Resolve referenced sibling pull requests on macOS and Windows

[zardus]

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

The ci jobs cle inherits resolve the sibling pull requests a description names. Test macos-15 and Test windows-2022, which this workflow defines itself, did not: they took binaries from master, and their own uv sync took archinfo and pyvex from master too, since [tool.uv.sources] pins both there.

Both jobs now read every reference out of the body the way resolve_refs.py does and write no-sources-package plus upgrade-package to a uv configuration file under the runner temporary directory, so uv sync resolves that package from the pull request head and leaves the checkout untouched. This description names angr/archinfo#367, so the run on it exercises the path. angr/angr#6821 and angr/angr-management#1716 now carry this same mechanism.

Validation: #738 (comment).

[zardus]

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Validation record for head b15360222433ca153c9369111fe44f7d2829bc90 against baseline 45c6509c753d07f740099035cd41f7f473dc6f31. This replaces the post-sync uv pip install --reinstall-package the branch previously carried: all three of angr/angr#6821, #738 and angr/angr-management#1716 now use one mechanism.

• Mechanism: the reference becomes no-sources-package plus upgrade-package in a uv configuration file under $RUNNER_TEMP, and UV_CONFIG_FILE carries it to every later uv command in the job, so the override sits inside uv's own resolver instead of being applied on top of a finished sync. One resolution, one lock, and nothing to undo afterwards. Both settings are needed and neither works alone, checked on uv 0.12.1 against a throwaway project pinning archinfo to branch = "master": with no-sources-package alone the pin is dropped and archinfo resolves from PyPI, source = { registry = "https://pypi.org/simple" }, not from the pull request; with upgrade-package alone resolution fails outright, Requirements contain conflicting URLs for package `archinfo` in all marker environments: - git+https://github.com/angr/archinfo.git@master - git+https://github.com/angr/archinfo@refs/pull/367/head; with both, source = { git = "https://github.com/angr/archinfo?rev=refs%2Fpull%2F367%2Fhead#a5f11be91c0c6f4483dfb9bf7e3517f73febb7a4" }, that pull request's head. The alternatives remain unavailable: a uv.toml rejects a sources table outright, and override-dependencies is ignored for a package that already has a source.
• --no-sync is gone from Run tests, so that line is back to what master has and the whole change is additive. It is no longer needed: because UV_CONFIG_FILE is exported for the rest of the job, the sync uv run performs on its own resolves the same thing rather than putting master back. Both jobs show it, Updated https://github.com/angr/archinfo (a5f11be91c0c6f4483dfb9bf7e3517f73febb7a4) during Run tests.
• UV_CONFIG_FILE does not displace the project's own [tool.uv]: with the file set, default-groups from pyproject.toml still applied, so the only thing the file changes is the package being overridden.
• End to end: this description named ArchPcode: Report no program counter for a language that declares none. archinfo#367 when the run triggered, and both jobs logged Installing archinfo from angr/archinfo#367, wrote no-sources-package = ["archinfo",] with upgrade-package = ["archinfo @ git+https://github.com/angr/archinfo@refs/pull/367/head",], and then uv sync itself installed + archinfo==9.3.3.dev0 (from git+https://github.com/angr/archinfo@a5f11be91c0c6f4483dfb9bf7e3517f73febb7a4), that pull request's head, in place of archinfo master da171ca, while pyvex stayed on master 90e9094. 225 passed and 9 skipped on both: macOS, Windows
• The worktree the sync leaves behind, checked on 2b0085b, a commit carrying one extra step for this purpose that is not part of the change and has since been dropped, everything else identical: on both runners git status --porcelain --untracked-files=all listed ?? uv.lock and nothing else, which uv sync writes on its own and master's sync writes too, git diff --stat printed nothing and git diff --exit-code passed, so no tracked file changed. uv pip freeze in the same step reported archinfo at a5f11be and pyvex at master. The configuration file was written to /Users/runner/work/_temp/uv-sources.toml and D:\a\_temp\uv-sources.toml, outside the checkout: https://github.com/angr/cle/actions/runs/31585579428/job/94078525296 and https://github.com/angr/cle/actions/runs/31585579428/job/94078525694
• Resolution against the real dependency graph, locally: uv lock on this pyproject.toml with the file the step writes for ArchPcode: Report no program counter for a language that declares none. archinfo#367 resolved 61 packages in one pass, took archinfo from refs/pull/367/head, and left pyvex on master.
