Skip to content

Degrade instead of failing when no token is available #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
n1ckyb merged 1 commit into from
Aug 9, 2026
+21 −0
Merged

Degrade instead of failing when no token is available #25

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,11 @@ jobs:
env:
CARGO_PROFILE_DEV_DEBUG: "false"
MATURIN_PEP517_ARGS: "--profile dev"
# Empty on Dependabot PRs and fork PRs, which receive NO repository secrets.
# Evaluated here because `secrets.*` cannot be referenced from a step-level `if:`.
# Every open Dependabot PR in this repo was red purely because provisioning
# hard-failed without it - nothing to do with the bumps they proposed.
HAS_SPLIT_TOKEN: ${{ secrets.SPLIT_REPO_TOKEN != '' }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
Expand Down Expand Up @@ -64,6 +69,7 @@ jobs:
# resolves to 'unknown' and the suite cannot run. Fail-closed: a missing or
# unverified component stops the job here rather than an hour later as mass
# PluginNotFoundError failures.
if: env.HAS_SPLIT_TOKEN == 'true'

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Provision the engine before the tokenless install

On every fork or Dependabot run without this secret, this condition skips the only step that creates build/intentumdiff-core, but the following pip install -e .[dev,serve] still invokes maturin with manifest-path = "build/intentumdiff-core/crates/rust-core-host/Cargo.toml". That directory is not tracked, so the editable install fails on the missing manifest and the newly added reduced pytest step is never reached; the no-token jobs therefore remain red rather than degrading. Separate token-independent engine staging from parser-artifact provisioning, or install a usable prebuilt backend for the reduced suite.

AGENTS.md reference: AGENTS.md:L9-L9

Useful? React with 👍 / 👎.

run: |
pip install "pyyaml>=6.0"
python scripts/provision_build_inputs.py --from-parser-artifacts
Expand All @@ -80,4 +86,19 @@ jobs:
pip install -e .[dev,serve]

- name: Run the full unit suite
if: env.HAS_SPLIT_TOKEN == 'true'
run: python -m pytest tests/unit -q

- name: Run the reduced suite (no token - components unavailable)
# Dependabot and fork PRs get no secrets, so parser components cannot be
# provisioned and every component-dependent test would fail for a reason the author
# cannot fix. Run what CAN run, and SAY what was skipped - a quiet reduced gate is
# indistinguishable from a full one, and someone will eventually merge believing the
# whole suite ran.
#
# The full gate still runs on every maintainer branch PR and on the base branch, so
# nothing merges without it having passed somewhere.
if: env.HAS_SPLIT_TOKEN != 'true'
run: |
echo "::notice::SPLIT_REPO_TOKEN unavailable (Dependabot or fork PR) - parser components were not provisioned, so component-dependent tests are skipped. A maintainer run exercises the full gate."
python -m pytest tests/unit -q --deselect tests/unit/test_construct_edit_matrix.py
Loading