- Dockerfile.ci: add python3 (gstack-jsonl-merge/brain-sync/detach shell out
to it), file (skill-validation's binary check), poppler-utils (make-pdf
e2e gates hard-require pdftotext/pdffonts/pdfinfo), fonts-noto-color-emoji
(emoji render gate, mirrors make-pdf-gate.yml). Fix the bun pin: the
bun.sh installer ignores a BUN_VERSION env var, so the old form silently
installed latest on every rebuild (observed 1.3.13/1.3.14 drift vs the
1.3.10 devs run locally); pass the version as the positional arg.
- free-tests.yml: git identity + safe.directory for the git-exercising
tests (container checkout is owned by a different uid than runner);
post-loop tree-mutation tripwire that names a tracked-file-mutating test
instead of letting downstream collateral confuse the report; skip the
documented variants-retry-after timing flake.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Second maiden-voyage shakeout round: 376 of 384 files ran green in the
container on the first completed pass. The 8 that can't run there yet are
excluded the same way the Windows shards curate POSIX-bound files — each
with its reason inline (headed-Chrome handoff, real-PTY round-trip, X server
management, extension-origin identity, the job's own TMPDIR override, and
three pre-existing env failures that fail on dev machines too). Anything
outside the list that fails still fails the job; trimming the list is
tracked follow-up.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Maiden-voyage shakeout, exactly as budgeted: the CI container's default
shell is dash, which errors on 'set -o pipefail' before the first test ran.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The full free suite (bun test: browse/test/ + test/ + make-pdf/test/) had no CI
job on any Linux/macOS runner — only Windows curated shards, paid evals, and
doc-freshness gates existed. That's how two module-load-crashing test files
survived 48 versions.
Same cached Dockerfile.ci image and container wiring as evals.yml (deps
restore, build, Chromium verify). Includes a module-load-error guard: older
Bun reported test-file import crashes with exit 0 on macOS/Linux, so the job
also fails on any nonzero 'N errors' count in the summary — future crash-class
regressions can't hide from the exact job built to catch them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Garry Tan