feat(ci): add bounded attempt-aware GitHub observation - #2868
Conversation
…emetry Collect authenticated run/job metadata across exact attempts and pages. Keep unknown timings null and previous failures visible. Protected-base observer has read-only permissions, no head/artifact/cache execution and no evidence-signing authority. Add adversarial provider/CLI/workflow tests. Refs #2336
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cfd7d74c48
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Independent review and single fix-round checkpoint Reviewed this slice with an independent Terra reader, then reviewed only the blocking fix diff. Current head: 9ffe1d7. The integrated final tree is byte-identical to independently reviewed 636a17329e5a480d702fcf1a9585cf279bbf60fb after preserving each original stack branch and propagating fixes with merge commits. Blocking changes: prohibit Git lazy fetch/protocol execution in immutable readers; use independently trusted self-contained export verification; repair Windows CRLF and privilege-free symlink fixtures. Slice-specific changes remain visible in this PR diff. No result-reuse activation or settings changes. Validation: cumulative Windows control command node --test scripts/ci/smart-ci/*.test.mjs passed 509/509, no failures/skips/cancellations. Independent fix checks: core/repository 110/110; export/workflow 11/11. node scripts/check-doc-links.mjs passed, 683 Markdown files and zero broken relative links. These are additive; hosted CI at the current head/base is still required. Nonblocking findings are tracked once on #2336: #2336 (comment) . Review budget: one original pass and one scoped fix verification, complete. Original E2E/nightly-map findings were already corrected in the previous authored heads and remain covered by the green control tests. The maintainer's current local request explicitly includes finishing and merging this CI work. Parent-first merge order remains #2863, #2864, #2865, #2867, #2868, #2869, #2871; children are retargeted only after parents land, with moved-base requalification. No branch deletion while it is a stack base. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9ffe1d7f29
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Parent #2867 merged as 6fbe62c at 05:04:30 UTC after exact-head required CI run 34437245616 succeeded, with no pending/failed checks or unresolved review threads. This PR now targets main, confirmed through the API. Updating the branch refreshed its head to 02638c3. A complete tree comparison against reviewed head 9ffe1d7 found no source changes. The code review remains applicable; fresh full hosted qualification is running before merge. After this observer lands, a real default-branch workflow run will be inspected separately from the already successful local live-API collection. |
1 participant
Stack
Depends on corrected #2867 (which includes corrected #2865). Parent-first review/merge; retarget and requalify after parents land. R4: maintainer and independent fresh-context review required; do not auto-merge.
Implementation
Adds a reusable fixed-origin/read-only GitHub provider and collection CLI. Binds repository/workflow/run identities, paginates every exact attempt, retains earlier failures after green retries, detects duplicate/truncated/racing inventories and enforces request/body/attempt/page limits. Unknown durations/test counts/billing stay null; job span is not labelled a computed DAG critical path. Markdown escapes untrusted names.
Adds
ci-continuation-observe.yml, triggered only by completed CI runs, with protectedgithub.workflow_shacheckout, explicit read-only contents/actions permissions, credential persistence disabled, automatic package caching disabled, immutable action pins, five-minute timeout and fourteen-day small-report retention. No head checkout, triggering-artifact download, release secret, signing key, product test execution or status write.The report is observation-only, not reusable proof. REST head_sha and a successful job conclusion do not establish actual checkout/commands/environment/full test inventory. No provenance flags are manufactured and no result reuse is activated. The observer itself begins running only once its definition reaches the default branch; this PR is not a deployed observer demonstration.
Validation
Local combined continuation + placement suite: 309 passed, 0 failed/skipped/cancelled, Node 22.16.0/Linux. Includes 101-job/two-page fixtures, multiple attempts, forged IDs, races, budget failures, unknown measurements, renderer injection and workflow boundaries. Initial local suite had one incorrect expected unknown-duration count (one per page, two total); fixed expectation and passing rerun retained separately. YAML parsed locally; hosted Actionlint/configured-Node checks remain required.
No real network collector run from the isolated local runtime, no full Taskdeck product-suite claim and no independent-review claim. Parent hosted integration failures were corrected without weakening fail-closed nightly validation and remain documented on #2867.
Documentation / rollback
docs/ci/continuation/OBSERVABILITY.md: commands, budgets, trust limits, null-metric semantics, all-attempt deduplication, primary GitHub references and rollback. The observer adds a small measurable overhead; no savings are invented. Revert observer/new modules without changing required qualification. Human settings and canonical coordinator-owned docs remain untouched.Refs #2336.