ops(queue): enroll quarantine-sandbox-runtime in queue-health evidence - #2220
seonghobae wants to merge 6 commits into
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== checked-out commit and ancestry =='
git rev-parse HEAD
git status --short
git merge-base --is-ancestor 491a901fd9747b97cce2943c1e1b05a2fa7415d0 5e9fd0cfd0e2557cae506ae0c3797b57ec30d894 && echo 'declared parent is an ancestor'
git log --oneline --decorate 491a901fd9747b97cce2943c1e1b05a2fa7415d0..5e9fd0cfd0e2557cae506ae0c3797b57ec30d894
echo '== exact range summary and patch =='
git diff --stat 491a901fd9747b97cce2943c1e1b05a2fa7415d0..5e9fd0cfd0e2557cae506ae0c3797b57ec30d894
git diff --name-status 491a901fd9747b97cce2943c1e1b05a2fa7415d0..5e9fd0cfd0e2557cae506ae0c3797b57ec30d894
git diff --check 491a901fd9747b97cce2943c1e1b05a2fa7415d0..5e9fd0cfd0e2557cae506ae0c3797b57ec30d894
git diff --no-ext-diff --unified=80 491a901fd9747b97cce2943c1e1b05a2fa7415d0..5e9fd0cfd0e2557cae506ae0c3797b57ec30d894 -- config/actions_queue_health_repositories.json tests/test_actions_queue_health_contract.py
echo '== relevant source outline =='
ast-grep outline tests/test_actions_queue_health_contract.py --items all
echo '== configuration =='
cat config/actions_queue_health_repositories.json
echo '== pull request metadata =='
gh pr view 2220 --repo ContextualWisdomLab/.github --json number,state,isDraft,headRefOid,baseRefName,baseRefOid,title,body,url 2>&1
echo '== predecessor metadata =='
gh pr view 2219 --repo ContextualWisdomLab/.github --json number,state,isDraft,headRefOid,baseRefName,baseRefOid,title,url 2>&1Length of output: 11353 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== locate collector and workflow =='
fd -a -t f 'actions_queue_health|actions-queue-health' . | sort
echo '== workflow outline and relevant references =='
ast-grep outline .github/workflows/actions-queue-health.yml --items all
rg -n -C 4 'actions_queue_health|actions_queue_health_repositories|repository|queue|status' .github/workflows/actions-queue-health.yml
echo '== collector outline =='
collector=$(fd -a -t f '^actions_queue_health\.py$' . | head -n 1)
printf '%s\n' "$collector"
ast-grep outline "$collector" --items all
rg -n -C 5 'actions_queue_health_repositories|repositories|queued|in_progress|runner_id|steps' "$collector"
echo '== predecessor scope =='
git diff --name-status c4054eef3fc3cd84c87ea830b2e94d4145aa34e8..491a901fd9747b97cce2943c1e1b05a2fa7415d0
git diff --no-ext-diff --unified=25 c4054eef3fc3cd84c87ea830b2e94d4145aa34e8..491a901fd9747b97cce2943c1e1b05a2fa7415d0 -- config/actions_queue_health_repositories.json tests/test_actions_queue_health_contract.py
echo '== static JSON and contract-list consistency =='
python - <<'PY'
import ast
import json
from pathlib import Path
config = json.loads(Path("config/actions_queue_health_repositories.json").read_text())["repositories"]
source = Path("tests/test_actions_queue_health_contract.py").read_text()
tree = ast.parse(source)
expected = None
for node in ast.walk(tree):
if isinstance(node, ast.Assert) and isinstance(node.test, ast.Compare):
left = node.test.left
if isinstance(left, ast.Name) and left.id == "payload":
expected = ast.literal_eval(node.test.comparators[0])["repositories"]
break
print("config_is_unique:", len(config) == len(set(config)))
print("config_is_sorted:", config == sorted(config, key=str.lower))
print("contract_matches_config:", expected == config)
print("repository_count:", len(config))
PYLength of output: 11622
I found no code-scope defect.
