Repository navigation
ci: route post-merge build and sanitizer shards to on-demand runners - #743
Conversation
Keep the post-merge build and sanitizer jobs on the dedicated on-demand profiles, and update the preflight, actionlint, allowlist mirror, tests, and CI runner table to describe those exact labels.
Treat on-demand amd64 labels as part of the runner-loss retry fleet, cover the new labels with a real acceptance row, remove the unused old label, and document the rollback path.
Fold the rollback note into the existing rerun policy paragraph so the documented line-count contract stays unchanged.
Keep the disk-sized amd64 acceptance control and require on-demand arm64 and malformed-label inputs to remain refused.
Update the release-gate workflow expectations to match the post-merge Release build label, preserving shard and runner-drift refusal controls.
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
No issues found by static checks — no coupling regressions or blocking issues in the code graph. That is not the same as safe to merge: see what was not checked.
Not checked: tests were not run; no formal proof of the changed code.
Graphify review — findings
Switches the ci-post.yml Release build and sanitizer jobs to new on-demand GKE runner labels, gke-ondemand-32cpu-64gb-amd64 and gke-ondemand-32cpu-64gb-amd64-256gb, replacing the old gke-32cpu-64gb-amd64 pair. The new labels are added to the actionlint self-hosted list, the runner-group allowlist mirror and docs/ci.md, so the docs and allowlist match the workflow. scripts/ci_preflight.py now expects the on-demand labels for those two jobs, and its GKE route and runner-group regexes accept an optional -ondemand segment. Preflight therefore refuses the old labels on ci-post.yml and still treats the new ones as group-member scale sets. The preflight tests are updated to the new expectations.
No blocking issues surfaced. 1 lower-confidence candidate did not survive cross-model review.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 919 functions depend on the 891 functions this change touches.
Health — grade C; 10 existing hotspot(s) in the area this change touches (pre-existing, not introduced here):
ci_workflow_findings()— 81 callers, 24 callees (high)gke_admit_workflow_findings()— 16 callers, 11 callees (high)check_commands()— 22 callers, 5 callees (high)native_workflow_findings()— 9 callers, 12 callees (high)_job_values()— 29 callers, 3 callees (high)admit_rule_findings()— 7 callers, 9 callees (high)_job_block()— 17 callers, 3 callees (high)runner_findings()— 2 callers, 25 callees (high)- …and 2 more
Verification — 919 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 919 function(s) in the blast radius were not formally verified this run
Merge main aff553b into the #742 branch without rebasing or force-updating it. Keep the complete #743 main delta. Conflict resolutions: - scripts/ci_preflight.py: keep #742's NATIVE_X86_JOB mapping to the spot 32CPU label while retaining main's on-demand build and sanitizer labels. - scripts/test_ci_preflight.py: keep the matching NATIVE_X86_JOB expectation and main's on-demand build and sanitizer expectations. All other main hunks are retained, including the workflow, allowlist, docs, rerun-controller, release-gate, and rerun-preempted changes.
Move only the post-merge Release build shards and sanitizer shards to the dedicated on-demand runner labels. Synchronize the runner-label contract and its tests with the workflow, keep every other job on its existing runner, and update the CI runner table.
Validation: the full test_ci_preflight.py module (504 tests) plus actionlint runner-label, runner-allowlist, and CI-workflow checks pass on the exact head.
This change updates the checker's runner-label pins together with the workflow, so the first admission run against main's rules is expected to fail until it lands.
🤖 Generated with Claude Code