Skip to content

Implement W365 Agents Phase 2 checkout and release lifecycle #1723

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tbyfield wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Implement W365 Agents Phase 2 checkout and release lifecycle #1723

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d9985fc
Implement W365 Agents Phase 2 checkout and release lifecycle
tbyfield Nov 10, 2026
d2d77aa
Preserve W365 checkout cleanup IDs and require Azure fixtures
tbyfield Nov 10, 2026
2ec6438
Keep Hyperlight native TLS scoped to x86_64
tbyfield Nov 10, 2026
ceb612a
Use native TLS for W365 HTTPS and lifecycle fixtures
tbyfield Nov 10, 2026
9f4d1ec
Fix native TLS fixture identity import and Windows tool selection
tbyfield Nov 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .azure-pipelines/templates/Mac.Build.Job.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,8 @@ jobs:
# retaining the rest of the package tests.
- script: |
set -euo pipefail
tests="$(cargo test --locked --release --target $(targetTriple) -p mxc-sdk --lib w365 -- --list)"
grep -q 'lifecycle_contract_and_recovery_fixture: test' <<< "$tests"
cargo test --locked --release --target $(targetTriple) \
-p mxc_darwin -p mxc-sdk -p unix_test_proxy -p mxc_ffi -- \
--skip 'core_modules::mxc_pty::tests::'
Expand Down
71 changes: 69 additions & 2 deletions .azure-pipelines/templates/Rust.Build.Job.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,9 @@ jobs:
artifactPrefix: lxc-binaries
workingDirectory: $(Build.SourcesDirectory)/src/tools/lxc
cargoFeatures: hyperlight
${{ if eq(item.arch, 'arm64') }}:
AARCH64_UNKNOWN_LINUX_GNU_OPENSSL_LIB_DIR: /usr/lib/aarch64-linux-gnu
AARCH64_UNKNOWN_LINUX_GNU_OPENSSL_INCLUDE_DIR: /usr/include
signPattern: |
lxc-exec
unix-test-proxy
Expand Down Expand Up @@ -98,11 +101,37 @@ jobs:
steps:
- checkout: self

# Install Linux ARM64 toolchain for arm64 linux builds
- pwsh: |
$openssl = Join-Path $env:ProgramFiles 'Git\usr\bin\openssl.exe'
if (-not (Test-Path $openssl)) {
throw 'Windows TLS fixtures require OpenSSL from Git for Windows'
}
Write-Host "##vso[task.setvariable variable=MXC_W365_TEST_OPENSSL]$openssl"
displayName: Expose OpenSSL for Windows TLS fixtures
condition: and(eq('${{ item.os }}', 'windows'), eq('${{ item.arch }}', 'x64'))

- script: |
set -euo pipefail
sudo apt-get update
sudo apt-get install -y --no-install-recommends libssl-dev pkg-config
displayName: Install Linux TLS build dependencies
condition: eq('${{ item.os }}', 'linux')

# Install Linux ARM64 toolchain for arm64 linux builds
- script: |
set -euo pipefail
sudo apt-get install -y gcc-aarch64-linux-gnu
displayName: Install ARM64 toolchain
sudo dpkg --add-architecture arm64
. /etc/os-release
sources="$(mktemp)"
trap 'rm -f "$sources"' EXIT
for suite in "$VERSION_CODENAME" "$VERSION_CODENAME-updates" "$VERSION_CODENAME-security"; do
echo "deb [arch=arm64 signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] http://ports.ubuntu.com/ubuntu-ports $suite main" >> "$sources"
done
apt_options=(-o "Dir::Etc::sourcelist=$sources" -o "Dir::Etc::sourceparts=-")
sudo apt-get "${apt_options[@]}" update
sudo apt-get "${apt_options[@]}" install -y --no-install-recommends libssl-dev:arm64
displayName: Install ARM64 toolchain and target OpenSSL
condition: and(eq('${{ item.os }}','linux'), eq('${{ item.arch }}','arm64'))

