Repository navigation
Surface early sticky disk commit denial and stop logging false commit success - #132
Merged
Merged
Conversation
Contributor
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
devin-ai-integration
Bot
force-pushed
the
devin/1788441779-branch-protection-readonly-notice
branch
from
September 3, 2026 13:52
2fc7a9e to
f81f4d4
Compare
piob-io
marked this pull request as ready for review
September 3, 2026 14:24
shreyas-blacksmith
approved these changes
Sep 3, 2026
shreyas-blacksmith
left a comment
shreyas-blacksmith
left a comment
Contributor
There was a problem hiding this comment.
The response fields are read through a structural cast, so this builds against the current @buf/blacksmith_vm-agent.* packages and is a no-op against agents that don't set them; bump the packages once fa#5403 is published. dist/ is rebuilt.
Cool pattern!
… success The VM agent reports commit_early_deny/commit_early_deny_reason on GetStickyDisk when it already knows the commit will be denied (branch protection). Emit a notice at setup, save the reason to state, skip the commit request in the post step, and stop logging a successful commit: the RPC only records intent and the host applies it at VM shutdown. Bumps @buf/blacksmith_vm-agent.bufbuild_es (and its @bufbuild/protobuf peer) to the BSR build that includes the new fields. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
devin-ai-integration
Bot
force-pushed
the
devin/1788441779-branch-protection-readonly-notice
branch
from
September 4, 2026 13:44
f81f4d4 to
0ba89c7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CommitStickyDiskonly records commit intent; the host decides whether to commit at VM teardown, after the job log is finalized. The post step nevertheless logsSuccessfully committed sticky diskas soon as the RPC returns, so with sticky disk branch protection enabled, jobs on untrusted triggers (pull_request,repository_dispatch, …) print a success line while the host discards their changes — which reads as "branch protection is not working".The VM agent reports the policy outcome at mount time (FastActions/fa#5403):
GetStickyDiskResponse.commit_early_deny/commit_early_deny_reason(e.g.branch protection: event "repository_dispatch" is not a trusted trigger). This PR consumes it:getStickyDiskreturnscommit_early_deny_reason(non-empty iffcommitEarlyDeny);setupStickyDiskemitscore.notice("Sticky disk changes will not be committed for this job (<reason>). The build cache is used as-is and any changes to it are discarded.")and saves the reason to state (stateHelper.setCommitEarlyDenyReason). The guest can still write to the disk; only the commit is denied.commitStickyDiskand logSkipping sticky disk commit: denied for this job (<reason>); changes to the build cache are discarded. Otherwise unchanged, except the final line is nowSticky disk commit requested; applied at VM shutdown— the action only knows the request was accepted.@buf/blacksmith_vm-agent.bufbuild_es(and its@bufbuild/protobufpeer) is bumped to the BSR build that carries the new fields; against agents that don't set them the fields decode asfalse/""and behavior is unchanged.dist/is rebuilt.Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled. (Staging)Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Link to Devin session: https://app.devin.ai/sessions/fef6ace05e9346dc9b520c6f7e20590c
Open in Devin Desktop: https://app.devin.ai/desktop/session/fef6ace05e9346dc9b520c6f7e20590c?variant=devin
Requested by: @piob-io