mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-01 11:02:14 +00:00
Zhengchao An
790bdc0e63
* ci: stop running expensive jobs that cannot inform the result Three independent fixes that all avoid burning self-hosted runners on work whose outcome is already determined. None of them changes what is tested. - ci-docs-only: add a "Quick Checks" companion job. It is a prerequisite for gating ci.yml's expensive jobs behind quick-checks (rustfs/backlog#1599): once "Quick Checks" is a required check, a docs-only PR would otherwise wait on it forever. The steps are a byte-identical copy of ci.yml's quick-checks rather than an `echo`, so that on a mixed PR the two same-named check runs execute the same commands against the same merge ref and cannot disagree — GitHub has no written contract for how it picks between same-named required check runs, and the real job only takes 45-51s, leaving no timing margin to rely on. - ci: guard uring-integration with the same `closed` check every other job already has. The pull_request trigger includes `closed` only so the concurrency group cancels in-flight runs; this job had no guard and no `needs`, so every closed or merged PR ran the full io_uring suite (4m17s, 7m19s and 7m31s on runs 30678272341, 30678117601 and 30662728539). - ci: gate s3-lifecycle-behavior-tests on e2e-tests, matching s3-implemented-tests. Both lanes only download the prebuilt debug binary, and s3-implemented-tests already finishes later, so a green PR's wall clock is unchanged; a red one stops holding a sm-standard-4 for up to 30 minutes. Refs: rustfs/backlog#1598, rustfs/backlog#1599 * ci: gate the seven expensive jobs on Quick Checks Every expensive job started in parallel with quick-checks, so a formatting or architecture-guard failure still paid for the full pipeline. On run 30673292690 Quick Checks failed after 0.8 minutes and the run went on to burn 424.5 runner-minutes — 99.8% of it after the gate had already failed. The self-hosted pool is 15-21 ARC runners and one full PR run needs about seven sm-standard-4 concurrently, so those minutes come straight out of other PRs' queue time (six runs measured 72-488 minutes queued). quick-checks itself is compile-free and takes 45-51s, so a passing PR pays about a minute of extra critical path. REQUIRES the branch ruleset to list "Quick Checks" as a required check BEFORE this merges. Adding `needs` gives these jobs a `skipped` conclusion for the first time, and GitHub treats a skipped required check as satisfied — with required_approving_review_count=0, a failing quick-checks would otherwise let a broken PR merge. Ordering is tracked in rustfs/backlog#1599. Refs: rustfs/backlog#1598, rustfs/backlog#1599 * ci: stop a PR run once Test and Lint has failed (#5530) On run 30674613104 the e2e, ILM and sftp lanes had all failed while Test and Lint and the rio-v2 variant kept running past 70 minutes. The run's verdict was settled; the remaining lanes were spending sm-standard-4 time on a result nobody could act on, and with one full PR run needing about seven of those runners, that time comes out of other PRs' queue time. Two mechanisms, both scoped to pull_request so main pushes, the merge queue and the weekly schedule keep the full failure signal: - test-and-lint-protocols: fail-fast on PRs, so one failing protocol leg stops its sibling. This is the only part that also covers fork PRs, since it needs no token. - test-and-lint: on failure, cancel the run through the REST API. Only test-and-lint may cancel. The lanes that are not required checks (protocols, ILM, e2e, s3-tests) must never hold that power: a flake in one of them would turn the required "Test and Lint" into `cancelled`, which blocks the merge. A maintainer can merge today with sftp red, and that has to stay true. The cancel step uses curl, not `gh`: every existing `gh` call in this repo runs on ubuntu-latest, and the sm-standard-* images are custom and trimmed, so `gh` is not known to exist there. Fork PRs are excluded by an explicit condition rather than left to fail, since their GITHUB_TOKEN is forced read-only and job-level permissions cannot raise it. Job-level permissions must list contents: read alongside actions: write — job-level permissions replace the workflow block instead of merging with it, and dropping contents would break this job's checkout and the repo-token the setup action passes to setup-protoc. Because that token can now cancel runs and delete Actions caches, the checkout also sets persist-credentials: false so a PR's own build.rs or proc-macro cannot read it back out of .git/config. Refs: rustfs/backlog#1598, rustfs/backlog#1599 * ci: correct the companion-workflow comments Addresses review feedback on #5528, which merged before these fixes were pushed. The ci-docs-only header claimed the ruleset already requires "Quick Checks". It does not — that ruleset change is a separate step, and this file's whole purpose is to land first so that change does not strand docs-only PRs. Say what is true today. Also move the byte-identical requirement onto ci.yml's quick-checks job, which is the more likely edit site, instead of pointing at a comment that was not there.