- ${{ if eq(parameters.isOfficialBuild, true) }}:
Expand All @@ -128,6 +157,18 @@ jobs:
${{ else }}:
enableTest: 'false'

- script: |
set -euo pipefail
features="$(cargo tree --locked --target $(triplet) -p mxc-sdk --no-default-features --features hyperlight -e features -i ureq)"
grep -q 'ureq feature "native-tls"' <<< "$features"
if grep -qE 'ureq feature "(gzip|rustls)"' <<< "$features"; then
echo "ARM64 must use native TLS without rustls or Hyperlight's x86_64-only gzip feature." >&2
exit 1
fi
displayName: Check ARM64 HTTP dependency features
workingDirectory: $(Build.SourcesDirectory)/src
condition: and(eq('${{ item.os }}', 'linux'), eq('${{ item.arch }}', 'arm64'))

# These are separate workspace members (not deps of lxc), so the
# workspace-member-scoped build above doesn't pick them up.
- script: |
Expand Down Expand Up @@ -155,6 +196,32 @@ jobs:
workingDirectory: $(Build.SourcesDirectory)/src
condition: and(eq('${{ item.os }}', 'linux'), eq('${{ item.arch }}', 'x64'))

- script: |
set -euo pipefail
tests="$(cargo test --locked --release --target $(triplet) -p mxc-sdk --lib w365 -- --list)"
grep -q 'lifecycle_contract_and_recovery_fixture: test' <<< "$tests"
cargo test --locked --release --target $(triplet) -p mxc-sdk --lib w365 -- --include-ignored
displayName: Test W365 checkout and release fixtures
workingDirectory: $(Build.SourcesDirectory)/src
condition: and(eq('${{ item.os }}', 'linux'), eq('${{ item.arch }}', 'x64'))

- pwsh: |
$ErrorActionPreference = 'Stop'
$fixtureTarget = Join-Path '$(Agent.TempDirectory)' 'w365-fixture'
cargo build --locked --release --target $(triplet) -p wxc --features test-support --target-dir $fixtureTarget
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
$env:MXC_W365_TEST_EXECUTOR = (Resolve-Path (Join-Path $fixtureTarget '$(triplet)\release\wxc-exec.exe')).Path
$tests = cargo test --locked --release --target $(triplet) -p mxc-sdk --lib w365 -- --list
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
foreach ($name in @('lifecycle_contract_and_recovery_fixture', 'lifecycle_fresh_executor_fixture')) {
if (-not ($tests -match "${name}: test")) { throw "Missing W365 fixture: $name" }
}
cargo test --locked --release --target $(triplet) -p mxc-sdk --lib w365 -- --include-ignored
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
displayName: Test W365 checkout and fresh-executor release fixtures
workingDirectory: $(Build.SourcesDirectory)/src
condition: and(eq('${{ item.os }}', 'windows'), eq('${{ item.arch }}', 'x64'))

- task: EsrpCodeSigning@6
displayName: Code Sign
condition: and(eq(${{ parameters.isOfficialBuild }}, true), eq('${{ item.os }}', 'windows'))
Expand Down
12 changes: 12 additions & 0 deletions .github/workflows/Build.Linux.Job.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,9 @@ jobs:
key: ${{ matrix.target }}-v2
cache-on-failure: false

- name: Install Linux TLS build dependencies
run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libssl-dev pkg-config

- name: Install ARM64 cross linker
if: matrix.target == 'aarch64-unknown-linux-gnu'
run: sudo apt-get update && sudo apt-get install -y --no-install-recommends gcc-aarch64-linux-gnu
Expand Down Expand Up @@ -172,6 +175,15 @@ jobs:
cargo test --locked --release --target "${{ matrix.target }}" -p mxc-sdk -p mxc_ffi --lib state_aware
cargo test --locked --release --target "${{ matrix.target }}" -p mxc-sdk --test state_aware

