Merge remote-tracking branch 'origin/main' into fix/gc-report-json-1257

Author: claude

.gitattributes

@@ -47,3 +47,11 @@ crates/socket-patch-core/tests/fixtures/sbt/** -text
 # (sbt-compatibility.yml); a CRLF checkout breaks them ($'\r').
 scripts/sbt-warm-seed.sh text eol=lf
 scripts/sbt-compat-matrix.sh text eol=lf
+
+# Real `bun install --save-text-lockfile` output: the migrated-lock revert
+# tests compare restored bun.lock bytes against it exactly (#784).
+crates/socket-patch-core/tests/fixtures/bun-lockb/1.2.23-migrated/*.lock -text
+
+# Real Bun locks with a version-less own-source copy (#497): the VEX tests
+# rewire the nested registry entry of the captured bytes in place.
+crates/socket-patch-core/tests/fixtures/bun-unversioned-copy/** -text

.github/workflows/bun-compatibility.yml

@@ -16,6 +16,11 @@ name: Bun patch compatibility
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
+    # Only this ecosystem's own files. A change to shared engine code
+    # (vendor/, patch/, vex/, scan/, Cargo.lock, ...) runs the full matrix on
+    # push to main, or on demand via workflow_dispatch on the PR branch;
+    # ci.yml's per-ecosystem blocking slice still runs on every PR and in
+    # the merge queue (#1198).
     paths:
       - '.github/actions/upload-artifact/**'
       - '.github/actions/pin-socket-hosts/**'
@@ -24,30 +29,13 @@ on:
       - 'scripts/backtest-bun*.py'
       - 'scripts/probe-bun-historical-linux.py'
       - 'scripts/bun-historical-shas.json'
+      - 'docs/testing/bun-compatibility.md'
+      - 'crates/*/src/**/bun_*'
+      - 'crates/*/src/**/bun.rs'
+      - 'crates/*/src/**/bun/**'
       - 'crates/socket-patch-cli/tests/e2e_bun_lockb.rs'
       - 'crates/socket-patch-core/tests/fixtures/bun-lockb/**'
-      - 'docs/testing/bun-compatibility.md'
-      - 'Cargo.lock'
-      - 'crates/socket-patch-core/src/vendor/**'
-      - 'crates/socket-patch-core/src/patch/redirect/**'
-      - 'crates/socket-patch-core/src/vendor/bun_lock_text.rs'
-      - 'crates/socket-patch-core/src/crawlers/npm_crawler.rs'
-      - 'crates/socket-patch-core/src/crawlers/pkg_managers.rs'
-      - 'crates/socket-patch-core/src/constants.rs'
-      - 'crates/socket-patch-core/src/utils/process.rs'
       - 'crates/socket-patch-core/tests/fixtures/redirect/npm/bun/**'
-      - 'crates/socket-patch-cli/src/commands/get.rs'
-      - 'crates/socket-patch-core/src/vex/**'
-      - 'crates/socket-patch-cli/src/commands/vex.rs'
-      - 'crates/socket-patch-cli/src/commands/vex_consumed.rs'
-      - 'crates/socket-patch-cli/src/commands/vex_sources.rs'
-      - 'crates/socket-patch-cli/src/commands/apply.rs'
-      - 'crates/socket-patch-cli/tests/vex_e2e_common/**'
-      - 'crates/socket-patch-cli/src/commands/scan/**'
-      - 'crates/socket-patch-cli/src/commands/rollback.rs'
-      - 'crates/socket-patch-cli/src/commands/vendor.rs'
-      - 'crates/socket-patch-cli/src/commands/vendored_backend/**'
-      - 'crates/socket-patch-cli/src/commands/remove.rs'
   # Main runs are the only rust-cache writers (save-if below), so a
   # path-filtered push trigger is what seeds the cache the PR builds restore
   # (rust-cache keys on Cargo.lock, so Cargo.lock belongs here) and re-runs
@@ -82,6 +70,14 @@ on:
       - 'crates/socket-patch-cli/src/commands/vendor.rs'
       - 'crates/socket-patch-cli/src/commands/vendored_backend/**'
       - 'crates/socket-patch-cli/src/commands/remove.rs'
+      - '.github/actions/upload-artifact/**'
+      - 'docs/testing/bun-compatibility.md'
+      - 'crates/socket-patch-core/src/vendor/bun_lock_text.rs'
+      - 'crates/socket-patch-core/src/crawlers/npm_crawler.rs'
+      - 'crates/socket-patch-core/src/crawlers/pkg_managers.rs'
+      - 'crates/socket-patch-core/src/constants.rs'
+      - 'crates/socket-patch-core/src/utils/process.rs'
+      - 'crates/socket-patch-core/tests/fixtures/redirect/npm/bun/**'
   workflow_dispatch:
     inputs:
       versions:

