Repository navigation
CI: merge queue prerequisites (merge_group triggers, one fixtures result) - #742
Conversation
PHPUnit Feature, Shared Server fixtures, SonarQube and Public Boundary now also run on merge_group, so a merge queue can replace the require-up-to-date rerun loop. Base-revision checks use the queue group's base_sha, the boundary scan covers the group's exact base..head range, and the push trigger skips gh-readonly-queue/** branches that the merge_group run already scans. Shared Server fixtures has no path filter for merge_group, so every queued group gets the full profile.
tests/Unit/MergeGroupTriggersTest.mjs checks that PHPUnit Feature, Shared Server fixtures, SonarQube and Public Boundary run on merge_group, that base-revision checks and the boundary range use the queue group's base and head, that queue branches are not scanned twice, and that superseded-run cancellation never applies to a queue group. It runs in Repository contracts. It fails 6 of 7 checks on the train head without merge_group support.
The OpenAPI evolution and regression corpus contracts pin the exact base revision expression; include the merge_group base so a queued group diffs against the revision it was built on.
The Sonar job receives SONAR_TOKEN and its fork guard is always true for a merge group, so it no longer runs on merge_group; the contract test now requires that. Public Boundary scans every push again, including queue branches, and the test requires the unfiltered push trigger alongside the exact merge-group range.
…y group #723 removed PHPUnit Feature's concurrency group, because its required gate runs with always() under the central action policy. The test now requires that any cancel-in-progress in a workflow the queue waits for cancels only pull request runs, and that Shared Server fixtures keeps its pull-request-only cancellation.
In each database job of Shared Server fixtures, the nine published-SDK direction profiles ran one after another (two pairs already overlapped), about 22 of the job's 64-72 minutes (train #729, PostgreSQL 17 job 120866907013: 12:19:50 to 12:41:36). Each profile already has its own containers, PHP and embedded databases, evidence and state directory, and its own workflow-ID prefix on the shared native server. sdk-direction-lanes.sh now runs them in three lanes balanced by those durations, in order within a lane. Every profile runs even after another fails; the step fails if any did, after printing each profile's log in its own group. The job's existing cleanup steps still stop and remove every profile's containers. Expected saving: about 14 minutes per database job.
heartbeat_renews_only_progress_deadline_and_cannot_resurrect_elapsed_authority compared two lease_expires_at strings. Native times are whole milliseconds and serialize without a fraction on a whole second, so a claim lease of ...:26Z sorted after a renewal of ...:26.045Z and the assertion failed about one run in a thousand (train #729, PostgreSQL 17 job 120852521096). The test now parses both and reports the values.
A required check and the merge queue both need a result that always reports. The pull_request path filter meant a docs-only pull request got no Shared Server fixtures result at all, so the workflow could not be required. - Pull requests now run the workflow without a path filter. A short `changes` job applies the push trigger's path list to the pull request's merge commit (renames count on both sides), so one list governs both triggers. Push, merge_group and manual runs run every fixture job, as does any pull request that cannot be classified. - `published-sdk-adapters` runs only when the classifier says so; the other fixture jobs need it, so they skip with it. - A terminal `Shared Server fixtures result` job runs with always(). It passes only when every fixture job passed, or when no input changed and every fixture job was skipped. A failed, cancelled or unexpectedly skipped job, a failed classifier, or an unreadable needs context fails it. - ServerParityAggregateTest covers the workflow structure, the result decisions and the classifier against scratch pull request merge commits. Repository contracts runs it. No permissions, secrets, actions or artifact paths change. Making the result a required check, and enabling the merge queue, stay separate repository-setting steps.
