NON-OS/nonos-ci
Watch
2
0
Fork
You've already forked nonos-ci
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity
Static-check, baseline, and trust-chain CI tooling for the NONOS microkernel
21 commits 4 branches 0 tags 140 KiB
  • Shell 90.9%
  • Python 9.1%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
eKisNonos 1f05aa7aed runtime lane: say why the harness runs without -e 
Seventeen scripts run strict; this one inspects exit codes as data on
guarded paths and aborting on the first nonzero would eat the report.
The choice was right and now it is written down where the next strict
mode audit will look.
2026-09-03 13:50:41 +02:00
.github/workflows ci: skip non-sh shells in the lint gate 2026-06-06 13:39:03 +02:00
baselines import: CI tooling extracted from nonos-micro-kernel 2026-05-21 01:04:57 +02:00
bench_boot_log.py ci: harden evidence and benchmark gates 2026-06-26 12:13:27 +02:00
bench_boot_matrix.py benchmark: aggregate repeated boot evidence 2026-06-29 10:36:02 +02:00
bench_collect.py benchmark: aggregate repeated boot evidence 2026-06-29 10:36:02 +02:00
bench_compare.py ci: harden evidence and benchmark gates 2026-06-26 12:13:27 +02:00
bench_host.py ci: harden evidence and benchmark gates 2026-06-26 12:13:27 +02:00
bench_suite.py benchmark: aggregate repeated boot evidence 2026-06-29 10:36:02 +02:00
bench_time.py ci: harden evidence and benchmark gates 2026-06-26 12:13:27 +02:00
check-baseline.sh import: CI tooling extracted from nonos-micro-kernel 2026-05-21 01:04:57 +02:00
check-capsule-ports.sh import: CI tooling extracted from nonos-micro-kernel 2026-05-21 01:04:57 +02:00
check-feature-profiles.py ci: harden evidence and benchmark gates 2026-06-26 12:13:27 +02:00
check-pqclean-pin.sh ci: hash the pqclean tree without the pin file 2026-06-02 11:31:44 +02:00
plan-a-runtime.sh runtime lane: say why the harness runs without -e 2026-09-03 13:50:41 +02:00
README.md docs: a real README 2026-09-03 13:29:32 +02:00
run-static-checks.sh trust: survive the modular Makefile split 2026-07-19 10:41:07 +02:00
scan-binary-hygiene.sh import: CI tooling extracted from nonos-micro-kernel 2026-05-21 01:04:57 +02:00
scan-microkernel-symbols.sh import: CI tooling extracted from nonos-micro-kernel 2026-05-21 01:04:57 +02:00
scratch-trust-bootstrap.sh trust: survive the modular Makefile split 2026-07-19 10:41:07 +02:00
setup-signing-key.sh ci: harden evidence and benchmark gates 2026-06-26 12:13:27 +02:00

README.md

nonos-ci

The scripts NONOS CI lanes call between checkout and verdict. Each one does a single job and is invoked by name from the workflows in the kernel repository, so what a lane does is readable here rather than inlined in YAML.

Provisioning

setup-signing-key.sh resolves the Ed25519 dev signing seed for a lane: the production secret when present, a clearly marked deterministic fork seed otherwise, so fork CI stays honest without access to anything real. scratch-trust-bootstrap.sh mints a complete throwaway trust chain, anchors, publisher keys, certificates, manifests, enrollment, for scratch lanes that build and boot the whole system without touching the committed keystore. Production lanes run neither bootstrap: they verify the committed set instead.

Checks

The check-* and scan-* scripts are the static battery: baseline comparisons, capsule endpoint collision checks, feature profile consistency, the pqclean pin, binary hygiene, and the microkernel symbol scan. run-static-checks.sh drives the set.

Benchmarks

The bench_*.py suite measures boot and runtime against the pinned baselines under baselines/; bench_compare.py turns two runs into a verdict. Regressions fail the lane rather than becoming folklore.

License

AGPL-3.0, like the rest of NONOS.