ci: compose reusable products and add Depot routing - #1113
Merged
Conversation
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (114)
📝 WalkthroughWalkthroughThis change reorganizes CI around immutable host, runtime, SDK, and static-ABI producers with composition-only consumers. It adds strict artifact verification, planned PR job routing, Depot trust boundaries, sccache evidence capture, pinned actions, reusable workflows, release integration, security-focused extraction, and extensive contract tests. ChangesCI artifact and runner migration
Estimated code review effort: 5 (Critical) | ~120 minutes ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
This pull request is currently a draft. Reviews will not take place until the PR is marked as ready for review. |
ndizazzo
force-pushed
the
codex/ci-composable-pr-builds
branch
from
July 29, 2026 22:15
f89bec9 to
ac5e517
Compare
…d-only # Conflicts: # .github/workflows/depot-canary.yml
ndizazzo
marked this pull request as ready for review
July 30, 2026 08:02
This was referenced Jul 30, 2026
This was referenced Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This restructures CI around one immutable product pipeline:
source -> neutral host + native runtime -> verified product-v2 -> smoke / SDK / packagingGitHub-hosted control
Current head:
60488208f704b49593531804a0c300b491456cabAll jobs above used GitHub-hosted or existing dedicated GPU runners. They are not Depot timings.
Historical PR Builds, 20-run sample: p50 33m12s, p90 45m21s, p95 55m33s, maximum 69m01s. The latest run stayed below historical p90 despite unusually high queue pressure. Its critical path was the 31m35s Windows CUDA producer, followed by a 2m16s thin composer and 3s summary. Queue and execution are reported separately.
The latest run completed 48 jobs with no failures. It uploaded 36 artifacts totaling 2.823 GiB: 16 immutable producer inputs, seven composed products, 11 machine-readable sccache evidence artifacts, and two inference-binary artifacts. Linux and Windows composers downloaded the exact expected neutral-host digest, combined it with the exact runtime digest, verified the product, and observed client readiness.
Cache evidence
The PR cache policy uses writable job-local sccache. Trusted main/release/warmers own shared compiler-cache publication.
Latest downloadable sccache evidence:
The Swift producer recorded 1,234 compile requests, 1,053 misses, 1,053 successful writes, and zero cache errors, confirming the earlier write-error failure mode is fixed.
Exact native restore evidence included Linux Vulkan, Linux static ABI, macOS dynamic Metal, macOS static Metal, and Swift hits. Windows CPU/CUDA/ROCm/Vulkan were expected cold misses after the corrected exact keys. Windows CUDA still completed with three sccache hits, 829 misses, and zero cache, write, or timeout errors.
The two controlled repeats are reproducible but are not Windows-native warm benchmarks: untrusted PR jobs intentionally cannot publish shared Windows ABI caches. Trusted main/warmers seed those exact epochs.
Depot evidence and rollback
DEPOT_RUNNERS_ENABLEDremains absent/false. Regular PR workflows remain on GitHub-hosted runners.The isolated canary has no checkout,
permissions: {}, validates architecture/image identity, exercises authenticated WebDAV sccache, and separately testsactions/cache.First real cold canary: 30521012517.
The first warm assertion 30521970209 correctly exposed an
actions/cacheprefix collision between the unsuffixed and sized runner labels. The canary now uses delimiter-safe v2 keys, with regression coverage.Corrected v2 sequence at merge SHA
3e30937ada7f4ff0dae61396c25b00ea09d392a9:actions/cacheEvery row queued for one second. Intel labels passed
x86_64, ARM labels passedaarch64, and image identity, WebDAV endpoint, and authentication guards passed. Every WebDAV sccache probe hit with zero errors or timeouts; the entry already existed from the earlier repository-scoped canary, so this is a cleanactions/cachecold/warm sequence but not a fresh sccache cold-write measurement.No general CI routing is enabled. Immediate rollback remains
DEPOT_RUNNERS_ENABLED=false, which selects GitHub-hosted labels without changing producer/composer inputs. GPU runner selection is independent and unchanged.Runner-images evidence
mesh-llm-runner-images PR #9 is merged as
4e79e68e.The post-merge staging run is green:
The earlier PR validation run completed in 6m22s versus 22m57s historically, a 72.3% wall reduction, with aggregate execution reduced 57.7%.
Packaging migration
mesh-packaging PR #16 applies the same build-once/stage/test/promote model.
contents: read.The attempted full native/Homebrew dry run 30521970516 reached execution and failed closed because every currently published Mesh release predates the
product-v2schema and five-addon contract. Bypassing the immutable released-tag requirement would weaken the trust model. PR #16 remains draft until a compatible authorized Mesh release exists for the complete native/Homebrew/npm rehearsal.Local validation
Mesh-LLM:
git diff --check: clean.cargo run -p xtask -- repo-consistency release-targets: passed.cargo fmt --all --check: clean.cargo test -p mesh-llm --test qa_nightly_stability: 6/6.cargo check -p mesh-llm: passed.cargo clippy -p mesh-llm --all-targets -- -D warnings: passed.just --fmt --checkandjust build: passed.Packaging:
git diff --check: clean.PowerShell is unavailable locally; the green GitHub-hosted Windows matrix is the execution evidence.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation