ci(forge): wire the live-contract oracle + fixture-regen lane (RIG-2230 T3) - #487
Open
rigel-mintaka wants to merge 2 commits into
Open
ci(forge): wire the live-contract oracle + fixture-regen lane (RIG-2230 T3)#487rigel-mintaka wants to merge 2 commits into
rigel-mintaka wants to merge 2 commits into
Conversation
|
Compass engineering docs preview: https://compass-server-2230-t3-ci-wi.compass-eng-docs.pages.dev Deployed from |
…30 T3) Wires leg 3 of the forge integration-testing lane (frozen record docs/designs/product/compass-forge-integration-testing/design.md §T3): the one authorized ci.yml edit that runs the //go:build livegithub oracle T2 built (TestLive*) against the real GitHub + Linear testbed, plus the operator-only fixture-regeneration lane. In the gates job, after the pgtest step: - A forge-affected detector (PRs only) resolving whether the PR touches go/internal/forge/** or ci.yml into $GITHUB_OUTPUT, mirroring the dogfood image_affected idiom (no changed-paths primitive in a step if:). - The live-contract oracle step, gated on the explicit tri-event boolean the record requires: (pull_request AND same-repo-head AND forge-affected) OR push OR schedule — an OR across events, never one same-repo guard ANDed across all three (that form nulls the oracle out on push/schedule, the secret-bearing backstops). Capture-replay-exit shape; CGO_ENABLED=1 for -race, matching go/moon.yml's race lane. - A source-derived assert-it-ran-not-skipped guard: it seds liveSkipMessage out of livegithub_test.go (so rewording the skip cannot leave the grep matching nothing and reporting success) and requires the package ok line, mirroring the pgtest and dogfood guards. - The D2 dogfood-tier comment scoped to say its no-secrets clause is the dogfood tier alone (the oracle is a separate secret-bearing gates step), citing this record. A separate workflow_dispatch regen-forge-fixtures job runs TestLiveUpdateFixtures -update against the testbed and opens a bot PR with the rewritten testdata/ diff — the PATs live only in Actions secrets, so a local -update is impossible. It is workflow_dispatch-only, never a gate step, so the required CI rollup (which does not need: it) is untouched. Staging (record §399-403 "Required-blocking activation ordering"): the required-blocking flip activates AFTER the testbed is provisioned; skip mode in the interim is the decided staging order. The skip-guard turns a credential-less skip into a HARD failure, so until RIG-2345 lands the LIVEGITHUB_*/LINEAR_FORGE Actions secrets a push-to-main or nightly run would red the build on a skip that is correct for an unprovisioned testbed. A forge_creds detect step resolves whether the GitHub trio is present into $GITHUB_OUTPUT, and both the oracle and its guard AND on have_creds == 'true'. Unprovisioned -> both skip cleanly (dormant-green); the moment the secrets land the gate flips true and enforcement activates with no further edit. The final RIG-2230 step, after provisioning is confirmed, removes the have_creds clause so a later secret-drop can no longer silently disable the required oracle. Also corrects the guard's package ok-line grep from the pre-rename github.com/sealedsecurity/compass path to github.com/RigelBuild/compass (module renamed under RIG-2025); the stale path would never match, redding the guard unconditionally. Verification: actionlint clean (the two remaining shellcheck info/error findings are pre-existing on main; the regen job's unquoted `nix build --no-link $stores` matches the gates/dogfood convention on main verbatim). Replayed the guard logic against a real credential-less oracle log: the suite skips-and-passes (exit 0), the sed-extracted skip string matches (guard is non-vacuous and would fire on a bare skip), and the corrected RigelBuild ok-line grep matches. Refs RIG-2230. Co-authored-by: Matt Wilkinson <matt@rigel.build>
Additive review-fix commit on PR #487. Round-1 review returned 0 high, 2 medium, 2 actionable low; this closes both mediums (contract-drift against the frozen record, not design forks) and the consistency low. Medium — Linear leg was vacuous-green (the load-bearing one). The record freezes Linear as CO-EQUAL and in-scope now, not deferred (design §525-526), and T2's suite carries an independent `liveLinearSkipMessage` for the Linear legs. The guard only asserted the GitHub `liveSkipMessage`, so a GitHub-provisioned / Linear-absent state would run the GitHub legs, skip the Linear legs, and still report the package `ok` — a required check going green while the co-equal Linear live-contract leg silently asserted nothing. That hole was PERMANENT: it survived the planned removal of the have_creds staging clause, so a later LINEAR_FORGE rotation-to-empty would erase Linear verification with no signal. Two coupled fixes: - forge_creds now requires all FIVE secrets (the LIVEGITHUB_* trio AND LINEAR_FORGE + LINEAR_FORGE_TEAM), so a half-provisioned window keeps the oracle fully dormant rather than half-running and redding on the still- skipped Linear leg. - the assert-it-ran guard now sed-derives BOTH skip literals from source and fails if EITHER leg skipped, plus the