Merge pull request #582 from bernardladenthin/fix/post-release-java8-and-logs

fix(post-release): macOS smoke on Java 8, job logs on the runner's gh

Author: bernardladenthin

.github/buildcheck/postrelease.py

@@ -347,15 +347,35 @@ def run_logs(repository, run_id):
             break
         page += 1
     logs = {}
+    flags = escape_flag()
     for job in jobs:
         if job["conclusion"] == "skipped":
             continue
-        out = subprocess.run(["gh", "api", f"repos/{repository}/actions/jobs/{job['id']}/logs"],
-                             capture_output=True, check=True).stdout
-        logs[job["name"]] = out.decode("utf-8", "replace")
+        logs[job["name"]] = job_log(repository, job["id"], flags).decode("utf-8", "replace")
     return logs
 
 
+def escape_flag():
+    """`--allow-escape-sequences` where this gh has it: newer gh refuses a response with terminal
+    escapes (every job log has colour codes), older gh does not know the flag."""
+    help_text = subprocess.run(["gh", "api", "--help"], capture_output=True, text=True).stdout
+    return ["--allow-escape-sequences"] if "--allow-escape-sequences" in help_text else []
+
+
+def job_log(repository, job_id, flags=(), attempts=3, pause=5):
+    """One job's log through `gh api`, retried; the error names what gh said, which check=True hid."""
+    import time
+    for attempt in range(1, attempts + 1):
+        proc = subprocess.run(["gh", "api", *flags, f"repos/{repository}/actions/jobs/{job_id}/logs"],
+                              capture_output=True)
+        if proc.returncode == 0:
+            return proc.stdout
+        if attempt < attempts:
+            time.sleep(pause * attempt)
+    raise RuntimeError(f"the log of job {job_id} could not be read ({attempts} attempts): "
+                       f"{proc.stderr.decode('utf-8', 'replace').strip() or f'gh exited {proc.returncode}'}")
+
+
 # --- the command --------------------------------------------------------------------------------
 
 def find_run(repository, tag):

.github/buildcheck/tests/test_postrelease.py

@@ -284,5 +284,49 @@ def test_off_everywhere_passes_and_a_job_with_the_cache_on_fails(self):
                          ["no job log shows the cache off -- the evidence is missing, not the cache"])
 
 
+class JobLogTest(unittest.TestCase):
+    def run_with(self, results):
+        calls = []
+
+        def fake(cmd, capture_output):
+            calls.append(cmd)
+            code, out, err = results[len(calls) - 1]
+            return subprocess.CompletedProcess(cmd, code, out, err)
+        original = postrelease.subprocess.run
+        postrelease.subprocess.run = fake
+        try:
+            return postrelease.job_log("o/r", 7, attempts=3, pause=0), calls
+        finally:
+            postrelease.subprocess.run = original
+
+    def test_retries_a_failed_read(self):
+        log, calls = self.run_with([(1, b"", b"HTTP 502"), (0, b"the log", b"")])
+        self.assertEqual(log, b"the log")
+        self.assertEqual(len(calls), 2)
+        self.assertEqual(calls[0], ["gh", "api", "repos/o/r/actions/jobs/7/logs"])
+
+    def test_passes_the_escape_flag(self):
+        calls = []
+
+        def fake(cmd, capture_output, text=False):
+            calls.append(cmd)
+            if cmd[-1] == "--help":
+                return subprocess.CompletedProcess(cmd, 0, "  --allow-escape-sequences   Allow ...\n", "")
+            return subprocess.CompletedProcess(cmd, 0, b"log", b"")
+        original = postrelease.subprocess.run
+        postrelease.subprocess.run = fake
+        try:
+            flags = postrelease.escape_flag()
+            postrelease.job_log("o/r", 7, flags, pause=0)
+        finally:
+            postrelease.subprocess.run = original
+        self.assertEqual(flags, ["--allow-escape-sequences"])
+        self.assertEqual(calls[-1], ["gh", "api", "--allow-escape-sequences", "repos/o/r/actions/jobs/7/logs"])
+
+    def test_names_what_gh_said(self):
+        with self.assertRaisesRegex(RuntimeError, r"job 7 could not be read \(3 attempts\): HTTP 403: Forbidden$"):
+            self.run_with([(1, b"", b"HTTP 403: Forbidden\n")] * 3)
+
+
 if __name__ == "__main__":
     unittest.main()

.github/smoke-native-macos.sh

@@ -67,6 +67,12 @@ trap 'rm -rf "$WORK"' EXIT
 unzip -o -q "$JAR" "$DYLIB_ENTRY" -d "$WORK" \
     || fail "the natives jar does not contain $DYLIB_ENTRY — the macOS natives never reached the package job"
 DYLIB="$WORK/$DYLIB_ENTRY"
+# NativeLoadSmoke is compiled first rather than run as a single source file: the post-release
+# consumer runs this script on Java 8, whose launcher has no source-file mode (Java 11+).
+SMOKE_CLASSES="$WORK/smoke-classes"
+mkdir -p "$SMOKE_CLASSES"
+javac -nowarn -cp "$CP" -d "$SMOKE_CLASSES" "$SCRIPT_DIR/smoke/NativeLoadSmoke.java" \
+    || fail "NativeLoadSmoke.java does not compile against the set"
 echo "extracted: $(cd "$(dirname "$DYLIB")" && pwd)/$(basename "$DYLIB") ($(wc -c < "$DYLIB") bytes)"
 
 # 0) The oldest macOS it loads on. CMAKE_OSX_DEPLOYMENT_TARGET (llama/CMakeLists.txt) pins it;
@@ -98,7 +104,7 @@ codesign --verify --strict --verbose=2 "$DYLIB" \
 #    and it is the only check that covers load-time failures the signature check cannot see
 #    (missing dependent library, wrong architecture, unresolved JNI_OnLoad class lookup).
 echo "== JVM load + JNI round-trip =="
-java -cp "$CP" "$SCRIPT_DIR/smoke/NativeLoadSmoke.java" \
+java -cp "$SMOKE_CLASSES:$CP" NativeLoadSmoke \
     || fail "the packaged native library did not load in a JVM"
 
 # 3) HTTPS in both directions out of the packaged jar: the server behind a self-signed certificate
@@ -154,7 +160,7 @@ wait "$SERVER_PID" 2> /dev/null || true
 echo "== lib.path: the natives directory, no natives jar on the classpath =="
 NATIVES_DIR="$(smoke_natives_directory "$SET_DIR" "$WORK/natives-dir")" || fail "could not unpack the natives jar into a directory"
 CP_NO_NATIVES="$(smoke_classpath_without_natives "$SET_DIR")" || exit 1
-java -cp "$CP_NO_NATIVES" "-Dnet.ladenthin.llama.lib.path=$NATIVES_DIR" "$SCRIPT_DIR/smoke/NativeLoadSmoke.java" \
+java -cp "$SMOKE_CLASSES:$CP_NO_NATIVES" "-Dnet.ladenthin.llama.lib.path=$NATIVES_DIR" NativeLoadSmoke \
     > load-dir-out.log 2> load-dir-err.log \
     || { cat load-dir-out.log load-dir-err.log; fail "the packaged native library did not load from the lib.path directory"; }
 cat load-dir-out.log

CLAUDE.md

@@ -1099,7 +1099,9 @@ publish jobs) downloads the `llama-smoke-macos-aarch64` smoke set and runs
 **`metal-macos-aarch64` natives jar** of the set and asserts two things: `codesign --verify
 --strict` (re-hashes the code pages against the signature's stored hashes — the direct check for a
 dylib assembled from two builds) and a real JVM load via `.github/smoke/NativeLoadSmoke.java`
-(`java -cp '<set>/*' …`, the JDK single-file source launcher), which forces
+(compiled with `javac` first and run as `java -cp <classes>:'<set>/*' NativeLoadSmoke` -- not through
+the single-file source launcher, which Java 8 lacks and the post-release consumer runs this script
+on), which forces
 `LlamaLoader.initialize() → System.load() → JNI_OnLoad` and then crosses JNI for
 `getLlamaCppBuildInfo()`, checked against the `LlamaCppVersion` pin. A third check comes first:
 the dylib's `minos` (`otool -l`, `LC_BUILD_VERSION`) must not exceed **15.0**, the supported floor.

