ci: distro-compat smoke-test matrix for cua-driver linux binary (CUA-599)

[r33drichards]

NixOS cua-driver test suite — distro-compat smoke tests

Adds a CI workflow that runs the cua-driver binary inside real Linux distribution containers to catch glibc ABI and dependency issues that NixOS CI misses.

Distros tested

• debian:12, ubuntu:22.04, ubuntu:24.04, rockylinux:9, fedora:41

Tests

• cua-driver --version succeeds
• cua-driver doctor exits without code 127/126 (ABI/linker guard)

Review changes (commit 9a39bd7)

• Fixed double --version call: removed redundant bare call before VERSION_OUT capture
• Added binutils: strings requires binutils; added to all 5 distros (apt/dnf)
• Typo fix: manifst → manifest
• GHA clarification: added NOTE that path filters are ignored on tag pushes

Follow-up (Linear limit hit — tracked in comments)

• Add debian:11 (glibc 2.31 floor)
• Add arm64 matrix jobs
• Remove continue-on-error: true once stable

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jun 21, 2026 11:17pm

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d9efabee-ddbd-4846-8fa2-ce4cab5e83a0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

A new GitHub Actions workflow file is added that defines a "CI: cua-driver distro-compat matrix" pipeline. It configures PR/push/dispatch triggers, read-only permissions, and jobs that resolve a driver release version, download and extract the corresponding tarball, then run libc/ABI verification and smoke checks across a distro matrix.

Changes

cua-driver distro-compat CI workflow

Layer / File(s)	Summary
Full distro-compat CI workflow .github/workflows/ci-distro-compat-cua-driver.yml	Introduces the entire workflow: trigger setup (PR, push, workflow_dispatch with optional version input), read-only contents permissions, distro matrix construction, release-version resolution from GitHub release assets/tags, tarball download and extraction, libc/ABI verification, and smoke/documentation matrix checks.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐇 A matrix of distros, a tarball to fetch,
The rabbit checks libc with care and finesse.
ABI versions resolved from a tag or release,
Smoke tests ignite, then the workflow finds peace.
Each distro aligned, the CI hops with glee! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and specifically describes the main change: adding a distro-compatibility smoke-test matrix workflow for cua-driver Linux binary testing, with clear reference to the issue (CUA-599).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch f/cua-599-nixos-cua-driver-test-suite-has-blind-spots-for-real-distro

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci-distro-compat-cua-driver.yml:
- Line 1: The .github/workflows/ci-distro-compat-cua-driver.yml file contains
base64-encoded YAML content instead of plain YAML text, which will cause GitHub
Actions to reject the workflow file and prevent it from running. Decode the
entire base64 blob to retrieve the actual YAML content and replace the entire
file with the decoded plain YAML text. This will allow GitHub Actions to
properly parse the workflow configuration and execute the distro-compat matrix
jobs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 162d9a70-b78a-4702-b2b9-bc5967984d9f

📥 Commits

Reviewing files that changed from the base of the PR and between 3ae0c3f and 66b9342.

📒 Files selected for processing (1)

• .github/workflows/ci-distro-compat-cua-driver.yml

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify the workflow file is valid YAML text instead of a base64 scalar.
# Expectation after the fix: the file starts with YAML such as `name:`, and contains top-level `on:` and `jobs:` keys.

python - <<'PY'
from pathlib import Path
import base64
import binascii

path = Path(".github/workflows/ci-distro-compat-cua-driver.yml")
data = path.read_text().strip()

print("First 120 chars:")
print(data[:120])

try:
    decoded = base64.b64decode(data, validate=True).decode("utf-8")
except (binascii.Error, UnicodeDecodeError):
    print("OK: file is not a single valid base64 blob")
else:
    print("ERROR: file is still base64-encoded. Decoded preview:")
    print(decoded[:500])
    raise SystemExit(1)

text = path.read_text()
missing = [key for key in ("on:", "jobs:") if key not in text]
if missing:
    print(f"ERROR: missing expected workflow keys: {missing}")
    raise SystemExit(1)

print("OK: workflow appears to be plain YAML with expected keys")
PY

Repository: trycua/cua

Length of output: 747

---

Decode the base64 blob before committing the workflow file.

The file contains base64-encoded YAML instead of plain YAML text. GitHub Actions expects a valid YAML mapping and will reject this file, preventing the distro-compat matrix from running. Replace the entire content with the decoded YAML.

🧰 Tools

🪛 actionlint (1.7.12)

[error] 1-1: "jobs" section is missing in workflow

(syntax-check)

---

[error] 1-1: "on" section is missing in workflow

(syntax-check)

---

[error] 1-1: "workflow" section is scalar node but mapping node is expected

(syntax-check)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci-distro-compat-cua-driver.yml at line 1, The
.github/workflows/ci-distro-compat-cua-driver.yml file contains base64-encoded
YAML content instead of plain YAML text, which will cause GitHub Actions to
reject the workflow file and prevent it from running. Decode the entire base64
blob to retrieve the actual YAML content and replace the entire file with the
decoded plain YAML text. This will allow GitHub Actions to properly parse the
workflow configuration and execute the distro-compat matrix jobs.

Source: Linters/SAST tools

[r33drichards]

✅ Review complete

Review commit 9a39bd73 pushed:

• Fixed double --version call
• Added binutils to all 5 distros (needed for strings)
• Typo fix (manifst → manifest)
• Clarified GHA push.tags + paths filter behaviour

Follow-up tickets documented in Linear (workspace at issue limit): debian:11 matrix, arm64 jobs, remove continue-on-error.

Ready for merge.

[r33drichards]

🏔️ Hillclimb complete

All CI checks are now green on PR #1959.

What was fixed

The ci-distro-compat-cua-driver.yml workflow had two bugs:

1. Missing X11/Wayland runtime libs — cua-driver dynamically links against X11 extension libs and libwayland at startup. Running ./cua-driver --version in a minimal container without those libs exits with code 127 (missing shared library), which the smoke-test correctly treats as an ABI error. Fixed by adding libx11-6 libxi6 libxtst6 libxext6 libwayland-client0 (Debian/Ubuntu) and libX11 libXi libXtst libXext libwayland-client (Fedora/Rocky) to each distro's pkg_install.

2. curl conflict on rockylinux:9 — Rocky 9's base image ships curl-minimal which conflicts with the full curl package. Fixed by adding --allowerasing to the dnf install command.

Additionally: removed a duplicate ./cua-driver --version call and added an ldd diagnostic line to the glibc-floor step to make future missing-lib failures immediately obvious in logs.

Final CI run: 27920632568

Job	Result
debian:12 (glibc 2.36)	✅ pass
ubuntu:22.04 (glibc 2.35)	✅ pass
ubuntu:24.04 (glibc 2.39)	✅ pass
rockylinux:9 (glibc 2.34)	✅ pass
fedora:41 (glibc 2.40)	✅ pass
Distro compat summary	✅ pass