• Resolver, the run: block taken verbatim out of ci.yml and driven with bash --noprofile --norc -eo pipefail, the way a shell: bash step runs, against the real GitHub API:
  • angr/archinfo#367 and the github.com/angr/archinfo/pull/367 spelling each produce no-sources-package = ["archinfo",] and the matching upgrade-package
  • merged [pre-commit.ci] pre-commit autoupdate archinfo#362 is reported closed and produces nothing; Add fixtures for cle loader cases that had no real binary binaries#176 and Add first-class WebAssembly runtime support angr#6658, neither in [tool.uv.sources], produce nothing and make no API call; prose with no reference, an empty body, which is what ${{ github.event.pull_request.body }} evaluates to on a push and on a workflow_dispatch, and an unset PR_BODY, all write no file and leave UV_CONFIG_FILE unset
  • two references to one repository take the first; a body naming ArchPcode: Report no program counter for a language that declares none. archinfo#367, Lifting: Tell libVEX how much of the lift buffer it may read. pyvex#564 and Add fixtures for cle loader cases that had no real binary binaries#176 produces the first two and ignores binaries
  • a body of angr/archinfo#367 $(touch …) `touch …` ; touch … && rm -rf / | id ${IFS} angr/archinfo#$(id -u) $(id)/$(id)#1 ../../etc#7 angr/archinfo;id#367 resolves refs/pull/367/head and nothing else, executes none of it, and leaves the canary file it would have created absent; only digits reach the URL and the body reaches the step through PR_BODY
  • run against the exact live description text of all three pull requests, each resolves only its intended siblings; the Resolve referenced sibling pull requests in the coverage tests angr#6821 and Resolve referenced sibling pull requests in the test jobs angr-management#1716 references in this description resolve to nothing here, neither being in cle's [tool.uv.sources], and this description's own validation link matches the URL spelling but overrides nothing for the same reason
  • the step reads pyproject.toml relative to working-directory: cle, so the eligible packages are read out of this checkout at run time and are archinfo and pyvex and nothing else
• Binaries: the combined step this branch used to carry is split back into the same Resolve the angr/binaries ref step Resolve referenced sibling pull requests in the coverage tests angr#6821 and Resolve referenced sibling pull requests in the test jobs angr-management#1716 use, byte for byte. Driven the same way it gives refs/pull/168/head for the open Regenerate caches for clarirs binaries#168, and master for merged Add fixtures for cle loader cases that had no real binary binaries#176, for a body naming only a sibling, and for an empty body. In the run above both jobs logged Checking out angr/binaries at master, this description naming no binaries pull request, so the two resolvers work independently.
• Shared text: the run: script of Resolve the angr/binaries ref is sha256 0297b9806c9d2f6ebd9a4c5d… in all four workflows across the three repositories that carry it, and the run: script of Resolve referenced sibling pull requests is sha256 b0e3646b08d1a133c4a60f0f… in all four. This copy carries one extra YAML key, working-directory: cle, because the checkout is a subdirectory of the workspace here; nothing inside the script differs.
• Lint: actionlint 1.7.12 with shellcheck 0.11.0 on ci.yml, clean on both the merge base and this head; pre-commit run --all-files in cle passes and leaves the tree unchanged.
• Not run: the workspace Python gate, since this changes no Python.

Everything on this head is green, 19 checks of 19. ci / Test (0), an inherited job this change does not touch, failed once on rex's test_write_what_where_shadowstack, an exploit-generation test, and passed on re-run; the run before it, on the same description and the same inherited workflow, passed that job first time.

Caveats: a description edit does not retrigger CI and a re-run replays the original event payload, so a reference has to be in the description when the run starts. A GitHub API failure while checking that a referenced pull request is open leaves that sibling on master rather than failing the job. Only a [tool.uv.sources] entry pointing at a github.com repository can be overridden, matched by URL, so a path or registry source is left alone. Because the override now goes through the resolver, a sibling head that genuinely conflicts with the rest of the graph fails the sync instead of being installed over an already-resolved environment; that is the intended trade for a coherent lock.

[angr-bot]

Corpus decompilation diffs can be found at angr/dec-snapshots@master...angr/cle_738