Skip to content

workflows: pin actions by commit SHA; Dependabot keeps the pins current - #143

Merged
bong-water-water-bong merged 1 commit into
mainfrom
pin-actions
Sep 26, 2026
Merged

bong-water-water-bong merged 1 commit into
mainfrom
pin-actions

Conversation

@bong-water-water-bong

Copy link
Copy Markdown
Collaborator

The workflows used actions/checkout@v4, upload-pages-artifact@v3 and deploy-pages@v4. A tag can be moved, so the code that runs could change underneath us. This pins each one to the commit its tag points to today:

action tag commit
actions/checkout v4.4.0 11d5960a
actions/upload-pages-artifact v3.0.1 56afc609
actions/deploy-pages v4.0.5 d6db9016

.github/dependabot.yml proposes new pins weekly, as PRs that run the usual checks. Once this merges, the repo setting that requires SHA-pinned actions gets turned on.

🤖 Generated with Claude Code

actions/checkout v4.4.0, actions/upload-pages-artifact v3.0.1 and actions/deploy-pages v4.0.5,
each by the commit its tag points to today, so a moved or compromised tag cannot change what
runs. .github/dependabot.yml proposes new pins weekly as PRs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
🧪 No relevant tests
🔒 No security concerns identified
⚡ Recommended focus areas for review

Dependabot Configuration

The Dependabot configuration file introduces a weekly update schedule for GitHub Actions. While this is good for keeping actions up-to-date, it does not specify a target-branch or labels which could be useful for managing these updates. Additionally, the commit message prefix is generic and may not be sufficient for tracking purposes in a complex repository.

# The workflows' actions are pinned by commit (the repository requires it); Dependabot proposes
# the new commit when an action releases, as a PR the usual checks run on.
version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    commit-message:
      prefix: "actions"
Action Pinning Consistency

The workflow uses a pinned commit SHA for actions/checkout, which is good for reproducibility. However, the comment indicating the tag version (# v4.4.0) should be verified to match the actual pinned commit to avoid confusion.

- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

@bong-water-water-bong
bong-water-water-bong merged commit 7bc33e2 into main Sep 26, 2026
5 checks passed
@bong-water-water-bong
bong-water-water-bong deleted the pin-actions branch September 26, 2026 15:56
bong-water-water-bong pushed a commit that referenced this pull request Oct 25, 2026
… MTP cap flag

`match.gguf_keys` is a new, optional recipe match key: the recipe applies only when every listed GGUF
metadata key is present in the `-m` file. It is what separates PrismML's Ternary-Bonsai-2-27B from
Qwen3.8-27B, which has the same `general.architecture = qwen35`: the ternary files carry
`prism.hadamard.version`, Qwen3.8 files do not. `app/gguf_meta.h` gains `gguf_has_keys()`, which walks
only the key/value section (same assumptions as `gguf_architecture`), and serve fills
`RecipeFacts::gguf_keys` only when a recipe matches on them, so a launch without such a recipe does not
read the header twice.

The Bonsai recipe comes first in file order because the first recipe to add a flag wins:

  bonsai-ternary-mtp-n2  hrx + qwen35 + mtp + prism.hadamard.version  ->  --spec-draft-n-max 2

Ternary-Bonsai-2-27B accepts 0.76 of two-token MTP drafts against 0.67 at three, so two wins prose,
short answers and translation (40.4 / 38.3 / 30.4 / 34.7 tok/s) and three to four wins code by 4-8%
(43.7 / 36.0 / 24.6 / 30.1 at four). The plain `qwen35-mtp-max-3` recipe then finds the flag already
set on those files and adds nothing, so Qwen3.8-27B keeps three.

Also fixes `qwen35-mtp-max-3` itself: it added `--mtp-max 3` to **llama-server**, which has no such
flag (serve's own `--mtp-max` maps to `--spec-draft-n-max`, app/serve.cpp); it now adds the flag
llama-server really reads. DFlash's `--spec-draft-p-min 0` was already correct.

Docs: `docs/recipes.md` documents `gguf_keys` and lists the Bonsai recipe; `docs/serve.md` gains a
"Ternary-Bonsai-2-27B" subsection in the drafters section (the three files hold identical weights,
PQ2_0 is the pick at pp512 553 / tg128 21.4, the Qwen3.8 MTP head attaches, two drafts by default and
four for code, DFlash2 works since fork #143 but trails MTP at 0.37 against 0.67 acceptance, and both
come with the next private-add-on pin); `docs/hrx.md`'s PrismML bullet records PQ2_0 on the dense
prefill kernels and ternary weights on the 2..16-token verify kernels.

Verified locally without a GPU: a standalone harness linking the real `app/recipes.cpp` builds synthetic
GGUFs with and without `prism.hadamard.version` and checks that the recipe matches only the file that
carries it, that an empty list matches anything, that a missing key does not match, and that a non-list
`gguf_keys` is refused; `tests/recipes_route.sh` covers the same through `1bit serve` with its fake
backend (present, absent and non-list cases added), and its header comment now names the key.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
bong-water-water-bong added a commit that referenced this pull request Oct 25, 2026
llama.cpp along 1bit/hrx-vulkan-patched 851fa6c8d8f2 -> e7e5cd08f9bb: DFlash2 drafters on the pinned branch (#139) + FILL cache key / TOP_K tests (#140), Qwen3.8-Flash-Next on HRX with the HIP-defer guard (#142) and IQ2_S routing (#144), DFlash2 Hadamard folds for Ternary-Bonsai (#143), HRX test-suite / Flint / jinja changes (#126-#135). hrx-system held at 82804197bcbe. hw-gate green after the KLD base logits were restored on the gate box. The private kernel pin follows in its own PR.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant