7 Commits

Author	SHA1	Message	Date
Zhengchao An	2b31bda6d1	ci: clear the checkout token in every job that does not push (#5547) ... actions/checkout writes its token into .git/config as an http extraheader, where it stays for the rest of the job. That matters more here than usual: pull_request jobs run on self-hosted runners and execute the PR's own build.rs, proc-macros and tests, any of which can read that file. Test and Lint holds actions: write on top of that, so its token can cancel runs and delete the Actions caches the whole pipeline now depends on — it was given persist-credentials: false when that permission was added, and this extends the same treatment to the other 45 checkouts. Two are exempt because the token IS the credential the job needs. helm-package's publish job pushes to rustfs/helm with it; clearing it would break chart publishing. nix-flake-update is exempt pending verification: it passes FLAKE_UPDATE_TOKEN to create-pull-request directly rather than reusing .git/config, so it very likely does not need persistence, but that is unproven and a broken weekly bot is not worth the guess. Both carry a persist-credentials-exempt comment saying which. scripts/security/check_persist_credentials.sh requires every checkout to either clear its credentials or carry that comment, so the decision stays visible in review rather than being an omission nobody notices. Refs: rustfs/backlog#1598, rustfs/backlog#1602	2026-08-01 11:48:47 +08:00
Zhengchao An	3f4f31129e	ci: narrow the io_uring lane and make the sampler attributable (#5540) ... Two independent changes to the Test and Lint area. The io_uring lane compiled 7 integration binaries to run none of their tests. Job log 91309868055 shows the lib target reporting "18 passed; 3453 filtered out" while every binary under crates/ecstore/tests/ reported "running 0 tests". Adding --lib drops them from the build without changing the selected set. The `uring_` filter itself must not be touched. libtest matches on substring, so it also selects names containing `during_` — 6 of the 18 selected tests are such incidental matches, and narrowing the filter to `io_uring` would silently drop them. scripts/check_uring_lane_lib_only.sh asserts the precondition --lib depends on: no test function whose name contains `uring_` may live under crates/ecstore/tests/. A count floor would not do, because the dangerous case — someone adding a matching test there — leaves the lib count unchanged and CI green. The resource sampler was measuring the wrong machine. The runners are ARC pods, so /proc/loadavg, /proc/pressure/*, `free` and `df` are node-level and include every other runner pod on the same Kubernetes node: one sample reported loadavg 6.67 with 832 threads node-wide while `ps` inside the pod showed about 10 processes. Judging a CARGO_BUILD_JOBS change on those numbers cannot work. The sampler moves to scripts/ci/resource_sampler.sh and now records /sys/fs/cgroup cpu.max, memory.max, memory.peak and the cpu/io/memory pressure files, which are this pod's own. The node-level readings stay — co-tenancy is a real cause of stalls, and a 9m57s plain `git checkout` was traced to it — but are labelled NODE-LEVEL so nobody reads them as this job's load. Phase markers are written on start, and clippy is now sampled too: it is the natural control arm for a CARGO_BUILD_JOBS experiment, since --all-targets is check-only for workspace members and never links the ~100 test binaries the limit throttles. No numbers are changed in this commit. CARGO_BUILD_JOBS stays at 2 until there is attributable data to change it on. Refs: rustfs/backlog#1598, rustfs/backlog#1601	2026-08-01 11:32:00 +08:00
Zhengchao An	6c99d4fe22	ci: stop the weekly flake.lock bot from running the whole pipeline (#5539) ... nix-flake-update opens a PR every Sunday that changes flake.lock and nothing else. flake.lock is consumed only by Nix packaging — cargo never reads it — yet it was in no paths filter, so each of those PRs ran the full Continuous Integration pipeline and the merge then ran Build and Release too. Added to all four lists that have to agree: ci.yml's push and pull_request paths-ignore, build.yml's push paths-ignore, and ci-docs-only.yml's paths. The cron stays. flake.lock still has consumers — anyone running `nix build` or `nix develop` — so stopping the updates would remove the workflow's output, not just its CI cost. Those four lists drifting is a silent failure, so scripts/check_ci_paths_sync.sh now asserts the pair that matters: ci.yml's pull_request paths-ignore must equal ci-docs-only.yml's paths. An entry present only in the first means a PR touching those files triggers neither workflow, nobody reports "Test and Lint" or "Quick Checks", and the PR waits on a required check forever. It also asserts both companion job names still exist, since renaming one produces the same hang. The push list is not compared: no required check is reported for push events. Also in this