Repository navigation
ci: release jobs run on pf-ci-release (owner: CI on our machines) - #461
Merged
Merged
Conversation
Prepare the engine release and promotion workflows for the isolated ["self-hosted","pf-ci","pf-ci-release"] runner class: - release: ubuntu-latest -> ["self-hosted","pf-ci","pf-ci-release"]. - notify-hub: ubuntu-latest -> ["self-hosted","pf-ci","pf-ci-release"]. - prebuilt / linux-x86_64: ubuntu-22.04 -> ["self-hosted","pf-ci","pf-ci-release"], selected through matrix.runner. - promote-baseline.yml / promote: ubuntu-latest -> ["self-hosted","pf-ci","pf-ci-release"] (L6 15:40, addendum 2). The release and notify-hub jobs mint App tokens. The Linux x64 prebuilt leg builds and uploads the release tarball, so artifact provenance also requires the isolated class. Keep the three-leg matrix, ubuntu-22.04-arm and macos-latest legs. The arm64 leg waits for a release arm64 class. Leave docs.yml:build hosted because its workflow accepts pull_request. Addendum 2 explicitly moves promote despite pull_request_target: it holds the GitHub App secret references and workflow OIDC write permission. Change only its runs-on line, retaining triggers, if, steps and permissions. The separate ci/sec846-engine branch adds promote-guard; after merging the branches, that guard takes the same runs-on array as promote. Retain the existing PR routing and credential handling. Replace the release runner pins with exact isolated labels and the unchanged ARM/macOS matrix entries. Pin workflow_dispatch-only release triggers. Pin promotion's existing pull_request_target and workflow_dispatch event set, retaining its closed-PR and promotion gate checks. Author must-fail mutations restoring each moved job's hosted runner, adding PR triggers, introducing a hosted fallback, routing releases to the PR pool, moving the retained ARM/macOS legs or deleting a matrix leg. These are expected refusals; their execution is NOT RUN. Push only after both CORE-TOP gates: (1) laneboss posts "pf-ci-release live" AND (2) the owner answers REL-HOSTED. Until then a job on that label with no runners only waits, so nothing is pushed. The supervisor commits and pushes this prepared diff after both gates. Validation: NOT RUN. This lane performs text reads and edits only; no repository code, parser, preflight, actionlint, tests, build or corpus sweep is run. Supervisor verification, ci-policy-check.py R6 and the TypeSafe diff guard are NOT RUN. - .github/workflows/release.yml: NOT RUN. - .github/workflows/promote-baseline.yml: NOT RUN. - scripts/ci_preflight.py: NOT RUN. - scripts/test_ci_preflight.py: NOT RUN. - docs/ci.md: NOT RUN. - COMMIT-MSG-PFREL.md: NOT RUN. - REPORT-PFREL.md: NOT RUN. Verbatim documentation sentences removed or rewritten from docs/ci.md at base 0212cab follow. Complete original passages include unchanged adjacent sentences where a sentence shares a line; README.md and CONTRIBUTING.md have no rewritten sentences. docs/ci.md:998-1015: ```text L6's standing ruling of 2026-10-19 keeps production credentials on hosted runners. A job that references any secret other than `secrets.GITHUB_TOKEN`, has `id-token: write` at job or workflow scope, or names an `environment` must use a hosted standard runner and carry no `PF_CI_LABELS`. Inherited workflow environment secrets count too. A conditional deployment step still holds those references in its job. The existing jobs restore their exact pre-CR-171 hosted routing: docs `build` uses `ubuntu-latest` for its Cloudflare secrets; baseline `promote` uses `ubuntu-latest` for its GitHub App secrets and workflow OIDC permission. Every job in `release.yml` stays hosted under the explicit release ruling, including `prebuilt`, which references only `GITHUB_TOKEN`. That workflow is byte-identical to the pre-CR-171 `origin/main` copy: `release` and `notify-hub` use `ubuntu-latest`, and `prebuilt` selects `ubuntu-22.04`, `ubuntu-22.04-arm` and `macos-latest`. New credential-bearing jobs use `ubuntu-24.04` or the standard macOS label; the existing hosted aliases above are pinned explicitly to preserve their original values. ``` docs/ci.md:1028-1030: ```text Each pool job uses the fragment's expression verbatim and sets its matching array as a job-level **string** `PF_CI_LABELS`, merged into any existing job environment. ``` docs/ci.md:1058-1059: ```text Release's separate matrix stays entirely hosted and sets