From c0c804be24afc19b2dce587b02c3fc9a502d332f Mon Sep 17 00:00:00 2001 From: frstrtr Date: Fri, 3 Jul 2026 19:16:16 +0000 Subject: [PATCH 1/7] ci(build): flip windows lane to self-hosted VM217 (fork-gated) VM217 (c2pool-windows-217) toolchain probe run 28679257030 is green across Python 3.12, Conan 2, CMake, Git and MSVC/VS 2022 C++ build tools. Route internal PRs/pushes to the self-hosted runner via the #439 fork-gate expr; fork PRs keep GitHub-hosted windows-2022. setup-python gated to github-hosted so VM217 uses its pre-provisioned interpreter. Last GitHub-hosted C++ lane. --- .github/workflows/build.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index bd956e349..1fb7a8905 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -37,7 +37,9 @@ jobs: sudo apt-get install -y --no-install-recommends \ g++ ccache cmake make libleveldb-dev libsecp256k1-dev + # Python is pre-provisioned on VM217; only provision on GitHub-hosted forks. - uses: actions/setup-python@v6 + if: ${{ runner.environment == 'github-hosted' }} with: { python-version: '3.12' } - name: Install Conan 2 @@ -721,14 +723,12 @@ jobs: name: Windows x86_64 # dash-slice campaign: skip Windows for PRs carrying the dash-linux-only label (re-enabled at block-viable gate, ~07-01) if: ${{ !(github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'dash-linux-only')) }} - # GitHub-hosted windows-2022 (ships cmake + MSVC/VS 2022 + the SDK). - # VM217 (c2pool-windows-217) is still a bare runner: the self-hosted flip - # failed at actions/setup-python@v6 (cannot provision Python on VM217) and - # no VS 2022 Build Tools are installed yet. FOLLOW-UP: once vm-fleet installs - # VS 2022 Build Tools (C++ workload) + cmake + python on VM217 and it builds - # c2pool clean, a follow-up PR flips this to the fork-gated self-hosted expr. - # web-static + pplns self-hosted routes on this branch are proven green. - runs-on: windows-2022 + # Internal PRs / pushes -> self-hosted c2pool-windows-217 (VM217): toolchain + # probe run 28679257030 green (Python 3.12, Conan 2, CMake, Git, MSVC/VS 2022 + # C++ build tools all provisioned). Fork PRs fall back to GitHub-hosted + # windows-2022 (ships cmake + MSVC/VS 2022 + SDK). Completes the #439 + # self-hosted migration -- Windows was the last GitHub-hosted C++ lane. + runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","Windows","X64","c2pool-build"]') || 'windows-2022' }} steps: - uses: actions/checkout@v6 From 24da884238d12e4a2b0c67e7c8d5368b2e89fd0d Mon Sep 17 00:00:00 2001 From: frstrtr Date: Fri, 3 Jul 2026 19:22:42 +0000 Subject: [PATCH 2/7] ci(build): gate windows setup-python to github-hosted forks VM217 self-hosted has Python 3.12 pre-provisioned; the ungated setup-python step re-extracted python via setup.ps1 and tripped a machine ExecutionPolicy SecurityError (PSSecurityException). Gate it to runner.environment == github-hosted, matching every Linux lane, so self-hosted uses the pre-provisioned toolchain. --- .github/workflows/build.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1fb7a8905..4c8e4a273 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -733,6 +733,7 @@ jobs: - uses: actions/checkout@v6 - uses: actions/setup-python@v6 + if: ${{ runner.environment == 'github-hosted' }} with: { python-version: '3.12' } - name: Install Conan 2 From 9be810ca7adf399ec2e220a976bc1e33b9d0b186 Mon Sep 17 00:00:00 2001 From: frstrtr Date: Fri, 3 Jul 2026 19:28:59 +0000 Subject: [PATCH 3/7] ci(build): windows Install Conan step -> PowerShell (VM217 has no bash on service PATH) The windows job self-hosted canary (run 28679621680, 9280bc15) passed the gated setup-python skip but failed the next step: Install Conan 2 ran shell:bash and VM217s runner-service account has no bash on PATH -> "bash: command not found". Conan 2 is provisioned on VM217 (probe run 28679257030). Convert the step to shell:powershell, which resolves on both the self-hosted lane and the fork-fallback windows-2022 lane. --- .github/workflows/build.yml | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4c8e4a273..0d838c713 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -737,13 +737,18 @@ jobs: with: { python-version: '3.12' } - name: Install Conan 2 - shell: bash - run: | - if [ "${{ runner.environment }}" = "github-hosted" ]; then + # VM217 self-hosted has no bash on the runner-service PATH (git.exe is + # present but Git-bash is not) -> shell:bash gave "bash: command not + # found". Conan 2 IS provisioned on VM217 (probe run 28679257030). + # PowerShell works on both lanes (VM217 has Windows PowerShell; the + # fork-fallback windows-2022 has it too). + shell: powershell + run: | + if ("${{ runner.environment }}" -eq "github-hosted") { pip install "conan>=2.0,<3.0" - else - conan --version # pre-provisioned at /usr/local/bin on self-hosted - fi + } else { + conan --version # pre-provisioned on VM217 self-hosted + } - name: Detect Conan profile run: | From 0f969648b09c0df20dd2e7ec430bd344f5e58090 Mon Sep 17 00:00:00 2001 From: frstrtr Date: Fri, 3 Jul 2026 19:35:08 +0000 Subject: [PATCH 4/7] ci(build): windows PowerShell steps -> ExecutionPolicy Bypass shell VM217 Windows PowerShell runs at ExecutionPolicy=Restricted; the runner cannot source its temp .ps1 command files (PSSecurityException / UnauthorizedAccess), which failed the Install Conan step on run 28679851820. Set a job-level defaults.run.shell to the Bypass form proven green by probe 28679257030, so all PowerShell steps (Install Conan, Detect Conan profile, Conan install, Build secp256k1, Verify binary) inherit it; the two cmd steps override locally. --- .github/workflows/build.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0d838c713..e876b5a7a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -729,6 +729,13 @@ jobs: # windows-2022 (ships cmake + MSVC/VS 2022 + SDK). Completes the #439 # self-hosted migration -- Windows was the last GitHub-hosted C++ lane. runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","Windows","X64","c2pool-build"]') || 'windows-2022' }} + defaults: + run: + # VM217 Windows PowerShell runs at ExecutionPolicy=Restricted, so the + # runner cannot source its temp .ps1 command files (PSSecurityException + # / UnauthorizedAccess). Bypass shell proven green by probe 28679257030. + # Applies to every PowerShell run step below; cmd steps override locally. + shell: powershell -ExecutionPolicy Bypass -Command ". '{0}'" steps: - uses: actions/checkout@v6 @@ -741,8 +748,8 @@ jobs: # present but Git-bash is not) -> shell:bash gave "bash: command not # found". Conan 2 IS provisioned on VM217 (probe run 28679257030). # PowerShell works on both lanes (VM217 has Windows PowerShell; the - # fork-fallback windows-2022 has it too). - shell: powershell + # fork-fallback windows-2022 has it too). Inherits the job-level + # ExecutionPolicy-Bypass shell (see defaults above). run: | if ("${{ runner.environment }}" -eq "github-hosted") { pip install "conan>=2.0,<3.0" From cded66f6cc8a1ec87b5b6cfd017154b8a4667806 Mon Sep 17 00:00:00 2001 From: frstrtr Date: Fri, 3 Jul 2026 19:39:00 +0000 Subject: [PATCH 5/7] ci(build): pip-install conan on windows self-hosted + export Scripts to GITHUB_PATH VM217 does not expose conan on the runner-service PATH; the pre-provisioned assumption caused CommandNotFoundException at Install Conan 2 (run 28680092936). Install unconditionally and prepend the pip Scripts dir(s) via GITHUB_PATH so this step and Detect profile / Conan install resolve the binary. --- .github/workflows/build.yml | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e876b5a7a..b5a9806f3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -746,16 +746,23 @@ jobs: - name: Install Conan 2 # VM217 self-hosted has no bash on the runner-service PATH (git.exe is # present but Git-bash is not) -> shell:bash gave "bash: command not - # found". Conan 2 IS provisioned on VM217 (probe run 28679257030). + # found". Conan 2 is pip-installed here (VM217 does not expose it on # PowerShell works on both lanes (VM217 has Windows PowerShell; the # fork-fallback windows-2022 has it too). Inherits the job-level # ExecutionPolicy-Bypass shell (see defaults above). run: | - if ("${{ runner.environment }}" -eq "github-hosted") { - pip install "conan>=2.0,<3.0" - } else { - conan --version # pre-provisioned on VM217 self-hosted - } + # VM217 runner-service PATH does NOT include conan: pip drops it in a + # Scripts dir that is not on PATH, so "conan --version" hit + # CommandNotFoundException even though Python 3.12 is present. Install + # unconditionally