[CI/Build] Add optional maintainer board apply mode by haritha3320 · Pull Request #2461 · vllm-project/semantic-router

haritha3320 · 2026-07-12T14:32:01Z

Purpose

Add an optional apply_actions input to the maintainer board workflow.
Keep the daily cron path read-only.
Let maintainers apply labels from proposed-actions.json via manual workflow_dispatch.
Module: CI/Build

Test Plan

Run local read-only sync:

MAINTAINER_BOARD_OUTPUT_DIR=/tmp/mb-safe-test \
MAINTAINER_BOARD_MILESTONE=v0.4 \
MAINTAINER_BOARD_ISSUE_LIMIT=5 \
MAINTAINER_BOARD_PR_LIMIT=5 \
bash tools/agent/scripts/run_maintainer_board_ci.sh

Confirm apply script refuses local runs:

MAINTAINER_BOARD_OUTPUT_DIR=/tmp/mb-safe-test \
bash tools/agent/scripts/run_maintainer_board_apply_ci.sh

Lint changed workflow/docs/shell files.
After merge, maintainer can test read-only dispatch first, then apply_actions=true if needed.

Test Result

Local sync succeeded and wrote today.md, current.json, and proposed-actions.json under /tmp/mb-safe-test.
Local apply script exited with a guard error outside workflow_dispatch (expected).
Shell and YAML lint passed locally.
Apply mode was not run against GitHub in this test.

Semantic Router PR Checklist

PR title uses module-aligned prefixes such as [Router], [CLI], [Dashboard], [Operator], [Fleet-Sim], [Bindings], [Training], [E2E], [Docs], or [CI/Build]
If the PR spans multiple modules, the title includes all relevant prefixes
Commits in this PR are signed off with git commit -s
The Purpose, Test Plan, and Test Result sections reflect the actual scope, commands, and blockers for this change

Add a gated workflow_dispatch apply job that reuses maintainer_board.py apply for label actions from proposed-actions.json while keeping the daily cron path read-only. Fixes vllm-project#2448 Signed-off-by: Haritha T H <hth@redhat.com>

netlify · 2026-07-12T14:32:06Z

✅ Deploy Preview for vllm-semantic-router ready!

Name	Link
🔨 Latest commit	`6b00987`
🔍 Latest deploy log	https://app.netlify.com/projects/vllm-semantic-router/deploys/6a571e5b5a334b0008b178d3
😎 Deploy Preview	https://deploy-preview-2461--vllm-semantic-router.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

github-actions · 2026-07-12T14:32:16Z

👥 vLLM Semantic Team Notification

The following members have been identified for the changed files in this PR and have been automatically assigned when their GitHub accounts are assignable in this repository:

📁 `Root Directory`

Owners: @rootfs, @Xunzhuo
Files changed:

.github/workflows/maintainer-board.yml

📁 `docs`

Owners: @FAUST-BENCHOU, @shraderdm, @drivebyer, @ramkrishs, @WUKUNTAI-0211, @AayushSaini101, @siloteemu
Files changed:

docs/agent/maintainer-ops.md

📁 `tools`

Owners: @FAUST-BENCHOU, @shraderdm, @drivebyer, @ramkrishs, @WUKUNTAI-0211, @AayushSaini101, @siloteemu
Files changed:

tools/agent/scripts/maintainer_board_ci_apply.py
tools/agent/scripts/run_maintainer_board_apply_ci.sh
tools/agent/scripts/tests/test_maintainer_board_ci_apply.py

🎉 Thanks for your contributions!

This comment was automatically generated based on the OWNER files in the repository.

github-actions · 2026-07-12T14:32:37Z

✅ Supply Chain Security Report — All Clear

Scanner	Status	Findings
AST Codebase Scan (Py, Go, JS/TS, Rust)	✅	29 finding(s) — MEDIUM: 22 · LOW: 7
AST PR Diff Scan	✅	No issues detected
Regex Fallback Scan	✅	No issues detected

Scanned at 2026-07-15T06:02:31.695Z · View full workflow logs

FAUST-BENCHOU

Acceptable for me

haritha3320 · 2026-07-13T17:27:35Z

@AayushSaini101 can you please review

Xunzhuo

The scheduled path remains read-only, but the new manual apply path does not yet preserve the repository's explicit reviewed-payload boundary or its documented label-only contract. I reproduced both key failures with a fake gh: a create_issue payload reaches gh issue create, and a two-action partial failure mutates the first action then exits with no job summary. Please add behavior tests for the allowlist, malformed/empty payloads, review boundary, and partial failure. make agent-validate, bash -n, the schedule guard, and git diff --check passed.

Xunzhuo · 2026-07-15T04:03:42Z

+
+  apply-actions:
+    needs: maintainer-board
+    if: github.event_name == 'workflow_dispatch' && inputs.apply_actions == true


[P1] Add a real review boundary before granting write permissions. apply_actions is selected before sync, and this same run immediately downloads and applies the newly generated payload, so nobody can inspect the exact proposed-actions.json before mutation. This contradicts the documented apply policy. Please consume a previously reviewed artifact identified by run ID/digest, or place the apply job behind a protected-environment approval after the artifact is uploaded.