no pool labels. Promotion stays hosted for both target and dispatch triggers. ``` docs/ci.md:1066-1068: ```text The pre-job hook also requires the matching `PF_CI_LABELS` string. ARM pool dispatch is disabled, so ARM stays hosted. ``` docs/ci.md:1078-1093: ```text It pins the original hosted labels in `docs.yml`, `promote-baseline.yml` and `release.yml`, the release matrix included, and checks every job for production secrets, OIDC write permission or an environment. Credential-bearing jobs must stay hosted without pool env; every other Linux x64 job must use one of the two current fragments and its matching job-level `PF_CI_LABELS`. macOS and ARM stay hosted. The contract refuses `pf-linux-x64-16`, any `*-xlarge` or `*-large` label, and any `larger_runner` key in every workflow. A credential-bearing job on the pool, an old `ubuntu-latest` fragment fallback, a missing, duplicate, non-string or mismatched pool `PF_CI_LABELS`, a changed build or release matrix, a call to a workflow outside `.github/workflows/`, a changed time limit, a `ci_verify.py` call without exactly one core-count `--jobs` (counted over the whole job, however its commands are chained, blocked or carried, with the flag and its value on one line), or any other `--jobs` or `JOBS` value fails preflight, and so does a jobs line or `runs-on` the check cannot read; `scripts/test_ci_preflight.py` holds the mutations. ``` Additional verbatim passages rewritten from the uncommitted first pass by addendum 2 (the base-tree quotations above remain applicable): ```text Push this prepared migration only after laneboss posts **"pf-ci-release live"**; until then jobs on that label wait. Jobs in workflows triggered by `pull_request` or `pull_request_target` never move to the release class. Docs `build` stays on `ubuntu-latest` because `docs.yml` accepts `pull_request`, even though its Cloudflare deployment step skips that event. Baseline `promote` stays on `ubuntu-latest` because `promote-baseline.yml` accepts `pull_request_target`, alongside manual dispatch. These two workflows are left intact. ``` ```text It pins the hosted PR deployment jobs in `docs.yml` and `promote-baseline.yml`, the isolated release jobs in `release.yml`, and the complete release matrix with its hosted ARM/macOS exceptions. The release pin requires readable `workflow_dispatch`-only triggers, refusing both PR events, and exact runner values without a fallback. Release jobs carry no `PF_CI_LABELS`; unlisted credential-bearing jobs retain the existing hosted guard, while other Linux x64 jobs use one of the two current CI fragments and its matching job-level `PF_CI_LABELS`. ``` ```text A credential-bearing job on a PR pool, a restored hosted label on a moved release job, a PR trigger on the release workflow, an old `ubuntu-latest` fragment fallback, a missing, duplicate, non-string or mismatched pool `PF_CI_LABELS`, a changed build or release matrix, a call to a workflow outside `.github/workflows/`, a changed time limit, a `ci_verify.py` call without exactly one core-count `--jobs` (counted over the whole job, however its commands are chained, blocked or carried, with the flag and its value on one line), or any other `--jobs` or `JOBS` value fails preflight, and so does a jobs line or `runs-on` the check cannot read; `scripts/test_ci_preflight.py` holds the mutations. ``` Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… fix) actionlint 1.7.12 rejects literal self-hosted runs-on labels that are not declared; the engine repo had no .github/actionlint.yaml, so the pfrel release/promote-baseline heads failed their own workflow-lint stage. - .github/actionlint.yaml: declare self-hosted, pf-ci, pf-ci-release, pf-ci-release-arm64, pf-ci-x64, pf-ci-x64-16 - scripts/ci_preflight.py: new actionlint-runner-labels stage that reads the config and fails on an undeclared literal label; workflow-lint now lints every workflow with -config-file - scripts/test_ci_preflight.py: must-fail cases for missing/undeclared labels - docs/ci.md: one sentence Co-Authored-By: Claude Code <noreply@anthropic.com>
notify-hub is release.yml's only fan-out. Pin its job-level guard and the dry_run dispatch input it reads in ci_preflight, with the must-fail rows: removing the guard, always(), a reversed condition, an always-true disjunction, a quoted scalar, and a dropped or retyped dry_run input all turn the contract stage red.
