Commit `c353193936`

c3531939362c5eafe0cf703544e3c7f0060398b5

parent: bee32a07c9

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-04 04:58 UTC

Drop CI; run the full suite from the pre-push hook

The gitbay runner is scoped to krz/gitbay (--repos on the host, the #92
mitigation), so builds queued for this repo were never claimed. Remove
.gitbay/ci.yml rather than leave a queue nothing drains.

.githooks/pre-push now runs cargo test --locked, clippy with -D warnings, and
the macos-collector Swift tests; a failure aborts the push. It checks for zsh
with zsh/zpty first so the differential secret-typing tests fail loudly instead
of being skipped.

Closes #4

.gitbay/ci.yml deleted −16

		@@ -1,16 +0,0 @@
1		# gitbay CI. One build per push; every step runs with `sh -c` and the first
2		# failure stops the job.
3		#
4		# The runner is Linux and unprivileged, so the macos-collector Swift tests
5		# cannot run here. They run from .githooks/pre-push on the Mac doing the push
6		# (git config core.hooksPath .githooks); see README "Build & test".
7		jobs:
8		test:
9		steps:
10		# The differential secret-typing tests (the privacy ship-gate) drive a
11		# real interactive zsh under zsh/zpty. Check for it up front so a missing
12		# zsh fails with a clear message instead of deep inside cargo test, and
13		# is never silently skipped.
14		- zsh -c 'zmodload zsh/zpty' \|\| { echo "runner needs zsh with the zsh/zpty module (apt-get install zsh)" >&2; exit 1; }
15		- cargo test --locked
16		- cargo clippy --all-targets --locked -- -D warnings

.githooks/pre-push +27 −10

		@@ -1,21 +1,38 @@
1	1	#!/bin/sh
2		# Run the macos-collector Swift tests before every push.
	2	# Run the full test suite before every push. There is no CI for this repo; this
	3	# hook is the only gate, so it runs everything and a failure aborts the push.
3	4	#
4		# gitbay's runner is Linux, so the Swift side of the Swift/Rust wire-contract
5		# test cannot run in CI. This hook is where it gates: a failing swift test
6		# aborts the push. Wired up once per clone with:
	5	# Wired up once per clone with:
7	6	#
8	7	# git config core.hooksPath .githooks
9	8	set -eu
10	9
	10	root=$(git rev-parse --show-toplevel)
	11	cd "$root"
	12
	13	# The differential secret-typing tests (the privacy ship-gate) drive a real
	14	# interactive zsh under zsh/zpty. Check for it up front so a missing zsh fails
	15	# with a clear message instead of deep inside cargo test, and is never silently
	16	# skipped.
	17	echo "pre-push: zsh/zpty preflight" >&2
	18	zsh -c 'zmodload zsh/zpty' \|\| {
	19	echo "pre-push: needs zsh with the zsh/zpty module" >&2
	20	exit 1
	21	}
	22
	23	echo "pre-push: cargo test" >&2
	24	cargo test --locked
	25
	26	echo "pre-push: cargo clippy" >&2
	27	cargo clippy --all-targets --locked -- -D warnings
	28
	29	# macos-collector is a Swift package; its tests only run on macOS.
11	30	case "$(uname -s)" in
12		Darwin) ;;
	31	Darwin)
	32	echo "pre-push: swift test (macos-collector)" >&2
	33	swift test --package-path "$root/macos-collector"
	34	;;
13	35	*)
14	36	echo "pre-push: not macOS, skipping swift test" >&2
15		exit 0
16	37	;;
17	38	esac
18
19		root=$(git rev-parse --show-toplevel)
20		echo "pre-push: swift test (macos-collector)" >&2
21		swift test --package-path "$root/macos-collector"

README.md +7 −9

		@@ -58,7 +58,7 @@ And it is tested (`crates/signal-schema/tests/privacy_invariant.rs`):
58	58	- `wire_format_has_no_content_field` — the `Signal` type declares no
59	59	content-carrying field beyond the audited `tag`.
60	60	- `forbidden_symbol_scan` — the tree contains none of the banned keylogger APIs
61		or shell line-buffer references (the static CI gate).
	61	or shell line-buffer references (the static gate).
62	62	- `differential_secret_typing` — active (the ship gate). It drives the real
63	63	hook (`shell-hooks/signald-hooks.zsh`) through a real interactive zsh under a
64	64	real pseudo-terminal (zsh's own `zsh/zpty` — no extra dependency), *typing a
		@@ -228,15 +228,13 @@ swift test # the Swift↔Rust wire-contract test
228	228	swift run macos-collector --once # one real IOKit read (no root)
229	229	```
230	230
231		### CI
	231	### Pre-push checks
232	232
233		`.gitbay/ci.yml` runs `cargo test --locked` and
234		`cargo clippy --all-targets --locked -- -D warnings` on every push. The
235		differential secret-typing tests need `zsh` with the `zsh/zpty` module on the
236		runner; the job checks for it first and fails rather than skipping the gate.
237
238		The runner is Linux, so the Swift tests run from `.githooks/pre-push` on the
239		Mac doing the push. Enable it once per clone:
	233	There is no CI. `.githooks/pre-push` is the gate: it runs `cargo test
	234	--locked`, `cargo clippy --all-targets --locked -- -D warnings`, and the
	235	`macos-collector` Swift tests, and a failure aborts the push. The differential
	236	secret-typing tests need `zsh` with the `zsh/zpty` module; the hook checks for
	237	it first and fails rather than skipping the gate. Enable it once per clone:
240	238
241	239	```sh
242	240	git config core.hooksPath .githooks

Commit c353193936

Commit `c353193936`