cleanup: - nix-flake-update's GITHUB_TOKEN drops to contents: read. The branch push and the pull request are both made by update-flake-lock with the FLAKE_UPDATE_TOKEN PAT, so the write scopes were an unused repo-write credential on an unattended weekly job. - build.yml's build_docker dispatch input is documented as advisory. docker.yml triggers on workflow_run and requires the triggering event to be a tag push, so a manual dispatch never reaches it whatever this input says. - The nine disabled workflow files get a banner saying so. Their disabled_manually state lives in GitHub's UI and is invisible when reading the file, which has already misled one audit into treating dead workflows as live. Refs: rustfs/backlog#1598, rustfs/backlog#1603	2026-08-01 11:28:14 +08:00
Zhengchao An	790bdc0e63	ci: gate the seven expensive jobs on Quick Checks (#5529) ... * ci: stop running expensive jobs that cannot inform the result Three independent fixes that all avoid burning self-hosted runners on work whose outcome is already determined. None of them changes what is tested. - ci-docs-only: add a "Quick Checks" companion job. It is a prerequisite for gating ci.yml's expensive jobs behind quick-checks (rustfs/backlog#1599): once "Quick Checks" is a required check, a docs-only PR would otherwise wait on it forever. The steps are a byte-identical copy of ci.yml's quick-checks rather than an `echo`, so that on a mixed PR the two same-named check runs execute the same commands against the same merge ref and cannot disagree — GitHub has no written contract for how it picks between same-named required check runs, and the real job only takes 45-51s, leaving no timing margin to rely on. - ci: guard uring-integration with the same `closed` check every other job already has. The pull_request trigger includes `closed` only so the concurrency group cancels in-flight runs; this job had no guard and no `needs`, so every closed or merged PR ran the full io_uring suite (4m17s, 7m19s and 7m31s on runs 30678272341, 30678117601 and 30662728539). - ci: gate s3-lifecycle-behavior-tests on e2e-tests, matching s3-implemented-tests. Both lanes only download the prebuilt debug binary, and s3-implemented-tests already finishes later, so a green PR's wall clock is unchanged; a red one stops holding a sm-standard-4 for up to 30 minutes. Refs: rustfs/backlog#1598, rustfs/backlog#1599 * ci: gate the seven expensive jobs on Quick Checks Every expensive job started in parallel with quick-checks, so a formatting or architecture-guard failure still paid for the full pipeline. On run 30673292690 Quick Checks failed after 0.8 minutes and the run went on to burn 424.5 runner-minutes — 99.8% of it after the gate had already failed. The self-hosted pool is 15-21 ARC runners and one full PR run needs about seven sm-standard-4 concurrently, so those minutes come straight out of other PRs' queue time (six runs measured 72-488 minutes queued). quick-checks itself is compile-free and takes 45-51s, so a passing PR pays about a minute of extra critical path. REQUIRES the branch ruleset to list "Quick Checks" as a required check BEFORE this merges. Adding `needs` gives these jobs a `skipped` conclusion for the first time, and GitHub treats a skipped required check as satisfied — with required_approving_review_count=0, a failing quick-checks would otherwise let a broken PR merge. Ordering is tracked in rustfs/backlog#1599. Refs: rustfs/backlog#1598, rustfs/backlog#1599 * ci: stop a PR run once Test and Lint has failed (#5530) On run 30674613104 the e2e, ILM and sftp lanes had all failed while Test and Lint and the rio-v2 variant kept running past 70 minutes. The run's verdict was settled; the remaining lanes were spending sm-standard-4 time on a result nobody could act on, and with one full PR run needing about seven of those runners, that time comes out of other PRs' queue time. Two mechanisms, both scoped to pull_request so main pushes, the merge queue and the weekly schedule keep the full failure signal: - test-and-lint-protocols: fail-fast on PRs, so one failing protocol leg stops its sibling. This is the only part that also covers fork PRs, since it needs no token. - test-and-lint: on failure, cancel the run through the REST API. Only test-and-lint may cancel. The lanes that are not required checks (protocols, ILM, e2e, s3-tests) must never hold that power: a flake in one of them would turn the required "Test and Lint" into `cancelled`, which blocks the merge. A maintainer can merge today with sftp red, and that has to stay true. The cancel step uses curl, not `gh`: every existing `gh` call in this repo runs on ubuntu-latest, and the sm-standard-* images are custom and trimmed, so `gh` is not known to exist there. Fork PRs are excluded by an explicit condition rather than left to fail, since their GITHUB_TOKEN is forced read-only and job-level permissions cannot raise it. Job-level permissions must list contents: read alongside actions: write — job-level permissions replace the workflow block instead of merging with it, and dropping contents would break this job's checkout and the repo-token the setup action passes to setup-protoc. Because that token can now cancel runs and delete Actions caches, the checkout also sets persist-credentials: false so a PR's own build.rs or proc-macro cannot read it back out of .git/config. Refs: rustfs/backlog#1598, rustfs/backlog#1599 * ci: correct the companion-workflow comments Addresses review feedback on #5528, which merged before these fixes were pushed. The ci-docs-only header claimed the ruleset already requires "Quick Checks". It does not — that ruleset change is a separate step, and this file's whole purpose is to land first so that change does not strand docs-only PRs. Say what is true today. Also move the byte-identical requirement onto ci.yml's quick-checks job, which is the more likely edit site, instead of pointing at a comment that was not there.	2026-08-01 10:57:02 +08:00
Zhengchao An	707d062174	ci: stop running expensive jobs that cannot inform the result (#5528) ... Three independent fixes that all avoid burning self-hosted runners on work whose outcome is already determined. None of them changes what is tested. - ci-docs-only: add a "Quick Checks" companion job. It is a prerequisite for gating ci.yml's expensive jobs behind quick-checks (rustfs/backlog#1599): once "Quick Checks" is a required check, a docs-only PR would otherwise wait on it forever. The steps are a byte-identical copy of ci.yml's quick-checks rather than an `echo`, so that on a mixed PR the two same-named check runs execute the same commands against the same merge ref and cannot disagree — GitHub has no written contract for how it picks between same-named required check runs, and the real job only takes 45-51s, leaving no timing margin to rely on. - ci: guard uring-integration with the same `closed` check every other job already has. The pull_request trigger includes `closed` only so the concurrency group cancels in-flight runs; this job had no guard and no `needs`, so every closed or merged PR ran the full io_uring suite (4m17s, 7m19s and 7m31s on runs 30678272341, 30678117601 and 30662728539). - ci: gate s3-lifecycle-behavior-tests on e2e-tests, matching s3-implemented-tests. Both lanes only download the prebuilt debug binary, and s3-implemented-tests already finishes later, so a green PR's wall clock is unchanged; a red one stops holding a sm-standard-4 for up to 30 minutes. Refs: rustfs/backlog#1598, rustfs/backlog#1599	2026-08-01 10:49:19 +08:00
Zhengchao An	f84ba243a1	chore(ci): guard against committed planning docs and remove re-added ones (#4777) ... chore(ci): guard against committed planning docs; remove re-added ones PR #4771 removed the docs/superpowers planning-doc archive and added a rule, but #4765 force-added two more (git add -f bypasses .gitignore): docs/superpowers/plans/2026-07-12-observability-single-writer.md and docs/superpowers/specs/2026-07-12-observability-single-writer-design.md — an agentic implementation plan and its design spec. Delete both. Close the enforcement gap so this cannot recur: - New scripts/check_no_planning_docs.sh fails if anything is tracked under docs/superpowers/, regardless of how it was added. - Wire it into make pre-commit/pre-pr/dev-check. - Run it in CI: ci.yml for code/mixed PRs, and ci-docs-only.yml (which was a green stub) so docs-only PRs can no longer slip a planning doc past the required 'Test and Lint' check. - Document the guard in AGENTS.md and the arch-checks skill.	2026-07-12 20:19:06 +08:00
Zhengchao An	2ae1e8ad05	ci: right-size pipelines, fix prerelease latest.json overwrite (#4582) ... - build.yml: update latest.json only for stable release tags (alpha/beta/rc tags previously overwrote the stable pointer with release_type "stable"); drop the placeholder .asc files; build the Linux targets only on main pushes (tags/schedule/dispatch keep the full matrix); remove the unreachable --build clause and a needless full-history clone - ci.yml: event-scoped concurrency so merges stop cancelling the weekly scheduled run; drop the redundant skip-duplicate-actions gate job; run clippy before tests; trim the unused toolchain from the typos job - ci-docs-only.yml (new): satisfy the required "Test and Lint" check on docs-only PRs that ci.yml skips via paths-ignore - audit.yml: drop cargo-audit (cargo-deny advisories covers the same RustSec database); same event-scoped concurrency fix - docker.yml: job-level short-circuit for per-merge dev builds; send the Trivy SARIF to code scanning; unify the upload-artifact pin - performance-ab.yml: add concurrency; only re-run on labeled events when the added label is perf-ab - stagger the Sunday crons (build 01:00, audit 03:00, nix-flake-update 05:00, mint 06:00) - delete performance.yml: disabled since 2025-07; idle-server profiling, no benchmark baseline, stale ecstore package name	2026-07-09 05:22:39 +08:00