AskaEth
8722c5a0ab
r2 复审：r1 那 11 条 + M3 已闭合（复审自己重放 12/12 红），但它新造的 40 条变异仍有 11 条漏网，
其中三条是「1 行改绿」：把 `probe.outputs.available` 改指向 `reason`/字面量（门永久关、每次绿）；
判据步的退出码在标记表之外被吞（`|| echo 先忽略` / `; :` / `| cat` / `if !` / `true # 原行`，
复审真 bash 实测 exit 0）；自检步被指向另一个脚本（自检根本不跑）。
三条 P1：
- 新判据 9：`probe.outputs.{available,log,png}` 必须逐个等于 `${{ steps.detect.outputs.<同名> }}`；
- 新判据 5：把 `id: judge` 的 `run` 原文真跑两次 —— 正例必须 exit 0、CPU 档日志必须 exit≠0，
且 `bash -e` 与**裸 bash** 各跑一遍（`; :` 只在后者现形，实测 `bash -e`=1 / 裸 bash=0）。
这一条一次封掉整类「吞码」，不依赖标记表；
- 判据 2：`id: wiring` 的 `run` 必须含 `gpu_shot_ci_selftest.py`，且 `vectors`/`wiring` 必须是**单条命令**
（不许换行/管道/`;`/`&`/反引号/`#`/`$(`）⇒ `|| echo 先忽略` 无从下手。
两条 P2：
- 新判据 10：`on:` 必须同时有 `push`（含 `main`）/`pull_request`/`workflow_call`；
- 「载体依赖」这条边界补进四处（自检 docstring / gpu-evidence.md §8 / README / workflow 头注释）：
整个 workflow 被删掉就没有东西会跑自检，`guards.yml` 399/400 行塞不进去。
止步线（写进 docstring 与 §8）：封闭清单 10 类 / 33 条变异向量；明确不覆盖「改判据脚本」「删掉整个
workflow」「求值器与 GitHub 语义差」「判据 4 的合法调用替换」；本文档不宣称「不可能被改成总是绿」；
**自 2026-11-11 起停止加固，扩项须由人类新开 mission**。
新增 `packaging/tests/gpu_shot_ci_expr.py`（`if:` 小求值器，判据脚本仍守 ≤400 行：377/215/64）。
39 lines
8.0 KiB
JSON
39 lines
8.0 KiB
JSON
{
|
||
"_note": "M253 接线自检的变异向量。全部按解析后的结构注入（排版变动不影响）：op ∈ step_delete / job_delete / step_set / job_set / path_set / trigger_set / run_append / run_replace；`also` 可叠加一组后续注入。expect = 必须报错的判据名（与 gpu_shot_ci_selftest.py 的 CHECKS 键逐字一致）。计数：33 = r1 复审表 20 条 + 1 条补充（M20）+ r2 复审 12 条（N28/N29/N22/N23/N24/N25/N26/N8'/N40/N41/N11/N12）。",
|
||
"vectors": [
|
||
{"id": "M1", "label": "自测步命令后加 || true（自测被吞）", "op": "run_append", "target": "vectors", "value": " || true", "expect": "8 不吞退出码（标记表，兜底）"},
|
||
{"id": "M2", "label": "接线自检步命令后加 || true（守卫守不到自己）", "op": "run_append", "target": "wiring", "value": " || true", "expect": "8 不吞退出码（标记表，兜底）"},
|
||
{"id": "M2b", "label": "接线自检步命令后加 ; true", "op": "run_append", "target": "wiring", "value": "; true", "expect": "2 自测步跑的是对脚本且是单条命令"},
|
||
{"id": "M3", "label": "判定的门加 || always()（门形同虚设）", "op": "job_set", "target": "evidence", "key": "if", "value": "needs.probe.outputs.available == 'true' || always()", "expect": "3 判定必须挂门"},
|
||
{"id": "M4", "label": "判据命令后加裸 exit 0", "op": "run_append", "target": "judge", "value": "\nexit 0\n", "expect": "8 不吞退出码（标记表，兜底）"},
|
||
{"id": "M5", "label": "整行删掉 ::warning:: 告警", "op": "run_replace", "target": "detect", "find": "echo \"::warning::GPU 证据：跳过（${reason}）—— 本次运行没有判过任何真实产物，不构成「GPU 证据已验证」\"", "replace": "", "expect": "6 跳过路径真跑（7 种输入）"},
|
||
{"id": "M6", "label": "不再写 $GITHUB_OUTPUT（判定永远拿不到产物）", "op": "run_replace", "target": "detect", "find": ">> \"$GITHUB_OUTPUT\"", "replace": ">> /dev/null", "expect": "6 跳过路径真跑（7 种输入）"},