- name: Test W365 checkout and release with trusted TLS fixtures
working-directory: src
shell: bash
run: |
set -euo pipefail
names="$(cargo test --locked -p mxc-sdk --lib --target "${{ matrix.target }}" -- --list)"
grep -Fq "backend_modules::w365agents::tests::lifecycle_contract_and_recovery_fixture: test" <<< "$names"
cargo test --locked -p mxc-sdk --lib --target "${{ matrix.target }}" w365 -- --include-ignored

- name: Test native module lifetime
working-directory: src
run: |
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/Build.MacOS.Job.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,14 @@ jobs:
cargo test --locked --release --target aarch64-apple-darwin -p mxc-sdk -p mxc_ffi --lib state_aware
cargo test --locked --release --target aarch64-apple-darwin -p mxc-sdk --test state_aware

- name: Test W365 checkout and release with trusted TLS fixtures
shell: bash
run: |
set -euo pipefail
names="$(cargo test --locked -p mxc-sdk --lib --target aarch64-apple-darwin -- --list)"
grep -Fq "backend_modules::w365agents::tests::lifecycle_contract_and_recovery_fixture: test" <<< "$names"
cargo test --locked -p mxc-sdk --lib --target aarch64-apple-darwin w365 -- --include-ignored

- name: Test Seatbelt streaming and PTY
run: cargo test --locked --release --target aarch64-apple-darwin
-p mxc-sdk --test streaming
Expand Down
26 changes: 26 additions & 0 deletions .github/workflows/Build.Windows.Job.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,15 @@ jobs:
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Expose OpenSSL for Windows TLS fixtures
shell: pwsh
run: |
$openssl = Join-Path $env:ProgramFiles 'Git\usr\bin\openssl.exe'
if (-not (Test-Path $openssl)) {
throw 'Windows TLS fixtures require OpenSSL from Git for Windows'
}
"MXC_W365_TEST_OPENSSL=$openssl" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

- name: Test loopback command quoting
shell: pwsh
run: ..\tests\scripts\test_loopback_anchor_command.ps1
Expand Down Expand Up @@ -158,6 +167,23 @@ jobs:
-BinaryDirectory 'src/target/${{ matrix.target }}/release' `
-Features '${{ matrix.features }}'

- name: Test W365 checkout and release with trusted TLS fixtures
shell: pwsh
run: |
cargo build --locked -p wxc --target '${{ matrix.target }}' `
--target-dir target/w365-fixture --features test-support
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
$env:MXC_W365_TEST_EXECUTOR = (Resolve-Path 'target/w365-fixture/${{ matrix.target }}/debug/wxc-exec.exe').Path
$names = @(cargo test --locked -p mxc-sdk --lib --target '${{ matrix.target }}' -- --list)
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
foreach ($case in @('lifecycle_contract_and_recovery_fixture', 'lifecycle_fresh_executor_fixture')) {
if (-not ($names -match "backend_modules::w365agents::tests::${case}: test")) {
throw "Missing required W365 fixture: $case"
}
}
cargo test --locked -p mxc-sdk --lib --target '${{ matrix.target }}' w365 -- --include-ignored
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
Comment on lines +184 to +185

@tbyfield tbyfield Nov 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in d2d77aa. Azure now explicitly discovers and runs the engine fixture on Linux x64 and both fixtures on Windows x64. Windows builds its test-support executor in a separate target directory outside shipping artifacts. macOS checks fixture discovery before the existing package suite runs it; cross-compiled Windows/Linux arm64 jobs remain build-only. Template structure and embedded PowerShell/Bash syntax checks passed locally; the updated Azure jobs have not run yet.


- name: Build debug executor for isolated telemetry smoke tests
env:
MXC_TELEMETRY_COMPONENT_PATH: ''
Expand Down
Loading
Loading