claudeandClaude Opus 5.5
ca0ee132d9
The release guard in 17d87b0 was safe but not live. Gitea 1.27.2 calls
CancelPreviousJobsByJobConcurrency whenever a job's `needs` resolve
(services/actions/clear_tasks.go:91, models/actions/run_job.go:641), so
a job's place in the `release-tag-v1` group followed when its own
selftest finished, not merge order. A newer merge C2 finishing selftest
first queued behind the older C1, C1 cancelled it, saw tip = C2, and
deferred: nobody pushed, and if merges then stopped v1 stayed stale
indefinitely behind a Skipped and a Cancelled job. The "always catches
up once merges pause" claim in ci.yaml and README was false.
What now holds:
- release-sweep.yaml runs on `schedule` every 15 minutes, in its own
workflow and concurrency group, so nothing in ci.yaml can cancel it.
When v1 already covers main's tip it stops after a checkout and one
merge-base. Otherwise it checks out the tip, runs the same shellcheck
and selftest.sh as ci.yaml's selftest job, and tags the tip only if
they pass; a failing main therefore turns the sweep red on every tick
while v1 lags, which is #27's AC1 loud-failure half. It reads the tip
itself because a scheduled run's github.sha is the CommitSHA recorded
when the schedule was registered on the last push to main
(services/actions/notifier_helper.go:569-580,
services/actions/schedule_tasks.go:126-141), and ref is the default
branch: schedules are registered only from it
(notifier_helper.go:120, :531, :603-604). event_name is "schedule"
(context.go:71 reads TriggerEvent, set at schedule_tasks.go:136).
Cron is 5-field robfig in UTC (models/actions/schedule_spec.go:38-41).
- 15 minutes, not 10: the sweep is the fallback, not the release path,
and every tick is a run on gitdan-ci's shared slots and a row in the
Actions list. 96 no-op runs a day of a few seconds each is the cost;
the lag bound it buys is one interval plus one selftest run.
- Both writers go through scripts/release-v1.sh and push with
--force-with-lease=refs/tags/v1:<v1 as read>, so v1 cannot move
backwards when the sweep and a merge job race. A lost lease re-reads
v1: at or ahead of this run's gated commit is a clean skip (the other
writer released something at least as new); still behind it is a
retry leased on the new value, up to three attempts, since the other
writer may have tagged an older commit and giving up there would leave
v1 short of a commit this run did gate; anything else goes red. A
rejection with v1 unmoved is diagnosed as a non-lease failure and goes
red at once.
- release-tag loses its job-level concurrency group. The lease already
gives the ordering the group was there for, and the group was what
cancelled the one job that could have released the newest merge.
Without it each merge's job runs, and the one whose commit is still
the tip when it checks releases it.
The shell moves out of ci.yaml into scripts/release-v1.sh so shellcheck
and selftest.sh cover it. release-v1-selftest.sh runs it against a
scratch bare origin: sweep no-op at and ahead of the tip, tag on a
green gate, no tag and a failing sweep on a red one, the stranded trace
above followed by a catching-up sweep, and each lost-lease outcome, with
a control showing an unleased push does step v1 back. Red-proved by
seven mutations of release-v1.sh, each failing a named assertion: plain
--force, accepting any lost lease, a merge job that never defers,
ancestry reduced to equality, no non-lease diagnosis, a sweep that never
needs to run, and a retry that does not re-lease.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UkSjXXtU6JYcN2vPntWhfb
138 lines
6.6 KiB
YAML
138 lines
6.6 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
# Spelled out only to keep `edited` in the list — naming any type replaces
|
|
# the whole default set, so the other three have to be restated.
|
|
#
|
|
# `edited`, not `ready_for_review`: draft here is the `WIP:` title prefix,
|
|
# so un-drafting is a title edit and no ready-for-review action is ever
|
|
# raised. That edit is what creates the run which lifts the `if:` skip
|
|
# below (decided once, when a run is CREATED). Do not swap it back and do
|
|
# not drop this to the bare default — either restores the bug. The accepted
|
|
# cost and the evidence are in README's Development section.
|
|
types: [opened, synchronize, reopened, edited]
|
|
|
|
# gitdan-ci runs four repos' CI on two capacity slots, and the compiler-backed
|
|
# suites below are multi-minute. A superseded run costs a slot in front of
|
|
# somebody's build, so drop it.
|
|
#
|
|
# `push` groups on `github.sha` rather than `github.ref`: a constant per-branch
|
|
# group is what let this Gitea cancel two of daniel/gitdan's merge runs
|
|
# outright while `cancel-in-progress` was gated away from `push` entirely —
|
|
# see the long note in that repo's ci.yaml. Observed on 1.26.0; the instance
|
|
# is 1.27.2 now and whether it persists is unverified, which is why every
|
|
# commit gets its own group instead of trusting the flag.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
selftest:
|
|
name: shellcheck + selftests
|
|
# Two clauses, both load-bearing. The second skips draft PRs: Gitea sets
|
|
# draft:true when the title starts with `WIP:`, so work-in-progress pushes
|
|
# cost the shared runner nothing until the PR is un-WIP'd. The first is
|
|
# what keeps that from also skipping pushes to `main` — a `push` event has
|
|
# no `pull_request` context, so `github.event.pull_request.draft` is empty
|
|
# there and the negation alone would be unreliable. Never drop it.
|
|
if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
# Deliberately no `container.volumes:` entry, unlike every repo that
|
|
# CONSUMES this action. The suites below build throwaway workspaces under
|
|
# `mktemp -d` and want a cold target dir every time — a persistent cache
|
|
# would make "did this run rebuild?" unanswerable, which is the question
|
|
# restore-mtimes-selftest.sh exists to ask. So this job takes no share of
|
|
# the shared CI cache disk budget.
|
|
steps:
|
|
- name: Checkout sources
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install shellcheck
|
|
uses: taiki-e/install-action@v2
|
|
with:
|
|
tool: shellcheck
|
|
|
|
# `hardlink-clone-selftest.sh` and `restore-mtimes-selftest.sh` drive a
|
|
# real Cargo against a real scratch workspace — they are the only things
|
|
# here that verify the hardlink-aliasing and mtime-freshness behaviour
|
|
# against the compiler rather than against a fixture, and selftest.sh's
|
|
# own header says `--fast` is for iterating, not for signing off a
|
|
# change. So CI installs a toolchain and runs the full set.
|
|
#
|
|
# The scratch workspaces use path dependencies only, so nothing here
|
|
# reaches crates.io.
|
|
# Nightly first, stable second, so stable ends up the default and
|
|
# nightly is only reachable through an explicit `+nightly`.
|
|
#
|
|
# `hardlink-clone-selftest.sh`'s last scenario needs a Cargo that
|
|
# resolves freshness by CONTENT — the mode where the dep-info file
|
|
# carries per-source checksums, which is the mutation that turns a
|
|
# hardlink clone into silent stale-artifact reuse rather than a slow
|
|
# build. This step is what supplies it, and as of 2026-08-26 it does:
|
|
# the scenario ran and passed against 1.100.0-nightly.
|
|
#
|
|
# It briefly did not. Cargo PR #17382 (2026-08-22) demoted
|
|
# `-Z checksum-freshness` to a gate and gave `build.fingerprint` the
|
|
# choice, defaulting to `mtime`, so the suite — which set only the gate —
|
|
# measured a genuine INACTIVE and skipped its strongest scenario. That
|
|
# read as "upstream withdrew content freshness" and was written up here
|
|
# as this step buying nothing. It was a moved switch, not a withdrawal;
|
|
# the suite now exports both and the coverage is back. See
|
|
# daniel/gitdan#62 for the investigation.
|
|
- name: Install Rust nightly
|
|
uses: dtolnay/rust-toolchain@nightly
|
|
- name: Install Rust toolchain
|
|
uses: dtolnay/rust-toolchain@stable
|
|
|
|
# Every script, including the suites themselves. `-x` follows the
|
|
# `. cache-lib.sh` each one sources, which is where most of the logic
|
|
# being checked actually lives; without it shellcheck reports SC1091 and
|
|
# analyses each file with a hole in it.
|
|
- name: shellcheck
|
|
run: shellcheck -x --source-path=scripts scripts/*.sh
|
|
|
|
# One command, not six: selftest.sh is the entry point a developer runs,
|
|
# so a suite added there is gated here without a matching edit in this
|
|
# file.
|
|
- name: Selftests
|
|
run: bash scripts/selftest.sh
|
|
|
|
release-tag:
|
|
name: move v1 to main
|
|
# `needs: selftest` is what makes this "after the gate is green": a failed
|
|
# selftest skips this job, so v1 never advances onto a broken build. The
|
|
# `if:` restricts it to an actual push to main.
|
|
#
|
|
# No job-level `concurrency:`. The lease in release-v1.sh already keeps v1
|
|
# from moving backwards, and a group here only cancelled queued jobs in
|
|
# whatever order their selftests finished -- which could leave no job to
|
|
# release the newest merge. Anything this job defers or misses,
|
|
# release-sweep.yaml picks up.
|
|
needs: selftest
|
|
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 2
|
|
# Requests write access from the run's built-in token (see README's
|
|
# Versioning section for what's actually verified about it). Without
|
|
# this the checkout below still succeeds -- it's the push that would be
|
|
# rejected, which is a red job, not a silent no-op.
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
# Full history, so the ancestry checks in release-v1.sh can see how
|
|
# this commit relates to v1.
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
fetch-depth: 0
|
|
|
|
# Releases this run's own commit only while it is still main's tip, and
|
|
# only forward -- see release-v1.sh.
|
|
- name: Move v1 to this commit if it is still main's tip
|
|
run: bash scripts/release-v1.sh merge "${{ github.sha }}"
|