.github/workflows/ci.yml

@@ -710,24 +710,18 @@ jobs:
           tags: socket-patch-test-${{ matrix.ecosystem }}:latest
           load: true
 
-      - name: Build instrumented socket-patch binary
-        # Source `cargo llvm-cov show-env` into the current shell so this
-        # `cargo build` picks up RUSTC_WRAPPER=cargo-llvm-cov and the
-        # same RUSTFLAGS that the subsequent `cargo llvm-cov` test step
-        # will use. The bin we build ends up byte-compatible with the
-        # test binaries — same source hashes → unified coverage map at
-        # report time. Env stays scoped to this step (intentional;
-        # cargo llvm-cov manages its own env in the test step).
-        run: |
-          eval "$(cargo llvm-cov show-env --export-prefix 2>/dev/null)"
-          cargo build --bin socket-patch
-
       - name: Configure docker-e2e coverage hooks
+        # Mount the instrumented socket-patch that the test step's own
+        # `cargo llvm-cov` builds for the integration tests (cargo builds
+        # a package's bins before running its integration tests), and
+        # write the in-container profraws next to the test processes'
+        # ones. `cargo llvm-cov report` reads only
+        # target/llvm-cov-target/*.profraw and objects built there, so a
+        # separately built binary or profraws elsewhere in target/ never
+        # reach the lcov.
         run: |
-          echo "SOCKET_PATCH_COV_BIN=$PWD/target/debug/socket-patch" >> "$GITHUB_ENV"
-          # Profraw files from the in-container binary land here.
-          # cargo-llvm-cov scans target/ for *.profraw at report time.
-          echo "SOCKET_PATCH_COV_PROFRAW_DIR=$PWD/target" >> "$GITHUB_ENV"
+          echo "SOCKET_PATCH_COV_BIN=$PWD/target/llvm-cov-target/debug/socket-patch" >> "$GITHUB_ENV"
+          echo "SOCKET_PATCH_COV_PROFRAW_DIR=$PWD/target/llvm-cov-target" >> "$GITHUB_ENV"
 
       - name: Run ${{ matrix.ecosystem }} Docker e2e test with coverage
         run: |
@@ -1109,8 +1103,13 @@ jobs:
           - {os: ubuntu-latest, suite: e2e_bun_lockb, bun: '1.0.36', test_filter: --include-ignored}
           - {os: ubuntu-latest, suite: e2e_bun_lockb, bun: '1.1.45', test_filter: --include-ignored}
           # Bun >= 1.4 migrating a hosted workspace bun.lockb to bun.lock
-          # (#803): the only binary-lock test whose reader must be 1.4+.
-          - {os: ubuntu-latest, suite: e2e_bun_lockb, bun: '1.4.2', test_filter: --include-ignored workspace_text_migration_heals_on_rerun}
+          # (#803; its reader must be 1.4+) and a vendored one, then
+          # reverting it (#784; skipped by the < 1.2 readers above). Both
+          # 1.4.2 and 1.3.14 also run the isolated-linker vendored re-run
+          # after a late dependent (#861); 1.3 re-hoists a frozen binary lock
+          # and refuses one whose trees changed.
+          - {os: ubuntu-latest, suite: e2e_bun_lockb, bun: '1.4.2', test_filter: --include-ignored text_migration workspace_late_dependent}
+          - {os: ubuntu-latest, suite: e2e_bun_lockb, bun: '1.3.14', test_filter: --include-ignored workspace_late_dependent}
           # Real-vlt capstones (DESIGN §8.4): wiremock patch service and a local
           # npm registry fed from npmjs, driven by the pinned vlt release
           # (`node vlt.js`, installed below from a sha512-checked `npm pack`).
@@ -1355,14 +1354,15 @@ jobs:
         env:
           UV_TEST_VERSION: ${{ matrix.uv }}
         run: |
-          python -m pip install --disable-pip-version-check --upgrade pip "uv==$UV_TEST_VERSION"
+          scripts/pip-install-retry.sh --upgrade pip "uv==$UV_TEST_VERSION"
           uv --version
 
       - name: Install uv (PDM / Hatch legs)
         if: matrix.pdm != '' || matrix.hatch != ''
         # The suites bootstrap the pinned PDM / Hatch into their own venv
         # with uv; this uv is tooling, not the release under test.
-        run: python -m pip install uv==0.11.19
+        shell: bash
+        run: scripts/pip-install-retry.sh uv==0.11.19
 
