Add CI validation helpers with explicit signature selection and owned results

tests/run-ci-validation-tests.py

@@ -0,0 +1,27 @@
+"""Compile the actual production CI wrapper body against deterministic CI doubles."""
+from pathlib import Path
+import subprocess
+import tempfile
+
+root = Path(__file__).resolve().parents[1]
+header = (root / 'include/Domito.h').read_text(encoding='utf-8-sig')
+start = header.index('#if (NTDDI_VERSION >= NTDDI_WIN10)\n// Native forwards')
+end = header.index('#define DOMITO_CI_SOURCE_EMBEDDED', start)
+constants_header = (root / 'include/Domito.MinCrypt.h').read_text(encoding='utf-8-sig')
+constants = '\n'.join(line for line in constants_header.splitlines()
+                      if line.startswith(('#define DOMITO_CI_VALIDATE_FLAG_', '#define MINCRYPT_MAX_HASH_LENGTH', '#define MINCRYPT_SHA')))
+source = (root / 'src/Domito.CodeIntegrity.Validation.cpp').read_text(encoding='utf-8-sig')
+source = source.replace('#include "Domito.Internal.h"', '')
+with tempfile.TemporaryDirectory(prefix='domito-ci-validation-') as temporary:
+    directory = Path(temporary)
+    (directory / 'ci-validation-api.inc').write_text(constants + '\n' + header[start:end], encoding='utf-8')
+    (directory / 'ci-validation-under-test.inc').write_text(source, encoding='utf-8')
+    for branch in ['x64', 'other']:
+        program = directory / (branch + '.exe')
+        flags = ['/DDOMITO_TEST_OTHER_ARCH'] if branch == 'other' else []
+        subprocess.run(['cl','/nologo','/EHsc','/W4','/WX','/std:c++17',
+                        '/DNTDDI_VERSION=0x0A000008','/DNTDDI_WIN10=0x0A000000',
+                        '/I' + str(directory), *flags, str(Path(__file__).with_name('ci-validation-tests.cpp')),
+                        '/Fe' + str(program), '/Fo' + str(directory / (branch + '.obj'))],
+                       cwd=directory, check=True)
+        subprocess.run([str(program)], check=True)