Skip to content

fix(strix): queue scans org-wide instead of racing NVIDIA NIM into shared-key 429s #1325

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 1 commit into from
Closed

fix(strix): queue scans org-wide instead of racing NVIDIA NIM into shared-key 429s #1325

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .github/workflows/strix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,16 @@ jobs:

strix:
if: github.event_name != 'pull_request_target' || github.event.action != 'closed'
# Org-wide scan serialization: NVIDIA NIM's shared tenant key 429s when
# every member repo's PR scans fire in parallel, and the gate correctly
# fails closed on provider unavailability -- so unrelated PRs were failing
# with zero findings purely from org-self-inflicted rate limits. A single
# broad group with cancel-in-progress: false QUEUES scans instead of
# racing them into the provider. The workflow-level per-PR group above
# still cancels superseded runs of the same PR.
concurrency:
group: strix-org-wide-nim-scan
cancel-in-progress: false
Comment on lines +102 to +104

@devin-ai-integration devin-ai-integration Bot Aug 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Static group cannot serialize scans across repositories

Concurrency groups are scoped to a single repository, and this required workflow runs in each member repo's own context. The identical strix-org-wide-nim-scan group in different repos never serializes, so cross-repo scans still race into the shared NVIDIA NIM key.

Prompt for agents 
The job-level concurrency group strix-org-wide-nim-scan in .github/workflows/strix.yml is intended to serialize Strix scans org-wide so they stop racing into the shared NVIDIA NIM tenant key. However, GitHub Actions concurrency groups are scoped to a single repository, and this workflow runs as an organization required workflow in each member repository's own context (see AGENTS.md / CLAUDE.md). A group with the same name in two different repositories is two independent groups, so scans in different repos will NOT serialize against each other and will still collide into the shared key. Cross-repository serialization cannot be achieved with a GitHub Actions concurrency group; it requires an external coordination mechanism (e.g., a shared mutex service, a queue keyed on the shared credential, or provider-side rate-limit handling/backoff). Reconsider the approach for the cross-repo case.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

Comment on lines +102 to +104

@devin-ai-integration devin-ai-integration Bot Aug 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Queued scans are canceled, not serialized

With cancel-in-progress: false GitHub still allows only one pending run per group. When a scan queues while one is in progress and another is already pending, the pending one is canceled. Since every PR in a repo shares this one static group, a busy repo cancels superseded-but-valid scans, dropping required Strix evidence instead of queueing it.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

Comment on lines +102 to +104

@devin-ai-integration devin-ai-integration Bot Aug 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: Existing concurrency contract tests unaffected

The new job-level concurrency block does not break test_strix_cancels_superseded_pr_head_security_evidence: its extraction window (split("concurrency:",1)[1].split("permissions:",1)[0]) captures only the workflow-level block, because the workflow-level permissions: precedes the new block.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

# Large repositories can require a legitimate full-hour review. The scanner
# gets a 90-minute process budget and a 95-minute total retry budget; the
# 100-minute step and 120-minute job leave deterministic time to preserve
Expand Down
Loading