|
||
{"id": "M7", "label": "selftest job 加 job 级 if: false", "op": "job_set", "target": "selftest", "key": "if", "value": false, "expect": "1 五步必须在场"},
|
||
{"id": "M8", "label": "探测步加 continue-on-error: true", "op": "step_set", "target": "detect", "key": "continue-on-error", "value": true, "expect": "7 禁 continue-on-error"},
|
||
{"id": "M9", "label": "接线自检步加 if: false", "op": "step_set", "target": "wiring", "key": "if", "value": false, "expect": "1 五步必须在场"},
|
||
{"id": "M10", "label": "整步删掉接线自检", "op": "step_delete", "target": "wiring", "expect": "1 五步必须在场"},
|
||
{"id": "M11", "label": "dispatch 分支 available 恒 false（门禁永久关闭）", "op": "run_replace", "target": "detect", "find": "available=true", "replace": "available=false", "occurrence": 1, "expect": "6 跳过路径真跑（7 种输入）"},
|
||
{"id": "M12", "label": "约定产物分支 available 恒 false（门禁永久关闭）", "op": "run_replace", "target": "detect", "find": "available=true", "replace": "available=false", "occurrence": 2, "expect": "6 跳过路径真跑（7 种输入）"},
|
||
{"id": "M13", "label": "整块删掉 evidence job", "op": "job_delete", "target": "evidence", "expect": "1 五步必须在场"},
|
||
{"id": "M14", "label": "::warning:: 改成裸 echo（跳过变静默 pass）", "op": "run_replace", "target": "detect", "find": "::warning::", "replace": "", "expect": "6 跳过路径真跑（7 种输入）"},
|
||
{"id": "M15", "label": "整步删掉 --self-test", "op": "step_delete", "target": "vectors", "expect": "1 五步必须在场"},
|
||
{"id": "M16", "label": "整步删掉退出码语义 0/1/2", "op": "step_delete", "target": "exitcodes", "expect": "1 五步必须在场"},
|
||
{"id": "M17", "label": "continue-on-error: 'true'（带引号）", "op": "step_set", "target": "detect", "key": "continue-on-error", "value": "true", "expect": "7 禁 continue-on-error"},
|
||
{"id": "M18", "label": "continue-on-error: ${{ true }}（表达式）", "op": "step_set", "target": "detect", "key": "continue-on-error", "value": "${{ true }}", "expect": "7 禁 continue-on-error"},
|
||
{"id": "M19", "label": "判定步加 if: ${{ always() }}", "op": "step_set", "target": "judge", "key": "if", "value": "${{ always() }}", "expect": "3 判定必须挂门"},
|
||
{"id": "M20", "label": "判定步的正例调用换成 true（不再调判据脚本）", "op": "run_replace", "target": "judge", "find": "python3 packaging/check_gpu_shot.py \"$LOG\" \"$PNG\"", "replace": "true", "expect": "4 判定用探测给的产物"},
|
||
{"id": "N28", "label": "probe.outputs.available 改指向 reason（门永久关、每次绿）", "op": "path_set", "path": ["jobs", "probe", "outputs", "available"], "value": "${{ steps.detect.outputs.reason }}", "expect": "9 probe.outputs 绑定 detect"},
|
||
