makiri 0.7.0-x64-mingw-ucrt

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 2eb7b21bb34a15cc0263881ecf90715fac3263521b58dfd27b5d0ca966738402
+  data.tar.gz: 6a570d13671d4ecb8e85a235800a4c9ddf22e63d34c92cebe50c51d89551320c
+SHA512:
+  metadata.gz: c552c96226c3a75ad96f9d23a68021c2a4b4c562060ac1fe8392ebd4274fa5216814de1e63ee96149060d85e2293f808b1709e0717a9ca87b004216f91bca053
+  data.tar.gz: 7fe9bcdf19dcbb900d8ddf87712ca7f3bc74e532eda2cc5594d267da690eafd9f4aae0cfb62fec75021496c35b4cc01500ba6b991d8d86a1638aab7f106f544e

data/.github/workflows/ci.yml

@@ -0,0 +1,74 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+jobs:
+  test:
+    name: Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        ruby: ["3.2", "3.3", "3.4", "4.0"]
+
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      - name: Compile the extension (builds vendored Lexbor, then the ext)
+        run: bundle exec rake compile
+
+      # The :threading suite is heavy (GC.stress across threads) and checks a
+      # structural property that does not vary by OS/Ruby, so run it on a single
+      # representative job; the rest of the matrix skips it for a fast run.
+      - name: Run the test suite
+        run: bundle exec rake spec
+        env:
+          THREADING: ${{ (matrix.os == 'ubuntu-latest' && matrix.ruby == '3.4') && '1' || '' }}
+
+      - name: Smoke-load the gem
+        shell: bash
+        run: bundle exec ruby -Ilib -r makiri -e 'p Makiri::VERSION'
+
+  sanitize:
+    name: AddressSanitizer + UBSan (Ruby ${{ matrix.ruby }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ["3.4", "4.0"]
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      # Builds the ext with -fsanitize=address,undefined and runs the whole
+      # spec suite with the ASan runtime preloaded. Any heap/UB error aborts
+      # the run with a non-zero exit, failing the job.
+      - name: Build + test under sanitizers
+        run: bundle exec rake sanitize

data/.github/workflows/conformance.yml

@@ -0,0 +1,116 @@
+name: Conformance
+
+# Differential / spec-conformance suites. These compare Makiri against external
+# references (Nokogiri's libxml2/Gumbo XPath+CSS, the html5lib-tests corpus) and
+# catch semantic divergences that the unit specs cannot. The XPath and CSS
+# differentials run OUTSIDE the bundle (the rake tasks use
+# Bundler.with_unbundled_env), so Nokogiri — a bench-only dependency — must be
+# present as a system gem; each job installs it explicitly.
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+  schedule:
+    - cron: "37 5 * * *" # nightly, offset from the other workflows
+  workflow_dispatch:
+
+jobs:
+  # PR + push: HTML5 parsing conformance, plus the XPath and CSS differentials
+  # over the curated corpus and a moderate batch of generated XPath expressions.
+  conformance:
+    name: HTML5 + XPath/CSS differential vs Nokogiri
+    runs-on: ubuntu-latest
+    if: github.event_name != 'schedule'
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Compile the extension (builds vendored Lexbor, then the ext)
+        run: bundle exec rake compile
+
+      - name: Install Nokogiri (system gem; the differentials run outside the bundle)
+        run: gem install --no-document nokogiri
+
+      - name: HTML5 parsing conformance (html5lib-tests)
+        run: bundle exec rake conformance:html5
+
+      # XPATH_ARGS must be a real env var, not a rake CLI arg: the task reads
+      # ENV['XPATH_ARGS'] inside Bundler.with_unbundled_env, which reverts to the
+      # pre-rake environment, so a rake-set var would be dropped.
+      - name: XPath 1.0 differential vs Nokogiri (corpus + generated)
+        run: bundle exec rake conformance:xpath
+        env:
+          XPATH_ARGS: "--generate 5000 --seed 1"
+
+      - name: CSS Selectors differential vs Nokogiri::HTML5
+        run: bundle exec rake conformance:css
+
+      - name: XML XPath 1.0 differential vs Nokogiri::XML
+        run: bundle exec rake conformance:xpath_xml
+
+      - name: XML CSS-selector differential vs Nokogiri::XML
+        run: bundle exec rake conformance:css_xml
+
+      - name: XML Builder differential vs Nokogiri::XML::Builder
+        run: bundle exec rake conformance:builder
+
+  # Nightly: a wide XPath differential sweep across many seeds and a high
+  # generated volume, to surface divergences the curated corpus and a single
+  # seed miss. Fails fast (bash -e) on the first real divergence.
+  conformance-nightly:
+    name: Nightly XPath differential sweep
+    runs-on: ubuntu-latest
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Compile the extension
+        run: bundle exec rake compile
+
+      - name: Install Nokogiri (system gem)
+        run: gem install --no-document nokogiri
+
+      - name: XPath differential sweep (many seeds, high volume)
+        run: |
+          for seed in 1 2 3 4 5 6 7 8; do
+            echo "::group::seed ${seed}"
+            XPATH_ARGS="--generate 20000 --seed ${seed}" bundle exec rake conformance:xpath
+            echo "::endgroup::"
+          done
+
+      # The W3C XML conformance suite fetches its (pinned) test corpus on first
+      # run, so it lives in the nightly rather than on every PR.
+      - name: XML 1.0 well-formedness vs the W3C XML Conformance Test Suite
+        run: bundle exec rake conformance:xmlconf
+
+      # Property-based tree differential: generated documents, Makiri's parsed
+      # tree + canonical output vs Nokogiri::XML. Scalable volume - nightly gets
+      # a much larger batch than the resident in-suite PBT specs.
+      - name: XML property-based tree differential vs Nokogiri::XML
+        run: bundle exec rake conformance:xml_pbt
+        env:
+          PBT_ARGS: "--count 20000"

