Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
43 commits
Select commit Hold shift + click to select a range
b3a108f
fix: restore queue health recovery progression (#2054)
svelderrainruiz Mar 30, 2026
b17db63
policy: shrink develop required merge checks (#2055)
svelderrainruiz Mar 30, 2026
e3b7259
Use touch-history semantics in VI history proofs (#2056)
svelderrainruiz Mar 30, 2026
809ba89
Preserve VI history category specificity (#2057)
svelderrainruiz Mar 30, 2026
520068d
Reveal collapsed VI history pairs (#2058)
svelderrainruiz Mar 31, 2026
e17aa99
Clarify VI history decision guidance (#2059)
svelderrainruiz Mar 31, 2026
6bce62f
Make LV32 shadow proof non-blocking (#2060)
svelderrainruiz Mar 31, 2026
a85d77a
Identify latest VI history signal pair (#2061)
svelderrainruiz Mar 31, 2026
6a91ca5
Add VI history review sequence guidance (#2062)
svelderrainruiz Mar 31, 2026
0e99c52
Expose VI history decision chronology (#2063)
svelderrainruiz Mar 31, 2026
c648f46
Run Windows VI history proof on self-hosted ingress (#2065)
svelderrainruiz Mar 31, 2026
afca493
Honor docker override across NI Linux proof tooling (#2066)
svelderrainruiz Mar 31, 2026
78e578f
Introduce Pester service-model pilot (#2068)
svelderrainruiz Mar 31, 2026
0b2c3cd
[ops]: harden Pester service-model skip-path contracts (#2070)
svelderrainruiz Mar 31, 2026
1e11ac1
[ops]: allow trusted Pester router on integration branches (#2073)
svelderrainruiz Mar 31, 2026
1a89659
[ops]: fix auto-merge helper for workflow-edit PRs (#2074)
svelderrainruiz Mar 31, 2026
b913d83
Classify readiness-blocked Pester evidence explicitly
web-flow Mar 31, 2026
0a20e5c
[ops]: classify readiness-blocked Pester evidence explicitly (#2075)
svelderrainruiz Mar 31, 2026
6eda190
[ops]: remove trusted pilot path filter
web-flow Mar 31, 2026
d1a957b
[ops]: remove trusted pilot path filter (#2076)
svelderrainruiz Mar 31, 2026
168c3ac
[ops]: harden trusted pilot routing outputs
web-flow Mar 31, 2026
092b893
[ops]: move pilot routing inside pester gate
web-flow Mar 31, 2026
e3fbc9a
[ops]: split trusted pilot concurrency domains
web-flow Mar 31, 2026
2e9363e
ci(pester): split service-model context layer (#2078)
web-flow Mar 31, 2026
ce47461
ci(pester): add hosted promotion evidence packet
web-flow Mar 31, 2026
790ae42
ci(pester): pin hosted packet checkouts to PR head
web-flow Mar 31, 2026
e71b8e0
ci(pester): split selection receipt from execution
web-flow Mar 31, 2026
e4a103e
ci(pester): grant issues read to trusted router
web-flow Mar 31, 2026
4f59f84
ci(pester): isolate service-model concurrency groups
web-flow Mar 31, 2026
68e53ea
ci(auto): restore gh-based automerge on integration rail (#2084)
svelderrainruiz Mar 31, 2026
7b6a764
ci(auto): require squash auto-merge on integration rail (#2085)
svelderrainruiz Mar 31, 2026
d78a552
ci(pester): split execution postprocess from dispatch (#2083)
svelderrainruiz Mar 31, 2026
077ceaa
ci(pester): split execution finalize side effects (#2086)
svelderrainruiz Mar 31, 2026
304d82a
Add local proof autonomy packets and Windows staging contracts (#2087)
svelderrainruiz Apr 1, 2026
4d1aa1c
ci: promote Windows NI proof authority and local proof autonomy (#2088)
svelderrainruiz Apr 1, 2026
5c837a9
release: defer downstream proof for non-develop tags
web-flow Apr 1, 2026
4ef45c7
merge: promote integration pester service model into develop
web-flow Apr 1, 2026
7f07a21
release: carry conductor fixes onto develop
web-flow Apr 1, 2026
3f45268
release: prepare v0.6.10 cut
web-flow Apr 1, 2026
5ee2aa7
release: ignore self branch in queue health gate
web-flow Apr 1, 2026
781839a
fix: normalize vi history paths on windows proof surfaces (#2089)
svelderrainruiz Apr 1, 2026
aaa49f9
Merge remote-tracking branch 'upstream/develop' into codex/release-v0…
web-flow Apr 1, 2026
b97247b
chore(release): prepare v0.6.11
web-flow Apr 1, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions .github/actionlint.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,11 @@ self-hosted-runner:
labels:
- comparevi
- capability-ingress
- docker-lane
- labview-2026
- lv32
- docker-lane
- teststand
- self-hosted-docker-linux
- hosted-docker-linux

