fix(ci): serialize AKS deploys without cancelling in-progress applies - #1596
seonghobae wants to merge 2 commits into
Conversation
Queue concurrent Deploy to AKS calls per repository so the shared naruon-dev namespace is not applied twice at once. Keep cancel-in-progress false because this is a deploy publication path.
|
Warning Review limit reachedNext included review available in 21 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
@coderabbitai review Exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="042b0c70531b229af3acbd0421a2f23098d848b3"
head="56d30a07d48f688519543815fd601e533dc8c3cd"
echo '== checked-out commit =='
git rev-parse HEAD
echo '== exact range changed files =='
git diff --name-status "$base" "$head"
echo '== exact range diff =='
git diff --check "$base" "$head"
git diff --find-renames --find-copies --unified=80 "$base" "$head" -- \
.github/workflows/deploy.yml \
backend/tests/test_deploy_workflow_concurrency.py
echo '== workflow outline/content =='
ast-grep outline .github/workflows/deploy.yml --items all || true
cat -n .github/workflows/deploy.yml
echo '== regression test outline/content =='
ast-grep outline backend/tests/test_deploy_workflow_concurrency.py --items all || true
cat -n backend/tests/test_deploy_workflow_concurrency.py
echo '== deploy workflow references and concurrency settings =='
rg -n -C 4 --glob '*.yml' --glob '*.yaml' \
'(^|\s)(concurrency:|group:|cancel-in-progress:|queue:)|deploy-aks-|deploy\.yml' \
.githubLength of output: 13682 🤖 web_search executed:
Length of output: 11658
변경 범위는
회귀 테스트는 group, Docker, Semgrep, CodeQL의 non-terminal 상태는 이 검토의 approval 근거로 사용하지 않았습니다.
|
|
@coderabbitai review Exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="042b0c70531b229af3acbd0421a2f23098d848b3"
head="7e29bfcacc02d950fb738a7d43a257582971e995"
echo "== checked-out commit =="
git rev-parse HEAD
echo "== exact range changed files =="
git diff --name-status "$base" "$head"
echo "== whitespace check =="
git diff --check "$base" "$head"
echo "== exact scoped diff =="
git diff --find-renames --find-copies --unified=100 "$base" "$head" -- \
.github/workflows/deploy.yml \
backend/tests/test_deploy_workflow_concurrency.py
echo "== workflow content =="
cat -n .github/workflows/deploy.yml
echo "== regression test content =="
cat -n backend/tests/test_deploy_workflow_concurrency.py
echo "== relevant workflow settings across workflow files =="
rg -n -C 4 --glob '*.yml' --glob '*.yaml' \
'(^|\s)(concurrency:|group:|cancel-in-progress:|queue:)|deploy-aks-|deploy\.yml' \
.github
echo "== current PR check rollup =="
gh pr checks 1596 --repo ContextualWisdomLab/naruon --json name,state,link,workflow 2>&1 || trueLength of output: 18954
Checked-out head는 변경 범위는
현재 head의 CI에는
|
|
@coderabbitai review Current exact head is |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="042b0c70531b229af3acbd0421a2f23098d848b3"
head="7e29bfcacc02d950fb738a7d43a257582971e995"
echo "== checked-out revision =="
git rev-parse HEAD
echo "== base and head objects =="
git cat-file -t "$base"
git cat-file -t "$head"
echo "== protected-base changed paths =="
git diff --name-status "$base" "$head"
echo "== whitespace errors =="
git diff --check "$base" "$head"
echo "== scoped protected-base delta =="
git diff --find-renames --find-copies --unified=100 "$base" "$head" -- \
.github/workflows/deploy.yml \
backend/tests/test_deploy_workflow_concurrency.py
echo "== deploy workflow =="
cat -n .github/workflows/deploy.yml
echo "== regression test =="
cat -n backend/tests/test_deploy_workflow_concurrency.py
echo "== concurrency-related workflow configuration =="
rg -n -C 5 --glob '*.yml' --glob '*.yaml' \
'(^|\s)(concurrency:|group:|cancel-in-progress:|queue:)|deploy-aks-|deploy\.yml' \
.github
echo "== exact-head PR check rollup (informational only) =="
gh pr checks 1596 --repo ContextualWisdomLab/naruon --json name,state,link,workflow 2>&1 || trueLength of output: 22824 🤖 web_search executed:
Length of output: 13554
I found no source-backed issues in the requested scope.