The Docker workflow isolation policy accepts only literal .sh and .py repository helpers in workflow steps, so the new jobs' direct node calls failed Public Boundary. changes.sh and aggregate.sh now run the Node scripts from the repository root, as the workflow does, and the classifier tests go through changes.sh.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Security correction required at exact head The failed CodeQL check is a concrete high-severity annotation at Please replace the dot-only replacement with complete regular-expression-literal escaping for every non-wildcard segment (after splitting The remaining source review and two in-progress checks continue in parallel. Send the corrected immutable head after its checks settle; no blind rerun of this head is requested. |
Every database job waited for published-sdk-adapters (about 15 minutes), but 10 of those minutes built the optimized native binary only the codec-deadline-health cells use (train #729: "Build one bounded optimized native artifact for deadline health", 10.0 minutes). The build, its upload and its container cleanup now run in a codec-native-build job beside the adapters; codec-deadline-health needs both, and the database jobs still need only the adapters, so they start about 10 minutes sooner. The build script and its bounded resources are unchanged.
|
Additional Security correction required at the same #742 head: the change classifier can skip a path that is inside a required prefix when the Git filename contains control characters. Exact isolated counterfactual: a pull-request merge commit added the valid Git path Please read the Git file list as bytes with No repository setting change or rerun is requested on the known-bad head. |
|
Security activation boundary: #742 remains source preparation, not authority to enable the merge queue. The active rulesets currently require After the source corrections and source merge, queue activation still requires coordination with General as the public-repository Sonar owner, an actual controlled merge-group SHA showing both current required checks plus the new terminal |
…est the lane wrapper Each lane stops its profile's PHP server as soon as the profile ends, so at most three run at once, and a failed stop only warns. The profile's status is kept either way. A shell-level test runs the wrapper with stub profiles and docker: all nine profiles run, every server is stopped after its profile, a failed profile does not stop its lane, and the wrapper fails only after printing every status and log. Also resolves the wrapper's Sonar findings.
… fixture when patterns or names cannot be classified The file list is read as bytes with --name-only -z and split only on NUL, so a quoted name can no longer slip past a required prefix; wildcards match newlines; a name that is not UTF-8 or an unsupported pattern runs every fixture job instead of failing the classifier.
…and wait for it codec-native-build is a second root fixture job. It runs only through the change classifier, and the result needs it like every other fixture job.
|
Corrections at head
42/42 pass in |
|
One exact-head correction remains for The substantive classifier fixes are sound in review: complete literal escaping in the production compiler, NUL-delimited byte input, fatal UTF-8 decoding that fails open to running, newline/tab/non-UTF-8 counterfactuals, and #741's However, the exact-head CodeQL gate is still red with a new high annotation at Please avoid a second regex compiler here. Compare the workflow block's lines to the exact literal |
|
Security exact-head source acceptance for
The requested Security source correction is accepted, so no further Security patch wait remains. The previously recorded activation boundary is unchanged: source merge does not authorize enabling the merge queue. Activation still requires General/Sonar coordination and a controlled real merge-group SHA proving the current required PHPUnit and Sonar App checks plus the new terminal fixture aggregate, including the negative/fail-closed case, without weakening Sonar. |
… the native server The namespace and selected-run signal profiles ran beside the plain signal profile, and on PostgreSQL 17 one's worker showed in another's routing diagnostics (server-parity-sdk-signals). The old serial workflow never overlapped them. A test now reads each profile's queues from its fixtures and refuses any two profiles that share one in different lanes.
…-325-merge-group-v2
|
Part of #325. Replaces #725 and #727, rebuilt on current
main(after #729) with only their merge-queue commits.Why
Each PR re-qualifies by hand whenever
mainmoves. A merge queue qualifies queued PRs in order against the head they will land on, so nobody has to mergemainback in and re-run. This PR makes the required checks run formerge_groupevents and gives branch protection one always-reporting fixtures result, so Security can turn the queue on.Change
merge_grouptriggers on PHPUnit Feature, Public Boundary and Shared Server fixtures (from CI: run the required checks for GitHub merge queue groups #725):changesjob (changes.sh) applies the push path list. Pull requests that cannot affect the fixtures, such as documentation-only changes, skip the fixture cells instead of running them.aggregatejob (aggregate.sh) always reports one terminal result for branch protection. Skipped cells count as passing only whenchangessaid to skip them.Checks
MergeGroupTriggersTestandServerParityAggregateTestpass 33/33, and the Docker workflow isolation policy passes.