The evidence wording is mostly cautious because it says the evidence “points to” the organization admission/capacity-starvation class. However, “rather than … a public GitHub Actions incident” overstates what the cited public status observation can establish. A status page reporting Actions as operational does not exclude a partial, regional, capacity-specific, or unreported GitHub Actions incident. Use narrower wording such as: “The current evidence is consistent with the already-owned organization admission/capacity-starvation class and does not establish a quarantine-runtime source defect, a floating-label-only problem, or a public GitHub Actions incident.” I did not execute repository tests. The reported
|
a66ef7b to
b5b1cfc
Compare
Superseded — closingEnrollment already on protected Verificationgit fetch origin main
git grep -lF 'ContextualWisdomLab/quarantine-sandbox-runtime' origin/main -- \
config/actions_queue_health_repositories.json \
tests/test_actions_queue_health_contract.py
# → origin/main:config/actions_queue_health_repositories.json
# → origin/main:tests/test_actions_queue_health_contract.py
git show origin/main:config/actions_queue_health_repositories.json | grep -c quarantine-sandbox-runtime
# → 1 (unique enrollment)
git diff --stat origin/main...HEAD # after rebase onto main
# → (empty)Focused suite on rebased tree (
Closing as not planned / superseded by #2241. No force-push and no new commits on this branch. |
1 participant
Parent queue-health owner: #1150. Serialized allowlist predecessor: #2219. Incident owner: #712.
Finding
ContextualWisdomLab/quarantine-sandbox-runtimenow supplies a current exact-head reproduction of the organization Actions pre-runner admission class, but the canonical read-only queue-health collector lineage does not include this repository in its explicit bounded allowlist.Fresh leaf evidence on
quarantine-sandbox-runtime#127@7b2b71f2557ab510dee3dfa0a79a9e1ebbda6185shows CI run35083728065with all five jobs still queued before execution: coverage104753533940, verify104753534176, branch coverage104753534238, hosted negative rootless/AppArmor104753534297, and positive SELinux104753534319. Each hasrunner_id=0andsteps=[]. The repository currently has zero in-progress runs and six queued runs, including current exact heads for #121, #127, #125, #112, #63 plus an obsolete older #112 generation that remains queued. This is incomplete infrastructure evidence, not a source GREEN or source RED.Independent organization evidence narrows the mechanism.
.githubStrix run35042040067had ordinaryubuntu-24.04job104623845874created at00:56:27Zand admitted only at05:31:14Z(4h34m47s queue delay). Its downstreamstrixjob104677640883, alsoubuntu-24.04, was created at05:31:20Zand admitted at10:22:30Z(4h51m10s queue delay), then progressed through checkout and sidecar setup. GitHub's public status page reports Actions operational on 2026-09-16. The current evidence is consistent with the already-owned organization admission/capacity-starvation class and does not establish a quarantine-runtime source defect, a floating-label-only problem, or a public GitHub Actions incident.No leaf rerun, wake/no-op commit, runner-selector churn, cancellation of current-head evidence, predecessor-status transfer or gate weakening was used or is authorized.
RED → minimum repair
This child is deliberately serialized on #2219 because #2219 owns the same allowlist/test paths; no competing sibling writer was opened.
Test-first commit
c399b44360c46819596ea98a0cfb4db99c8ff4c6extends the exact-equality allowlist contract to requireContextualWisdomLab/quarantine-sandbox-runtimewhile the inherited config still omits it. Focused reconstruction of the exact workflow/config/test contents is deterministically RED:1 failed, 1 passed; the only mismatch is the missing quarantine-runtime repository entry.Causal successor
5e9fd0cfd0e2557cae506ae0c3797b57ec30d894adds only the matching repository entry. Relative to exact parent #2219491a901fd9747b97cce2943c1e1b05a2fa7415d0, the branch is two ordinary commits ahead and changes exactly the same two bounded owner paths:config/actions_queue_health_repositories.json: enrollContextualWisdomLab/quarantine-sandbox-runtime;tests/test_actions_queue_health_contract.py: preserve the explicit/bounded exact-equality contract with quarantine runtime included.Focused reconstruction of the exact current workflow/config/test contents is GREEN:
python -m pytest -q tests/test_actions_queue_health_contract.py→2 passed. Collector logic, schedule, permissions, runner selectors, cancellation/rerun behavior, observed leaf branches, and required gates are unchanged.Ownership / acceptance
Base is serialized enrollment predecessor #2219 exact
491a901fd9747b97cce2943c1e1b05a2fa7415d0, itself stacked on #2200 → canonical queue-health owner #1150. Keep this PR Draft until the parent stack integrates normally and this child is ordinary/non-force reconciled onto the integrated predecessor with fresh exact-head evidence.Enrollment does not claim queue starvation is resolved. GREEN for the incident class requires the canonical collector to run on its eventual protected owner source and publish a read-only snapshot that binds current quarantine-runtime repository/PR/head/workflow/job identities while distinguishing the obsolete #112 queued generation from current-head required evidence.
Do not self-approve, administrator-bypass, force update, destructively rebase, copy workflow source, cancel current-head evidence, blindly rerun, add no-op freshness commits, change runner selectors, synthesize status, transfer predecessor evidence or weaken gates.