Refactor integration suite and CI

.devcontainer/devcontainer.json

@@ -4,12 +4,6 @@
 		"dockerfile": "Containerfile",
 		"options": ["--compress"]
 	},
-	"capAdd": [
-		"SYS_PTRACE"
-	],
-	"securityOpt": [
-		"seccomp=unconfined"
-	],
 	"features": {},
 	"customizations": {
 		"vscode": {

.github/actions/setup-zig/action.yml

@@ -5,9 +5,10 @@ description: Install the Zig version specified in build.zig.zon
 runs:
   using: composite
   steps:
-    - shell: bash
+    - name: Install minisign
+      shell: bash
       run: |
-        version=$(grep 'minimum_zig_version' build.zig.zon | sed 's/.*"\(.*\)".*/\1/')
+        set -euo pipefail
 
         case "$RUNNER_OS" in
           Linux) os=linux ;;
@@ -21,12 +22,79 @@ runs:
           *) echo "Unsupported arch: $RUNNER_ARCH" >&2; exit 1 ;;
         esac
 
-        url="https://ziglang.org/download/${version}/zig-${arch}-${os}-${version}.tar.xz"
+        # Linux release is a tar.gz with minisign-linux/{x86_64,aarch64}/minisign.
+        # macOS release is a zip with a universal binary at the root.
+        minisign_ver="0.12"
+        minisign_base="https://github.com/jedisct1/minisign/releases/download/${minisign_ver}"
+        dest="${RUNNER_TOOL_CACHE:-$HOME/.cache}/minisign"
+        mkdir -p "$dest"
+
+        case "$os" in
+          linux)
+            tmpdir=$(mktemp -d)
+            curl -sSfL "${minisign_base}/minisign-${minisign_ver}-linux.tar.gz" \
+              | tar -xz -C "$tmpdir"
+            cp "${tmpdir}/minisign-linux/${arch}/minisign" "${dest}/minisign"
+            rm -rf "$tmpdir"
+            ;;
+          macos)
+            tmpdir=$(mktemp -d)
+            curl -sSfL -o "${tmpdir}/minisign-macos.zip" \
+              "${minisign_base}/minisign-${minisign_ver}-macos.zip"
+            python3 -c "
+        import zipfile
+        zipfile.ZipFile('${tmpdir}/minisign-macos.zip').extract('minisign', '${dest}')
+        "
+            rm -rf "$tmpdir"
+            ;;
+        esac
+        chmod +x "${dest}/minisign"
+
+        echo "${dest}" >> "$GITHUB_PATH"
+
+    - name: Install Zig
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        ZIG_MINISIGN_PUBKEY="RWSGOq2NVecA2UPNdBUZykf1CCb147pkmdtYxgb3Ti+JO/wCYvhbAb/U"
+
+        # build.zig.zon may come from an untrusted PR checkout; only accept a plain semver triple.
+        version=$(grep -m1 'minimum_zig_version' build.zig.zon | sed 's/.*"\(.*\)".*/\1/')
+        if [[ -z "${version}" ]] || [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          echo "::error::minimum_zig_version must be a semver triple (e.g. 0.15.2)" >&2
+          exit 1
+        fi
+
+        case "$RUNNER_OS" in
+          Linux) os=linux ;;
+          macOS) os=macos ;;
+          *) echo "Unsupported OS: $RUNNER_OS" >&2; exit 1 ;;
+        esac
+
+        case "$RUNNER_ARCH" in
+          X64)   arch=x86_64  ;;
+          ARM64) arch=aarch64 ;;
+          *) echo "Unsupported arch: $RUNNER_ARCH" >&2; exit 1 ;;
+        esac
+
+        tarball="zig-${arch}-${os}-${version}.tar.xz"
+        url="https://ziglang.org/download/${version}/${tarball}"
         echo "Installing Zig ${version} from ${url}"
 
         install_dir="${RUNNER_TOOL_CACHE:-$HOME/.cache}/zig"
         mkdir -p "$install_dir"
-        curl -sSfL "$url" | tar -xJ -C "$install_dir"
+
+        tmpdir=$(mktemp -d)
+        trap 'rm -rf "$tmpdir"' EXIT
+
+        curl -sSfL -o "${tmpdir}/${tarball}" "$url"
+        curl -sSfL -o "${tmpdir}/${tarball}.minisig" "${url}.minisig"
+
+        echo "Verifying minisign signature..."
+        minisign -Vm "${tmpdir}/${tarball}" -P "$ZIG_MINISIGN_PUBKEY"
+
+        tar -xJ -C "$install_dir" -f "${tmpdir}/${tarball}"
 
         # Tarball top-level dir is zig-<arch>-<os>-<version>
         zig_dir="${install_dir}/zig-${arch}-${os}-${version}"

.github/workflows/ci.yml

@@ -15,12 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: main
-          sparse-checkout: .github/actions
-          path: _actions
-      - uses: ./_actions/.github/actions/setup-zig
+      - uses: Ledger-Donjon/absolution/.github/actions/setup-zig@main
       - run: zig build test
 
   integration-test:
@@ -32,12 +27,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: main
-          sparse-checkout: .github/actions
-          path: _actions
-      - uses: ./_actions/.github/actions/setup-zig
+      - uses: Ledger-Donjon/absolution/.github/actions/setup-zig@main
       - run: zig build -Doptimize=${{ matrix.optimize }}
-      - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0
-      - run: uv run scripts/integration.py
+      - run: zig run scripts/integration.zig  

.github/workflows/release.yml

@@ -26,12 +26,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.release_tag }}
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: main
-          sparse-checkout: .github/actions
-          path: _actions
-      - uses: ./_actions/.github/actions/setup-zig
+      - uses: Ledger-Donjon/absolution/.github/actions/setup-zig@main
       - run: zig build -Doptimize=${{ matrix.optimize }} -Dstrip=true
       - name: Upload tarball
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7.0.0

CONTRIBUTING.md

@@ -24,7 +24,7 @@ absolution/
 │       ├── <file>.c.in       # Optional input invariant
 │       └── <file>.c.zon      # Golden output
 ├── scripts/
-│   ├── integration.py        # pytest-based integration test runner
+│   ├── integration.zig       # Integration test runner (zig run scripts/integration.zig)
 │   └── gen-golden.sh         # Golden file generator
 └── build.zig                 # Build configuration
 ```
@@ -96,9 +96,10 @@ zig build run -- --help      # Build and run with args
 ### Testing
 
 ```bash
-zig build test               # Unit tests (in-source)
-zig build test --summary all # Verbose unit test output
-uv run scripts/integration.py  # Integration tests (pytest)
+zig build test                          # Unit tests (in-source)
+zig build test --summary all            # Verbose unit test output
+zig run scripts/integration.zig         # Integration tests
+zig run scripts/integration.zig -- foo  # Run only tests matching "foo"
 ```
 
 ### Adding a new test case
@@ -126,7 +127,7 @@ uv run scripts/integration.py  # Integration tests (pytest)
 
 5. Run to verify:
    ```bash
-   uv run scripts/integration.py
+   zig run scripts/integration.zig
    ```
 
 ## Architecture Notes

README.md

@@ -73,8 +73,9 @@ working example with multiple translation units.
 ## Testing
 
 ```bash
-zig build test                # Run unit tests
-uv run scripts/integration.py # Integration tests (pytest)
+zig build test                          # Run unit tests
+zig run scripts/integration.zig         # Integration tests
+zig run scripts/integration.zig -- foo  # Run only tests matching "foo"
 ```
 
 ## Documentation