7f6c497a21
Root cause of demo_composition pin thrash was not cancelled CI runs: verify_no_global_state_mutation dumped full env_subset before/after tuples into the lane report, embedding CORE_ENGINE_STATE_DIR temp paths (and any ambient CORE_* host values). Each hermetic run then produced a different report SHA. Fix for good: - Report key-level env deltas only (+/- / changed), with path-like CORE_* values redacted to <path> in the message text. - Detection still uses raw snapshots (mutations are not ignored). - Hermetic CORE_ENGINE_STATE_DIR for demo_composition and all verify_lane_shas invocations. - Dual-run-stable re-pin: demo_composition e2ba2314…, public_demo 7d8ba0db… (matches CI-observed soft-budget SHA). - Drop dead CORE_SHOWCASE_SKIP_BUDGET workflow env (soft is default). - Tests pin the delta format and hermetic-path stability. Lane: python scripts/verify_lane_shas.py → 9/9 match.
69 lines
1.9 KiB
YAML
69 lines
1.9 KiB
YAML
name: lane-shas
|
|
|
|
# Verify that every ADR-0092..0099 lane produces its pinned SHA-256
|
|
# report. A failing job means a lane's deterministic output changed
|
|
# without an explicit ADR-tracked pin update via:
|
|
#
|
|
# python scripts/verify_lane_shas.py --update
|
|
#
|
|
# Single source of truth for the pinned values is scripts/verify_lane_shas.py.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: lane-shas-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
verify:
|
|
name: verify pinned lane SHAs
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 1
|
|
|
|
# setup-uv (not actions/setup-python) provisions Python on the aarch64
|
|
# self-hosted runner; actions/setup-python has no arm64 build for the
|
|
# pinned 3.12.13. Matches smoke.yml / full-pytest.yml.
|
|
- name: set up uv
|
|
uses: astral-sh/setup-uv@v5
|
|
with:
|
|
python-version: '3.12.13'
|
|
enable-cache: true
|
|
|
|
- name: install dependencies
|
|
run: |
|
|
uv pip install -e . pyyaml pytest
|
|
|
|
- name: verify lane SHAs
|
|
env:
|
|
PYTHONPATH: ${{ github.workspace }}
|
|
# public_demo wall-clock is soft by default (see evals/public_demo/runner.py).
|
|
# Do not set CORE_SHOWCASE_HARD_BUDGET here — cold Act runners exceed 60s.
|
|
# Content cases (claims, determinism, pure composition) remain hard gates.
|
|
run: |
|
|
uv run python scripts/verify_lane_shas.py
|
|
|
|
- name: verify CLAIMS.md is current
|
|
env:
|
|
PYTHONPATH: ${{ github.workspace }}
|
|
run: |
|
|
uv run python scripts/generate_claims.py --check
|
|
|
|
- name: emit machine-readable report (on failure)
|
|
if: failure()
|
|
env:
|
|
PYTHONPATH: ${{ github.workspace }}
|
|
run: |
|
|
uv run python scripts/verify_lane_shas.py --json || true
|