ci(netns): network-namespace integration job for gvproxy proofs by norrietaylor · Pull Request #510 · gominimal/minimal

norrietaylor · 2026-06-21T05:16:23Z

Establishes the CI verification path for Unit 1 of the minimald networking epic, so the implementation tasks (#496/#497) can ship CI-provable proofs instead of handing off.

Why

#496 (U1-T2) handed off (needs-human) because:

its proof artifacts (UC1 no-net, UC6 PTask-to-PTask over the gvproxy switch) need a real network namespace + tap + live gvproxy — the execute agent sandbox denies unshare --net;
the only gvproxy CI job (ci-gvproxy.yml) just downloads + checksums the binary; it does not run integration tests;
so there was no executable proof path, and the agent (correctly) would not open an unverifiable PR.

Change

ci-netns.yml on ubuntu-latest (unprivileged userns + passwordless sudo — netns/tap need no KVM; the gvproxy switch is userspace):

fetches the pinned gvproxy via scripts/fetch-gvproxy.sh;
a fail-fast probe that the runner can create a netns;
runs cargo test -p minimald -p sandbox2 -p minimald-rpc -- --include-ignored with MINIMALD_NETNS_TEST=1 and GVPROXY_BIN exported.

Contract for the Unit 1 implementation (issue #496)

gate UC1/UC6 tests #[ignore] + on MINIMALD_NETNS_TEST;
read the gvproxy binary path from GVPROXY_BIN.

Until those tests land this job is a green no-op build of the affected crates. After they land, clearing needs-human on #496 lets the agent ship with a runnable proof path.

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Added a new CI workflow for network-namespace integration testing with gvproxy support. It runs on pull requests and pushes to main when relevant files change (or via manual dispatch), includes a preflight verification for namespace creation, and executes the gated netns-filtered integration test suite for the minimald, sandbox2, and minimald-rpc crates.

Unit 1's proof artifacts (UC1 no-net isolation, UC6 same-host PTask-to-PTask over the gvproxy switch) require a real network namespace + tap + a live gvproxy switch. The SDD execute agent cannot run them — its sandbox denies unprivileged netns — and the only gvproxy CI job just downloads the binary. So #496 (U1-T2) correctly handed off: there was no executable proof path. Add ci-netns.yml on ubuntu-latest (unprivileged userns + sudo, no KVM needed), which fetches the pinned gvproxy via scripts/fetch-gvproxy.sh and runs the crates' `#[ignore]` tests with --include-ignored under MINIMALD_NETNS_TEST=1. A startup probe fails fast if the runner can't create a netns. This establishes the verification contract so the agent's Unit 1 implementation becomes CI-provable: gate UC1/UC6 tests on MINIMALD_NETNS_TEST, read the gvproxy path from GVPROXY_BIN. Until those tests land it is a green no-op. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ss8WXtUUr9PBHuJcJMseBj

coderabbitai · 2026-06-21T05:16:35Z

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d3a9fcf1-51d2-480d-9db4-dce208ec5aaf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds .github/workflows/ci-netns.yml, a new GitHub Actions workflow that triggers on pull requests, pushes to main, and manual dispatch. It installs the Rust toolchain and protobuf compiler, fetches a pinned gvproxy binary, runs a preflight unprivileged network namespace capability check, then executes cargo test --include-ignored for minimald, sandbox2, and minimald-rpc with MINIMALD_NETNS_TEST=1 and GVPROXY_BIN set.

Changes

Network Namespace CI Workflow

Layer / File(s)	Summary
Full netns CI workflow `.github/workflows/ci-netns.yml`	Defines the complete `CI netns (gvproxy integration)` workflow: path-filtered triggers, cancel-in-progress concurrency, read-only permissions, job steps for toolchain/protoc/cache/gvproxy-fetch, a preflight `unshare`+`ip netns` capability probe, and a gated `cargo test --include-ignored --nocapture` run with `MINIMALD_NETNS_TEST=1` and `GVPROXY_BIN` across three crates.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

feat(minimald): gvproxy DM2 child lifecycle, OwnIp switch attachment via SCM_RIGHTS, and integration tests #496: This workflow directly enables the #[ignore]-gated network-namespace integration tests described in that issue by setting MINIMALD_NETNS_TEST=1 and running cargo test --include-ignored for the relevant crates.

Suggested reviewers

bryan-minimal

Poem

🐇 A workflow hops into the CI queue,
It fetches gvproxy and namespaces too,
With unshare it probes what the kernel can do,
Then cargo test --include-ignored runs through,
The netns proofs pass — hip hip, caribou! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding a CI job for network-namespace integration tests with gvproxy.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci-netns.yml:
- Around line 51-53: The repository has inconsistent application of the security
hardening measure persist-credentials: false across GitHub workflows. Currently,
ci-netns.yml, ci-macos.yml, and ci-linux-kvm.yml include this configuration in
their actions/checkout@v6 steps, but commitlint.yml, ci.yml, and ci-gvproxy.yml
do not. Add persist-credentials: false with the same structure to the
actions/checkout@v6 step in all three missing workflows (commitlint.yml, ci.yml,
and ci-gvproxy.yml) to ensure consistent security hardening across the entire
repository, or alternatively document explicit justification in the workflows
that require different configurations.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ffaebf7b-b85b-4173-bf96-33e99bf01fb0

📥 Commits

Reviewing files that changed from the base of the PR and between 4bdbdc0 and 5f85ff5.

📒 Files selected for processing (1)

.github/workflows/ci-netns.yml

norrietaylor · 2026-06-21T05:40:46Z

@coderabbitai review

coderabbitai · 2026-06-21T05:40:52Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

The job ran the full minimald suite via --include-ignored, which failed on an existing test needing socat (not installed here; ci.yml covers the broad suite). Filter the run to tests whose path contains 'netns' so only the Unit 1 proofs execute — a green no-op until they land. Documents the naming contract.

norrietaylor · 2026-06-21T06:02:45Z

@coderabbitai review

coderabbitai · 2026-06-21T06:02:51Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

bryan-minimal

LGTM

coderabbitai Bot reviewed Jun 21, 2026

View reviewed changes

Comment thread .github/workflows/ci-netns.yml

norrietaylor mentioned this pull request Jun 21, 2026

feat(minimald): gvproxy DM2 child lifecycle, OwnIp switch attachment via SCM_RIGHTS, and integration tests #496

Closed

norrietaylor enabled auto-merge (squash) June 21, 2026 22:18

bryan-minimal approved these changes Jun 22, 2026

View reviewed changes

norrietaylor merged commit 83c5013 into main Jun 22, 2026
29 checks passed

norrietaylor deleted the ci/netns-gvproxy-integration branch June 22, 2026 02:21

gominimal-aw-bot Bot mentioned this pull request Jun 22, 2026

feat(minimald,sandbox2): gvproxy switch lifecycle, OwnIp tap relay, and netns proofs #525

Merged

This was referenced Jul 10, 2026

ci: add the Linux-native lane, retire the mothballed netns lane #697

Merged

ci,test: auto-discover integration harnesses by name convention across every lane #732

Merged

Navigation Menu

Uh oh!

ci(netns): network-namespace integration job for gvproxy proofs - #510

ci(netns): network-namespace integration job for gvproxy proofs#510
norrietaylor merged 2 commits into
mainfrom
ci/netns-gvproxy-integration

norrietaylor commented Jun 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 21, 2026 •

edited

Loading

Review skipped

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Suggested reviewers

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

norrietaylor commented Jun 21, 2026

Uh oh!

coderabbitai Bot commented Jun 21, 2026 •

edited

Loading

Uh oh!

norrietaylor commented Jun 21, 2026

Uh oh!

coderabbitai Bot commented Jun 21, 2026 •

edited

Loading

Uh oh!

bryan-minimal left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

norrietaylor commented Jun 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

Change

Contract for the Unit 1 implementation (issue #496)

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Suggested reviewers

Poem

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

norrietaylor commented Jun 21, 2026

Uh oh!

coderabbitai Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

norrietaylor commented Jun 21, 2026

Uh oh!

coderabbitai Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bryan-minimal left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

norrietaylor commented Jun 21, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 21, 2026 •

edited

Loading

coderabbitai Bot commented Jun 21, 2026 •

edited

Loading

coderabbitai Bot commented Jun 21, 2026 •

edited

Loading