mirror of
https://github.com/nexu-io/open-design.git
synced 2026-09-20 06:15:06 +08:00
PerishFire
993f2e1a9e
* feat(ci): add workload convergence shadow * fix(ci): identify convergence public reads * refactor(ci): move convergence policy into scripts * fix(ci): fail open on malformed convergence reads Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * fix(ci): preserve safe convergence observations Generated-By: looper 0.11.2 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>
104 lines
4.0 KiB
YAML
104 lines
4.0 KiB
YAML
name: convergence.atom
|
|
|
|
# Atomic capability: publish immutable reusable workload results only after a
|
|
# successful ci run. All validation and R2 writes execute trusted default-branch
|
|
# Python; pull-request code is treated solely as data.
|
|
on:
|
|
workflow_run:
|
|
workflows: [ci]
|
|
types: [completed]
|
|
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: convergence-${{ github.event.workflow_run.id }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
publish:
|
|
name: Publish reusable workload results
|
|
if: >-
|
|
${{
|
|
github.repository == 'nexu-io/open-design'
|
|
&& github.event.workflow_run.name == 'ci'
|
|
&& github.event.workflow_run.conclusion == 'success'
|
|
&& github.event.workflow_run.head_repository.full_name == github.repository
|
|
&& (
|
|
github.event.workflow_run.event == 'pull_request'
|
|
|| github.event.workflow_run.event == 'merge_group'
|
|
)
|
|
}}
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- name: Checkout trusted convergence code
|
|
uses: actions/checkout@v6.0.2
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.event.repository.default_branch }}
|
|
fetch-depth: 1
|
|
|
|
- name: Check trusted convergence contracts
|
|
run: |
|
|
python3 .github/scripts/handoff.py self-check
|
|
python3 .github/scripts/convergence.py validate
|
|
|
|
- name: Resolve convergence handoff
|
|
id: artifact
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: python3 .github/scripts/handoff.py resolve-run-artifact convergence ci-results
|
|
|
|
- name: Download convergence handoff
|
|
if: ${{ steps.artifact.outputs.found == 'true' }}
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: ${{ steps.artifact.outputs.name }}
|
|
run-id: ${{ github.event.workflow_run.id }}
|
|
path: ${{ runner.temp }}/handoff-convergence
|
|
github-token: ${{ github.token }}
|
|
|
|
- name: Validate producing run and control plane
|
|
if: ${{ steps.artifact.outputs.found == 'true' }}
|
|
id: trust
|
|
run: >-
|
|
python3 .github/scripts/convergence.py admit
|
|
--handoff-root "$RUNNER_TEMP/handoff-convergence"
|
|
|
|
- name: Resolve publication configuration
|
|
if: ${{ steps.trust.outputs.publish == 'true' }}
|
|
id: storage
|
|
env:
|
|
CLOUDFLARE_R2_WORKLOAD_RESULTS_URL: ${{ secrets.CLOUDFLARE_R2_WORKLOAD_RESULTS_URL }}
|
|
CLOUDFLARE_R2_WORKLOAD_RESULTS_BUCKET: ${{ secrets.CLOUDFLARE_R2_WORKLOAD_RESULTS_BUCKET }}
|
|
OD_WORKLOAD_RESULTS_BASE_URL: ${{ secrets.OD_WORKLOAD_RESULTS_BASE_URL }}
|
|
CLOUDFLARE_R2_WORKLOAD_RESULTS_AK: ${{ secrets.CLOUDFLARE_R2_WORKLOAD_RESULTS_AK }}
|
|
CLOUDFLARE_R2_WORKLOAD_RESULTS_SK: ${{ secrets.CLOUDFLARE_R2_WORKLOAD_RESULTS_SK }}
|
|
run: python3 .github/scripts/convergence.py storage-status
|
|
|
|
- name: Download current-run product artifacts
|
|
if: ${{ steps.storage.outputs.configured == 'true' }}
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: >-
|
|
python3 .github/scripts/convergence.py stage-products
|
|
--candidate "${{ steps.trust.outputs.candidate }}"
|
|
--output-dir "$RUNNER_TEMP/convergence-products"
|
|
|
|
- name: Publish immutable workload results
|
|
if: ${{ steps.storage.outputs.configured == 'true' }}
|
|
env:
|
|
CLOUDFLARE_R2_WORKLOAD_RESULTS_URL: ${{ secrets.CLOUDFLARE_R2_WORKLOAD_RESULTS_URL }}
|
|
CLOUDFLARE_R2_WORKLOAD_RESULTS_BUCKET: ${{ secrets.CLOUDFLARE_R2_WORKLOAD_RESULTS_BUCKET }}
|
|
OD_WORKLOAD_RESULTS_BASE_URL: ${{ secrets.OD_WORKLOAD_RESULTS_BASE_URL }}
|
|
CLOUDFLARE_R2_WORKLOAD_RESULTS_AK: ${{ secrets.CLOUDFLARE_R2_WORKLOAD_RESULTS_AK }}
|
|
CLOUDFLARE_R2_WORKLOAD_RESULTS_SK: ${{ secrets.CLOUDFLARE_R2_WORKLOAD_RESULTS_SK }}
|
|
run: >-
|
|
python3 .github/scripts/convergence.py publish
|
|
--candidate "${{ steps.trust.outputs.candidate }}"
|
|
--output-dir "$RUNNER_TEMP/convergence-publication"
|
|
--products-root "$RUNNER_TEMP/convergence-products"
|