Repository navigation
ci: accept release.yml's matrix runner under its fetched path in PR admission - #615
luisleo526 wants to merge 2 commits into
Conversation
…admission rules
The member-only admission reads the head's workflows as data and names each
file by its repository path, so the runs-on literal check compared the bare
name `release.yml` with `.github/workflows/release.yml` and never matched.
Every pull request's admission therefore refused the one
`runs-on: ${{ matrix.runner }}` line that release.yml carries on main, and the
hosted result job went red before any pod job was requested.
Compare the file name instead of the full path. A new test fetches the real
release.yml with the admission workflow and expects no finding, and a control
row keeps the same line refused in any other workflow.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Code graph out of date: Health delta baseline: last indexed commit d55b116, 1 commit(s) behind this PR's base. Impact and hotspot numbers below may be wrong.
No verdict: the code graph is out of date. Static checks found no blocking issues, but they compared against an outdated graph. The next push after the repository re-indexes gets a full review.
Not checked: tests were not run; formal verification proved 0 of 1 changed function(s) (1 sampled, not proven).
Formal verification. PR-changed functions: 1/1 verified (0 proven, 1 may-equivalent, 0 distinguished) · 0 not verified.
Graphify review — findings
Fixes the admission check so the runs-on: ${{ matrix.runner }} exemption for release.yml applies when the file is named by its fetched repository path (.github/workflows/release.yml), not just the bare filename. The exemption now compares Path(name).name, so any other workflow carrying the same expression is still refused with "every runs-on must be a literal value". A new test copies the real workflow files into a temp directory, checks that admission passes, and checks that a stray other.yml with the same runs-on line is still flagged.
No blocking issues surfaced. 2 lower-confidence candidates did not survive cross-model review.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 660 functions depend on the 643 functions this change touches.
Health — this change adds coupling hotspots:
- worse:
ci_workflow_findings()— 79 callers, 24 callees - worse:
native_workflow_findings()— 8 callers, 11 callees - worse:
check_commands()— 17 callers, 5 callees - worse:
_job_values()— 24 callers, 3 callees - new:
gke_admit_workflow_findings()— 7 callers, 10 callees - worse:
runner_findings()— 2 callers, 20 callees - new:
admit_rule_findings()— 4 callers, 9 callees - worse:
_job_block()— 12 callers, 3 callees - …and 5 more — each is listed as a finding
Verification — 660 functions in the blast radius were not formally verified this run (proofs are advisory here).
Health delta baseline: last indexed commit d55b116, 1 commit(s) behind this PR's base.
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 660 function(s) in the blast radius were not formally verified this run
Formal verification
No difference found (not proven): No behavior difference found in \_admit\_flow\_findings (not a proof).
The verifier ran both versions of \_admit\_flow\_findings on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.
Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.
Note: An input the sampler did not try could still differ.
· 13 more finding(s) on lines outside this diff (see the check run).
Brings the branch up to date with main before its merge; no conflict, no other change. Co-Authored-By: Claude Opus 5.5 <[email protected]>
…aling, UDT graphs, metrics replay and the CI admission fix (#616) This lands twelve engine pull requests as one change, verified and measured once on the combined tree: - #593 scratch: a fixed write-through read cache for the adapter's id tables - #594 live runner: a delta report stream by default, and report-path work that does not rescan closed trades - #597 live runner: typed pre-growth stop for the ledger budget and flat pending counts - #608 run_json: reserve the report channel, so strategy output on fd 1 cannot corrupt a report - #586 Pine UDT object graphs on the paged object Store - #578 native order: dormant working book, flat per-point cost for never-filled orders - #579 adapter: skip roster passes and empty-family scans that cannot change anything - #599 adapter: read projected pending orders through one cached duplicate index - #563 adapter: gate the reversal exit cancel on candidate owners instead of every historical id - #591 report sink: retire sealed closed-trade rows on sink routes when the module opts in - #596 metrics: stream the bar Sharpe and Sortino through an ordered, packed return replay - #615 ci: accept release.yml's matrix runner under its fetched path in PR admission Fixes found while testing the combined tree are in the final commits: the retiring ledger's cache sizing, a residency witness that bounds sink-run heap by the declared cache cap and checks zero growth at 100k, 200k and 1M trades, a test fix for a descriptor reuse race, and a standing-orders timing grid whose 20,000-order point is tracked in #621. The member pull requests are closed as landed here.
The pull-request admission reads the head's workflows as data and names each file by its repository path. The
runs-onliteral check compared the bare namerelease.ymlwith.github/workflows/release.yml, so it never matched. Every pull request's admission therefore refused the oneruns-on: ${{ matrix.runner }}line thatrelease.ymlcarries on main. The result job went red before any pod job was requested; the first gke-pr run failed this way.The fix compares the file name instead of the full path (
scripts/ci_preflight.py, one line).scripts/test_ci_preflight.pygains a test that fetches the realrelease.ymltogether with the admission workflow and expects no finding; it fails on main with the line above. A control keeps the sameruns-onexpression refused in any other workflow file.No workflow file changes. The lab preflight of this commit is running.
🤖 Generated with Claude Code