From ce6158774b6006ae595701fb8ea11a4ea8e88ed3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 14:20:42 +0900 Subject: [PATCH 1/2] fix(strix): de-synchronize concurrent PR scans with run-id jitter Several pull requests frequently start their required Strix scans within the same minute. Without a spread, all of them hit the same NVIDIA NIM / OpenAI capacity window simultaneously and fail with provider 429s before the transient-retry ladder can recover, which fails a required check for infrastructure rather than security reasons. Add a bounded, deterministic pre-scan stagger derived from the run id and attempt number (max ~2.75 min across three attempts), so concurrent scans spread out instead of colliding. No gate semantics, severity thresholds, model ladder, or failure classification changed. --- .github/workflows/strix.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml index f89119070..59428d8c4 100644 --- a/.github/workflows/strix.yml +++ b/.github/workflows/strix.yml @@ -855,6 +855,8 @@ jobs: PR_BASE_SHA: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.event.client_payload.pr_base_sha }} PR_HEAD_SHA: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.event.client_payload.pr_head_sha }} IS_PR_EVIDENCE_RUN: ${{ (github.event_name == 'pull_request_target' || github.event.client_payload.pr_number != '') && 'true' || 'false' }} + github_run_id: ${{ github.run_id }} + github_run_attempt: ${{ github.run_attempt }} run: | budget_suffix="TIME""OUT" process_budget_seconds="5400" @@ -871,6 +873,19 @@ jobs: # could not complete a scan. Provider failure is typed infrastructure # evidence, but remains non-passing because no authoritative complete # vulnerability result exists. + + # De-synchronize concurrent PR scans. Several pull requests often + # start within the same minute; without a spread they all hit the + # same NVIDIA NIM / OpenAI capacity window at once and exhaust it + # with 429s before any retry ladder can recover. A run-id-derived + # jitter stays deterministic per run while bounding the delay well + # inside the process budget. + scan_stagger_seconds=$(( (github_run_id % 8) * 15 + (github_run_attempt - 1) * 30 )) + if [ "$scan_stagger_seconds" -gt 0 ]; then + echo "Staggering Strix scan start by ${scan_stagger_seconds}s to avoid provider-capacity collisions across concurrent PR scans." >&2 + sleep "$scan_stagger_seconds" + fi + strix_run_log="$RUNNER_TEMP/strix_gate_console.log" strix_rc=0 set +e From 98733c71762e82c6b9182d75177cb7bfaeea9d8b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 15:11:44 +0900 Subject: [PATCH 2/2] fix(strix): complete the gpt-5.6-luna fallback migration pinned by policy tests The exact-head-path-policy contract tests on main already require: - private-repository default and no-key fallback model gpt-5.6-luna; - the nvidia_nim fallback ladder ending in openai-direct/gpt-5.6-luna. The workflow still carried gpt-5.4 in those three positions, so every PR check failed these two tests regardless of its own changes. Align strix.yml with the tested contract. This also directly mitigates the observed gpt-5.4 rate-limit exhaustion that produced STRIX_PROVIDER_UNAVAILABLE failures across fast-mlsirm PRs. --- .github/workflows/strix.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml index 59428d8c4..8862f9c69 100644 --- a/.github/workflows/strix.yml +++ b/.github/workflows/strix.yml @@ -453,7 +453,7 @@ jobs: - name: Gate Strix secrets id: gate env: - STRIX_MODEL: ${{ github.event.client_payload.strix_llm || (steps.target_visibility.outputs.is_private == 'false' && 'nvidia_nim/nvidia/nemotron-3-super-120b-a12b' || 'gpt-5.4') }} + STRIX_MODEL: ${{ github.event.client_payload.strix_llm || (steps.target_visibility.outputs.is_private == 'false' && 'nvidia_nim/nvidia/nemotron-3-super-120b-a12b' || 'gpt-5.6-luna') }} STRIX_MODEL_REQUESTED: ${{ github.event.client_payload.strix_llm || '' }} STRIX_OPENAI_API_KEY: ${{ secrets.STRIX_OPENAI_API_KEY || secrets.OPENAI_API_KEY }} STRIX_OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} @@ -464,7 +464,7 @@ jobs: run: | strix_model="$(printf '%s' "$STRIX_MODEL" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')" if [ -z "$STRIX_MODEL_REQUESTED" ] && [ "$strix_model" = "nvidia_nim/nvidia/nemotron-3-super-120b-a12b" ] && [ -z "${STRIX_NVIDIA_NIM_API_KEY:-}" ]; then - strix_model="gpt-5.4" + strix_model="gpt-5.6-luna" fi echo "strix_model=$strix_model" >> "$GITHUB_OUTPUT" case "$strix_model" in @@ -834,7 +834,7 @@ jobs: STRIX_LLM_MAX_RETRIES: 1 STRIX_TRANSIENT_RETRY_PER_MODEL: 2 STRIX_TRANSIENT_RETRY_BACKOFF_SECONDS: 60 - STRIX_FALLBACK_MODELS: ${{ steps.gate.outputs.provider_mode == 'github_models' && 'openai-direct/gpt-5.4' || steps.gate.outputs.provider_mode == 'openai_direct' && 'openai-direct/gpt-5.4' || steps.gate.outputs.provider_mode == 'openrouter' && 'openai-direct/gpt-5.4' || steps.gate.outputs.provider_mode == 'nvidia_nim' && 'nvidia_nim/nvidia/llama-3.3-nemotron-super-49b-v1.5 openai-direct/gpt-5.4' || '' }} + STRIX_FALLBACK_MODELS: ${{ steps.gate.outputs.provider_mode == 'github_models' && 'openai-direct/gpt-5.6-luna' || steps.gate.outputs.provider_mode == 'openai_direct' && 'openai-direct/gpt-5.6-luna' || steps.gate.outputs.provider_mode == 'openrouter' && 'openai-direct/gpt-5.6-luna' || steps.gate.outputs.provider_mode == 'nvidia_nim' && 'nvidia_nim/nvidia/llama-3.3-nemotron-super-49b-v1.5 openai-direct/gpt-5.6-luna' || '' }} STRIX_GITHUB_MODELS_API_BASE_FILE: ${{ env.STRIX_GITHUB_MODELS_API_BASE_FILE }} STRIX_GITHUB_MODELS_KEY_FILE: ${{ env.STRIX_GITHUB_MODELS_KEY_FILE }} STRIX_OPENAI_FALLBACK_KEY_FILE: ${{ env.STRIX_OPENAI_FALLBACK_KEY_FILE }}