fix(ci): let coverage guard use payload-only Gate runs - #115
Conversation
|
Warning Review limit reachedNext included review available in 8 minutes. View limit detailsLimit details: You’ve used the included review currently available. Your 69 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (4)
Comment |
Workflow source detectedPR #115 now has valid workflow source context (origin=local_request). No linked GitHub issue is required for this PR. |
Automated Status SummaryHead SHA: cce8c0e
Coverage Overview
Coverage Trend
Top Coverage Hotspots (lowest coverage)
Low Coverage Files (<50.0%)
Updated automatically; will refresh on subsequent CI/Docker completions. Keepalive checklistScopeNo scope information available Tasks
Acceptance criteria
|
|
Runner dispatch state for autofix on PR #115. Do not edit. |
|
Runner dispatch state for codex on PR #115. Do not edit. |
|
Workflow state fingerprint for Agents Gate Followups. Do not edit. |
|
Workflow state fingerprint for Keepalive Loop Reporter. Do not edit. |
github-actions
Bot
added
autofix
|
Autofix updated these files:
|
bba1b31 to
9e729dd
Compare
GitHub Actions
Inactive
|
Steward handoff: the exact head This is |
…pendent reasons, all silent (#3252) * fix(coverage-guard): the monitor has never once executed — three independent reasons, all silent The fleet's nightly coverage monitor has produced exactly ONE baseline-breach issue in its history (stranske/Trend_Model_Project #2933, 2025-10-23). That is not because coverage has been healthy. It is because the guard has never run to completion anywhere. 1. A PAIRED LITERAL THAT DISAGREED. pr-00-gate.yml uploads the payload under the ARTIFACT name `gate-coverage.json` — the FILE name, used as the artifact name — while this guard required `gate-coverage`. So it probed ten successful Gate runs, found two of three required artifacts every time, and reported no usable run at all. Verified against live artifact listings: no consumer publishes a bare `gate-coverage` except Orchestrator, which renamed its own producer locally in its #110. Fixed HERE rather than at the producer, deliberately: pr-00-gate.yml is distributed create-only, so renaming it reaches NEW repos only, while this file is sync-managed and reaches all thirteen. Discovery now accepts either name and EMITS the one it found, so the downloader learns the name from the producer's actual artifact list. A discovered name cannot drift from the name that exists. 2. OPTIONAL ARTIFACTS WERE REQUIRED. Trend and history were in the required set, but their download steps already tolerate absence and the guard already omits their CLI arguments when missing. Requiring them made any repo that has not enabled the soft gate permanently unusable — a gate demanding an artifact its own subject need not emit. They are now optional, gated on discovery having resolved a name, and the artifact-cache downloads for the two of them stop failing fast. 3. A SKIP LOOKED EXACTLY LIKE A PASS. `guard` is gated on the rate-limit job, so when quota is low the job is skipped and THE WORKFLOW IS GREEN with nothing checked. stranske/Workflows' three most recent runs all read `success` at the workflow level and `coverage baseline monitor: skipped` at the job level. That is how a monitor that has never executed came to look healthy for months, and it is why "only Workflows succeeds" was the wrong reading of the fleet. A new always-run `report` job states which happened, in the run's own summary and as a notice. It does NOT fail on a deferral: the quota gate is legitimate, and turning a deferral into a red would train everyone to ignore the red. It makes the state legible, which is the actual defect. Both copies patched — `.github/workflows/` (floating refs, artifact-cache) and `templates/consumer-repo/.github/workflows/` (pinned SHAs, download-artifact). They are deliberate variants, not mirrors, so the same logic is applied to each. This SUPERSEDES stranske/Orchestrator#115, which relaxes the same required-artifact set but in Orchestrator's local copy of a sync-managed file — the next template sync overwrites it, and requiring a bare `gate-coverage` would still fail in the other twelve repos. Validated: actionlint clean on both (SC2129 fixed rather than allowlisted); YAML parses; 1940 passed, 5 skipped (pre-existing) across the coverage/guard/workflow/template/sync suites. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(drift): refresh the coverage-guard fingerprint for the guard repair Health 74 flagged pair.18 because both surfaces changed. The change is applied IDENTICALLY to root and consumer, so it introduces no NEW divergence — the underlying divergence (root uses the local artifact-cache action, consumers mint an App token and use pinned public download actions) is unchanged, and divergence_reviewed deliberately keeps its 2026-08-23 date per this file's own convention. Hashes taken from `check_template_drift.py --print-allowlist-template`, not computed by hand: the checker normalizes before hashing, so a plain sha256 of the file does NOT match the recorded value — verified against the untouched pr-00-gate pair before trusting it. Break -> revert: restoring the old main_sha256 fails the check (exit 1); restoring the new one passes (exit 0). The fingerprint is load-bearing, not decorative. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Codex Automation <codex-automation@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
|
Superseded by stranske/Workflows#3252, now merged. Two reasons this could not have worked as scoped:
#3252 fixes it upstream in both workflow copies: discovery accepts either That last one is the part neither of us had: the guard job is skipped when quota is low, and a skipped job leaves the workflow green. Workflows' three most recent runs all read The diagnosis in this PR was right; it just needed to land one level up. |
1 participant
Summary
The coverage guard incorrectly required optional trend artifacts before it could inspect a Gate payload. Successful Gate runs publish
gate-coverage; trend/history downloads are already best-effort and the guard already handles their absence.gate-coverageduring candidate discoveryValidation
python3 -m pytest tests/test_coverage_guard_config.py.github/workflows/maint-coverage-guard.ymland.github/workflows/pr-00-gate.ymlwith PyYAMLgit diff --checkFixes the failed verification run 32790552224 after #110.