data/.github/workflows/libfuzzer.yml

@@ -0,0 +1,83 @@
+name: libFuzzer
+
+on:
+  # Nightly: libFuzzer runs are coverage-guided and long-running; they complement
+  # the PR-level short fuzz (30s) and the nightly sanitizer fuzz (300s per target).
+  # We run them on a schedule because the coverage signal needs sustained CPU
+  # time to reach deep branches (e.g. DOCTYPE quote/bracket state machine,
+  # reference expansion boundaries).
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+
+jobs:
+  # Build the libFuzzer harnesses under clang with -fsanitize=fuzzer,address
+  # and run each target for 300s.  The corpus is stored as a build artifact so
+  # it can be seeded in subsequent runs (regression asset per the roadmap).
+  libfuzzer-nightly:
+    name: libFuzzer ${{ matrix.target }} (clang)
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [xml, xpath, xml_xpath]
+
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      # Build the vendored Lexbor first (plain mode is fine; the harness links
+      # the static archive).  The fuzzer binary itself is built with ASan.
+      - name: Compile the extension (builds Lexbor)
+        run: bundle exec rake compile
+
+      - name: Install clang
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clang
+
+      - name: Build libFuzzer harnesses
+        run: |
+          cd ext/makiri/fuzz
+          make clean
+          make all
+
+      # Restore the previous corpus so the fuzzer starts from the accumulated
+      # regression seeds rather than from scratch.
+      - name: Restore corpus cache
+        uses: actions/cache@v4
+        with:
+          path: ext/makiri/fuzz/corpus/${{ matrix.target }}
+          key: libfuzzer-corpus-${{ matrix.target }}-${{ github.run_id }}
+          restore-keys: |
+            libfuzzer-corpus-${{ matrix.target }}-
+
+      - name: Run libFuzzer ${{ matrix.target }} (300s)
+        run: |
+          mkdir -p ext/makiri/fuzz/corpus/${{ matrix.target }}
+          cd ext/makiri/fuzz
+          ./${{ matrix.target }}_fuzz \
+            -max_total_time=300 \
+            -max_len=4096 \
+            -print_final_stats=1 \
+            corpus/${{ matrix.target }}
+
+      # Save the mutated corpus as an artifact for download / seeding.
+      - name: Upload corpus artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: libfuzzer-corpus-${{ matrix.target }}
+          path: ext/makiri/fuzz/corpus/${{ matrix.target }}
+          retention-days: 7