       - name: Install pinned Poetry
         if: matrix.poetry != ''
@@ -1374,7 +1374,7 @@ jobs:
         env:
           POETRY_TEST_VERSION: ${{ matrix.poetry }}
         run: |
-          python -m pip install uv==0.11.19
+          scripts/pip-install-retry.sh uv==0.11.19
           case "$POETRY_TEST_VERSION" in 1.0.*|1.1.*) py=3.8.20 ;; *) py=3.12 ;; esac
           uv venv "$RUNNER_TEMP/poetry" --python "$py"
           extra=""; [ "$POETRY_TEST_VERSION" = "1.2.2" ] && extra="cleo==1.0.0a5"
@@ -2460,7 +2460,7 @@ jobs:
 
       - name: Install uv
         if: steps.gate.outputs.run == 'true'
-        run: python -m pip install --disable-pip-version-check uv && uv --version
+        run: scripts/pip-install-retry.sh uv && uv --version
 
       - name: Setup Ruby
         if: steps.gate.outputs.run == 'true'

.github/workflows/composer-compatibility.yml

@@ -22,9 +22,32 @@ name: Composer patch compatibility
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
+    # Only this ecosystem's own files. A change to shared engine code
+    # (vendor/, patch/, vex/, scan/, Cargo.lock, ...) runs the full matrix on
+    # push to main (when it is in the push filter below) or nightly, or on
+    # demand via workflow_dispatch on the PR branch;
+    # ci.yml's per-ecosystem blocking slice still runs on every PR and in
+    # the merge queue (#1198).
     paths:
       - '.github/workflows/composer-compatibility.yml'
       - 'tests/docker/Dockerfile.composer'
+      - 'crates/*/src/**/*composer*'
+      - 'crates/*/src/**/*composer*/**'
+      - 'crates/socket-patch-core/tests/fixtures/redirect/composer/**'
+      - 'crates/socket-patch-core/tests/fixtures/composer-version-vectors.json'
+      - 'crates/socket-patch-cli/tests/e2e_*composer*.rs'
+      - 'crates/socket-patch-cli/tests/docker_e2e_vendor_composer.rs'
+      - 'crates/socket-patch-cli/tests/composer_e2e_common/**'
+      - 'crates/socket-patch-cli/tests/e2e_vex_lockfile/composer.rs'
+  push:
+    branches: [main]
+    # The ecosystem's pre-#1198 relevance set (the shared engine code its
+    # cells run through), its PR paths and the toolchain files. A main
+    # push outside this set waits for the nightly run below.
+    paths:
+      - '.github/workflows/composer-compatibility.yml'
+      - 'tests/docker/Dockerfile.composer'
+      - 'tests/docker/Dockerfile.base'
       - 'Cargo.lock'
       - 'Cargo.toml'
       - 'crates/*/Cargo.toml'
@@ -62,8 +85,14 @@ on:
       - 'crates/socket-patch-cli/tests/docker_vendor_common/**'
       - 'crates/socket-patch-cli/tests/e2e_vex_lockfile/composer.rs'
       - 'crates/socket-patch-cli/tests/vex_e2e_common/**'
-  push:
-    branches: [main]
+      - 'crates/*/src/**/*composer*'
+      - 'crates/*/src/**/*composer*/**'
+      - 'rust-toolchain.toml'
+      - '.cargo/**'
+  schedule:
+    # Nightly full matrix, so a main change outside the push filter
+    # still gets a run within a day.
+    - cron: '17 4 * * *'
   workflow_dispatch:
 
 permissions:

.github/workflows/go-compatibility.yml

@@ -8,6 +8,28 @@ name: Go patch compatibility
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
+    # Only this ecosystem's own files. A change to shared engine code
+    # (vendor/, patch/, vex/, scan/, Cargo.lock, ...) runs the full matrix on
+    # push to main (when it is in the push filter below) or nightly, or on
+    # demand via workflow_dispatch on the PR branch;
+    # ci.yml's per-ecosystem blocking slice still runs on every PR and in
+    # the merge queue (#1198).
+    paths:
+      - '.github/workflows/go-compatibility.yml'
+      - 'crates/*/src/**/*golang*'
+      - 'crates/*/src/**/*golang*/**'
+      - 'crates/socket-patch-core/src/vendor/go*.rs'
+      - 'crates/socket-patch-core/src/crawlers/go_crawler.rs'
+      - 'crates/socket-patch-core/src/crawlers/go_crawler/**'
+      - 'crates/socket-patch-cli/tests/e2e_golang_*build.rs'
+      - 'crates/socket-patch-cli/tests/e2e_vendor_golang_build.rs'
+      - 'crates/socket-patch-cli/tests/golang_e2e_matrix/**'
+      - 'crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs'
+  push:
+    branches: [main]
+    # The ecosystem's pre-#1198 relevance set (the shared engine code its
+    # cells run through), its PR paths and the toolchain files. A main
+    # push outside this set waits for the nightly run below.
     paths:
       - '.github/workflows/go-compatibility.yml'
       - 'crates/socket-patch-core/src/vendor/go*.rs'
@@ -22,8 +44,18 @@ on:
       - 'crates/socket-patch-cli/tests/golang_e2e_matrix/**'
       - 'crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs'
       - 'crates/socket-patch-cli/tests/vex_e2e_common/**'
-  push:
-    branches: [main]
+      - 'crates/*/src/**/*golang*'
+      - 'crates/*/src/**/*golang*/**'
+      - 'crates/socket-patch-core/src/crawlers/go_crawler/**'
+      - 'Cargo.lock'
+      - 'Cargo.toml'
+      - 'crates/*/Cargo.toml'
+      - 'rust-toolchain.toml'
+      - '.cargo/**'
+  schedule:
+    # Nightly full matrix, so a main change outside the push filter
+    # still gets a run within a day.
+    - cron: '17 4 * * *'
   workflow_dispatch:
 
