6517401f01
Every path-gated workflow begins with one small job -- `does this change touch
it`, or `which workspaces this change touches` for the standards build -- that
all of its real jobs declare in `needs`. All 55 of those gate jobs ran on
`linux-arm64`.
That is the one label the fleet cannot spare. Sampled while 267 runs were
queued, every waiting run had the same shape:
[waiting] linux-arm64 does this change touch it
[blocked] linux member · dataflow device, simulated
[blocked] macos member · dataflow device absent
237 runs, each holding a gate in the longest queue, and every real job blocked
behind it. Not only `linux` jobs: `macos`, `linux-hw`, `linux-arm64-hw` and
`macos-m3-ultra` jobs were blocked too. The measured effect was `linux-arm64`
263 deep against `linux` **zero**, with jetson-hub's 20 cores taking no job for
a full hour -- starved not for want of work but because the work could not be
unblocked. A gate waiting on the resource it is rationing is head-of-line
blocking, and it makes every other runner in the fleet idle on its behalf.
The gates move to `linux`. Nothing else changes: the diff is 55 `runs-on` lines
and no others, and every touched file still parses.
Why `linux` and not elsewhere. The gate is not free -- it compares
`BASE...HEAD`, which needs the merge base, so `fetch-depth: 0` is a full clone
rather than a ten-second script. `macos` is served by hosts on a Mac Studio
sitting at load 185; `linux` is a separate 20-core box that was measurably
empty. This moves a serialisation point to the least contended label; it does
not remove it, and the gate is still a single point of failure for its
workflow. The structural fix is an early-exit first step inside each job, which
costs one checkout per leg and is a larger change.
Follow-up, deliberately not bundled: jetson-hub runs at capacity 2 with 15 GB of
RAM, so 55 clones still serialise two at a time. Raising capacity helps gates
and hurts the heavy emulated-architecture jobs that share the label, so it wants
measuring on its own.
Co-Authored-By: Claude Opus 5 <[email protected]>
232 lines
8.6 KiB
YAML
232 lines
8.6 KiB
YAML
name: smart-byte conformance gate
|
|
|
|
# One run per branch at a time. A push supersedes the run before it.
|
|
#
|
|
# There is one `macos` runner and it is the dev Mac, so every macOS job in this
|
|
# repo queues on it. With no concurrency group, a session pushing four versions
|
|
# of a branch queued four complete sets of runs and every one of them had to
|
|
# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
|
|
# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
|
|
# commit's verdict is wanted, so the older runs are cancelled.
|
|
#
|
|
# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
|
|
# the key parses, and a newer push moves an older run to `cancelled` even while
|
|
# it is still queued, which is the case that matters.
|
|
#
|
|
# `cancel-in-progress: true` also applies to `main`. That is deliberate and
|
|
# safe here: main advances by merge commits whose tree contains the commits
|
|
# before them, so the newer run covers the older one's changes.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- 'smart-byte/spec/**'
|
|
- 'smart-byte/conformance/**'
|
|
- '.github/workflows/conformance.yml'
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- 'smart-byte/spec/**'
|
|
- 'smart-byte/conformance/**'
|
|
- '.github/workflows/conformance.yml'
|
|
|
|
jobs:
|
|
# Does this pull request's own diff touch the paths below? This forge matches a
|
|
# workflow's `paths:` against the push, so a merge of main into a branch fires the
|
|
# workflow whatever the pull request changes; every job here waits on this answer.
|
|
# A push to main, a schedule, or anything the script cannot determine answers
|
|
# `true` (scripts/pr-touches-paths.py).
|
|
relevant:
|
|
name: does this change touch it
|
|
runs-on: linux
|
|
outputs:
|
|
run: ${{ steps.gate.outputs.run }}
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
fetch-depth: 0
|
|
- id: gate
|
|
run: |
|
|
set -euo pipefail
|
|
r=$(python3 scripts/pr-touches-paths.py .github/workflows/conformance.yml \
|
|
"${{ github.event.pull_request.base.sha }}" \
|
|
"${{ github.event.pull_request.head.sha }}")
|
|
echo "this change touches conformance: $r"
|
|
echo "run=$r" >> "$GITHUB_OUTPUT"
|
|
|
|
validate-json:
|
|
needs: relevant
|
|
if: needs.relevant.outputs.run == 'true'
|
|
name: Validate conformance JSON files
|
|
runs-on: linux
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Ensure jq is available
|
|
run: jq --version
|
|
|
|
- name: Validate every JSON file under smart-byte/conformance/v*
|
|
run: |
|
|
set -euo pipefail
|
|
found=0
|
|
fail=0
|
|
while IFS= read -r -d '' f; do
|
|
found=$((found+1))
|
|
if ! jq empty "$f" >/dev/null 2>&1; then
|
|
echo "::error file=$f::invalid JSON"
|
|
fail=$((fail+1))
|
|
else
|
|
echo "ok: $f"
|
|
fi
|
|
done < <(find smart-byte/conformance -type f -name '*.json' -print0)
