Repository navigation
CI: merge queue prerequisites (merge_group triggers, one fixtures result) - #742
Conversation
PHPUnit Feature, Shared Server fixtures, SonarQube and Public Boundary now also run on merge_group, so a merge queue can replace the require-up-to-date rerun loop. Base-revision checks use the queue group's base_sha, the boundary scan covers the group's exact base..head range, and the push trigger skips gh-readonly-queue/** branches that the merge_group run already scans. Shared Server fixtures has no path filter for merge_group, so every queued group gets the full profile.
tests/Unit/MergeGroupTriggersTest.mjs checks that PHPUnit Feature, Shared Server fixtures, SonarQube and Public Boundary run on merge_group, that base-revision checks and the boundary range use the queue group's base and head, that queue branches are not scanned twice, and that superseded-run cancellation never applies to a queue group. It runs in Repository contracts. It fails 6 of 7 checks on the train head without merge_group support.
The OpenAPI evolution and regression corpus contracts pin the exact base revision expression; include the merge_group base so a queued group diffs against the revision it was built on.
The Sonar job receives SONAR_TOKEN and its fork guard is always true for a merge group, so it no longer runs on merge_group; the contract test now requires that. Public Boundary scans every push again, including queue branches, and the test requires the unfiltered push trigger alongside the exact merge-group range.
…y group #723 removed PHPUnit Feature's concurrency group, because its required gate runs with always() under the central action policy. The test now requires that any cancel-in-progress in a workflow the queue waits for cancels only pull request runs, and that Shared Server fixtures keeps its pull-request-only cancellation.
In each database job of Shared Server fixtures, the nine published-SDK direction profiles ran one after another (two pairs already overlapped), about 22 of the job's 64-72 minutes (train #729, PostgreSQL 17 job 120866907013: 12:19:50 to 12:41:36). Each profile already has its own containers, PHP and embedded databases, evidence and state directory, and its own workflow-ID prefix on the shared native server. sdk-direction-lanes.sh now runs them in three lanes balanced by those durations, in order within a lane. Every profile runs even after another fails; the step fails if any did, after printing each profile's log in its own group. The job's existing cleanup steps still stop and remove every profile's containers. Expected saving: about 14 minutes per database job.
heartbeat_renews_only_progress_deadline_and_cannot_resurrect_elapsed_authority compared two lease_expires_at strings. Native times are whole milliseconds and serialize without a fraction on a whole second, so a claim lease of ...:26Z sorted after a renewal of ...:26.045Z and the assertion failed about one run in a thousand (train #729, PostgreSQL 17 job 120852521096). The test now parses both and reports the values.
A required check and the merge queue both need a result that always reports. The pull_request path filter meant a docs-only pull request got no Shared Server fixtures result at all, so the workflow could not be required. - Pull requests now run the workflow without a path filter. A short `changes` job applies the push trigger's path list to the pull request's merge commit (renames count on both sides), so one list governs both triggers. Push, merge_group and manual runs run every fixture job, as does any pull request that cannot be classified. - `published-sdk-adapters` runs only when the classifier says so; the other fixture jobs need it, so they skip with it. - A terminal `Shared Server fixtures result` job runs with always(). It passes only when every fixture job passed, or when no input changed and every fixture job was skipped. A failed, cancelled or unexpectedly skipped job, a failed classifier, or an unreadable needs context fails it. - ServerParityAggregateTest covers the workflow structure, the result decisions and the classifier against scratch pull request merge commits. Repository contracts runs it. No permissions, secrets, actions or artifact paths change. Making the result a required check, and enabling the merge queue, stay separate repository-setting steps.
The Docker workflow isolation policy accepts only literal .sh and .py repository helpers in workflow steps, so the new jobs' direct node calls failed Public Boundary. changes.sh and aggregate.sh now run the Node scripts from the repository root, as the workflow does, and the classifier tests go through changes.sh.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Security correction required at exact head The failed CodeQL check is a concrete high-severity annotation at Please replace the dot-only replacement with complete regular-expression-literal escaping for every non-wildcard segment (after splitting The remaining source review and two in-progress checks continue in parallel. Send the corrected immutable head after its checks settle; no blind rerun of this head is requested. |
Every database job waited for published-sdk-adapters (about 15 minutes), but 10 of those minutes built the optimized native binary only the codec-deadline-health cells use (train #729: "Build one bounded optimized native artifact for deadline health", 10.0 minutes). The build, its upload and its container cleanup now run in a codec-native-build job beside the adapters; codec-deadline-health needs both, and the database jobs still need only the adapters, so they start about 10 minutes sooner. The build script and its bounded resources are unchanged.
|
Additional Security correction required at the same #742 head: the change classifier can skip a path that is inside a required prefix when the Git filename contains control characters. Exact isolated counterfactual: a pull-request merge commit added the valid Git path Please read the Git file list as bytes with No repository setting change or rerun is requested on the known-bad head. |
|
Security activation boundary: #742 remains source preparation, not authority to enable the merge queue. The active rulesets currently require After the source corrections and source merge, queue activation still requires coordination with General as the public-repository Sonar owner, an actual controlled merge-group SHA showing both current required checks plus the new terminal |
…est the lane wrapper Each lane stops its profile's PHP server as soon as the profile ends, so at most three run at once, and a failed stop only warns. The profile's status is kept either way. A shell-level test runs the wrapper with stub profiles and docker: all nine profiles run, every server is stopped after its profile, a failed profile does not stop its lane, and the wrapper fails only after printing every status and log. Also resolves the wrapper's Sonar findings.
