-
Notifications
You must be signed in to change notification settings - Fork 57
build(sfw): bump to 1.14.0, retire the SFW_SHIM_ACTIVE_CARGO escape hatch #577
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
jdalton
wants to merge
1
commit into
nubjs:main
Choose a base branch
from
jdalton:build/sfw-1.14-drop-cargo-sentinel
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,125 @@ | ||
| name: soak-autofix | ||
|
|
||
| # An expired soakBypass annotation or a cleared minimumReleaseAgeExclude pin | ||
| # is STALE, not unsafe: the version has soaked, so the gates warn rather than | ||
| # fail. Nobody should have to watch for that warning either — this workflow | ||
| # runs the fixers daily and, when they change anything, commits to a bot | ||
| # branch and opens (or updates) a PR, so the ledger converges to clean on its | ||
| # own. Invalid annotations (missing, malformed, wrong arithmetic) still fail | ||
| # the gate; those need a human. | ||
|
|
||
| on: | ||
| schedule: | ||
| # Daily, shortly after midnight UTC — annotations expire on date | ||
| # boundaries, so the fix lands the morning a window clears. | ||
| - cron: '23 0 * * *' | ||
| workflow_dispatch: | ||
|
|
||
| permissions: {} | ||
|
|
||
| # One run at a time: overlapping runs would race on the bot branch | ||
| # force-push and the open-PR check. | ||
| concurrency: | ||
| group: soak-autofix | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| autofix: | ||
| # Guard the dispatch path: run only from main, so a workflow_dispatch | ||
| # on a topic branch can't force-push bot/soak-autofix from arbitrary | ||
| # HEAD state. | ||
| if: github.ref == 'refs/heads/main' | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 10 | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| steps: | ||
| # persist-credentials stays on: this job pushes its own fix branch. | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked] | ||
| with: | ||
| # Optional PAT: PRs opened with the default github.token do NOT | ||
| # trigger CI on the PR (GitHub drops workflow events from | ||
| # token-created refs), so checks stay pending until a human | ||
| # closes/reopens the PR. Set the SOAK_AUTOFIX_TOKEN repo secret | ||
| # (a fine-grained PAT with contents+pull-requests write) to make | ||
| # the autofix PRs run CI like any other PR. | ||
| token: ${{ secrets.SOAK_AUTOFIX_TOKEN || github.token }} | ||
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | ||
| with: | ||
| node-version: "24" | ||
| - name: Run the soak fixers | ||
| id: fixers | ||
| # Fixers write mechanical repairs first, then exit by post-fix | ||
| # check status. Capture that status instead of masking it: the | ||
| # commit step below still lands whatever WAS fixable, and the | ||
| # final step re-raises the failure so a crashed fixer or a | ||
| # human-only finding can never ride a green run. | ||
| run: | | ||
| status=0 | ||
| node scripts/soak/soak.mts --fix || status=$? | ||
| node scripts/soak/external-tools.mts --fix || status=$? | ||
| echo "status=${status}" >> "$GITHUB_OUTPUT" | ||
| - name: Commit + PR when something was fixed | ||
| env: | ||
| GH_TOKEN: ${{ secrets.SOAK_AUTOFIX_TOKEN || github.token }} | ||
| run: | | ||
| set -euo pipefail | ||
| if git diff --quiet; then | ||
| echo "soak surfaces clean — nothing to fix" | ||
| exit 0 | ||
| fi | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | ||
| BRANCH="bot/soak-autofix" | ||
| # NO force push. The previous fetch-then---force-with-lease shape | ||
| # was security theater: `git fetch origin $BRANCH` updates the | ||
| # remote-tracking ref to the branch's CURRENT tip (checkout leaves | ||
| # the default wildcard refspec in place), so the lease is taken | ||
| # against whatever another actor just pushed and the force | ||
| # succeeds — silently discarding, for example, a human's review | ||
| # fixes committed onto the open autofix PR. | ||
| # | ||
| # Instead: stash the mechanical fixes, BASE the work on the | ||
| # existing bot branch when there is one, and fast-forward push. | ||
| # Human commits on the branch are preserved by construction, and | ||
| # a genuine conflict fails the run instead of being resolved by | ||
| # deletion. | ||
| git stash push --include-untracked -m soak-autofix | ||
| if git fetch origin "$BRANCH"; then | ||
| git checkout -B "$BRANCH" "origin/$BRANCH" | ||
| else | ||
| echo "no existing $BRANCH on origin — creating it" | ||
| git checkout -B "$BRANCH" | ||
| fi | ||
| if ! git stash pop; then | ||
| echo "::error::soak fixes conflict with the existing $BRANCH; resolve that branch (or close its PR) and re-run" | ||
| exit 1 | ||
| fi | ||
| git add -A | ||
| # Re-running the fixers on top of an already-fixed branch is a | ||
| # no-op; say so and stop rather than pushing an empty commit. | ||
| if git diff --cached --quiet; then | ||
| echo "$BRANCH already carries these fixes — nothing to push" | ||
| exit 0 | ||
| fi | ||
| git commit -m "chore(soak): prune expired soak annotations (automated) | ||
|
|
||
| Generated by the soak-autofix workflow: soak.mts --fix + | ||
| external-tools.mts --fix. Windows that cleared have soaked; | ||
| their bypass annotations are dead weight the gates would | ||
| otherwise fail on." | ||
| git push origin "$BRANCH" | ||
| if [ -z "$(gh pr list --head "$BRANCH" --state open --json number --jq '.[0].number')" ]; then | ||
| gh pr create --head "$BRANCH" \ | ||
| --title "chore(soak): prune expired soak annotations (automated)" \ | ||
| --body "Automated by the soak-autofix workflow. The listed soak windows have cleared, so their bypass annotations are stale. Diff is the full review: only annotation/window lines are touched." | ||
| fi | ||
| - name: Re-raise fixer findings | ||
| # After the mechanical repairs are committed, a nonzero fixer | ||
| # status means findings remain that need a human (or the fixer | ||
| # itself crashed) — fail the run so it can't read as clean. | ||
| if: steps.fixers.outputs.status != '0' | ||
| run: | | ||
| echo "soak fixers exited nonzero — human-actionable findings remain (see fixer step log)" | ||
| exit 1 | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.