Lawrence Chen
f4222dec61
blacksmith testbox warmup resolves the workflow definition and the hydrated source from one --ref, so a lane that warms a candidate branch runs that branch's copy of the workflow before begin-testbox writes the Testbox auth token into the job. A candidate could therefore delete its own guards. Hydrate main only. The first step refuses any ref except refs/heads/main, and no repository code runs before the token. A candidate revision reaches the box afterwards through blacksmith testbox run, which syncs a maintainer's worktree onto the warm VM and needs Blacksmith org credentials that already grant box access, so it moves no trust boundary. The hydrated commit and the benchmarked commit are now deliberately different. The stage helper checks the setup marker for VM identity, runner class, and toolchain completeness instead of source equality, records the hydrated ref and SHA under a new "hydration" block, and still fails closed when the active Rust, Cargo, or Zig differs from what warmed the caches. The lane no longer needs BLACKSMITH_TESTBOX_REVIEWED_REF or BLACKSMITH_TESTBOX_REVIEWED_SHA; the environment needs a deployment branch rule of exactly main.
81 lines
1.5 KiB
Plaintext
81 lines
1.5 KiB
Plaintext
# Xcode
|
|
.build/
|
|
build/
|
|
DerivedData/
|
|
*.xcuserstate
|
|
xcuserdata/
|
|
*.xcworkspace/xcshareddata/
|
|
|
|
# macOS
|
|
.DS_Store
|
|
|
|
# Local env
|
|
.env
|
|
.envrc
|
|
!web/.envrc
|
|
ios/Config/AppStoreConnect.local.plist
|
|
|
|
# Swift Package Manager
|
|
.swiftpm/
|
|
.ci-source-packages/
|
|
.ci-reload-derived-data/
|
|
|
|
# GhosttyKit binary (built from ghostty submodule via scripts/setup.sh)
|
|
GhosttyKit.xcframework
|
|
GhosttyKit.xcframework.bak-*/
|
|
|
|
# Release artifacts
|
|
cmux-*.zip
|
|
cmux-macos.dmg
|
|
appcast.xml
|
|
|
|
# Python
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
.pytest_cache/
|
|
.hypothesis/
|
|
.vercel
|
|
|
|
# Zig
|
|
.zig-cache/
|
|
zig-out/
|
|
|
|
# Node
|
|
node_modules/
|
|
.next/
|
|
|
|
# Test outputs
|
|
tests/visual_output/
|
|
tests/visual_report.html
|
|
experiments/*/target/
|
|
|
|
# Stale pre-rebrand Rust TUI dir (renamed to cmux-tui/; old checkouts may
|
|
# still have an untracked mux/target that must never be committed again)
|
|
/mux/
|
|
|
|
# Generated docs search index
|
|
web/.pagefind-site/
|
|
web/public/pagefind/
|
|
|
|
# Local scratch (screenshots, etc.)
|
|
tmp/
|
|
tmp-*/
|
|
.iter-logs/
|
|
.claude/worktrees/
|
|
.claude/scheduled_tasks.lock
|
|
|
|
# Local dogfood scratch (screenshots, recordings) — never commit
|
|
artifacts/
|
|
!Packages/Shared/CmuxAgentChat/Sources/CmuxAgentChat/Artifacts/
|
|
!Packages/Shared/CmuxAgentChat/Sources/CmuxAgentChat/Artifacts/*.swift
|
|
!Packages/iOS/CmuxAgentChatUI/Sources/CmuxAgentChatUI/Artifacts/
|
|
!Packages/iOS/CmuxAgentChatUI/Sources/CmuxAgentChatUI/Artifacts/*.swift
|
|
|
|
# tmux verbose debug logs (tmux -v) that land in the cwd
|
|
tmux-*.log
|
|
|
|
# Remote-only Blacksmith cmux-tui benchmark output
|
|
/testbox-benchmark/
|
|
/.cmux-scratch/
|