| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
fix(ci): allow cold LLM gateway smoke startup (#12809) ## Problem The auto development LLM gateway smoke used `kubectl run --rm -i`, inheriting kubectl's one minute pod startup timeout. A cold pull of the approximately 800 MB gateway image could exceed that budget, and `--rm` deleted the pod before Pending/ImagePullBackOff diagnostics were collected. ## Change Create the smoke pod with secret references, wait up to 300 seconds for scheduling and image startup, then allow a separate 180 second smoke completion budget. Keep the pod until status, describe output, events, and logs have been emitted on every failure before the exit cleanup removes it. ## Validation - `backend/.venv/bin/python -m pytest -q backend/tests/unit/test_llm_gateway_deploy_contract.py --disable-warnings --maxfail=1` (16 passed) - composite action YAML parse - `git diff --check` - `make preflight` Failure-Class: none | 4 天前 | |
ci(public-build): env-var removal, per-environment flags, real invoker identity checks (#12582) * ci(public-build): env-var removal, per-environment flags, real invoker identity checks Plaintext Cloud Run env vars survived merge deploys, restricted ingress was applied to development, and TBD placeholders passed presence checks into gcloud. Co-authored-by: Cursor <cursoragent@cursor.com> * ci(public-build): probe actAs via IAM testIamPermissions REST gcloud has no iam service-accounts test-iam-permissions subcommand, so the previous preflight would fail every prod deploy. Call the IAM REST method with urllib and a print-access-token bearer instead. * ci(public-build): reject remove_runtime_env_vars overlapping preserved secrets Cubic review (PRRT_kwDOLkKqys6eWSS0): a runtime name in both preserve_runtime_secrets and remove_runtime_env_vars loaded cleanly, yet deployment emits --remove-env-vars for a binding the contract claims to preserve via the merge update strategies — the removal would strip the preserved secret binding. Extend the dedicated overlap rejection to preserve_runtime_secrets and its mirrored fallback_runtime_secrets, with a regression test. --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: David Zhang <9387252+Git-on-my-level@users.noreply.github.com> | 8 天前 | |
fix(ci): make Telegram deployment notification optional Failure-Class: none | 1 个月前 | |
Remove Job log from message | 3 个月前 | |
docs: take operator pages off docs.omi.me Unlisted Mintlify MDX is still a public URL. Move runbooks, flags, invariants, and agent rules next to owning code, add docs/AGENTS.md as the site allow-list, and correct the live kill-switch contract after the JIT authority page leaves the site. Co-authored-by: Cursor <cursoragent@cursor.com> | 10 天前 | |
fix(deploy): gate public builds on browser canaries Move browser-public build configuration into a reviewed, versioned source and enforce its contract locally and in CI. Deploy each public target as a no-traffic candidate, prove the built client initializes in a browser, then promote only that revision. Verification: public-build fixtures and static contract check; deployment secret-boundary and concurrency checks; actionlint; targeted client lint/type checks (the web/app legacy next lint runner is incompatible with its installed Next version). | 1 个月前 | |
ci(public-build): assert the candidate commit SHA in the promotion smoke (#12581) Bake GITHUB_SHA into the frontend canary so the public-URL promotion smoke can tell the new revision from the previous one behind the LB. Co-authored-by: Cursor <cursoragent@cursor.com> | 8 天前 | |
ci: make CI fast and reliable — every job under 20 minutes, recurring flake removed (#12247) * ci(desktop-windows): cache electron & electron-builder downloads The Linux package job failed on main (EAI_AGAIN github.com) and on PRs (read ECONNRESET) because electron-builder re-downloads its packaging tools on every run. Cache the tool and Electron archives so steady-state builds never depend on those endpoints, on both the Linux and Windows packaging jobs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(hermetic-e2e): stop minting red checks from cancelled runs; harden sync stack readiness The merge gate ran under always() and failed hard on 'cancelled' upstream results whenever cancel-in-progress superseded a run — 3 of the last 4 re-run-to-green cycles on this workflow were exactly that. Gate now goes neutral on cancellation and defers to the superseding run. The sync Cloud Tasks stack's one genuine flake: scenarios run back-to-back, a dying child of the previous stack can still answer a TCP probe, and the authoritative health check had the tightest budget (20s) while the weak port probe had the generous one. close() now drains the stack's ports and health gets 60s. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(desktop-swift): collapse macOS-runner demand that was queueing every run Desktop Swift CI's tail (p90 150 min, max 218 min) was queue time: the repo's only macos-15 consumers demanded ~4.9 concurrent runners against a cap of ~5. Cut the demand instead of the deadline: - Run the release-mode UserNotifications regression inside the Release Compile job, next to the release build it consumes, instead of paying a second from-scratch release build (~31 min) on the verify runner. The planner still requires the Release Compile check by exact name, and the Build & Tests aggregate now hard-fails on the release job's result, so release tagging and PR merges both still gate on it (#11373/#11374 protection preserved). - Cache SwiftPM dependencies and the release Desktop/.build in the Release Compile job, saved from main pushes so every ref can restore it, and drop the forced rm -rf that guaranteed a ~20-min cold build. - Run launcher script tests 3-way parallel with per-test logs (9.3 min serial p50), and widen the build-lock recovery budgets that saturated runners pushed past 4s. - blob:none the verify checkout; full history stays for diffing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(mobile,web,parakeet): kill checkout/cache tails and 45-min unschedulable burns Mobile and Web Checks' p90-to-max tail was almost entirely actions/checkout pulling all blobs of a ~1.25GB repo with fetch-depth: 0 (a 53-minute checkout-only Web run happened); history-needing jobs now use blob:none and worktree-only jobs go shallow, with timeout caps so no job can idle unbounded again. The Android compile smoke paid a ~700s cold Gradle build every run because the default cache policy never wrote from main; main now seeds the cache PRs read, and the build_runner cache keys drop the run_id suffix that guaranteed a miss on every single run. Parakeet GPU tests have failed nightly since 08-03 burning exactly 45 min each with zero logs: the pod is unschedulable (L4 pool at capacity) and the workflow neither noticed nor captured pod events. Gate on PodScheduled within 5 minutes with the real cause in the error, stream pod logs live so deadline kills keep evidence, and include pod events in diagnostics. The capacity fix itself (NLLB squatting the parakeet pool's second GPU) is a cluster change tracked separately. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(repo-checks): make the line-count ratchet invariant under base drift; pin uv 13 of the last 17 Repo Checks failures were the line-count ratchet, and the nondeterministic ones shared one cause: the check demanded byte-exact absolute counts against a synthetic merge with origin/main, which moves under every open PR (~90 pushes/hr). A correct declaration went stale with no author action, in both directions (drifted endpoints, and previously- mandatory exceptions turning fatally 'unused' when main absorbed an edit). The declaration now approves a growth *allowance* — the delta is a property of the PR alone — and an exception the diff no longer needs warns instead of failing. Growth beyond the allowance, duplicates, malformed lines, and unsupported paths still fail. Also pin setup-uv's resolved version (matching backend/Dockerfile's UV_VERSION) so it stops fetching the astral-sh 'latest' manifest, which hard-failed a run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci: pin setup-uv's resolved version everywhere it was fetching 'latest' Every unpinned astral-sh/setup-uv call resolves 'latest' by fetching the astral-sh/versions manifest from raw.githubusercontent.com at job start — one observed Repo Checks failure was exactly that fetch dying. Pin the same 0.11.13 the backend Dockerfiles already use, which the action resolves locally with no network call. repo-checks.yml was pinned in the previous commit; this covers the remaining call sites and the release-eligibility action (with its byte-exact contract fixture). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(desktop-swift): batch SwiftPM test invocations with per-suite fallback The debug suite spawned one 'xcrun swift test' process per discovered suite — 674 SwiftPM startups at ~5.1s each, ~28.7 min of the verify job's wall clock, dwarfing actual test execution. Workers now run suites in batches of 25 through one SwiftPM process (repeated --filter flags), with batching kept strictly optimistic: a batch that exits non-zero or times out is discarded and every member re-runs through the untouched per-suite path, so isolation semantics, per-suite budgets, and failure attribution are unchanged for anything red. The serial shared-auth cluster is never batched, and OMI_SWIFT_TEST_SUITE_BATCH_SIZE=1 restores the old behavior bit-for-bit. Also fixes a pre-existing bash-3.2 set -u break (empty build_args expansion) that made OMI_SWIFT_TEST_PREBUILD=0 kill every suite, and restores the case-pattern skip list in the workflow's launcher step that check-launcher-test-skips.py parses. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(backend-unit): fail-open module stubs, checkout tail, and honest runner verdicts The suite's recurring 'flake' was one deterministic trap: a module-scope sys.modules['utils'] stub with __path__ = [] turned every new import in routers/conversations.py into a ModuleNotFoundError for whoever ran CI next — main broke twice on 2026-08-25 and four unrelated PRs inherited the red. The stub package now carries the real package __path__, so unlisted submodules resolve to the real module instead of raising (explicit stubs still stub; verified by reproducing the incident against both versions). Checkout p90 was 267s and max 786s from full-blob clones; blob:none keeps the merge-base history scripts/changed-files needs. timeout 45→30 so a hang stops burning a concurrency slot for 25 minutes past the p90. Also two standing runner bugs found while measuring: pytest's exit 5 on total worker death was read as 'no tests selected' and reported green, and the fast-unit duration guard's verdict was silently discarded under xdist (workers now hand offenders to the controller). A single-session xdist partition of the suite was implemented, measured, and disproved on this tree (upb descriptor segfaults, OOM at 815 files, per-worker collection); it ships opt-in via BACKEND_PYTEST_PARALLEL_SESSION=1 with the measurements in the comments, default behavior unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(desktop): changelog fragment for internal CI runner changes Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(desktop-swift): keep measure-block suites out of batches; three workers The first PR run of the batched suite exposed one pathology: the batch carrying MemoryAtlasPerformanceHarnessTests (245s of XCTest measure blocks, slower still under contention) blew its 17-minute budget and paid the 25-suite isolated fallback on top — 15 of the step's 40 minutes. Measure suites are now derived from the source (like the serial cluster, so a new one cannot silently join the batch pool) and run in their own SwiftPM process with a doubled per-suite budget. With per-invocation SwiftPM startup gone — the reason two workers were the measured ceiling — workers now match the runner's three cores. This PR's CI runs are the macOS-runner evidence; drop back to two if the performance harness starts timing out. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> | 14 天前 | |
fix(ci): strip leftover MEMORY_ENABLED_USERS from Cloud Run backend deploys (#11472) * fix(ci): strip leftover MEMORY_ENABLED_USERS from Cloud Run backend deploys Cloud Run merges --update-env-vars, so retired MEMORY_ENABLED_USERS survives candidate verification after #11447. Add it to the existing --remove-env-vars lists for backend, backend-sync, backend-sync-backfill, and backend-integration. Failure-Class: FC-runtime-binding-contract * fix(ci): strip leftover MEMORY_ENABLED_USERS from maintenance job deploys The memory-maintenance-job is also a Cloud Run deploy that merges env vars across revisions. Its rendered --remove-env-vars was missing MEMORY_ENABLED_USERS, so the stale per-user binding survived on that job after #11447. Add it to both dev and prod maintenance-job flags and extend the test to cover that deployment path. Addresses Codex review comment on #11472. * fix: update _base.yaml source and format test for env-compose contract The committed runtime_env.yaml (composed output) had MEMORY_ENABLED_USERS added for the memory-maintenance-job but the declarative source _base.yaml was not updated, breaking the backend-runtime-env-compose check. Also run black on test_render_backend_runtime_env.py. --------- Co-authored-by: David Zhang <9387252+Git-on-my-level@users.noreply.github.com> | 27 天前 | |
fix(ci): sign the dev backend release probe for its Firebase project (#12264) The known-audio gate authenticates against the production Firebase project (based-hardware) because the development backend verifies user tokens there. Since 224b2c536d split project_id from firebase_auth_project_id, the gate corrected the token *audience* but kept signing with the development deploy identity, which Identity Toolkit will not accept for another project. Every manual development backend deploy has failed at custom_token_signing/permission_denied since then, so development has been silently refusing new deploys: candidates were built --no-traffic and never promoted. #12019 plumbed an escape hatch, firebase_probe_signer_service_account, but the variable it reads has never been set and needs an IAM grant to be usable. Sign locally with the Firebase project's own key instead. That is what desktop_backend_auto_dev.yml already does for the identical project split, and what .github/AGENTS.md prescribes: stage the environment-owned GCP_SERVICE_ACCOUNT in a mode-0600 runner file, let the token minter reject signer-project drift before the key is used, and delete the key after the probe. No IAM change is required. The named-signer input stays available and is only consulted when no credential is supplied. sync_ledger_fence_cutover.yml carries the same split in its development lane and is wired the same way; its production lane deploys into based-hardware and keeps signing with its active identity. Co-authored-by: Claude Fable 5 <noreply@anthropic.com> | 14 天前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 4 天前 | ||
| 8 天前 | ||
| 1 个月前 | ||
| 3 个月前 | ||
| 10 天前 | ||
| 1 个月前 | ||
| 8 天前 | ||
| 14 天前 | ||
| 27 天前 | ||
| 14 天前 |