CI audit: delete zero-signal MSRV, cache container smoke, scope fan-out - #329
Open
jmagar wants to merge 11 commits into
Open
CI audit: delete zero-signal MSRV, cache container smoke, scope fan-out#329jmagar wants to merge 11 commits into
jmagar wants to merge 11 commits into
Conversation
msrv.yml pinned 1.97.1 — identical to rust-toolchain.toml, Cargo.toml rust-version, and the toolchain ci.yml already builds with. It re-ran a full `cargo check --all-targets` plus `cargo test --no-run --all-targets` on every push and PR for no differential signal. Deleted, along with its duplicate changed-paths job. "MSRV Gate" has been removed from branch protection. - container-smoke: build via buildx with a GHA layer cache and gate PRs on a new narrow `docker_build` flag (image inputs only). It previously ran an uncached full Rust release image build on a billed hosted runner for essentially every code PR, because `docker` = rust||web||config||scripts. Pushes to main still smoke unconditionally. - split the `test` mega-job: Python SDK/package tests and the wasm32-wasip2 component conformance build are now their own path-gated jobs instead of serializing behind nextest on one 30-min critical path. - non-core workflow edits no longer force full CI. Only ci.yml, the shared composite actions, and the classifier itself fail-safe to all-true. - drop actions/cache on target/ for the self-hosted jobs: the <repo>-<name>-<lockhash> key saved once then exact-hit forever, pinning stale multi-GB entries against the 10 GB quota while kache already covers those runners. The hosted release build keeps a real cache instead. - release.yml: add the concurrency group it was missing (the only release workflow without one). - route hosted runners at the public kache S3 endpoint; the composite targeted a LAN-only address that GitHub-hosted runners cannot reach, silently degrading to LOCAL-ONLY on an ephemeral VM. - CLAUDE.md/xtask README: drop the stale instruction to require "MSRV Gate".
jmagar
enabled auto-merge (squash)
August 5, 2026 15:31
…ty tests Two regressions from the CI-audit branch, both caught by this PR's own checks: - setup-rust-kache had been re-pinned from 0.13.0 down to 0.12.0. The runner fleet ships 0.13.0, so the downgrade left RUSTC_WRAPPER=kache pointing at a binary the job never provisioned, and nested cargo invocations died with "could not execute process `kache ...` (never executed)". Restored to 0.13.0, matching both main and the installed fleet binary. - the Test job lost packages/python/.venv when the Python suites moved to the new python-tests job. python_authoring_fixtures_match_across_prepared_runner_modes looks for that venv and hard-fails without it, so the job now runs `uv sync --project packages/python --frozen` explicitly rather than relying on another job's side effects.
jmagar
disabled auto-merge
August 7, 2026 05:05
This repository is public. An earlier commit on this branch added
default: "https://s3.tootie.tv"
to the s3-endpoint input, which publishes an internal infrastructure hostname
in source. main deliberately carries scrubbed placeholders (192.0.2.2, an
RFC 5737 documentation address, and "Nashost MinIO") for exactly this reason.
The default was never needed: every caller passes
${{ vars.KACHE_S3_ENDPOINT }}, so the real value already lives in org
variables. An empty default means a credential-less caller falls back to
local-only caching, which is the existing behaviour.
jmagar
enabled auto-merge (squash)
August 7, 2026 05:10
jmagar
disabled auto-merge
August 7, 2026 05:43
The previous commit's s3-endpoint description contained a literal
${{ vars.KACHE_S3_ENDPOINT }}. GitHub evaluates expressions inside an action's
input `description`, and the `vars` context is not available while loading a
composite action, so every job that uses setup-rust-kache fails in seconds
with:
Unrecognized named-value: 'vars'
Failed to load ./.github/actions/setup-rust-kache/action.yml
This was copied verbatim into cortex, yarr and axon and broke all three mains
until each was hotfixed (cortex#184, yarr#124, axon#534). soma is the last
carrier.
The description now names the variable in prose instead, and says explicitly
why an expression must never appear there.
jmagar
enabled auto-merge (squash)
August 7, 2026 06:18
# Conflicts: # .github/workflows/ci.yml # CLAUDE.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fleet CI audit follow-up for soma. Measured motivation: over the last 100 runs soma's CI averaged 145 min and MSRV averaged 139 min — both firing on every push and PR.
The headline:
msrv.ymlis deletedIt pinned
1.97.1, which is identical torust-toolchain.toml's channel,Cargo.toml'srust-version, and the toolchainci.ymlalready builds with. It ran a fullcargo check --all-targetspluscargo test --no-run --all-targets --workspaceat that same compiler on every push and PR — roughly 40 minutes of duplicate compilation producing zero differential signal, plus its own duplicatechanged-pathsjob on the critical path.MSRV Gatehas already been removed from branch protection, so this does not strand PRs.CLAUDE.mdpreviously instructed future maintainers to require that gate; it now records why the workflow is gone and the condition under which it should return (MSRV dropping below the pinned toolchain).Other changes
container-smokewas an uncached full Rust release image build on a billed hosted runner, on nearly every code PR — its gate wasdocker=rust || web || config/ || scripts/. Now builds through buildx with a GHA layer cache and, on PRs, only when real image inputs change (new narrowdocker_buildflag). Pushes to main still smoke unconditionally.testmega-job. Python SDK/package tests and thewasm32-wasip2component conformance build were serialized behind nextest on a single 30-min critical path; they are now independently path-gated jobs.ci.yml, the shared composite actions, and the classifier itself fail-safe to all-true.actions/cacheontarget/for self-hosted jobs. The<repo>-<name>-<lockhash>key was an exact hit on every run after the first, so the post-job save never fired again — permanently stale multi-GB entries thrashing the 10 GB quota on runners where kache already provides caching. The hosted release build gets a real cache instead.release.ymlgained theconcurrencygroup it was the only release workflow to lack.All 11
cargo xtask changed-pathsclassifier tests pass, including new cases for the narroweddocker_build,python,wasm_component, and non-core-workflow routing.CI Gateneeds were updated for the two new jobs.