Repository navigation
ci(OMN-19640): cancel superseded pull request runs in 5 workflows - #4142
Conversation
jonahgabriel
added
the
hold:auto-merge
|
No OCC evidence companion was minted for this PR. product PR is a draft; companion suppressed (F-17) Matched in the state: To clear this: Mark the PR ready for review. The ready_for_review trigger re-fires the born path and the companion mints then. Reported by |
|
OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required. |
#11368) * evidence: OCC companion pass 1 for OmniNode-ai/omnibase_infra#4142 * evidence: OCC companion self-bind for #11368 --------- Co-authored-by: node-occ-companion-effect <occ-companion-effect@omninode.ai>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: qwen3-review, qwen3-review-b, glm-review
Models failed: none
New finding threads: 3
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 3
Nit-level findings suppressed: 4
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 3 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [MAJOR]
.github/workflows/contract-topic-graph.yml, governed-helper-primitive-gate.yml, kb-doc-gate.yml, public-repo-hygiene.yml, runner-route-probe.yml(glm-review) — Push events to PR branches are never cancelled | The concurrency group key falls back to github.sha for non-pull_request events, so every push to a PR source branch receives a unique group and cancel- - [MINOR]
.github/workflows/(qwen3-review-b) — Concurrency block not added to all workflows that trigger on pull_request | The diff adds the concurrency block to five workflow files. If there are other workflow files in the repository that trigger - [MINOR]
.github/workflows/runner-route-probe.yml, lines ~116-124(glm-review) — Fallback block writes decision=hosted regardless of captured rc | Within the changed hunk, rc is captured via|| rc=$?but the fallback block unconditionally writes decision=hosted and reason=probe_
Findings not anchored to a changed file
-
[MAJOR] hostile-reviewer (qwen3-review)
Concurrency group collides across distinct PRs on push events | The concurrency group expression uses
github.event.pull_request.number || github.sha. Forpushevents,github.event.pull_request.numberis empty, so the group resolves to<workflow-name>-<sha>. If two different pull requests are merged into the same branch (or if a push is made to a branch that is also targeted by an open PR), the resulting SHA is identical, causing the concurrency group to collide. This means a push-triggered run couldResolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MAJOR] hostile-reviewer (qwen3-review)
cancel-in-progress is true for all pull_request events, not just superseded ones | The
cancel-in-progressexpression evaluates totruefor anypull_requestevent. This means that when a new commit is pushed to an existing PR, the previous run is cancelled. However, if a PR is opened and then a different PR is opened against the same branch, the concurrency group for the new PR (based on its own number) will not cancel the old PR's run, which is correct. But the expression does not distinguish betweenResolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MAJOR] hostile-reviewer (qwen3-review-b)
Concurrency group key collision between push and pull_request events | The concurrency group is constructed as
${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}. Forpushevents,github.event.pull_request.numberis empty, so the key falls back togithub.sha. Forpull_requestevents, the key is the PR number. This means a push to a branch and a pull request from that same branch will have different concurrency groups, which is intended. However, thecancel-in-progresseResolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492).
Findings demoted from threads (anchor rejected)
-
[MINOR] hostile-reviewer (qwen3-review)
Grouped echo to GITHUB_OUTPUT may be less readable but is functionally equivalent | The change from three separate
echo ... >> "${GITHUB_OUTPUT}"statements to a single grouped{ echo ...; echo ...; echo ...; } >> "${GITHUB_OUTPUT}"is functionally equivalent in bash. However, the grouped form is less common and may reduce readability. More importantly, if any of theechocommands fail (e.g., due to a broken pipe or permission issue), the grouped form will still redirect the entire block's output, whiResolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MINOR] hostile-reviewer (qwen3-review-b)
Grouped echo to GITHUB_OUTPUT may produce malformed output on some runners | The change in runner-route-probe.yml replaces three separate
echo ... >> "${GITHUB_OUTPUT}"statements with a single grouped block{ echo ...; echo ...; echo ...; } >> "${GITHUB_OUTPUT}". While functionally equivalent in bash, the grouped form writes all three lines in a single redirection. If the shell implementation or runner environment has any buffering or atomicity differences, this could theoretically affect how GitHub AcResolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MINOR] hostile-reviewer (glm-review)
Concurrency cancellation can truncate the runner-route-probe fallback path mid-write | The runner-route-probe workflow is now subject to cancel-in-progress. If a run is cancelled between the probe failing and the fallback block appending to GITHUB_OUTPUT, or mid-job after routing outputs are written but before the refusal exit is honored, downstream consumer jobs get skipped rather than completing with an explicit refusal. For workflows whose outputs feed routing decisions, silent cancellation substitutes '
Resolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492).