{"id": "N29", "label": "probe.outputs.available 改成字面量 'false'（门永久关）", "op": "path_set", "path": ["jobs", "probe", "outputs", "available"], "value": "false", "expect": "9 probe.outputs 绑定 detect"},
|
||
{"id": "N22", "label": "判据命令后加 || echo 先忽略（绿而没判）", "op": "run_replace", "target": "judge", "find": "python3 packaging/check_gpu_shot.py \"$LOG\" \"$PNG\"", "replace": "python3 packaging/check_gpu_shot.py \"$LOG\" \"$PNG\" || echo \"判据没过（先忽略）\"", "expect": "5 判据步真跑（正例 0 / CPU 档非 0）"},
|
||
{"id": "N24", "label": "判据命令后加 ; :（吞退出码）", "op": "run_replace", "target": "judge", "find": "python3 packaging/check_gpu_shot.py \"$LOG\" \"$PNG\"", "replace": "python3 packaging/check_gpu_shot.py \"$LOG\" \"$PNG\" ; :", "expect": "5 判据步真跑（正例 0 / CPU 档非 0）"},
|
||
{"id": "N25", "label": "去掉 pipefail 再把判据命令接管道 | cat（吞退出码）", "op": "run_replace", "target": "judge", "find": "python3 packaging/check_gpu_shot.py \"$LOG\" \"$PNG\"", "replace": "python3 packaging/check_gpu_shot.py \"$LOG\" \"$PNG\" | cat", "also": [{"op": "run_replace", "target": "judge", "find": "set -uo pipefail", "replace": "set -u"}], "expect": "5 判据步真跑（正例 0 / CPU 档非 0）"},
|
||
{"id": "N26", "label": "判据命令包进 if ! … then echo; fi（吞退出码）", "op": "run_replace", "target": "judge", "find": "python3 packaging/check_gpu_shot.py \"$LOG\" \"$PNG\"", "replace": "if ! python3 packaging/check_gpu_shot.py \"$LOG\" \"$PNG\"; then echo \"没判过\"; fi", "expect": "5 判据步真跑（正例 0 / CPU 档非 0）"},
|
||
{"id": "N8b", "label": "判据命令改成 true 后注释掉原行（保留子串锚点）", "op": "run_replace", "target": "judge", "find": "python3 packaging/check_gpu_shot.py \"$LOG\" \"$PNG\"", "replace": "true # python3 packaging/check_gpu_shot.py \"$LOG\" \"$PNG\"", "expect": "5 判据步真跑（正例 0 / CPU 档非 0）"},
|
||
{"id": "N40", "label": "接线自检步指向 gpu_shot_ci_probe.py（自检根本不跑）", "op": "step_set", "target": "wiring", "key": "run", "value": "python3 packaging/tests/gpu_shot_ci_probe.py", "expect": "2 自测步跑的是对脚本且是单条命令"},
|
||
{"id": "N41", "label": "接线自检步指向另一个自测（自检根本不跑）", "op": "step_set", "target": "wiring", "key": "run", "value": "python3 packaging/check_gpu_shot.py --self-test", "expect": "2 自测步跑的是对脚本且是单条命令"},
|
||
{"id": "N23", "label": "接线自检步后加 || echo 先忽略（守卫把自己关了）", "op": "run_append", "target": "wiring", "value": " || echo \"自检没过（先忽略）\"", "expect": "2 自测步跑的是对脚本且是单条命令"},
|
||
{"id": "N11", "label": "删掉 push / pull_request 触发（main、PR 侧停摆）", "op": "trigger_set", "value": ["workflow_dispatch"], "expect": "10 触发面（push/pull_request/workflow_call）"},
|
||
{"id": "N12", "label": "删掉 workflow_call 触发（dev 线 uses 会加载失败）", "op": "trigger_set", "value": {"push": {"branches": ["main"]}, "pull_request": null, "workflow_dispatch": null}, "expect": "10 触发面（push/pull_request/workflow_call）"}
|
||
]
|
||
}
|