paths:
.github/workflows/release.yml:
ignore:
- 'SC2016:info:.*Expressions don''t expand in single quotes'
28 changes: 28 additions & 0 deletions .github/actions/dispatcher-profile/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,27 @@ outputs:
emit_failures_json_always:
description: 'Emit failures json always (true/false)'
value: ${{ steps.set.outputs.emit_failures_json_always }}
detect_leaks:
description: 'Detect lingering processes after execution (true/false)'
value: ${{ steps.set.outputs.detect_leaks }}
fail_on_leaks:
description: 'Fail the run on detected leaks (true/false)'
value: ${{ steps.set.outputs.fail_on_leaks }}
kill_leaks:
description: 'Attempt to kill leaks when detected (true/false)'
value: ${{ steps.set.outputs.kill_leaks }}
leak_grace_seconds:
description: 'Grace period before the final leak check'
value: ${{ steps.set.outputs.leak_grace_seconds }}
clean_labview_before:
description: 'Clean LabVIEW before execution (true/false)'
value: ${{ steps.set.outputs.clean_labview_before }}
clean_after:
description: 'Clean LabVIEW after execution (true/false)'
value: ${{ steps.set.outputs.clean_after }}
track_artifacts:
description: 'Track execution artifacts (true/false)'
value: ${{ steps.set.outputs.track_artifacts }}
runs:
using: composite
steps:
Expand Down Expand Up @@ -73,6 +94,13 @@ runs:
# Outputs for dispatcher parameters
"timeout_seconds=$to" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
"emit_failures_json_always=$emit" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
"detect_leaks=$detect" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
"fail_on_leaks=$fail" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
"kill_leaks=$kill" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
"leak_grace_seconds=$grace" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
"clean_labview_before=$cleanBefore" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
"clean_after=$cleanAfter" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
"track_artifacts=$track" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8

if ($env:GITHUB_STEP_SUMMARY) {
$lines = @('### Dispatcher Profile','')
Expand Down
186 changes: 186 additions & 0 deletions .github/workflows/pester-context.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,186 @@
name: Pester context

on:
workflow_call:
inputs:
sample_id:
required: false
type: string
checkout_repository:
required: false
type: string
checkout_ref:
required: false
type: string
outputs:
receipt_status:
description: 'Overall context status for the repo/control-plane layer'
value: ${{ jobs.context.outputs.receipt_status }}
receipt_artifact_name:
description: 'Artifact name containing the context receipt bundle'
value: ${{ jobs.context.outputs.receipt_artifact_name }}
repository:
description: 'Repository slug resolved for context classification'
value: ${{ jobs.context.outputs.repository }}
standing_priority_issue:
description: 'Standing-priority issue number when context is ready'
value: ${{ jobs.context.outputs.standing_priority_issue }}
standing_priority_reason:
description: 'Reason emitted by the context classifier'
value: ${{ jobs.context.outputs.standing_priority_reason }}
workflow_dispatch:
inputs:
sample_id:
description: 'Sampling correlation id (prevents cancels)'
required: false
default: ''
type: string
checkout_repository:
description: 'Repository to checkout for context resolution'
required: false
default: ''
type: string
checkout_ref:
description: 'Git ref or SHA to checkout for context resolution'
required: false
default: ''
type: string