I did not transfer predecessor review results or check results. I did not use the current check rollup as an approval basis.
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
7e29bfcacc02d950fb738a7d43a257582971e995. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34173300797/job/101898413126)
- CodeQL PR/CodeQL compatibility analysis (javascript-typescript): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34173300797/job/101898413179)
- CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34173300797/job/101898413139)
- CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34173300797/job/101898413126)
- CodeQL compatibility analysis (javascript-typescript) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34173300797/job/101898413179)
- CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34173300797/job/101898413139)
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34173299597/job/101898553461)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34173299597/job/101898553461)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: deploy.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: deploy.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_deploy_workflow_concurrency.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_deploy_workflow_concurrency.py"]
R2 --> V2["targeted test run"]
OpenCode Review Overview
|
seonghobae
added
bug
ChatGPT Codex Connector
|
Current exact-head audit (2026-09-08): head |
1 participant
목표와 현재 권위
deploy.yml은 release tag publication path에서docker-publish.yml이 호출하는 AKS apply owner입니다. 기존에는 workflow-level concurrency가 없어 연속 publication이 동일한naruon-devnamespace에 겹쳐 apply될 수 있었습니다.develop@042b0c70531b229af3acbd0421a2f23098d848b37e29bfcacc02d950fb738a7d43a257582971e995.github/workflows/deploy.yml,backend/tests/test_deploy_workflow_concurrency.pybandit.yml,docker-publish.yml,mail-smoke.yml의 별도 owner PR은 수정하지 않았습니다.finding → causal fix
GitHub Actions의 default
queue: single은 running 1개 + pending 1개 상태에서 추가 run이 들어오면 기존 pending run을 교체합니다. 배포 publication은 오래된 requested deploy를 조용히 버리는 동작이 적절하지 않으므로 repository-wide deploy group에cancel-in-progress: false와queue: max를 사용합니다.queue: max는 현재 concurrency group당 pending run 최대 100개를 보존하며 초과 요청은 취소될 수 있습니다. 실행 시작 순서는 플랫폼 scheduling 영향이 있으므로 사용자 수준 FIFO를 보장한다고 주장하지 않습니다.Original source
56d30a07d48f688519543815fd601e533dc8c3cd의 workflow comment는 이 실제 contract와 달리 “Keep every requested deploy queued”라고 적혀 있었습니다. #1595에서 같은 계열의 CodeRabbit finding을 검증한 뒤 이 PR도 fresh source로 대조해 동일한 과장 표현임을 확인했습니다. Ordinary child7e29bfcacc02d950fb738a7d43a257582971e995에서 동작은 그대로 두고 comment만 bounded semantics로 수정했습니다: pending 최대 100개, bound 초과 시 취소 가능, FIFO 보장 없음. predecessor GREEN은 새 head로 승계하지 않습니다.Primary authority:
Focused regression
backend/tests/test_deploy_workflow_concurrency.py는 repository-widedeploy-aks-${{ github.repository }},cancel-in-progress: false,queue: max,cancel-in-progress: true비재도입을 고정합니다.exact-head validation boundary
Current unchanged
7e29bfc...repository-owned runs are terminal except the shared required CodeQL verdict:34173300788— success34173300820— success34173300951— success34173300812— success34173300835— success34173300797— failure at the shared fail-closed terminal-verdict bridge; 이 PR의 deploy source-analysis finding으로 입증된 실패가 아님.Current inline review thread는 0개이고 formal review submission도 아직 0개입니다. Exact-head
@coderabbitai review를 다시 요청했으며 response/approval을 merge evidence로 미리 간주하지 않습니다.CodeQL failure는 canonical
ContextualWisdomLab/.github#1929가 소유하는 current-head terminal receipt/publication 문제와 같은 패턴입니다. Naruon에서 synthetic status, dummy commit, authorization 확대, central workflow 복제나 gate 완화로 우회하지 않습니다.acceptance
cancel-in-progress: false, PASS at source.queue: max, PASS at source; platform maximum 100, FIFO/unlimited claim 없음.Merge는 이 unchanged exact head에서 당시의 모든 required context가 terminal-success이고 qualifying post-last-push independent approval이 있을 때만 허용합니다. force-push, destructive rebase, self-approval, synthetic status, dummy/no-op requeue, central authorization widening, gate weakening은 금지합니다.