| name | cws-btfhub-sync |
| description | Sync CWS BTFHub constants after adding a new constantfetch offset, so pre-BTF kernels can resolve it. Use when KMT secagent jobs log "failed to fetch constant for <name>". |
| allowed-tools | Read, Grep, Bash, AskUserQuestion |
| model | sonnet |
Syncing CWS BTFHub constants
A new appendOffsetofRequest in probe_ebpf.go resolves via BTF on modern kernels, but
pre-BTF kernels read the offset from the checked-in, arch-split constants:
pkg/security/probe/constantfetch/constants_amd64.jsonpkg/security/probe/constantfetch/constants_arm64.json
These predate your change and so lack the new entry. Regenerating them is the fix.
Run it
gh workflow run cws-btfhub-sync.yml --ref main -f base_branch=<your-feature-branch>
The trap: --ref selects the workflow definition — keep it main. base_branch is the
ref the generate and combine jobs check out, and the base of the PR it opens. Leave
base_branch at its main default and the generator never sees your new offset requests: the
sync yields an empty diff and it looks like btfhub simply lacks the offsets.
Before running, confirm the failing distros are covered by the cone matrix in
.github/workflows/cws-btfhub-sync.yml.
Wait for it
It is a ~15-job matrix and takes tens of minutes. Poll it from a background shell so the
wait costs nothing and you get re-invoked on exit:
until [ "$(gh run view <run-id> --json status -q .status)" = completed ]; do sleep 60; done
gh run view <run-id> --json conclusion -q .conclusion
Do not run gh run watch in the foreground (it outlives the tool timeout) and do not chain
short sleeps in the main loop. When the notification arrives, carry straight on to Land it
in the same turn — this is one task, not a hand-off.
Land it
On success the workflow opens a PR titled CWS: sync BTFHub constants from a
cws/constants-sync-* branch, targeting your branch:
gh pr list --search "CWS: sync BTFHub constants" --state open --json number,baseRefName,url
From the list, select the that has the baseRefName equal to this feature branch and
merge it directly (gh pr merge <number> --merge); feature branches carry no protection rule,
so this needs no approval.
Confirm the merged commit touches btfhub/constants.json and that your new offset names appear
in the diff.