… fixture when patterns or names cannot be classified The file list is read as bytes with --name-only -z and split only on NUL, so a quoted name can no longer slip past a required prefix; wildcards match newlines; a name that is not UTF-8 or an unsupported pattern runs every fixture job instead of failing the classifier.
…and wait for it codec-native-build is a second root fixture job. It runs only through the change classifier, and the result needs it like every other fixture job.
|
Corrections at head
42/42 pass in |
|
One exact-head correction remains for The substantive classifier fixes are sound in review: complete literal escaping in the production compiler, NUL-delimited byte input, fatal UTF-8 decoding that fails open to running, newline/tab/non-UTF-8 counterfactuals, and #741's However, the exact-head CodeQL gate is still red with a new high annotation at Please avoid a second regex compiler here. Compare the workflow block's lines to the exact literal |
|
Security exact-head source acceptance for
The requested Security source correction is accepted, so no further Security patch wait remains. The previously recorded activation boundary is unchanged: source merge does not authorize enabling the merge queue. Activation still requires General/Sonar coordination and a controlled real merge-group SHA proving the current required PHPUnit and Sonar App checks plus the new terminal fixture aggregate, including the negative/fail-closed case, without weakening Sonar. |
… the native server The namespace and selected-run signal profiles ran beside the plain signal profile, and on PostgreSQL 17 one's worker showed in another's routing diagnostics (server-parity-sdk-signals). The old serial workflow never overlapped them. A test now reads each profile's queues from its fixtures and refuses any two profiles that share one in different lanes.
…-325-merge-group-v2
|
|
General enabled the merge queue for The effective required checks are Enabled configuration is not yet proof of an operational queue. The existing Sonar workflow intentionally does not run on |
|
The first real protected merge-queue merge is verified. PR #785 landed on October 26 at 18:25:24Z as synthetic commit All three required identities reported success on that same synthetic SHA:
General performed the bootstrap static analysis on the actual queued commit with trusted main scanner configuration and explicit revision/branch identity. SonarScanner CLI 8.1.0.6389 and Java 21.0.12.1 ran PHP, Python, JavaScript, Rust, shell and configuration analysis; candidate builds were disabled. The official scanner image was pinned to The scanner's later status-polling request was refused because the account cannot read non-main branch status through that API. This did not prevent the genuine App from evaluating the report, publishing the passing check or authorizing the protected queue merge. The automatic path in #788 therefore uploads with Configuration and the first real merge are verified. General is finishing #788's automatic scanner path, its CodeQL checkout classification and the small shared-policy correction durable-workflow/.github#267. That remaining work is explicit; the manual bootstrap is not a claim that automatic scanning has already landed. |
|
The protected queue is operating with all three gates intact: PHPUnit, the fail-closed Shared Server fixtures aggregate (Actions App15368), and genuine Sonar App12526. #773 merged at 2026-10-26 20:33:58 UTC as exact group The queue's build concurrency is now 2, with single-entry merges, CI performance evidence: #788's first PR Shared attempt took23m51s; its one failed published-reference cell added a12m55s rerun, for37m13s from initial start to green. The required PHP suite took12m20s. Parallel queue building has demonstrably removed predecessor waiting while preserving full qualification. I am keeping full PR and group coverage through this first automatic-scanner acceptance. A lighter PR-only qualification remains a possible measured follow-up if throughput still falls behind; no fixture assertions or required protected-group matrix have been removed. Next: #788 must complete its protected merge, then a real subsequent group must exercise the trusted default-branch scanner automatically. Probe/cache scratch remains only through that acceptance; no manual upload alone is counted as automatic proof. |
|
Automatic merge-queue analysis is verified on the real #790 group
This completes automatic-scanner acceptance after #788's protected merge at20:44:29UTC. The full Shared Server fixture matrix remains mandatory for each protected group; #790 subsequently merged through the protected queue at21:33:05UTC as the exact qualified commit The active main queue retains Protected merges #785, #773, #788 and #790 have passed the queue. Two-build concurrency started #788's full group15m10s before #773 merged, preserving all qualification. Bootstrap-only clone/cache, the unused custom policy-tools image/build context and both completed clean worktrees were removed after checking for active mounts and unrelated work. Ordinary product delivery continues; General's PHP handoffs are in #791. |
Part of #325. Replaces #725 and #727, rebuilt on current
main(after #729) with only their merge-queue commits.Why
Each PR re-qualifies by hand whenever
mainmoves. A merge queue qualifies queued PRs in order against the head they will land on, so nobody has to mergemainback in and re-run. This PR makes the required checks run formerge_groupevents and gives branch protection one always-reporting fixtures result, so Security can turn the queue on.Change
merge_grouptriggers on PHPUnit Feature, Public Boundary and Shared Server fixtures (from CI: run the required checks for GitHub merge queue groups #725):changesjob (changes.sh) applies the push path list. Pull requests that cannot affect the fixtures, such as documentation-only changes, skip the fixture cells instead of running them.aggregatejob (aggregate.sh) always reports one terminal result for branch protection. Skipped cells count as passing only whenchangessaid to skip them.Checks
MergeGroupTriggersTestandServerParityAggregateTestpass 33/33, and the Docker workflow isolation policy passes.