From d702f6fb33480530c4e9a2b45bfd3ab02fa10c0c Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Tue, 14 Jul 2026 22:39:32 -0700 Subject: [PATCH] ci: shorten full release validation critical path (#107894) * ci(release): parallelize plugin Docker lanes * test(plugins): expect malformed URL redaction * ci: start release performance validation concurrently * docs(agents): guard PR operations after throttling --- .github/workflows/full-release-validation.yml | 4 +++- .github/workflows/plugin-prerelease.yml | 2 +- AGENTS.md | 1 + src/plugins/marketplace.test.ts | 2 +- test/scripts/plugin-prerelease-test-plan.test.ts | 3 ++- 5 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/full-release-validation.yml b/.github/workflows/full-release-validation.yml index e4ba3a97b014..b96c379e698f 100644 --- a/.github/workflows/full-release-validation.yml +++ b/.github/workflows/full-release-validation.yml @@ -1248,7 +1248,9 @@ jobs: name: Run product performance evidence needs: [resolve_target, evidence_reuse] if: ${{ always() && needs.resolve_target.result == 'success' && contains(fromJSON('["all","performance"]'), inputs.rerun_group) && needs.evidence_reuse.outputs.reuse != 'true' }} - runs-on: ubuntu-24.04 + # Keep this monitor off the four-slot GitHub-hosted pool so performance starts + # with the other child workflows instead of extending the critical path. + runs-on: blacksmith-4vcpu-ubuntu-2404 timeout-minutes: ${{ inputs.release_profile == 'full' && 360 || 120 }} outputs: run_id: ${{ steps.dispatch.outputs.run_id }} diff --git a/.github/workflows/plugin-prerelease.yml b/.github/workflows/plugin-prerelease.yml index f0b26412bce9..7c8a47a2511d 100644 --- a/.github/workflows/plugin-prerelease.yml +++ b/.github/workflows/plugin-prerelease.yml @@ -548,7 +548,7 @@ jobs: include_release_path_suites: false include_openwebui: false docker_lanes: ${{ needs.preflight.outputs.plugin_prerelease_docker_lanes }} - targeted_docker_lane_group_size: 4 + targeted_docker_lane_group_size: 2 allow_unreleased_changelog: true include_live_suites: false live_models_only: false diff --git a/AGENTS.md b/AGENTS.md index 085fc21cdf59..95a5104f7492 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -234,6 +234,7 @@ Skills own workflows; root owns hard policy and routing. - CI polling: exact SHA, relevant checks only, minimal fields. Skip routine noise (`Auto response`, `Labeler`, docs agents, performance/stale). Logs only after failure/completion or concrete need. Never `gh run watch`; its 3s polling exhausts API quota. Use sparse GraphQL rollups. Filter `gh run list` by workflow/branch/commit; broad JSON lists can exceed relay caps. `gh --jq` has no jq `--arg`; use `--commit` for SHA filtering. - Trusted-workflow release-branch CI: pass `target_ref` + `release_candidate_ref`; never `release_gate` (requires workflow head == target). - Agent PR landing to `main`: use only the repo-native `scripts/pr` wrapper: run `scripts/pr review-init `, follow its emitted checkout/guard guidance, initialize and complete review artifacts with `scripts/pr review-artifacts-init `, validate them with `scripts/pr review-validate-artifacts `, then run `OPENCLAW_TESTBOX=1 scripts/pr prepare-run ` and `scripts/pr merge-run `. The Testbox flag is mandatory for agents so prepare verifies hosted CI/Testbox on the current head or reuses a patch-identical pre-rebase run green within 24 hours instead of running full gates locally. `prepare-run` fails fast; invoke only after exact-head CI is complete and green. For owner-approved reviewed fork code without hosted Testbox, use `OPENCLAW_PR_GATES_REMOTE=testbox` instead. Do not rebase only because `main` advanced; merge drift is advisory unless strict drift is explicitly enabled, while GitHub still blocks conflicts. Do not idle on `auto-response` or `check-docs`. +- After GitHub throttling, check core quota before `scripts/pr prepare-run` or `merge-run`. A failed operation can retain its lock; verify no child remains, then recover only with its emitted token. - Non-main PRs: do not run `scripts/pr prepare-run` or `merge-run`; they diff against `main`. Use review artifacts, exact base-head CI, revalidate `headRefOid`, then `gh pr merge --match-head-commit `. - Merge guard shells: start `set -euo pipefail`; a failed `[[ ... ]]` alone does not stop a later merge command. - After `scripts/pr merge-run` removes its worktree, `cd` to a persistent repo before follow-up commands. diff --git a/src/plugins/marketplace.test.ts b/src/plugins/marketplace.test.ts index 89a3ace5a8ac..0b1374f8a1cb 100644 --- a/src/plugins/marketplace.test.ts +++ b/src/plugins/marketplace.test.ts @@ -751,7 +751,7 @@ describe("marketplace plugins", () => { }); }); - it("returns a structured error for invalid archive URLs", async () => { + it("redacts invalid archive URLs in structured errors", async () => { await withTempDir("openclaw-marketplace-test-", async (rootDir) => { const manifestPath = await writeMarketplaceManifest(rootDir, { plugins: [ diff --git a/test/scripts/plugin-prerelease-test-plan.test.ts b/test/scripts/plugin-prerelease-test-plan.test.ts index 200ea0a30e65..bf472da6f21e 100644 --- a/test/scripts/plugin-prerelease-test-plan.test.ts +++ b/test/scripts/plugin-prerelease-test-plan.test.ts @@ -566,7 +566,7 @@ describe("scripts/lib/plugin-prerelease-test-plan.mjs", () => { ref: "${{ needs.preflight.outputs.checkout_revision }}", shared_image_artifact_namespace: "plugin-prerelease", shared_image_policy: "no-push-artifact", - targeted_docker_lane_group_size: 4, + targeted_docker_lane_group_size: 2, }, }); expect(dockerSuite.secrets).toBeUndefined(); @@ -613,6 +613,7 @@ describe("scripts/lib/plugin-prerelease-test-plan.mjs", () => { ]) { expect(fullReleaseWorkflow.jobs[jobName]["runs-on"]).toBe("ubuntu-24.04"); } + expect(fullReleaseWorkflow.jobs.performance["runs-on"]).toBe("blacksmith-4vcpu-ubuntu-2404"); expect(fullReleaseWorkflow.jobs.normal_ci["timeout-minutes"]).toBe( "${{ inputs.release_profile != 'beta' && 240 || 60 }}", );