Repository navigation
🐛 [v6] contribute: a role-delegated task's guidance carries the assigned repo's AGENTS.md and the issue's relevant knowledge #11166
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Native queue policy | ||
|
Check warning on line 1 in .github/workflows/native-queue-policy.yml
|
||
| on: | ||
| pull_request_target: | ||
| branches: [v5, v6] | ||
| types: [opened, synchronize, reopened, ready_for_review, edited, labeled, unlabeled] | ||
| merge_group: | ||
| types: [checks_requested] | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| checks: read | ||
| actions: read | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.event.pull_request.number || github.run_id }} | ||
| # Serialise per PR but never cancel: the evidence wait below runs up to | ||
| # 22.5 min, and every stage-label flip re-fires this workflow. With | ||
| # cancel-in-progress the check could never reach a verdict on a PR the | ||
| # hive is actively staging (#16942). The queued run re-reads the mutable | ||
| # PR state after the current one finishes, so fail-closed is preserved. | ||
| cancel-in-progress: false | ||
| jobs: | ||
| policy: | ||
| name: native-queue-policy | ||
| # Read-only, GitHub-hosted: do not run candidate code with write credentials | ||
| # or put fork/group policy scripts on a privileged self-hosted runner. | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 25 | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| # A group's candidates must not supply their own evidence validator. | ||
| # PR-target checks out the base branch head (trusted base code, never candidate | ||
| # code); the PR's recorded base.sha lags the branch and can predate these scripts. | ||
| ref: ${{ github.event.merge_group.base_sha || format('refs/heads/{0}', github.event.pull_request.base.ref) }} | ||
| persist-credentials: false | ||
| - name: Test policy behavior | ||
| run: node --test .github/scripts/native-queue-policy.test.cjs .github/scripts/diagnose-dco-provider.test.cjs | ||
| - name: Replay last verdict for cosmetic label flips | ||
| id: label-flip | ||
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | ||
| with: | ||
| script: | | ||
| const { isCosmeticLabelFlip, replayLastVerdict, isTransientAPIError } = require('./.github/scripts/native-queue-policy.cjs'); | ||
| let cosmetic = isCosmeticLabelFlip(context); | ||
| if (cosmetic) { | ||
| core.info('Label "' + context.payload.label.name + '" is not read by the policy; replaying the last completed verdict instead of waiting for evidence.'); | ||
| try { | ||
| const replayed = await replayLastVerdict({github, context}); | ||
| if (replayed === null) { | ||
| // No prior success on this head (never evaluated, or the last | ||
| // wait failed/timed out): run the authoritative wait instead of | ||
| // pinning that verdict onto every later cosmetic flip. | ||
| core.info('No successful native-queue-policy run on this head to replay; running the full evidence wait.'); | ||
| cosmetic = false; | ||
| } else { | ||
| core.info(replayed); | ||
| } | ||
| } catch (error) { | ||
| if (isTransientAPIError(error)) { | ||
| core.info('GitHub API ' + error.status + ' while replaying; running the full evidence wait (which retries) instead.'); | ||
| cosmetic = false; | ||
| } else { | ||
| core.setFailed(error.message); | ||
| } | ||
| } | ||
| } | ||
| core.setOutput('cosmetic', String(cosmetic)); | ||
| - name: Validate exact-head evidence (bounded wait for PR providers) | ||
| if: steps.label-flip.outputs.cosmetic != 'true' | ||
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | ||
| with: | ||
| script: | | ||
| const { evaluate, PendingEvidence, ProviderUnavailable } = require('./.github/scripts/native-queue-policy.cjs'); | ||
| const attempts = 90; | ||
| const intervalMs = 15000; | ||
| for (let attempt = 0; attempt < attempts; attempt++) { | ||
| try { | ||
| core.info(await evaluate({github, context})); | ||
| return; | ||
| } catch (error) { | ||
| if (error instanceof ProviderUnavailable) { | ||
| await core.summary | ||
| .addHeading('Admission blocked: DCO provider unavailable') | ||
| .addRaw(error.message) | ||
| .write(); | ||
| core.setFailed(error.message); | ||
| return; | ||
| } | ||
| if (!(error instanceof PendingEvidence) || attempt === attempts - 1) throw error; | ||
| core.info(error.message); | ||
| await new Promise(resolve => setTimeout(resolve, intervalMs)); | ||
| } | ||
| } | ||