TODO.md

@@ -64,17 +64,31 @@ so entries below describe remaining work or an explicit deferral policy.
       smoke and the WebUI check pass on the jars from Central (in Docker, JDK 21, not 8). Open:
       - [x] The `java/audit-publication` pin is the actions release that carries it: v1.1.0
             (`44390bd4`), like every other pin of the workflows.
-      - [ ] Read the first real run: a `workflow_dispatch` with `v6.0.0`
-            (`gh workflow run post-release.yml -f tag=v6.0.0`; expected: one android finding) and
-            the first `workflow_run` after 6.1.0. The two `workflow_run` runs after #573
-            (40367736958, 40367890447) ended `skipped`, correctly: no `v*` tag is behind those
-            Publish runs. Unverified on a runner: the Java 8
-            rows (Temurin 8 on Linux and Windows, Zulu 8 on macOS arm64), `smoke-native-macos.sh`
-            and `smoke-test-natives.ps1` on Java 8, `gh attestation verify` with the workflow token
-            (`attestations: read`), and the keyserver fetch from a runner.
-      - [ ] Repeat the `LocalCheck` (Java 8) and `FfmCheck` acceptances against the 6.0.0 jars from
-            Central, as far as the run above does not cover them; the earlier acceptances were made
-            on b11827 artifacts.
+      - [x] **The `workflow_dispatch` with `v6.0.0`** (2026-10-27). The first one (40373377002) found
+            two defects of the workflow itself: `smoke-native-macos.sh` launched
+            `NativeLoadSmoke.java` as a single source file, which Java 8 cannot ("Could not find or
+            load main class"), and `postrelease.run_logs` died on the first job log with a bare
+            `CalledProcessError` -- the runner's gh refuses a response with terminal escapes
+            unless given `--allow-escape-sequences`, which the gh 2.87 used locally does not know.
+            Both fixed (the smoke compiles the class first; `job_log` passes the flag where `gh api
+            --help` lists it, retries, and names what gh said). Run 40515663015 from the fix branch:
+            the 8 audit checks pass on the runner (signatures with the key from the keyserver,
+            provenance with the workflow token's `attestations: read`), `post-release-check.py` reads all 73
+            job logs (68 show the cache off, none on) and fails android on exactly the expected
+            checker-qual finding, and all four Java 8 consumers pass -- Temurin 8 on Linux x86-64,
+            Linux aarch64 and Windows, Zulu 8 on macOS arm64, including `smoke-native-macos.sh`
+            (load, HTTPS, lib.path) and `smoke-test-natives.ps1` on Java 8.
+      - [ ] The first `workflow_run` after 6.1.0. The `workflow_run` runs after #573 and since
+            (40367736958, 40367890447, ...) ended `skipped`, correctly: no `v*` tag is behind those
+            Publish runs.
+      - [x] **`LocalCheck` (Java 8) and `FfmCheck` against the 6.0.0 jars from Central**
+            (2026-10-27): `llama-platform` + `llama-ffm` 6.0.0 resolved into an empty local
+            repository (13 jars), Qwen3-0.6B Q4_K_M. `LocalCheck` -- `LlamaModel` chat ("Paris."),
+            an encode/decode round trip and `getJllamaBuildInfo()` (b11887, `jllama.version=6.0.0`)
+            -- passes on Temurin 8 in Docker (Linux x86-64, `cpu-linux-x86-64`, GNU 14.2.1, module
+            `haswell`) and on the Windows host with JDK 21 (`cpu-windows-x86-64`, Clang 20.1.8).
+            `FfmCheck` -- `Jllama.apiVersion()` 6.0.0, `FfmLlamaModel.chatCompletions` ("Paris.")
+            and a tokenize/detokenize round trip through FFM -- passes on Temurin 25 in Docker.
 
 ## Delivery roadmap — remaining work