and export the pip Scripts dir(s) via GITHUB_PATH so + # this step and later steps (Detect profile / Conan install) resolve it. + pip install "conan>=2.0,<3.0" + $scripts = & python -c "import sysconfig; print(sysconfig.get_path(scripts))" + $userScripts = & python -c "import sysconfig; print(sysconfig.get_path(scripts,nt_user))" + $env:PATH = "$scripts;$userScripts;$env:PATH" + Add-Content -Path $env:GITHUB_PATH -Value $scripts + Add-Content -Path $env:GITHUB_PATH -Value $userScripts + conan --version - name: Detect Conan profile run: | From a53dd7f1c6c63d4dff3666b4c3d35fd4104be022 Mon Sep 17 00:00:00 2001 From: frstrtr Date: Fri, 3 Jul 2026 19:42:09 +0000 Subject: [PATCH 6/7] ci(build): use python -m pip for conan on VM217 (bare pip not on PATH) VM217 runner-service PATH exposes python (3.12) but not the bare pip launcher, so "pip install" hit CommandNotFoundException. Invoke pip via its module entrypoint, which resolves through the already-working python. --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b5a9806f3..c996f07ab 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -756,7 +756,7 @@ jobs: # CommandNotFoundException even though Python 3.12 is present. Install # unconditionally and export the pip Scripts dir(s) via GITHUB_PATH so # this step and later steps (Detect profile / Conan install) resolve it. - pip install "conan>=2.0,<3.0" + python -m pip install "conan>=2.0,<3.0" $scripts = & python -c "import sysconfig; print(sysconfig.get_path(scripts))" $userScripts = & python -c "import sysconfig; print(sysconfig.get_path(scripts,nt_user))" $env:PATH = "$scripts;$userScripts;$env:PATH" From 8c181baff5a36353d63b269c608802bc5769c622 Mon Sep 17 00:00:00 2001 From: frstrtr Date: Fri, 3 Jul 2026 19:47:41 +0000 Subject: [PATCH 7/7] ci(build): resolve Python via py launcher on VM217 windows lane VM217 runner-service PATH exposes neither conan nor a bare python (setup-python is gated off for self-hosted), so python -m pip hit CommandNotFoundException. Resolve an interpreter ourselves (py -> python3 -> python) with where.exe diagnostics on miss, and fix the unquoted sysconfig.get_path(scripts) NameError. --- .github/workflows/build.yml | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c996f07ab..d52e184cb 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -751,14 +751,26 @@ jobs: # fork-fallback windows-2022 has it too). Inherits the job-level # ExecutionPolicy-Bypass shell (see defaults above). run: | - # VM217 runner-service PATH does NOT include conan: pip drops it in a - # Scripts dir that is not on PATH, so "conan --version" hit - # CommandNotFoundException even though Python 3.12 is present. Install - # unconditionally and export the pip Scripts dir(s) via GITHUB_PATH so - # this step and later steps (Detect profile / Conan install) resolve it. - python -m pip install "conan>=2.0,<3.0" - $scripts = & python -c "import sysconfig; print(sysconfig.get_path(scripts))" - $userScripts = & python -c "import sysconfig; print(sysconfig.get_path(scripts,nt_user))" + # VM217 runner-service PATH exposes neither conan nor a bare python: + # setup-python is gated off for self-hosted, so resolve an interpreter + # ourselves. The Windows py launcher (C:\Windows, on PATH for all + # users) is the reliable entry point; fall back py -> python3 -> python + # and dump where.exe diagnostics if none resolve. Then pip-install conan + # and export its Scripts dir(s) via GITHUB_PATH for later steps. + $py = $null + foreach ($cand in @('py','python3','python')) { + if (Get-Command $cand -ErrorAction SilentlyContinue) { $py = $cand; break } + } + if (-not $py) { + Write-Host "No Python interpreter on PATH. Diagnostics:" + & where.exe python 2>&1; & where.exe py 2>&1; & where.exe python3 2>&1 + Write-Host "PATH=$env:PATH" + throw "VM217 has no Python interpreter on the runner-service PATH" + } + Write-Host "Using interpreter: $py" + & $py -m pip install "conan>=2.0,<3.0" + $scripts = & $py -c "import sysconfig; print(sysconfig.get_path('scripts'))" + $userScripts = & $py -c "import sysconfig; print(sysconfig.get_path('scripts','nt_user'))" $env:PATH = "$scripts;$userScripts;$env:PATH" Add-Content -Path $env:GITHUB_PATH -Value $scripts Add-Content -Path $env:GITHUB_PATH -Value $userScripts