data/.github/workflows/release.yml

@@ -0,0 +1,249 @@
+name: Release
+
+# Build the source gem and precompiled ("fat") native gems for the major
+# platforms, attach them to a GitHub Release, and (optionally, on manual
+# dispatch) publish to RubyGems.
+#
+# Native gems are built on each target platform's own runner — NOT
+# cross-compiled — because the extension builds vendored Lexbor with CMake using
+# the host toolchain (see ext/makiri/extconf.rb). Each runner compiles for
+# Ruby 3.2/3.3/3.4; script/build_native_gem.rb then assembles one gem per
+# platform containing all three ABIs (lib/makiri.rb selects the right one at
+# require time). `gem install` of a native gem does not recompile or need
+# cmake / the Lexbor submodule.
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      publish_to_rubygems:
+        description: "Push the built gems to RubyGems (via Trusted Publishing / OIDC)"
+        type: boolean
+        default: false
+
+permissions:
+  contents: write   # create the GitHub Release and upload assets
+
+env:
+  RUBY_ABIS: "3.2 3.3 3.4 4.0"   # Ruby minor versions a native gem serves
+
+jobs:
+  # --- source gem (always builds; compiles from source at install time) -------
+  source-gem:
+    name: Source gem
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive   # vendored Lexbor must be in the gem's file list
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+      - name: Build source gem
+        run: |
+          mkdir -p pkg
+          gem build makiri.gemspec -o pkg/makiri-source.gem
+      - uses: actions/upload-artifact@v7
+        with:
+          name: gem-source
+          path: pkg/*.gem
+          if-no-files-found: error
+
+  # --- compile the extension natively, per platform x Ruby --------------------
+  compile:
+    name: Compile ${{ matrix.platform }} (Ruby ${{ matrix.ruby }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ["3.2", "3.3", "3.4", "4.0"]
+        platform:
+        - x86_64-linux
+        - aarch64-linux
+        - arm64-darwin
+        - x64-mingw-ucrt
+        include:
+          - { platform: x86_64-linux,   os: ubuntu-latest }
+          - { platform: aarch64-linux,  os: ubuntu-24.04-arm }
+          - { platform: arm64-darwin,   os: macos-14 }
+          - { platform: x64-mingw-ucrt, os: windows-latest }
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - name: Compile (builds vendored Lexbor, then the ext)
+        run: bundle exec rake compile
+      - name: Smoke-load
+        shell: bash
+        run: bundle exec ruby -Ilib -r makiri -e 'p Makiri::VERSION'
+      - name: Stage the compiled binary under its ABI subdir
+        shell: bash
+        run: |
+          minor="$(ruby -e 'print RUBY_VERSION[/\d+\.\d+/]')"
+          dlext="$(ruby -e 'print RbConfig::CONFIG["DLEXT"]')"   # so | bundle
+          mkdir -p "artifact/${minor}"
+          cp "lib/makiri/makiri.${dlext}" "artifact/${minor}/makiri.${dlext}"
+          ls -l "artifact/${minor}"
+      - name: Assert the binary is Ruby-portable (no libruby hard-link)
+        shell: bash
+        # extconf.rb builds the extension with dynamic_lookup / no libruby link so
+        # one precompiled binary loads on any compatible Ruby of that ABI. If a
+        # change reintroduces a libruby dependency, the gem would only load on the
+        # exact build Ruby — fail loudly here instead of shipping a broken gem.
+        run: |
+          dlext="$(ruby -e 'print RbConfig::CONFIG["DLEXT"]')"
+          bin="lib/makiri/makiri.${dlext}"
+          case "$(uname -s)" in
+            Darwin)
+              if otool -L "$bin" | grep -i 'libruby'; then
+                echo "::error::$bin hard-links libruby; precompiled gem would not load on other Ruby installs"; exit 1
+              fi
+              ;;
+            MINGW*|MSYS*|CYGWIN*)
+              # Windows PE DLLs MUST import the Ruby DLL via the import library
+              # (no dynamic_lookup on PE/COFF). A libruby import here is by design,
+              # not a portability bug, so this assertion does not apply.
+              echo "Windows (x64-mingw-ucrt): Ruby import-library link is by design; skipping libruby assertion"
+              ;;
+            *)
+              if readelf -d "$bin" 2>/dev/null | grep -iE 'NEEDED.*libruby'; then
+                echo "::error::$bin has a libruby NEEDED entry; precompiled gem may not load on a static Ruby"; exit 1
+              fi
+              ;;
+          esac
