Skip to content

ci: give seconds-long jobs their own ECS lane #10575

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wenshao wants to merge 19 commits into from
Closed

ci: give seconds-long jobs their own ECS lane #10575

Show file tree
Hide file tree
Changes from 16 commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
db84f90
ci: give seconds-long jobs their own ECS lane
wenshao Aug 30, 2026
3376a1f
ci: correct the lane convention comment to the per-host split
wenshao Aug 30, 2026
8992683
ci: fail the lane guard closed on runs-on spellings it cannot read
wenshao Aug 30, 2026
bcd4f36
ci: close the lane guard's remaining fail-open surfaces structurally
wenshao Aug 31, 2026
e360963
ci: describe the lane convention by shape, not by host inventory
wenshao Aug 31, 2026
4b91514
ci: rebuild the lane guard on the YAML parser
wenshao Aug 31, 2026
82dd7b6
ci: judge every value arm of an expression runs-on
wenshao Aug 31, 2026
161d196
ci: judge expression arms against a closed shape allowlist
wenshao Aug 31, 2026
6db7d86
ci: require a checkable producer behind consumer arms; reject mixed-O…
wenshao Aug 31, 2026
be8f5ab
ci: resolve consumer operands by name; anchor exemptions; keep empty …
wenshao Sep 1, 2026
93cf54f
ci: attribute producer assemblies to the job the consumer names
wenshao Sep 1, 2026
44284ef
ci: anchor the consumer vouch on the $GITHUB_OUTPUT publish write
wenshao Sep 1, 2026
90f6637
ci: vouch consumed outputs only through a closed chain allowlist
qwen-code-ci-bot Sep 1, 2026
4611b23
Merge branch 'main' into ci/short-job-lane
qwen-code-dev-bot Sep 1, 2026
31f1fc3
ci: close the producer vouch's residual surface structurally
qwen-code-ci-bot Sep 2, 2026
507a31b
Merge branch 'main' into ci/short-job-lane
qwen-code-dev-bot Sep 2, 2026
e890052
ci: register the hk4 lane and close four guard fail-open seams
qwen-code-ci-bot Sep 2, 2026
b4534bb
ci: observe the runner-set producer's published value, not just its s…
qwen-code-ci-bot Sep 2, 2026
60fd514
Merge branch 'main' into ci/short-job-lane
qwen-code-dev-bot Sep 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1,884 changes: 1,884 additions & 0 deletions .github/scripts/ci/runner-lane-labels.test.mjs
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ env:
# BOTH the github_ci_only helper step and the full-profile Test step, so a
# new helper test can't be added to one path and silently dropped from the
# other.
HELPER_TESTS: '.github/scripts/pr-safety-precheck.test.mjs .github/scripts/cap-release-notes.test.mjs .github/scripts/ci/classify-profile.test.mjs .github/scripts/ci/classify-platform-sensitivity.test.mjs .github/scripts/ci/classify-pr-profile.test.mjs .github/scripts/upsert-bot-comment.test.mjs .github/scripts/ci/main-failure-signature.test.mjs .github/scripts/classify-release-notes.test.mjs .github/scripts/dsw-swe-verified/make-manifest.test.mjs .github/scripts/dsw-swe-verified/make-terminal-bench-manifest.test.mjs .github/scripts/resolve-sandbox-image.test.mjs .github/scripts/web-shell-visuals-publish.test.mjs .github/scripts/web-shell-visuals-compose.test.mjs .github/scripts/serve-ab-diff.test.mjs .github/scripts/serve-ab-drive.test.mjs .github/scripts/qwen-triage-workflow.test.mjs .github/scripts/assign-issue-owner.test.mjs .github/scripts/auto-minimize-spam.test.mjs .github/scripts/ci-runner-routing.test.mjs .github/scripts/autofix-status-heartbeat.test.mjs .github/scripts/assign-pr-owner.test.mjs .github/scripts/check-disk-floor.test.mjs .github/scripts/ci-disk-pressure.test.mjs'
HELPER_TESTS: '.github/scripts/pr-safety-precheck.test.mjs .github/scripts/cap-release-notes.test.mjs .github/scripts/ci/classify-profile.test.mjs .github/scripts/ci/classify-platform-sensitivity.test.mjs .github/scripts/ci/classify-pr-profile.test.mjs .github/scripts/upsert-bot-comment.test.mjs .github/scripts/ci/main-failure-signature.test.mjs .github/scripts/classify-release-notes.test.mjs .github/scripts/dsw-swe-verified/make-manifest.test.mjs .github/scripts/dsw-swe-verified/make-terminal-bench-manifest.test.mjs .github/scripts/resolve-sandbox-image.test.mjs .github/scripts/web-shell-visuals-publish.test.mjs .github/scripts/web-shell-visuals-compose.test.mjs .github/scripts/serve-ab-diff.test.mjs .github/scripts/serve-ab-drive.test.mjs .github/scripts/qwen-triage-workflow.test.mjs .github/scripts/assign-issue-owner.test.mjs .github/scripts/auto-minimize-spam.test.mjs .github/scripts/ci-runner-routing.test.mjs .github/scripts/ci/runner-lane-labels.test.mjs .github/scripts/autofix-status-heartbeat.test.mjs .github/scripts/assign-pr-owner.test.mjs .github/scripts/check-disk-floor.test.mjs .github/scripts/ci-disk-pressure.test.mjs'
# The growth ratchet and its vitest mirror compare each workflow against
# the PR's base commit to tell "this PR grew the file" apart from "the
# baseline went stale on main" (#9904). Wired once here so every lane
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/pr-force-push-reminder.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,10 @@ jobs:
# Checks out nothing and runs no repository code (pull_request_target
# events use base-repo YAML), so the persistent ECS pool is safe and
# skips the saturated hosted queue. Kill-switch: MAINTAINER_ECS_RUNNER_DISABLED.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
# Seconds-long job: uses the ecs-light short-job lane (head-of-line
# blocking, not capacity); lane convention and fleet split documented
# in .github/scripts/ci/runner-lane-labels.test.mjs.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-light"]'') || fromJSON(''["ubuntu-latest"]'') }}'
steps:
- name: 'Detect force-push and post reminder'
uses: 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3' # v9.0.0