… allowlist pf-ci-release-arm64 is a RESERVED runner-group name, not a live label: no engine workflow uses it and canon (ci-labels.md) does not name it. The allowlist and the self-test's synthetic workflow now carry only the labels that exist; the ARM follow-up declares the label once laneboss posts it. Co-Authored-By: Claude Code <noreply@anthropic.com>
luisleo526
added a commit
that referenced
this pull request
Oct 20, 2026
Brings in #461 (engine release jobs on pf-ci-release). It touches .github/workflows/promote-baseline.yml, .github/workflows/release.yml, .github/actionlint.yaml, docs/ci.md, scripts/ci_preflight.py and scripts/test_ci_preflight.py; the merge has no conflict (this branch changes ci.yml, AGENTS.md, CONTRIBUTING.md and different regions of the other three). No resolution edits were made. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
luisleo526
added a commit
that referenced
this pull request
Oct 20, 2026
Brings in #461 (engine release and promote jobs on pf-ci-release). Conflicts in scripts/ci_preflight.py (3 hunks), scripts/test_ci_preflight.py (2), docs/ci.md (4) and .github/actionlint.yaml (main's superset taken); both intents are kept: - ci_preflight.py: the canon CI/native pins, authz and refusal-step checks stay; #461's RELEASE_RUNNER, RELEASE_JOB_RUNNERS and release/promote event checks come in; HOSTED_JOB_RUNNERS keeps only docs `build`, because #461 removed the hosted pins for promote and release. The release `prebuilt` matrix expression stays `${{ matrix.runner }}` as on main. - test_ci_preflight.py: the canon tests and #461's isolated-release tests and the actionlint label tests are all kept; the tests that asserted the old hosted promote/release routes are replaced by #461's pinned-route tests. - docs/ci.md: the canon text stays verbatim; #461's release isolation and promotion descriptions come in; the dated transitional sentence now says the hosted pins are gone and cites the real lines of the resolved preflight. Resolution by Codex lane core-canon-merge461 (report kept with the lane), read hunk by hunk by the supervisor; the preflight on the merged tree is the check. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
luisleo526
added a commit
that referenced
this pull request
Oct 20, 2026
…cks under the CI canon (#464) * ci: native-live and the ubuntu Debug leg run as canon pull_request checks (authz + pool labels, no hosted fallback) Apply the frozen ci-labels.md canon, SHA-256 ac875205d8bdae2d7e0c23aca438118a0e9da2efb297de4e6b2cd80e7416f5b3. Copy the canon authz job into CI and the reusable native workflow. Gate all work on it, remove the PR branch filter and hosted runner fallbacks, use the heavy pool for preflight and Linux builds, and retain the existing macos-26 exception. Both always-running aggregates refuse non-successful authz first; the caller retains only the classified docs-only skip exception. Keep PR slow-row selection and all existing platform job maxima unchanged. Pin the resolved arrays, authz script and dependencies, and refusal steps. Add file-backed runner/authz/aggregate mutations and real-shell identity cases, including a no-op refusal mutation. Keep corpus and release routing separately pinned without changing those workflows. Intentionally replace the old runner/fallback and classification policy sentences in docs/ci.md, including material introduced by 0212cab, 3c19a69, 133f571, 693fd9e, d093560, 116c461, c3ed455, f736676, 2394ba2 and 7da487a. This supersedes the 28fe3466a / f9bee22 policy descriptions and the 3484a7c stopgap; no new timing measurements are claimed. No repository scripts, linters, lexers, builds or tests were run on this Mac, per CORE-TOP's 2026-10-20 stop order. The org policy checker was also not run because it requires Ruby. Git hooks are disabled for this commit so they cannot execute repository code. Full verification and pool CI remain pending on the committed tree. * ci: fix canon CLOUD preflight and status-function guards Repair the stale verifier-name mutation by matching the real step fields independently