+          echo "OK: portability check complete for $bin"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: bin-${{ matrix.platform }}-${{ matrix.ruby }}
+          path: artifact/
+          if-no-files-found: error
+
+  # --- assemble one fat gem per platform from its per-ABI binaries ------------
+  native-gem:
+    name: Native gem ${{ matrix.platform }}
+    needs: compile
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - platform: x86_64-linux
+          os: ubuntu-latest
+        - platform: aarch64-linux
+          os: ubuntu-24.04-arm
+        - platform: arm64-darwin
+          os: macos-14
+        - platform: x64-mingw-ucrt
+          os: windows-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive   # for the gemspec's file scan (ext/vendor are then dropped)
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+      - name: Download this platform's per-ABI binaries
+        uses: actions/download-artifact@v8
+        with:
+          pattern: bin-${{ matrix.platform }}-*
+          merge-multiple: true
+          path: staged
+      - name: Place binaries under lib/makiri/<abi>/
+        shell: bash
+        run: |
+          mkdir -p lib/makiri
+          echo "Downloaded artifacts:"
+          find staged -maxdepth 3 -type f -print || true
+          if ! find staged -mindepth 2 -maxdepth 2 -name 'makiri.*' | grep -q .; then
+            echo "::error::No makiri binaries were downloaded for ${{ matrix.platform }}"
+            exit 1
+          fi
+          cp -r staged/* lib/makiri/
+          echo "Staged binaries:"
+          find lib/makiri -maxdepth 2 -name 'makiri.*' -print
+      - name: Build the native gem
+        run: ruby script/build_native_gem.rb "${{ matrix.platform }}"
+      - name: Verify it installs without recompiling
+        shell: bash
+        run: |
+          gem install "makiri-"*"-${{ matrix.platform }}.gem" --local
+          ruby -e 'require "makiri"; puts Makiri::VERSION'
+      - uses: actions/upload-artifact@v7
+        with:
+          name: gem-${{ matrix.platform }}
+          path: "*.gem"
+          if-no-files-found: error
+
+  # --- attach every gem to a GitHub Release (on a version tag) ----------------
+  release:
+    name: GitHub Release
+    needs: [source-gem, native-gem]
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: gem-*
+          merge-multiple: true
+          path: dist
+      - name: List assets
+        run: ls -l dist
+      - name: Create / update the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Mark pre-release tags (v1.2.3.rc1 / -beta / -alpha / -pre) as such.
+          pre=""
+          case "$GITHUB_REF_NAME" in
+            *rc*|*beta*|*alpha*|*pre*) pre="--prerelease" ;;
+          esac
+          gh release create "${GITHUB_REF_NAME}" dist/*.gem \
+            --repo "${GITHUB_REPOSITORY}" \
+            --title "${GITHUB_REF_NAME}" \
+            --notes "Automated release for ${GITHUB_REF_NAME}. See CHANGELOG.md." \
+            $pre --verify-tag || \
+          gh release upload "${GITHUB_REF_NAME}" dist/*.gem --repo "${GITHUB_REPOSITORY}" --clobber
+
+  # --- publish to RubyGems, behind the `rubygems` environment approval gate ---
+  # Held until the `rubygems` environment's Required-reviewers rule is approved,
+  # so a tag push releases on GitHub immediately but the RubyGems push waits.
+  #
+  # Auth is RubyGems Trusted Publishing (OIDC): no stored API key. Configure a
+  # matching Trusted Publisher on RubyGems.org (owner=takahashim, repo=makiri,
+  # workflow=release.yml, Environment=rubygems) so the token is only accepted
+  # through this gated environment.
+  publish:
+    name: Publish to RubyGems
+    needs: [source-gem, native-gem]
+    if: >-
+      startsWith(github.ref, 'refs/tags/') ||
+      (github.event_name == 'workflow_dispatch' && inputs.publish_to_rubygems)
+    runs-on: ubuntu-latest
+    environment: rubygems
+    permissions:
+      contents: read
+      id-token: write       # OIDC identity token for Trusted Publishing
+    steps:
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: gem-*
+          merge-multiple: true
+          path: dist
+      - name: Configure RubyGems credentials (OIDC trusted publishing)
+        uses: rubygems/configure-rubygems-credentials@762a4b77c3300434bb57c7ce80b20e36231927aa # v2.0.0
+      - name: gem push
+        run: |
+          for g in dist/*.gem; do
+            echo "Pushing $g"
+            gem push "$g"
+          done