docs(benchmarks): round 7 plan — train and requantise with Unsloth, serve with Ollama, score on a fresh three-slot pin #2242
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot auto-merge | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| compatible-update: | |
| if: >- | |
| github.actor == 'dependabot[bot]' && | |
| github.event.pull_request.user.login == 'dependabot[bot]' && | |
| !github.event.pull_request.draft | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Read Dependabot update metadata | |
| id: metadata | |
| uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Check out the PR head | |
| if: >- | |
| steps.metadata.outputs.update-type == 'version-update:semver-patch' || | |
| steps.metadata.outputs.update-type == 'version-update:semver-minor' | |
| uses: actions/checkout@v7 | |
| # #2741: four times now, a dependabot frontend-next bump has resolved | |
| # its lockfile with npm 11/12 (whatever dependabot's own service | |
| # ships) and produced a package-lock.json that prunes optional-peer | |
| # placements node:22-alpine's npm 10 -- the image the Dockerfile | |
| # actually builds on -- still requires. quality.yml's own "lockfile | |
| # installs under the image's npm" step (#1816) already catches this, | |
| # loudly, but `main` carries no branch protection at all (checked | |
| # live: `gh api repos/.../branches/main/protection` -> 404 "Branch | |
| # not protected"), so nothing in the repo's actual required-checks | |
| # configuration makes that loud failure block anything. The step | |
| # below is the same #1816 has -- byte for byte -- run here instead, | |
| # at the one choke point dependabot bumps actually go through: this | |
| # job's own approve+auto-merge. `gh pr merge --auto` genuinely honors | |
| # a branch's required status checks when they exist; since none are | |
| # configured, this is the only gate a dependabot PR passes through | |
| # before this workflow would otherwise wave it onto `main` | |
| # unconditionally. Scoped to this workflow rather than turning on | |
| # branch protection repo-wide, which would gate every PR (not just | |
| # dependabot's) on a curated required-check list this issue was | |
| # never asked to design. | |
| # | |
| # #2752: the pull and the install are split into their own steps with | |
| # their own outcome. `docker run ... npm ci` used to fail identically | |
| # whether npm ci genuinely rejected the lockfile or `docker pull | |
| # node:22-alpine` itself failed first (Hub rate limit, a transient | |
| # registry error, a runner network hiccup) -- so the "regenerate your | |
| # lockfile" comment below fired even when the lockfile was never | |
| # actually tested. Both failure classes still block auto-merge exactly | |
| # as before (the gate itself is unchanged); only the human-facing | |
| # message now says which one actually happened. | |
| - name: Pull node:22-alpine (the Dockerfile's own image) | |
| id: image-pull | |
| if: >- | |
| (steps.metadata.outputs.update-type == 'version-update:semver-patch' || | |
| steps.metadata.outputs.update-type == 'version-update:semver-minor') && | |
| hashFiles('arcane/home/honeypot-dashboard/frontend-next/package-lock.json') != '' | |
| continue-on-error: true | |
| run: docker pull node:22-alpine | |
| - name: lockfile installs under the image's npm (#2741, mirrors #1816) | |
| id: lockfile-check | |
| if: >- | |
| (steps.metadata.outputs.update-type == 'version-update:semver-patch' || | |
| steps.metadata.outputs.update-type == 'version-update:semver-minor') && | |
| hashFiles('arcane/home/honeypot-dashboard/frontend-next/package-lock.json') != '' && | |
| steps.image-pull.outcome == 'success' | |
| continue-on-error: true | |
| working-directory: arcane/home/honeypot-dashboard/frontend-next | |
| run: | | |
| docker run --rm \ | |
| --user "$(id -u):$(id -g)" \ | |
| -e HOME=/tmp -e npm_config_cache=/tmp/npm-cache \ | |
| -v "$PWD:/app" -w /app \ | |
| node:22-alpine npm ci --no-audit --no-fund | |
| - name: Approve patch and minor updates | |
| if: >- | |
| (steps.metadata.outputs.update-type == 'version-update:semver-patch' || | |
| steps.metadata.outputs.update-type == 'version-update:semver-minor') && | |
| steps.image-pull.outcome != 'failure' && | |
| steps.lockfile-check.outcome != 'failure' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| run: gh pr review --approve "$PR_URL" | |
| - name: Enable squash auto-merge after required checks | |
| if: >- | |
| (steps.metadata.outputs.update-type == 'version-update:semver-patch' || | |
| steps.metadata.outputs.update-type == 'version-update:semver-minor') && | |
| steps.image-pull.outcome != 'failure' && | |
| steps.lockfile-check.outcome != 'failure' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| run: | | |
| # Arm GitHub's native auto-merge so the PR merges once its required | |
| # checks pass. This needs branch protection (or a ruleset) on the base | |
| # branch; without it the enablePullRequestAutoMerge mutation returns | |
| # "Protected branch rules not configured for this branch". Treat only | |
| # that specific case as non-fatal -- a human still merges manually -- | |
| # instead of failing this required check on every dependabot PR. | |
| if err="$(gh pr merge --auto --squash "$PR_URL" 2>&1)"; then | |
| echo "$err" | |
| exit 0 | |
| fi | |
| echo "$err" | |
| if printf '%s' "$err" | grep -q "Protected branch rules not configured"; then | |
| echo "::warning::Auto-merge could not be armed: the base branch has no branch protection / ruleset. Merge this dependabot PR manually once its checks pass." | |
| gh pr comment "$PR_URL" --body \ | |
| "Auto-merge is unavailable because the base branch has no branch protection or ruleset configured, so GitHub cannot arm \`--auto\`. This compatible dependabot update is fine to merge manually once its checks pass. (Configuring a branch-protection rule or ruleset on the default branch would restore automatic merging.)" || true | |
| exit 0 | |
| fi | |
| exit 1 | |
| - name: Leave the lockfile mismatch for a human | |
| if: steps.lockfile-check.outcome == 'failure' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| run: | | |
| gh pr comment "$PR_URL" --body \ | |
| "Not auto-merging: this lockfile does not install under node:22-alpine's npm (the Dockerfile's own image), the recurring #2741 failure mode. Regenerate it under that image before merging -- see #2741's canonical command." | |
| - name: Leave the registry pull failure for a human | |
| if: steps.image-pull.outcome == 'failure' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| run: | | |
| gh pr comment "$PR_URL" --body \ | |
| "Not auto-merging: pulling node:22-alpine failed (registry rate limit, transient error, or a runner network hiccup) before the lockfile could even be tested. This is not a #2741 lockfile problem -- re-run this workflow (or push a new commit) to retry." |