 permissions:

.github/workflows/gradle-compatibility.yml

@@ -37,6 +37,12 @@ name: Gradle patch compatibility
 # download them. Every cell uploads its JSON probe reports
 # (gradle_build_common::probe_report: Gradle / JDK version, resolved jar path
 # and sha256, hash-dir naming, refresh / RO-cache / transform canaries).
+#
+# On pull_request the ubuntu `cells` are skipped: ci.yml's `e2e` PR tier runs
+# the same suites, filters, Gradle lines and JDKs on ubuntu on every PR and
+# in the merge queue. The ubuntu `extras` run on a PR only when it touches
+# Gradle code (`changes` below); every other PR gets them from the nightly
+# (#1177). Windows cells run on every PR that matches `paths:`.
 
 on:
   pull_request:
@@ -100,16 +106,58 @@ env:
   SOCKET_TELEMETRY_DISABLED: '1'
 
 jobs:
+  changes:
+    # Whether this run needs the ubuntu `extras`: always off pull_request, and
+    # on a PR only when it touches Gradle code.
+    if: github.event.pull_request.draft != true
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      gradle_core: ${{ steps.diff.outputs.gradle_core }}
+    steps:
+      - name: Checkout
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          # The PR merge commit and its first parent, the base it merges into.
+          fetch-depth: 2
+
+      - name: Diff against the base
+        id: diff
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set -euo pipefail
+          if [ "$EVENT_NAME" != pull_request ]; then
+            echo "gradle_core=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          core='^(\.github/workflows/gradle-compatibility\.yml$|scripts/install-gradle\.sh$'
+          core+='|crates/socket-patch-core/src/gradle/|crates/socket-patch-core/src/vendor/jvm/'
+          core+='|crates/socket-patch-core/src/crawlers/gradle_cache\.rs$'
+          core+='|crates/socket-patch-core/src/patch/redirect/([^/]*\.gradle|gradle\.rs|upstream/gradle\.rs)$'
+          core+='|crates/socket-patch-cli/tests/(gradle_|e2e_[^/]*gradle|e2e_vendor_jvm_build))'
+          if git diff --name-only HEAD^1 HEAD | grep -E "$core"; then
+            echo "gradle_core=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No Gradle code changed; the ubuntu extras run nightly."
+            echo "gradle_core=false" >> "$GITHUB_OUTPUT"
+          fi
+
   build:
     name: build ${{ matrix.os }}
-    if: github.event.pull_request.draft != true
+    needs: [changes]
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
         exclude:
           # macOS legs run on push to main (and nightly where scheduled), not per PR push.
           - os: ${{ github.event_name == 'pull_request' && 'macos-latest' || '' }}
+          # On a PR only the ubuntu `extras` use the ubuntu build.
+          - os: ${{ github.event_name == 'pull_request' && needs.changes.outputs.gradle_core != 'true' && 'ubuntu-latest' || '' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     env:
@@ -185,6 +233,8 @@ jobs:
         exclude:
           # macOS legs run on push to main (and nightly where scheduled), not per PR push.
           - os: ${{ github.event_name == 'pull_request' && 'macos-latest' || '' }}
+          # ci.yml's `e2e` runs these ubuntu cells on every PR (#1177).
+          - os: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || '' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     steps: &cell-steps
@@ -348,7 +398,8 @@ jobs:
 
   extras:
     name: gradle ${{ matrix.gradle }} / jdk ${{ matrix.java }} / ${{ matrix.mode }} / ${{ matrix.label }}
-    needs: [build]
+    needs: [changes, build]
+    if: needs.changes.outputs.gradle_core == 'true'
     strategy:
       fail-fast: false
       matrix: