Verify C++ binaries run with right stdlib

[nikobockerman]

No description provided.

[Copilot]

Pull request overview

Adds a CI/runtime guard to ensure C++ artifacts produced by the solver build actually load the intended C++ standard library at runtime (not just link against it), preventing silent fallback to system-provided libstdc++/libc++.

Changes:

• Introduces a new mise task (cpp:verify-runtime-stdlib) that scans a CMake build directory and verifies resolved runtime library paths via ldd (Linux) / otool (macOS).
• Integrates the verification into the C++ GitHub Actions workflow, selecting the expected runtime prefix based on the matrix (libstdc++ vs libc++, hardened vs non-hardened).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
mise-tasks/cpp/verify-runtime-stdlib.py	New verifier script that inspects built binaries and asserts libstdc++/libc++ loads from an expected prefix.
.github/workflows/cpp-build-test-run.yaml	Adds a workflow step to run the verifier with an expected prefix derived from the build matrix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

mise-tasks/cpp/verify-runtime-stdlib.py:139

• On macOS, _resolve_install_name treats @loader_path/@executable_path expansions as resolvable only if the expanded string starts with /. If the scanned binary path is relative (e.g. when <build_dir> is passed as a relative path), the expansion becomes a relative path and will be incorrectly reported as <not-found> even when the file exists.

    expanded = _expand_at_path(name, str(binary.parent), is_dylib=is_dylib)
    if expanded.startswith("/"):  # @loader_path, or @executable_path for an executable
        return expanded if Path(expanded).exists() else _NOT_FOUND
    return _NOT_FOUND  # e.g. @executable_path in a dylib: not statically resolvable

mise-tasks/cpp/verify-runtime-stdlib.py:215

• rstrip("/") can turn an intended root prefix ("/") into the empty string, which then makes _under_prefix compare against the current working directory instead of /. This is a surprising edge case for callers that may want to allow system libraries by passing /.

    expected_prefix = os.environ["usage_expected_prefix"].rstrip("/")  # noqa: SIM112

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.