|
|
if [ "$found" -eq 0 ]; then
|
|
echo "::error::no JSON files found under smart-byte/conformance/v*"
|
|
exit 1
|
|
fi
|
|
if [ "$fail" -ne 0 ]; then
|
|
echo "::error::$fail JSON file(s) failed validation"
|
|
exit 1
|
|
fi
|
|
echo "validated $found JSON file(s)"
|
|
|
|
- name: Validate vector schema (top-level array, name field present)
|
|
run: |
|
|
set -euo pipefail
|
|
fail=0
|
|
while IFS= read -r -d '' f; do
|
|
if ! jq -e 'type == "array"' "$f" >/dev/null; then
|
|
echo "::error file=$f::top-level value must be a JSON array"
|
|
fail=$((fail+1))
|
|
continue
|
|
fi
|
|
if ! jq -e 'all(.[]; has("name") and has("description"))' "$f" >/dev/null; then
|
|
echo "::error file=$f::every vector must have name and description fields"
|
|
fail=$((fail+1))
|
|
fi
|
|
done < <(find smart-byte/conformance -type f -name '*_vectors.json' -print0)
|
|
if [ "$fail" -ne 0 ]; then
|
|
echo "::error::$fail vector file(s) failed schema validation"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Validate vector names are unique within each file
|
|
run: |
|
|
set -euo pipefail
|
|
fail=0
|
|
while IFS= read -r -d '' f; do
|
|
dupes=$(jq -r '[.[].name] | group_by(.) | map(select(length>1)) | .[][0] // empty' "$f")
|
|
if [ -n "$dupes" ]; then
|
|
echo "::error file=$f::duplicate vector name(s): $dupes"
|
|
fail=$((fail+1))
|
|
fi
|
|
done < <(find smart-byte/conformance -type f -name '*_vectors.json' -print0)
|
|
if [ "$fail" -ne 0 ]; then
|
|
exit 1
|
|
fi
|
|
|
|
# The pack's values come from the Rust reference implementation, and
|
|
# standards-build checks them against it under `cargo test`. This job checks
|
|
# them against a second implementation, written separately in another
|
|
# language, so a mistake shared by the generator and its own verifier still
|
|
# fails here. Standard library only: nothing to install beyond python3.
|
|
crosscheck:
|
|
needs: relevant
|
|
if: needs.relevant.outputs.run == 'true'
|
|
name: Second implementation reproduces every vector
|
|
runs-on: linux
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Ensure python3 is available
|
|
shell: bash
|
|
run: |
|
|
if ! command -v python3 >/dev/null 2>&1; then
|
|
SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo"
|
|
$SUDO apt-get update -qq
|
|
$SUDO apt-get install -y -qq python3
|
|
fi
|
|
python3 --version
|
|
|
|
- name: Cross-check v1
|
|
run: python3 smart-byte/conformance/crosscheck/verify_v1.py smart-byte/conformance/v1
|
|
|
|
spec-vector-coupling:
|
|
needs: relevant
|
|
if: needs.relevant.outputs.run == 'true' && (github.event_name == 'pull_request')
|
|
name: Spec changes require vector-pack updates
|
|
runs-on: linux
|
|
steps:
|
|
- name: Checkout (with full history for diff)
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Determine the PR base
|
|
id: base
|
|
run: |
|
|
base="${{ github.event.pull_request.base.sha }}"
|
|
if [ -z "$base" ]; then
|
|
base="origin/main"
|
|
fi
|
|
echo "base=$base" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Enforce coupling between spec and conformance changes
|
|
run: |
|
|
set -euo pipefail
|
|
base="${{ steps.base.outputs.base }}"
|
|
head="${{ github.event.pull_request.head.sha }}"
|
|
if [ -z "$head" ]; then
|
|
head="HEAD"
|
|
fi
|
|
changed=$(git diff --name-only "$base" "$head")
|
|
echo "Files changed in this PR:"
|
|
echo "$changed"
|
|
spec_touched=0
|
|
conformance_touched=0
|
|
if echo "$changed" | grep -qE '^smart-byte/spec/'; then
|
|
spec_touched=1
|
|
fi
|
|
if echo "$changed" | grep -qE '^smart-byte/conformance/'; then
|
|
conformance_touched=1
|
|
fi
|
|
if [ "$spec_touched" -eq 1 ] && [ "$conformance_touched" -eq 0 ]; then
|
|
echo "::error::This PR modifies smart-byte/spec/ without modifying smart-byte/conformance/."
|
|
echo "::error::Per the conformance social contract, every spec change must be accompanied by a vector-pack update."
|
|
echo "::error::If the spec change is editorial and the wire format is unchanged, record the editorial reason in smart-byte/conformance/v<N>/regeneration.md and include that file in the PR."
|
|
exit 1
|
|
fi
|
|
echo "coupling check passed (spec_touched=$spec_touched, conformance_touched=$conformance_touched)"
|
|
|
|
versions-present:
|
|
needs: relevant
|
|
if: needs.relevant.outputs.run == 'true'
|
|
name: VERSIONS.md and README.md must exist
|
|
runs-on: linux
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
- name: Required pack metadata files
|
|
run: |
|
|
set -euo pipefail
|
|
missing=0
|
|
for f in smart-byte/conformance/README.md smart-byte/conformance/VERSIONS.md; do
|
|
if [ ! -f "$f" ]; then
|
|
echo "::error file=$f::missing required pack metadata file"
|
|
missing=$((missing+1))
|
|
fi
|
|
done
|
|
for d in smart-byte/conformance/v*/ ; do
|
|
if [ ! -f "$d/regeneration.md" ]; then
|
|
echo "::error file=$d/regeneration.md::missing regeneration.md for $d"
|
|
missing=$((missing+1))
|
|
fi
|
|
done
|
|
if [ "$missing" -ne 0 ]; then
|
|
exit 1
|
|
fi
|