and keeping a file-backed unsized-call refusal witness. Declare the pool labels in the automatically discovered actionlint config and refresh the AGENTS content pin. Copy the frozen ci-labels.md refusal step before checkout in every inline CI job with a status function. Enforce the protocol for always, cancelled, failure and success, retain leading uses/run keys on unnamed steps, and add file-backed negative controls with positive guarded-run controls. Canon SHA-256: ac875205d8bdae2d7e0c23aca438118a0e9da2efb297de4e6b2cd80e7416f5b3. Intentionally correct the classification-order sentence in docs/ci.md introduced by 133f571: authz is first and changes needs it. The native-feature-parity edit changes only the sha256 pin for the unchanged AGENTS lines. No repository script, test, linter, parser, build or measurement was run on this Mac under the owner stop order. Git hooks are disabled for this local commit. The supervisor CLOUD preflight remains the validation judge. * docs: point the PASS anchor at the AGENTS.md lines that hold it The anchor's pin hash was refreshed to AGENTS.md:144-145, but the sentence it cites (`PASS` verdict binding the exact HEADs) lives at 149-150, so the SYMMISS check fails the preflight. Restore the pin to the windows's real hash and cite the real range. Co-Authored-By: Claude Code <noreply@anthropic.com> * docs(ci): restore the ci.md rules the preflight enforces, under the owner's October 20 runner rulings Squash of two earlier docs commits (e413335ad restored the preflight-enforced rules; 5c1bc44e2 adopted the owner's October 20 runner rulings): against the parent the net change is additions plus one rewritten sentence, and no L6 2026-10-19 hosted paragraph appears at all. Policy now stated in docs/ci.md: owner CI-HOSTED = B (all CI on our own machines, credentialed jobs included: credential-free jobs on pf-ci, credentialed jobs on pf-ci-release at protected refs, one job per VM, only macOS stays on GitHub; the CR-171 hosted exception is void) and REL-HOSTED = B (no release hosted exception), as amended by L6 on 2026-10-21 00:0x. A dated transitional sentence names the preflight pins that still list docs, promote and release as hosted until #461 and the ci/pfrel-* heads land. Rewritten sentence (the matrix-skip description), old text quoted verbatim: > so a documentation-only run shows one skipped `build` check instead of the four legs. Required-check configuration must retain this aggregate to enforce that exception. New text: the same sentences, with "under its unexpanded name" added after "one skipped `build` check". Validation: NOT RUN here (nothing from the repository runs on the authoring machine); the CLOUD preflight of the merged head is the proof. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> --------- Co-authored-by: luisleo526 <luisleo526@users.noreply.github.com> Co-authored-by: Claude Code <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Owner decision (2026-10-20): all CI on our own machines; credential jobs go to laneboss's separate
pf-ci-releaseclass, never the shared pool. This moves the engine's release workflow there.release,notify-huband the linux x86_64 prebuilt run on["self-hosted","pf-ci","pf-ci-release"]. macOS stays GitHub-hosted (no Mac hardware yet). The linux aarch64 prebuilt stays where it is until laneboss's release-arm class is live; its move is a separate follow-up.release.ymlis started byworkflow_dispatchonly. Thepf-ci-releaserunner group accepts onlyrelease.yml@refs/heads/main(laneboss, read back 20:2x), and the dispatcher refuses any other ref.notify-hubcarriesif: ${{ !inputs.dry_run }}and is the workflow's only dispatch. New must-fail rows inscripts/ci_preflight.py/test_ci_preflight.pyturn red if that guard or the boolean input goes away.Proof: engine preflight via lab remote on this head's tree,
rj-20261020t123148-16c678(CLOUD, passed). CORE-TOP gating read (Opus): all items ACCEPT after the one-line label fix in the last commit. Merge only once laneboss posts "pf-ci-release live" (L6 lands).🤖 Generated with Claude Code