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/pr-self-report-label.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,10 @@ jobs:
# Checks out nothing and runs no repository code (pull_request_target
# events use base-repo YAML), so the persistent ECS pool is safe and
# skips the saturated hosted queue. Kill-switch: MAINTAINER_ECS_RUNNER_DISABLED.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
# Seconds-long job: uses the ecs-light short-job lane (head-of-line
# blocking, not capacity); lane convention and fleet split documented
# in .github/scripts/ci/runner-lane-labels.test.mjs.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-light"]'') || fromJSON(''["ubuntu-latest"]'') }}'
timeout-minutes: 5
steps:
- name: 'Label a self-reported PR'
Expand Down
18 changes: 15 additions & 3 deletions .github/workflows/qwen-code-pr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,10 @@ jobs:
concurrency:
group: 'qwen-pr-ack-${{ github.event.issue.number || github.event.pull_request.number }}'
cancel-in-progress: false
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
# Seconds-long job: uses the ecs-light short-job lane (head-of-line
# blocking, not capacity); lane convention and fleet split documented
# in .github/scripts/ci/runner-lane-labels.test.mjs.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-light"]'') || fromJSON(''["ubuntu-latest"]'') }}'
timeout-minutes: 5
permissions:
pull-requests: 'write'
Expand Down Expand Up @@ -216,7 +219,13 @@ jobs:
github.event_name == 'pull_request_target' &&
github.event.action == 'review_requested' &&
github.event.requested_reviewer.login == 'qwen-code-ci-bot'
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
# Seconds-long job: uses the ecs-light short-job lane (head-of-line
# blocking, not capacity); lane convention and fleet split documented
# in .github/scripts/ci/runner-lane-labels.test.mjs.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-light"]'') || fromJSON(''["ubuntu-latest"]'') }}'
# A single echo, but on a three-slot lane an uncapped job is a third of
# the lane's capacity if it ever wedges — so cap it like its siblings.
timeout-minutes: 5
permissions: {}
outputs:
bot_login: '${{ steps.values.outputs.bot_login }}'
Expand Down Expand Up @@ -310,7 +319,10 @@ jobs:
# use the persistent ECS runner. The job IS the write-permission check, so
# it cannot route on its own output; downstream jobs already route on the
# repository guard alone.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'' && github.event.pull_request && github.event.pull_request.head.repo.full_name == github.repository) && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
# Seconds-long job: uses the ecs-light short-job lane (head-of-line
# blocking, not capacity); lane convention and fleet split documented
# in .github/scripts/ci/runner-lane-labels.test.mjs.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'' && github.event.pull_request && github.event.pull_request.head.repo.full_name == github.repository) && fromJSON(''["self-hosted", "linux", "x64", "ecs-light"]'') || fromJSON(''["ubuntu-latest"]'') }}'
timeout-minutes: 5
permissions:
contents: 'read'
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/qwen-triage-finalize.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,10 @@ jobs:
# Checks out nothing and runs no repository code (workflow_run events use
# base-repo YAML), so the persistent ECS pool is safe and skips the
# saturated hosted queue. Kill-switch: MAINTAINER_ECS_RUNNER_DISABLED.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
# Seconds-long job: uses the ecs-light short-job lane (head-of-line
# blocking, not capacity); lane convention and fleet split documented
# in .github/scripts/ci/runner-lane-labels.test.mjs.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-light"]'') || fromJSON(''["ubuntu-latest"]'') }}'
timeout-minutes: 10
steps:
- name: 'Finalize CI evidence and deferred approval'
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/qwen-triage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,10 @@ jobs:
# use the persistent ECS runner. The job IS the write-permission check, so
# it cannot route on its own output; downstream jobs (triage, tmux, verify)
# route on what it finds instead.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'' && github.event.pull_request && github.event.pull_request.head.repo.full_name == github.repository) && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
# Seconds-long job: uses the ecs-light short-job lane (head-of-line
# blocking, not capacity); lane convention and fleet split documented
# in .github/scripts/ci/runner-lane-labels.test.mjs.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'' && github.event.pull_request && github.event.pull_request.head.repo.full_name == github.repository) && fromJSON(''["self-hosted", "linux", "x64", "ecs-light"]'') || fromJSON(''["ubuntu-latest"]'') }}'
timeout-minutes: 5
permissions:
contents: 'read'
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/serve-ab-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,10 @@ jobs:
# Checks out nothing and runs no repository code (workflow_run events use
# base-repo YAML), so the persistent ECS pool is safe.
# Kill-switch: MAINTAINER_ECS_RUNNER_DISABLED.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
# Seconds-long job: uses the ecs-light short-job lane (head-of-line
# blocking, not capacity); lane convention and fleet split documented
# in .github/scripts/ci/runner-lane-labels.test.mjs.
runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-light"]'') || fromJSON(''["ubuntu-latest"]'') }}'
timeout-minutes: 10
steps:
- name: 'Restore workspace ownership'
Expand Down
Loading