CI audit: concurrency, coverage gating, release cache + cron scoping - #177
Merged
Conversation
- ci.yml: add concurrency with cancel-in-progress on PRs (was absent, so superseded pushes ran to completion on the contended ci-pool-rust pool) - coverage: restrict to push/schedule/dispatch. On PRs it re-ran the entire suite under instrumentation to produce a --summary-only report nothing reads - docs-contract: skip when rust==true (Tests already runs docs_tests:: via nextest); it now covers only the docs/release/skills/docker/workflow lanes - new toolchain-free `identity` job runs check-public-identity.sh once, gated on the union of paths that script scans (previously it ran twice, and moving it under version-sync alone would have missed docs-only and config-only PRs) - changed_paths: the weekly cron enabled every lane, so a RUSTSEC advisory check rebuilt all of CI. schedule now enables only the security lane; workflow_dispatch keeps full fan-out - release.yml: add concurrency; route the hosted Linux build at the public kache S3 endpoint (the composite pointed at a LAN-only address, so every release built cold); drop the dead CARGO_BUILD_RUSTC_WRAPPER override - setup-rust-kache: stop apt-installing the Tauri/GTK/WebKit stack; cortex links none of it, and hosted runners paid a full WebKitGTK install per release - pin cargo-deny-action, upload/download-artifact and action-gh-release to SHAs - add timeout-minutes to every ci.yml job (default was 360m on a shared pool)
jmagar
enabled auto-merge (squash)
August 5, 2026 15:31
This was referenced Aug 5, 2026
jmagar
added a commit
that referenced
this pull request
Aug 7, 2026
This repository is public. Three internal identifiers were committed under .github/: * action.yml:34 default: "https://s3.tootie.tv" (PR #177) * action.yml:228 endpoint = "http://10.1.0.2:9000" (PR #159) * action.yml:233 "... via Tootie MinIO" (PR #159) * actionlint.yaml self-hosted-runner labels tootie/dookie The s3-endpoint default was never reachable. The endpoint is only consumed inside the `KACHE_S3_ACCESS_KEY && KACHE_S3_SECRET_KEY` branch, and the only caller that supplies those keys (release.yml) also passes `s3-endpoint: ${{ vars.KACHE_S3_ENDPOINT }}`. The org variable holds the real value, so nothing changes. The hardcoded 10.1.0.2 block is dead: it needs a runner with no existing ~/.config/kache/config.toml AND a ~/.aws/credentials [kache] profile. Every self-hosted job logs "existing kache config present - leaving it alone", so the branch never runs. Scrubbed to the RFC 5737 documentation address and the placeholder name already used on soma main. actionlint's tootie/dookie labels are stale: no workflow uses them; every self-hosted job routes through a ci-pool-* label.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fleet CI audit follow-up for cortex. Measured motivation: cortex CI averaged 116 min wall-clock over the last 100 runs, with jobs queueing up to 97 min behind a 4-runner
ci-pool-rustpool while running for under 2 min.Changes
ci.ymlhad noconcurrency:block at all — every follow-up push left the prior run's jobs occupying the contended Rust pool. Adopts the idiom already used byrepository-contract.yml.coverageoff PRs. It performed a full instrumented rebuild plus a second full run of the suitetesthad just run, emitting--summary-onlyoutput that is not uploaded, thresholded, or commented. Now push/schedule/dispatch only.docs-contractno longer duplicatestest. Whenrust == true, nextest already executesdocs_tests::.check-public-identity.shran twice per PR (version-sync+docs-contract). It now runs once in a new toolchain-freeidentityjob whose gate is the exact union of the paths the script scans — deliberately not folded intoversion-sync, whose gate would have missed docs-only and config-only PRs.classify()returned every lane true forschedule, so the cron documented as a cargo-deny advisory check rebuilt all of CI.setup-rust-kachetargeted a LAN-only endpoint unreachable from GitHub-hosted runners, silently degrading to LOCAL-ONLY on an ephemeral VM — a cold--releasebuild every tag. Now uses the public kache S3 endpoint via the existing org secrets/vars.timeout-minuteseverywhere (default 360m).Known pre-existing gap (not introduced here)
check-public-identity.shscansplugins/*, but no classifier output coversplugins/syslog/**, so a PR touching only that path skips the check. The newidentitygate is coverage-identical to the previousdocs-contractgate, so this is unchanged by this PR — worth a separate fix.