✅ Hostile Reviewer — REVIEWEDCritical findings: 0
Semantics (OMN-17492 — the model finds, thread resolution gates)
Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review, qwen3-review-b, glm-review (OMN-8468/OMN-8524/OMN-17492) |
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: qwen3-review, qwen3-review-b, glm-review
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 6
Nit-level findings suppressed: 4
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 6 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [MAJOR]
.github/workflows/contract-topic-graph.yml, .github/workflows/governed-helper-primitive-gate.yml, .github/workflows/kb-doc-gate.yml, .github/workflows/public-repo-hygiene.yml, .github/workflows/runner-route-probe.yml(qwen3-review) — Concurrency group lacks workflow isolation, causing cross-workflow cancellation | The concurrency group is defined as${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}. Th - [MINOR]
.github/workflows/contract-topic-graph.yml, .github/workflows/governed-helper-primitive-gate.yml, .github/workflows/kb-doc-gate.yml, .github/workflows/public-repo-hygiene.yml, .github/workflows/runner-route-probe.yml(qwen3-review-b) — Concurrency group does not include branch, allowing cross-branch cancellation | The concurrency group is${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}. For pull_reques - [MINOR]
.github/workflows/runner-route-probe.yml(qwen3-review-b) — Shell block for GITHUB_OUTPUT may not handle multi-line values correctly | The change inrunner-route-probe.ymlreplaces three separateechocommands with a single shell block `{ echo ...; echo .. - [MINOR]
.github/workflows/contract-topic-graph.yml, governed-helper-primitive-gate.yml, kb-doc-gate.yml, public-repo-hygiene.yml, runner-route-probe.yml(glm-review) — Concurrency group conflates trigger semantics via fallback | The group expressiongithub.event.pull_request.number || github.shagives PR runs a per-PR group and all other events a per-SHA group. Be - [MINOR]
.github/workflows/kb-doc-gate.yml, .github/workflows/public-repo-hygiene.yml(glm-review) — Cancellation can interrupt runs whose artifacts gate merges | cancel-in-progress: true on pull_request cancels any in-flight run for the same PR number when a new event (synchronize, edited, labeled, - [MINOR]
.github/workflows/runner-route-probe.yml, probe fallback block(glm-review) — Runner probe fallback refactor untested for output atomicity | The refactor of the threeecho >> ${GITHUB_OUTPUT}statements into a brace group changes failure semantics: previously, if the first ec
Findings not anchored to a changed file
-
[MAJOR] hostile-reviewer (qwen3-review)
Shell redirection precedence causes unintended file overwrite | In the runner-route-probe.yml change, the block
{ echo ...; echo ...; echo ...; } >> "${GITHUB_OUTPUT}"is used. In POSIX shell, the redirection operator>>applies to the entire compound command block. This means the shell will open the file, truncate it (or append, depending on the exact semantics, but typically>>appends), and then execute the commands. However, the critical issue is that if this block is intended to append to a fileResolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MAJOR] hostile-reviewer (qwen3-review-b)
Concurrency group collision between push and PR events | The concurrency group uses
github.event.pull_request.number || github.sha. For push events,github.event.pull_request.numberis null, so the group becomes<workflow>-<sha>. For pull_request events, it becomes<workflow>-<pr_number>. This is correct for isolation. However, thecancel-in-progressexpression is${{ github.event_name == 'pull_request' }}. This evaluates to the stringtrueorfalse. GitHub Actions expects a boolean. While YResolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492).
Summary
Adds PR-scoped concurrency to 5 workflows. Pull-request runs group by PR number with SHA fallback; only pull-request runs cancel superseded work. Push, merge-group, scheduled, and manually dispatched runs remain non-cancelling.
Ticket: OMN-19640
Ruling: 2026-09-25T17:30:10Z
Workflows changed
.github/workflows/contract-topic-graph.yml.github/workflows/governed-helper-primitive-gate.yml.github/workflows/kb-doc-gate.yml.github/workflows/public-repo-hygiene.yml.github/workflows/runner-route-probe.ymlWorkflows skipped
docker-build.yml— aggregator (build-summary); deferred to the own-job cancelled-supersession grace wave.arm64-verify-runner-proof.yml— existing top-level concurrency block; semantics preserved.artifact-reconciliation-webhook.yml— existing top-level concurrency block; semantics preserved.auto-tag-on-merge.yml— existing top-level concurrency block; semantics preserved.contractor-integration-note.yml— existing top-level concurrency block; semantics preserved.delegation-consumer-kwarg-parity.yml— existing top-level concurrency block; semantics preserved.delegation-seam-gate.yml— existing top-level concurrency block; semantics preserved.dispatch-parity-gate.yml— existing top-level concurrency block; semantics preserved.runner-image-build-smoke.yml— existing top-level concurrency block; semantics preserved.s6-runtime-seam-gate.yml— existing top-level concurrency block; semantics preserved.shared-env-runner-parity.yml— existing top-level concurrency block; semantics preserved.Verification
Evidence-Ticket: OMN-19640
Evidence-Source: OCC#11368