concurrency:
group: pester-context-${{ github.event.inputs.sample_id || inputs.sample_id || github.ref }}
cancel-in-progress: true

jobs:
context:
runs-on: ubuntu-latest
outputs:
receipt_status: ${{ steps.receipt.outputs.status }}
receipt_artifact_name: ${{ steps.receipt.outputs.artifact_name }}
repository: ${{ steps.receipt.outputs.repository }}
standing_priority_issue: ${{ steps.receipt.outputs.standing_priority_issue }}
standing_priority_reason: ${{ steps.receipt.outputs.reason }}
steps:
- uses: actions/checkout@v5
with:
repository: ${{ inputs.checkout_repository || github.repository }}
ref: ${{ inputs.checkout_ref || github.sha }}

- name: Install Node dependencies
shell: pwsh
run: node tools/npm/cli.mjs ci

- name: Validate repository context
shell: pwsh
run: |
$repository = '${{ inputs.checkout_repository || github.repository }}'
if ([string]::IsNullOrWhiteSpace($repository)) {
throw 'Repository context is empty.'
}

- name: Export workflow token for context sync
shell: pwsh
env:
WORKFLOW_TOKEN: ${{ github.token }}
run: |
if (-not $env:WORKFLOW_TOKEN) { throw 'github.token is empty' }
"GH_TOKEN=$env:WORKFLOW_TOKEN" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
"GITHUB_TOKEN=$env:WORKFLOW_TOKEN" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8

- name: Resolve standing-priority context
id: standing_context
continue-on-error: true
shell: pwsh
run: node tools/priority/run-sync-standing-priority.mjs --materialize-cache

- name: Write context receipt
id: receipt
if: always()
shell: pwsh
run: |
$outDir = 'tests/results/pester-context'
New-Item -ItemType Directory -Force -Path $outDir | Out-Null

$issueDir = 'tests/results/_agent/issue'
$routerPath = Join-Path $issueDir 'router.json'
$noStandingPath = Join-Path $issueDir 'no-standing-priority.json'
$repository = '${{ inputs.checkout_repository || github.repository }}'
if ([string]::IsNullOrWhiteSpace($repository)) {
$repository = $env:GITHUB_REPOSITORY
}

$status = 'blocked'
$reason = 'context-sync-missing'
$standingIssue = ''
$issueSummaryPath = $null
$syncOutcome = '${{ steps.standing_context.outcome }}'

if (Test-Path -LiteralPath $noStandingPath) {
$report = Get-Content -LiteralPath $noStandingPath -Raw | ConvertFrom-Json -ErrorAction Stop
$status = 'blocked'
$reason = if ($report.reason) { [string]$report.reason } elseif ($report.message) { [string]$report.message } else { 'standing-priority-missing' }
} elseif (Test-Path -LiteralPath $routerPath) {
$router = Get-Content -LiteralPath $routerPath -Raw | ConvertFrom-Json -ErrorAction Stop
$issueValue = 0
if ([int]::TryParse([string]$router.issue, [ref]$issueValue) -and $issueValue -gt 0) {
$standingIssue = [string]$issueValue
$issueSummaryPath = Join-Path $issueDir ("{0}.json" -f $standingIssue)
if (Test-Path -LiteralPath $issueSummaryPath) {
$issueSummary = Get-Content -LiteralPath $issueSummaryPath -Raw | ConvertFrom-Json -ErrorAction Stop
if ($issueSummary.schema -eq 'standing-priority/issue@v1') {
$status = 'ready'
$reason = 'standing-priority-available'
if ($issueSummary.url -match 'https://github.com/(?<slug>[^/]+/[^/]+)/issues/') {
$repository = $matches.slug
}
} else {
$status = 'warning'
$reason = ("unexpected-issue-schema:{0}" -f $issueSummary.schema)
}
} else {
$status = if ($syncOutcome -eq 'success') { 'warning' } else { 'blocked' }
$reason = if ($syncOutcome -eq 'success') { 'standing-priority-summary-missing' } else { 'context-sync-failed' }
}
} else {
$status = if ($syncOutcome -eq 'success') { 'warning' } else { 'blocked' }
$reason = if ($syncOutcome -eq 'success') { 'standing-priority-router-missing-issue' } else { 'context-sync-failed' }
}
} elseif ($syncOutcome -eq 'success') {
$status = 'warning'
$reason = 'standing-priority-router-missing'
} else {
$status = 'blocked'
$reason = 'context-sync-failed'
}

$receipt = [ordered]@{
schema = 'pester-context-receipt@v1'
generatedAtUtc = [DateTime]::UtcNow.ToString('o')
status = $status
repository = $repository
sampleId = '${{ inputs.sample_id || github.event.inputs.sample_id || '' }}'
standingPriority = [ordered]@{
issueNumber = if ($standingIssue) { [int]$standingIssue } else { $null }
reason = $reason
routerPath = if (Test-Path -LiteralPath $routerPath) { 'tests/results/_agent/issue/router.json' } else { $null }
issueSummaryPath = if ($issueSummaryPath -and (Test-Path -LiteralPath $issueSummaryPath)) { "tests/results/_agent/issue/$standingIssue.json" } else { $null }
noStandingPath = if (Test-Path -LiteralPath $noStandingPath) { 'tests/results/_agent/issue/no-standing-priority.json' } else { $null }
}
sync = [ordered]@{
outcome = $syncOutcome
}
}
$receiptPath = Join-Path $outDir 'pester-context.json'
$receipt | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $receiptPath -Encoding UTF8
"status=$status" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
"artifact_name=pester-context" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
"repository=$repository" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
"standing_priority_issue=$standingIssue" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
"reason=$reason" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8

- name: Upload context receipt
if: always()
uses: actions/upload-artifact@v7
with:
name: pester-context
path: tests/results/pester-context
if-no-files-found: error
Comment on lines +55 to +186

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI about 2 months ago

In general, fix this by adding an explicit permissions block that grants only the minimal scopes needed. Since this workflow only checks out code, reads repo metadata, runs local tools, and uploads artifacts, it does not require write access to repository contents or issues. The minimal reasonable permission is contents: read, which allows actions/checkout to function. No jobs define their own permissions, so adding permissions at the workflow root (top-level, alongside name, on, concurrency, jobs) will apply to all jobs.

The best fix without changing existing functionality is to insert:

permissions:
  contents: read

after the on: block and before concurrency: (for clarity) in .github/workflows/pester-context.yml. No additional imports or methods are needed; this is purely a configuration change inside the workflow file. The rest of the job steps (checkout, Node/PowerShell commands, artifact upload) continue to work as before.

Suggested changeset 1
.github/workflows/pester-context.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/pester-context.yml b/.github/workflows/pester-context.yml
--- a/.github/workflows/pester-context.yml
+++ b/.github/workflows/pester-context.yml
@@ -46,6 +46,9 @@
         default: ''
         type: string
 
+permissions:
+  contents: read
+
 concurrency:
   group: pester-context-${{ github.event.inputs.sample_id || inputs.sample_id || github.ref }}
   cancel-in-progress: true
EOF
@@ -46,6 +46,9 @@
default: ''
type: string

permissions:
contents: read

concurrency:
group: pester-context-${{ github.event.inputs.sample_id || inputs.sample_id || github.ref }}
cancel-in-progress: true
Copilot is powered by AI and may make mistakes. Always verify output.
Loading
Loading