Xunzhuo · 2026-07-15T04:03:42Z

+fi
+
+echo "Applying ${action_count} proposed maintainer board action(s) from ${ACTIONS_FILE}"
+python3 maintainer_board.py apply --actions "${ACTIONS_FILE}" --confirm


[P1] Enforce the advertised label-only allowlist before invoking the generic apply command. This wrapper only counts arbitrary JSON, while maintainer_board.py apply also accepts create_issue; a synthetic create_issue payload reaches gh issue create through this CI wrapper. Validate the root/list schema, allow only label_issue/label_pr, require repo-local numeric targets, and restrict labels to maintainer policy, with negative tests.

Xunzhuo · 2026-07-15T04:03:42Z

+echo "Applying ${action_count} proposed maintainer board action(s) from ${ACTIONS_FILE}"
+python3 maintainer_board.py apply --actions "${ACTIONS_FILE}" --confirm
+
+if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then


[P1] Always report partial application before failing the job. Actions mutate sequentially and set -e exits on the first failed gh command before this summary block, so earlier successful mutations become invisible. A two-action reproduction applied the first, failed the second, returned non-zero, and produced no summary. Track attempted/succeeded/failed actions through a trap/finally path, write the summary, then preserve the failing status.

Separate sync and apply into two workflow_dispatch runs via source_run_id, validate CI apply payloads against maintainer policy, and report partial gh failures in the job summary with behavior tests. Signed-off-by: Haritha T H <hth@redhat.com>

…ainer-board-apply-mode

Use cd ... || exit so Pre-commit shellcheck passes on the CI apply wrapper. Signed-off-by: Haritha T H <hth@redhat.com>

haritha3320 · 2026-07-15T05:50:37Z

@Xunzhuo Thanks for the review — I've addressed all three P1 items in the latest commits:

Review boundary — sync and apply are now separate workflow_dispatch runs via source_run_id; apply downloads a previously reviewed artifact instead of mutating in the same run.
Label-only allowlist — added maintainer_board_ci_apply.py to validate payloads (only label_issue/label_pr, #<number> targets, maintainer-policy labels; rejects create_issue and malformed input).
Partial failure reporting — apply tracks attempted/succeeded/failed actions and writes the full summary even when some gh commands fail.

Also added behavior tests in test_maintainer_board_ci_apply.py and fixed a shellcheck issue in the apply wrapper.

Could you please take another look when you have a moment?

haritha3320 requested review from Xunzhuo and rootfs as code owners July 12, 2026 14:32

github-actions Bot assigned AayushSaini101, drivebyer, FAUST-BENCHOU, ramkrishs, rootfs, shraderdm and WUKUNTAI-0211 Jul 12, 2026

github-actions Bot assigned Xunzhuo Jul 12, 2026

Merge branch 'main' into ci/maintainer-board-apply-mode

62de27f

FAUST-BENCHOU reviewed Jul 12, 2026

View reviewed changes

AayushSaini101 and others added 3 commits July 13, 2026 09:45

Merge branch 'main' into ci/maintainer-board-apply-mode

434e137

Merge branch 'main' into ci/maintainer-board-apply-mode

fe253e2

Merge branch 'main' into ci/maintainer-board-apply-mode

62e7b77

Merge branch 'main' into ci/maintainer-board-apply-mode

d7d99c5

Xunzhuo requested changes Jul 15, 2026

View reviewed changes

hth3320 and others added 4 commits July 15, 2026 11:02

Merge branch 'ci/maintainer-board-apply-mode' of origin into ci/maint…

5ec719a

…ainer-board-apply-mode

[CI/Build] fix shellcheck SC2164 in maintainer board apply script

b63939e

Use cd ... || exit so Pre-commit shellcheck passes on the CI apply wrapper. Signed-off-by: Haritha T H <hth@redhat.com>

Merge branch 'main' into ci/maintainer-board-apply-mode

6b00987

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[CI/Build] Add optional maintainer board apply mode#2461

[CI/Build] Add optional maintainer board apply mode#2461
haritha3320 wants to merge 10 commits into
vllm-project:mainfrom
haritha3320:ci/maintainer-board-apply-mode

haritha3320 commented Jul 12, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Jul 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 12, 2026 •

edited

Loading

Uh oh!

FAUST-BENCHOU left a comment

Uh oh!

haritha3320 commented Jul 13, 2026

Uh oh!

Xunzhuo left a comment

Uh oh!

Xunzhuo Jul 15, 2026

Uh oh!

Xunzhuo Jul 15, 2026

Uh oh!

Xunzhuo Jul 15, 2026

Uh oh!

haritha3320 commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

Uh oh!

Conversation

haritha3320 commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Test Plan

Test Result

Uh oh!

netlify Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for vllm-semantic-router ready!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

👥 vLLM Semantic Team Notification

📁 Root Directory

📁 docs

📁 tools

🎉 Thanks for your contributions!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Supply Chain Security Report — All Clear

Uh oh!

FAUST-BENCHOU left a comment

Choose a reason for hiding this comment

Uh oh!

haritha3320 commented Jul 13, 2026

Uh oh!

Xunzhuo left a comment

Choose a reason for hiding this comment

Uh oh!

Xunzhuo Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

Xunzhuo Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

Xunzhuo Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

haritha3320 commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

haritha3320 commented Jul 12, 2026 •

edited

Loading

netlify Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

📁 `Root Directory`

📁 `docs`

📁 `tools`

github-actions Bot commented Jul 12, 2026 •

edited

Loading