Skip to content

CI audit: delete zero-signal MSRV, cache container smoke, scope fan-out - #329

Open
jmagar wants to merge 11 commits into
mainfrom
ci/audit-fixes-20260805
Open

CI audit: delete zero-signal MSRV, cache container smoke, scope fan-out#329
jmagar wants to merge 11 commits into
mainfrom
ci/audit-fixes-20260805

Conversation

@jmagar

@jmagar jmagar commented Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Fleet CI audit follow-up for soma. Measured motivation: over the last 100 runs soma's CI averaged 145 min and MSRV averaged 139 min — both firing on every push and PR.

The headline: msrv.yml is deleted

It pinned 1.97.1, which is identical to rust-toolchain.toml's channel, Cargo.toml's rust-version, and the toolchain ci.yml already builds with. It ran a full cargo check --all-targets plus cargo test --no-run --all-targets --workspace at that same compiler on every push and PR — roughly 40 minutes of duplicate compilation producing zero differential signal, plus its own duplicate changed-paths job on the critical path.

MSRV Gate has already been removed from branch protection, so this does not strand PRs. CLAUDE.md previously instructed future maintainers to require that gate; it now records why the workflow is gone and the condition under which it should return (MSRV dropping below the pinned toolchain).

Other changes

  • container-smoke was an uncached full Rust release image build on a billed hosted runner, on nearly every code PR — its gate was docker = rust || web || config/ || scripts/. Now builds through buildx with a GHA layer cache and, on PRs, only when real image inputs change (new narrow docker_build flag). Pushes to main still smoke unconditionally.
  • Split the test mega-job. Python SDK/package tests and the wasm32-wasip2 component conformance build were serialized behind nextest on a single 30-min critical path; they are now independently path-gated jobs.
  • Non-core workflow edits no longer trigger the full matrix. Only ci.yml, the shared composite actions, and the classifier itself fail-safe to all-true.
  • Removed actions/cache on target/ for self-hosted jobs. The <repo>-<name>-<lockhash> key was an exact hit on every run after the first, so the post-job save never fired again — permanently stale multi-GB entries thrashing the 10 GB quota on runners where kache already provides caching. The hosted release build gets a real cache instead.
  • release.yml gained the concurrency group it was the only release workflow to lack.
  • Hosted runners now reach the shared kache remote over the public S3 endpoint; the composite pointed at a LAN-only address, silently degrading to LOCAL-ONLY on ephemeral VMs.

All 11 cargo xtask changed-paths classifier tests pass, including new cases for the narrowed docker_build, python, wasm_component, and non-core-workflow routing. CI Gate needs were updated for the two new jobs.

msrv.yml pinned 1.97.1 — identical to rust-toolchain.toml, Cargo.toml
rust-version, and the toolchain ci.yml already builds with. It re-ran a full
`cargo check --all-targets` plus `cargo test --no-run --all-targets` on every
push and PR for no differential signal. Deleted, along with its duplicate
changed-paths job. "MSRV Gate" has been removed from branch protection.

- container-smoke: build via buildx with a GHA layer cache and gate PRs on a
  new narrow `docker_build` flag (image inputs only). It previously ran an
  uncached full Rust release image build on a billed hosted runner for
  essentially every code PR, because `docker` = rust||web||config||scripts.
  Pushes to main still smoke unconditionally.
- split the `test` mega-job: Python SDK/package tests and the wasm32-wasip2
  component conformance build are now their own path-gated jobs instead of
  serializing behind nextest on one 30-min critical path.
- non-core workflow edits no longer force full CI. Only ci.yml, the shared
  composite actions, and the classifier itself fail-safe to all-true.
- drop actions/cache on target/ for the self-hosted jobs: the
  <repo>-<name>-<lockhash> key saved once then exact-hit forever, pinning
  stale multi-GB entries against the 10 GB quota while kache already covers
  those runners. The hosted release build keeps a real cache instead.
- release.yml: add the concurrency group it was missing (the only release
  workflow without one).
- route hosted runners at the public kache S3 endpoint; the composite targeted
  a LAN-only address that GitHub-hosted runners cannot reach, silently
  degrading to LOCAL-ONLY on an ephemeral VM.
- CLAUDE.md/xtask README: drop the stale instruction to require "MSRV Gate".
Copilot AI lite review requested due to automatic review settings August 5, 2026 15:22

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@jmagar
jmagar enabled auto-merge (squash) August 5, 2026 15:31
jmagar and others added 2 commits August 5, 2026 11:32
…ty tests

Two regressions from the CI-audit branch, both caught by this PR's own checks:

- setup-rust-kache had been re-pinned from 0.13.0 down to 0.12.0. The runner
  fleet ships 0.13.0, so the downgrade left RUSTC_WRAPPER=kache pointing at a
  binary the job never provisioned, and nested cargo invocations died with
  "could not execute process `kache ...` (never executed)". Restored to
  0.13.0, matching both main and the installed fleet binary.
- the Test job lost packages/python/.venv when the Python suites moved to the
  new python-tests job. python_authoring_fixtures_match_across_prepared_runner_modes
  looks for that venv and hard-fails without it, so the job now runs
  `uv sync --project packages/python --frozen` explicitly rather than relying
  on another job's side effects.
Copilot AI review requested due to automatic review settings August 5, 2026 16:37

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot AI review requested due to automatic review settings August 5, 2026 18:10

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot AI review requested due to automatic review settings August 6, 2026 01:19

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@jmagar
jmagar disabled auto-merge August 7, 2026 05:05
This repository is public. An earlier commit on this branch added

    default: "https://s3.tootie.tv"

to the s3-endpoint input, which publishes an internal infrastructure hostname
in source. main deliberately carries scrubbed placeholders (192.0.2.2, an
RFC 5737 documentation address, and "Nashost MinIO") for exactly this reason.

The default was never needed: every caller passes
${{ vars.KACHE_S3_ENDPOINT }}, so the real value already lives in org
variables. An empty default means a credential-less caller falls back to
local-only caching, which is the existing behaviour.
@jmagar
jmagar enabled auto-merge (squash) August 7, 2026 05:10
@jmagar
jmagar disabled auto-merge August 7, 2026 05:43
The previous commit's s3-endpoint description contained a literal
${{ vars.KACHE_S3_ENDPOINT }}. GitHub evaluates expressions inside an action's
input `description`, and the `vars` context is not available while loading a
composite action, so every job that uses setup-rust-kache fails in seconds
with:

    Unrecognized named-value: 'vars'
    Failed to load ./.github/actions/setup-rust-kache/action.yml

This was copied verbatim into cortex, yarr and axon and broke all three mains
until each was hotfixed (cortex#184, yarr#124, axon#534). soma is the last
carrier.

The description now names the variable in prose instead, and says explicitly
why an expression must never appear there.
@jmagar
jmagar enabled auto-merge (squash) August 7, 2026 06:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants