From 848f5685a0d50a2f0af0e63d98aacfff347f7341 Mon Sep 17 00:00:00 2001 From: Yusuke Watanabe Date: Wed, 29 Jul 2026 17:55:16 +0900 Subject: [PATCH] fix(ci): restore identity reads under the codecov step's redirected git config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `GIT_CONFIG_GLOBAL` REPLACES the global config rather than layering on it. So #20, which redirected the codecov step's git writes away from the contended shared `~/.gitconfig`, also hid `user.name` / `user.email` from git for that step — silently, because nothing there reads them today. Seed the throwaway file with an `include.path` back to the real config before the step runs. Identity resolves through the include; `--add safe.directory` still lands in the throwaway file, so the lock contention #20 fixed stays fixed. I did not consider identity when writing #20 — I reasoned only about the lock. scitex-hpc caught the identical shape in their launcher-level fix an hour before this, where it WOULD have made every CI commit identity-less, and they caught it by asserting the mechanism instead of trusting it. This is the same bug scoped to one step: harmless for what that step does today, silently wrong the moment anything under that env needs identity. Landing it now rather than waiting for the launcher fix to supersede it. That deployment is gated on an operator decision with no date, and a known-latent config sitting in a workflow every scitex repo calls should not have an open-ended window. If the deployment lands tomorrow this is one redundant line for a day, which is the better side of that trade. The seeding step carries the same `if:` guard as the codecov step, so it does not run on the legs that have no codecov upload. --- .github/workflows/pytest-matrix.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.github/workflows/pytest-matrix.yml b/.github/workflows/pytest-matrix.yml index f960a89..4960a81 100644 --- a/.github/workflows/pytest-matrix.yml +++ b/.github/workflows/pytest-matrix.yml @@ -145,6 +145,32 @@ jobs: export PYTEST_XDIST_AUTO_NUM_WORKERS="$(.venv/bin/python -c 'import os; print(len(os.sched_getaffinity(0)))')" .venv/bin/python -m pytest tests/ -n auto \ --cov="src/$PKG" --cov-report=xml --cov-report=term + - name: Seed the per-job git config for the codecov step + if: always() && matrix.python-version == '3.12' + run: | + set -euo pipefail + # GIT_CONFIG_GLOBAL REPLACES the global config, it does not layer on + # top of it. So the step below, which redirects writes away from the + # shared ~/.gitconfig, ALSO hides user.name / user.email from git — + # silently, because nothing in the codecov step reads them today. + # + # `include.path` restores reads while leaving writes redirected: + # identity resolves through the real config, `--add safe.directory` + # still lands in the throwaway file. + # + # Added prophylactically. codecov-action appears not to need identity, + # and CI has been green since the redirect landed — but "appears not + # to need" is an assumption nobody asserted, and scitex-hpc caught the + # same shape in their launcher fix an hour before this was written, + # where it WOULD have made every CI commit identity-less. + # + # This whole block is temporary. The launcher-level fix in the runner + # supervisor sets GIT_CONFIG_GLOBAL once, for every runner and every + # one of the ~58 per-repo callers this workflow never sees. When that + # is deployed and live, revert this and the env: below together. + printf '[include]\n\tpath = %s\n' "$HOME/.gitconfig" \ + > "${{ runner.temp }}/gitconfig-codecov" + - name: Upload coverage to Codecov if: always() && matrix.python-version == '3.12' uses: codecov/codecov-action@v5