Syncing CWS BTFHub constants

A new appendOffsetofRequest in probe_ebpf.go resolves via BTF on modern kernels, but pre-BTF kernels read the offset from the checked-in, arch-split constants:

• pkg/security/probe/constantfetch/constants_amd64.json
• pkg/security/probe/constantfetch/constants_arm64.json

These predate your change and so lack the new entry. Regenerating them is the fix.

Run it

gh workflow run cws-btfhub-sync.yml --ref main -f base_branch=<your-feature-branch>

The trap: --ref selects the workflow definition — keep it main. base_branch is the ref the generate and combine jobs check out, and the base of the PR it opens. Leave base_branch at its main default and the generator never sees your new offset requests: the sync yields an empty diff and it looks like btfhub simply lacks the offsets.

Before running, confirm the failing distros are covered by the cone matrix in .github/workflows/cws-btfhub-sync.yml.

Wait for it

It is a ~15-job matrix and takes tens of minutes. Poll it from a background shell so the wait costs nothing and you get re-invoked on exit:

until [ "$(gh run view <run-id> --json status -q .status)" = completed ]; do sleep 60; done
gh run view <run-id> --json conclusion -q .conclusion

Do not run gh run watch in the foreground (it outlives the tool timeout) and do not chain short sleeps in the main loop. When the notification arrives, carry straight on to Land it in the same turn — this is one task, not a hand-off.

Land it

On success the workflow opens a PR titled CWS: sync BTFHub constants from a cws/constants-sync-* branch, targeting your branch:

gh pr list --search "CWS: sync BTFHub constants" --state open --json number,baseRefName,url

From the list, select the that has the baseRefName equal to this feature branch and merge it directly (gh pr merge <number> --merge); feature branches carry no protection rule, so this needs no approval.

Confirm the merged commit touches btfhub/constants.json and that your new offset names appear in the diff.