package-ok line — the source-derived backstop that a partial credential state cannot pass green, independent of the staging clause. Medium — workflow_dispatch silently broadened the whole workflow. Adding the top-level `workflow_dispatch` trigger for the regen lane also satisfied every other job's `github.event_name != 'pull_request'` guard, so a fixture-regen dispatch would spin up the full ~90-minute gates battery + the podman dogfood tier alongside the regen job, and a flake in either would show the dispatch run red though the regen PR opened cleanly. Added `github.event_name != 'workflow_dispatch' &&` to the gates, dogfood-e2e, and CI-rollup job `if:` blocks (OR-group kept parenthesized — `&&` binds tighter than `||`), confining a dispatch to the regen-forge-fixtures job alone, which is what the regen job's own comment already claimed. Low — forge_affected now mirrors the gtk3-affected gate's explicit `git rev-parse --verify --quiet` base-ref check, emitting an actionable `::error::` when the base does not resolve instead of surfacing a bare git diff error (behavior was already fail-closed; this names the cause). Not changed: the one review low re: livegithub_test.go absence is moot — T2 (PR #486) has since merged, so internal/forge/livegithub_test.go and both skip consts exist at main; the guard's sed reads a real file. Verification: actionlint clean over the full file (the three residual shellcheck findings — SC2086 x2, SC1087 — are pre-existing on main; the regen job's unquoted `nix build --no-link $stores` matches the gates/dogfood convention at lines 203/911 verbatim). Boolean precedence of all three dispatch-exclusion guards traced by hand across every event. Refs RIG-2230. Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
force-pushed
the
compass-server-2230-t3-ci-wiring
branch
from
August 22, 2026 13:37
8dc9089 to
5b6cc65
Compare
mattwilkinsonn
approved these changes
Aug 22, 2026
mattwilkinsonn
approved these changes
Aug 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wires leg 3 of the forge integration-testing lane (frozen record
docs/designs/product/compass-forge-integration-testing/design.md §T3):
the one authorized ci.yml edit that runs the //go:build livegithub
oracle T2 built (TestLive*) against the real GitHub + Linear testbed,
plus the operator-only fixture-regeneration lane.
In the gates job, after the pgtest step:
go/internal/forge/** or ci.yml into $GITHUB_OUTPUT, mirroring the
dogfood image_affected idiom (no changed-paths primitive in a step if:).
the record requires: (pull_request AND same-repo-head AND forge-affected)
OR push OR schedule — an OR across events, never one same-repo guard
ANDed across all three (that form nulls the oracle out on push/schedule,
the secret-bearing backstops). Capture-replay-exit shape; CGO_ENABLED=1
for -race, matching go/moon.yml's race lane.
out of livegithub_test.go (so rewording the skip cannot leave the grep
matching nothing and reporting success) and requires the package ok line,
mirroring the pgtest and dogfood guards.
dogfood tier alone (the oracle is a separate secret-bearing gates step),
citing this record.
A separate workflow_dispatch regen-forge-fixtures job runs
TestLiveUpdateFixtures -update against the testbed and opens a bot PR with
the rewritten testdata/ diff — the PATs live only in Actions secrets, so a
local -update is impossible. It is workflow_dispatch-only, never a gate
step, so the required CI rollup (which does not need: it) is untouched.
Staging (record §399-403 "Required-blocking activation ordering"): the
required-blocking flip activates AFTER the testbed is provisioned; skip
mode in the interim is the decided staging order. The skip-guard turns a
credential-less skip into a HARD failure, so until RIG-2345 lands the
LIVEGITHUB_*/LINEAR_FORGE Actions secrets a push-to-main or nightly run
would red the build on a skip that is correct for an unprovisioned
testbed. A forge_creds detect step resolves whether the GitHub trio is
present into $GITHUB_OUTPUT, and both the oracle and its guard AND on
have_creds == 'true'. Unprovisioned -> both skip cleanly (dormant-green);
the moment the secrets land the gate flips true and enforcement activates
with no further edit. The final RIG-2230 step, after provisioning is
confirmed, removes the have_creds clause so a later secret-drop can no
longer silently disable the required oracle.
Also corrects the guard's package ok-line grep from the pre-rename
github.com/sealedsecurity/compass path to github.com/RigelBuild/compass
(module renamed under RIG-2025); the stale path would never match, redding
the guard unconditionally.
Verification: actionlint clean (the two remaining shellcheck info/error
findings are pre-existing on main; the regen job's unquoted
nix build --no-link $storesmatches the gates/dogfood convention on mainverbatim). Replayed the guard logic against a real credential-less oracle
log: the suite skips-and-passes (exit 0), the sed-extracted skip string
matches (guard is non-vacuous and would fire on a bare skip), and the
corrected RigelBuild ok-line grep matches.
Refs RIG-2230.
Co-authored-by: Matt Wilkinson matt@rigel.build