {manifest_path}")
if not libraries:
raise SystemExit(f"native runtime libraries are empty in {manifest_path}")

for library in libraries:
library_path = source / library
if not library_path.is_file():
raise SystemExit(f"native runtime library is missing: {library_path}")
Comment on lines +51 to +54

@coderabbitai coderabbitai Bot Jun 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Constrain library paths to stay within the runtime bundle root

On Lines 51-54, source / library allows absolute paths and parent traversal (..) to pass validation if those external files exist. That weakens the manifest integrity check for the bundle itself.

Proposed fix 
 for library in libraries:
-    library_path = source / library
-    if not library_path.is_file():
+    library_path = (source / library).resolve()
+    if source.resolve() not in library_path.parents:
+        raise SystemExit(f"native runtime library escapes bundle root: {library}")
+    if not library_path.is_file():
         raise SystemExit(f"native runtime library is missing: {library_path}")
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
for library in libraries:
library_path = source / library
if not library_path.is_file():
raise SystemExit(f"native runtime library is missing: {library_path}")
for library in libraries:
library_path = (source / library).resolve()
if source.resolve() not in library_path.parents:
raise SystemExit(f"native runtime library escapes bundle root: {library}")
if not library_path.is_file():
raise SystemExit(f"native runtime library is missing: {library_path}")
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/ci-install-native-runtime.sh` around lines 51 - 54, The validation
loop for libraries in the native runtime bundle currently only checks if a
library file exists, but does not verify that the resolved path stays within the
intended bundle root directory. This allows absolute paths or parent directory
traversal (like `..`) to potentially reference files outside the bundle. Modify
the validation in the for loop to first resolve the library_path to its absolute
canonical form, then verify that the resolved path is within the source
directory before checking if the file exists. If the resolved path escapes the
bundle root, raise a SystemExit error indicating that the library path is
outside the allowed bundle directory.


target = cache / mesh_version / runtime_id
if target.exists():
shutil.rmtree(target)
target.parent.mkdir(parents=True, exist_ok=True)
shutil.copytree(source, target)
print(f"Installed CI native runtime: {target}", file=sys.stderr)
PY

printf '%s\n' "$RUNTIME_CACHE"
Loading