mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-31 19:16:29 +00:00
007ca57dc8
From the workflow reliability audit: - tests.yml: duration-cache restore had NO restore-keys while saves use run_id-suffixed keys — the cache never matched once, so LPT slicing always ran blind and unbalanced slices pushed heavy files toward the per-file timeout. One-line restore-keys fixes slice balancing. - Label gates (lint ci-reviewed, supply-chain mcp-catalog-reviewed): 'gh pr view || true' turned an API blip into 'label absent' → false BLOCKING failure. Now 3x retry, and API failure is reported as an API failure instead of a missing label. - detect-changes action: compare API retried before failing open (was silently running all lanes on any blip). - uv-lockfile-check: 'uv lock --check' resolves against PyPI — retried so registry blips don't read as 'lockfile stale'. - docker.yml merge job: imagetools create retried (Docker Hub eventual consistency on just-pushed digests). - Dockerfile: apt-get Acquire::Retries=3; s6-overlay ADDs converted to curl --retry 3 (ADD cannot retry; checksums still enforced); npm --fetch-retries=5; playwright chromium fetch retried 3x. - Advisory artifact uploads (per-slice durations, ci-timings report) get continue-on-error so an artifact-service blip can't fail a green test slice.
84 lines
3.3 KiB
YAML
84 lines
3.3 KiB
YAML
name: Detect affected areas
|
|
description: >-
|
|
Classify a PR's changed files into CI work lanes (python, frontend, site,
|
|
scan, deps, mcp_catalog) so the orchestrator can conditionally call only
|
|
the sub-workflows a PR can affect. Outputs are always "true" on push/dispatch
|
|
events and fail open (everything "true") when the diff cannot be computed.
|
|
|
|
outputs:
|
|
python:
|
|
description: Run Python tests / ruff / ty / windows-footguns.
|
|
value: ${{ steps.classify.outputs.python }}
|
|
frontend:
|
|
description: Run the TypeScript testing matrix + desktop build.
|
|
value: ${{ steps.classify.outputs.frontend }}
|
|
docker_meta:
|
|
description: Docker setup and meta files have changed.
|
|
value: ${{ steps.classify.outputs.docker_meta }}
|
|
site:
|
|
description: Build the Docusaurus docs site.
|
|
value: ${{ steps.classify.outputs.site }}
|
|
scan:
|
|
description: Run the supply-chain critical-pattern scanner.
|
|
value: ${{ steps.classify.outputs.scan }}
|
|
deps:
|
|
description: Check pyproject.toml dependency upper bounds.
|
|
value: ${{ steps.classify.outputs.deps }}
|
|
npm_lock:
|
|
description: Post/update the semantic package-lock.json diff PR comment.
|
|
value: ${{ steps.classify.outputs.npm_lock }}
|
|
mcp_catalog:
|
|
description: Require MCP catalog security review label.
|
|
value: ${{ steps.classify.outputs.mcp_catalog }}
|
|
ci_review:
|
|
description: Require CI-sensitive file review label.
|
|
value: ${{ steps.classify.outputs.ci_review }}
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Classify changed files
|
|
id: classify
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
REPO: ${{ github.repository }}
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# Only pull_request events are gated. Other events (push, release,
|
|
# dispatch) leave CHANGED empty, so the classifier fails open and every
|
|
# lane runs. Post-merge / on-demand validation is never weakened.
|
|
if [ "$EVENT_NAME" = "pull_request" ]; then
|
|
# Use the compare endpoint with the pinned base/head SHAs from the
|
|
# event payload instead of the "current PR files" endpoint. The SHAs
|
|
# are frozen at trigger time, so the file list is deterministic even
|
|
# if the PR receives a new push between trigger and detect.
|
|
#
|
|
# Retried: a rate-limit blip or eventual-consistency 404 on a
|
|
# freshly-pushed HEAD would otherwise silently fall open (all lanes
|
|
# run — safe, but wasteful and it masks the API failure).
|
|
CHANGED=""
|
|
for i in 1 2 3; do
|
|
if CHANGED="$(gh api \
|
|
--paginate \
|
|
"repos/${REPO}/compare/${BASE_SHA}...${HEAD_SHA}" \
|
|
--jq '.files[].filename')"; then
|
|
break
|
|
fi
|
|
if [ "$i" = 3 ]; then
|
|
echo "::warning::compare API failed after 3 attempts — failing open (all lanes run)"
|
|
CHANGED=""
|
|
break
|
|
fi
|
|
echo "::warning::compare API failed (attempt $i); retrying in 10s"
|
|
sleep 10
|
|
done
|
|
fi
|
|
|
|
echo "Changed files:"
|
|
printf '%s\n' "${CHANGED:-(none)}"
|
|
printf '%s\n' "${CHANGED:-}" | python3 scripts/ci/classify_changes.py
|