Repository navigation
ci(OMN-20375): every required dev context reports on merge_group - #3250
Conversation
The OCC preflight caller gains the merge_group trigger (its reusable re-runs eligibility on a queue commit by design). A new merge_group-only workflow reports the pull-request-scoped required contexts and CI Summary external contexts on the queue commit from the verdict each reached on the queued pull request's head, read live from its check-runs, never assumed.
✅ Architectural Review — PASSEDErrors: 0 What this checks
No architectural violations found. Static architectural lint — no model inference (OMN-14176). |
|
OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required. Considered 2 changed file(s):
This verdict is occ-autobind's, derived from this head and its merge base alone. A second producer, the occ-companion-effect backstop, consumes its own command on the lab bus and may still mint a companion under the generic binding. Whether it does depends on that consumer running, not on this diff (OMN-18876). |
✅ Hostile Reviewer — PASSEDBlocking findings (critical/error): 0 Gate semantics
Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524) |
Each PR-scoped context is now its own job, named exactly as the context, that reads that context's newest check-run on the queued pull request head. The separate resolve job is gone: the advisory-job gate read it as a verification job no required context enforced, and a matrix-named job cannot be resolved to the contexts it reports. Onex-Lane: merge-queues-0c2f Onex-Session: bd1921649d2a48acb428ce374fdcaaf1
|
The required check "verify / verify" (Receipt Gate, run 37033629376, attempt 3, head 3b8a1d2) failed because the gate resolved Evidence-Source OCC#12367 to OCC sha a0d82161b775f5be2b13363f609507385a17af44 and returned omnibase_core's onex_change_control#12360 (OMN-20370, merged 2026-10-02T15:07:21Z) makes OCC CI reject new hand-authored receipts missing Two conflicting fixes exist: (a) advance the validator ref in omnibase_core No code change in this PR resolves the conflict. Left for an operator decision; nothing was pushed. |
…exts Merged origin/dev (084c757) into the branch with no conflicts. The branch was 22 commits behind dev and pinned omnibase_core receipt-gate.yml at 52851458622f368c3b596c82bf810bc6acce1d5e, while dev pins fad21c40911b356c30f3e38c9075332f11524617. The old pin caused verify / verify (run 37033629376) to fail with reason=nonpass_receipt because ModelDodReceipt rejected artifact_sha256. The CI Summary failed only because it waits on verify / verify. The merged head carries the dev pin which accepts artifact_sha256 and creates a fresh pull_request event.
|
OCC autobind rebound this PR's evidence-source stamp line to The receipt gate's own eligibility validator, run against the change-control tree the gate pins for Reported by |
Summary
OMN-20375. Operator consent 2026-10-02 (ledger OPERATOR-CONSENT 2026-10-02T15:09:59Z lane=merge-queues-0c2f) puts omnimarket
devunder a merge queue, with the ruleset copied from omnibase_infra 13269702. This PR comes first, because a queue commit must carry every required context. On origin/dev at e141812, 20 of the 35 requireddevcontexts come from workflows that never run onmerge_group. CI Summary also asserts 30 L4 external contexts with nomerge_groupproducer. With the queue on as things stand, every entry would wait for these contexts until the queue's check timeout and then be ejected.call-occ-preflight.ymlnow triggers onmerge_group. The pinned reusable (omnibase_core occ-preflight.yml @52851458) re-runs eligibility fully on a queue commit, which is its invariant I2, soocc-preflight / eligibilityis a real verdict on the queue commit and is not carried over from the PR run. The pollers that wait for that context find it there as well.merge-group-pr-scoped-contexts.yml, which runs onmerge_grouponly, covers the 29 remaining contexts. Their producers read the pull request itself (title, body, review, diff against its base) or call a cross-repo reusable that fails on a non-PR event. There is one job per context, and each job is named exactly as its context. Each job reads the PR that the queue ref names and lists that context's check-runs on the PR head, then takes the newest run. The job passes only when that run concluded success, neutral or skipped, which is the set branch protection accepts. No run on the head, a run still in progress, a red run, an unreadable ref or a failed API read all fail the job. The workflow never runs on a pull request, so it cannot stand in for the real producer or race it.resolvejob and matrix. The advisory-job gate readresolveas a verification job that no required context enforced. A job named from a matrix cannot be resolved to the contexts it reports either. Explicit jobs fix both, andadvisory_job_gate.pynow prints PASS on this tree.This is the merge_group short-circuit that omnibase_infra uses (deploy-gate, dep-provenance, dispatch-parity, contract-validation), with one change: the verdict is read from the PR head instead of assumed.
Not runtime-affecting: only two workflow files change, and no node, handler, contract or runtime path is touched, so there is no lab pass to cite.
Evidence (local, on the branch head)
merge_groupproducer. Positive control: the same check at HEAD~1 lists the 30 contexts that were missing.pre-commit run --fileson both workflows exits 0, and the commit's own hooks passed.actionlinton both files is clean, and the required-check skip-vector validator (validate_no_required_check_skip_vectors.py) prints PASS.uv run pytest tests/unit/workflows tests/ci tests/unit/scripts/ci/test_ci_summary_gate.py: 1414 passed.The ruleset is enabled only after this PR is on origin/dev. The first queue group is then watched, and the ruleset is removed if that group stalls.
Evidence-Ticket: OMN-20375
Evidence-Source: OCC#12369