131 lines
5.1 KiB
YAML
131 lines
5.1 KiB
YAML
# Copyright 2026 RustFS Team
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# Companion to ci.yml for required status checks.
|
|
#
|
|
# ci.yml skips docs-only pull requests via paths-ignore, but the branch ruleset
|
|
# requires a check named "Test and Lint" — without this workflow a docs-only PR
|
|
# would wait on it forever. This workflow triggers on exactly the paths ci.yml
|
|
# ignores and reports success under the same job name. Mixed PRs trigger both
|
|
# workflows and the real check still gates: a required check with any failing
|
|
# run blocks the merge.
|
|
# https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
|
|
#
|
|
# "Quick Checks" is mirrored here ahead of the ruleset change that will make it
|
|
# required too (rustfs/backlog#1599). Until that change lands this job is
|
|
# inert; mirroring it first is what lets the ruleset change happen without
|
|
# stranding docs-only PRs on a check nobody reports.
|
|
#
|
|
# Keep the paths list below in sync with the pull_request paths-ignore list
|
|
# in ci.yml, and keep the quick-checks steps below byte-identical to the
|
|
# quick-checks job in ci.yml.
|
|
|
|
name: Continuous Integration (docs only)
|
|
|
|
on:
|
|
pull_request:
|
|
types: [ opened, synchronize, reopened ]
|
|
branches: [ main ]
|
|
paths:
|
|
- "**.md"
|
|
- "docs/**"
|
|
- "deploy/**"
|
|
- "scripts/dev_*.sh"
|
|
- "scripts/probe.sh"
|
|
- "LICENSE*"
|
|
- ".gitignore"
|
|
- ".dockerignore"
|
|
- "README*"
|
|
- "**/*.png"
|
|
- "**/*.jpg"
|
|
- "**/*.svg"
|
|
- ".github/workflows/build.yml"
|
|
- ".github/workflows/docker.yml"
|
|
- ".github/workflows/audit.yml"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
# Deliberately NOT a bare `echo`. Once "Quick Checks" becomes a required
|
|
# check, ci.yml gates every expensive job behind it, so a mixed PR reports
|
|
# two check runs with this name: the real one (45-51s) and this companion.
|
|
# GitHub has no written contract for how it picks between same-named
|
|
# required check runs ("latest wins" vs "any failure blocks"), so instead of
|
|
# relying on ordering we make both runs execute the same commands against
|
|
# the same merge ref — their conclusions are then necessarily identical and
|
|
# the choice does not matter. Keep these steps byte-identical to the
|
|
# quick-checks job in ci.yml (a guard script that asserts this, and the paths
|
|
# sync below, is tracked in rustfs/backlog#1603).
|
|
#
|
|
# For a genuinely docs-only PR this adds no strictness (no code changed, so
|
|
# fmt and the guards always pass) and costs ~50s of ubuntu-latest.
|
|
quick-checks:
|
|
name: Quick Checks
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
|
|
- name: Install ripgrep
|
|
run: sudo apt-get update && sudo apt-get install -y ripgrep
|
|
|
|
- name: Install Rust toolchain
|
|
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
|
|
with:
|
|
components: rustfmt
|
|
|
|
- name: Check code formatting
|
|
run: cargo fmt --all --check
|
|
|
|
- name: Check unsafe code allowances
|
|
run: ./scripts/check_unsafe_code_allowances.sh
|
|
|
|
- name: Check layered dependencies
|
|
run: ./scripts/check_layer_dependencies.sh
|
|
|
|
- name: Check architecture migration rules
|
|
run: ./scripts/check_architecture_migration_rules.sh
|
|
|
|
- name: Check tokio io-uring feature guard
|
|
run: ./scripts/check_no_tokio_io_uring.sh
|
|
|
|
- name: Check extension schema boundaries
|
|
run: ./scripts/check_extension_schema_boundaries.sh
|
|
|
|
- name: Check body-cache whitelist guard
|
|
run: ./scripts/check_body_cache_whitelist.sh
|
|
|
|
- name: Check no planning docs committed
|
|
run: ./scripts/check_no_planning_docs.sh
|
|
|
|
test-and-lint:
|
|
name: Test and Lint
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
|
|
# Docs-only PRs skip the full code CI, but they are exactly where a
|
|
# planning-type document could be slipped in (git add -f bypasses
|
|
# .gitignore). Run the guard here so the required "Test and Lint" check
|
|
# stays meaningful for docs-only changes.
|
|
- name: Check no planning docs committed
|
|
run: ./scripts/check_no_planning_docs.sh
|
|
|
|
- name: Satisfy required check for docs-only changes
|
|
run: echo "Docs-only change — code CI is skipped by paths-ignore; planning-docs guard passed, reporting success for the required 'Test and Lint' check."
|