6517401f01
Every path-gated workflow begins with one small job -- `does this change touch
it`, or `which workspaces this change touches` for the standards build -- that
all of its real jobs declare in `needs`. All 55 of those gate jobs ran on
`linux-arm64`.
That is the one label the fleet cannot spare. Sampled while 267 runs were
queued, every waiting run had the same shape:
[waiting] linux-arm64 does this change touch it
[blocked] linux member · dataflow device, simulated
[blocked] macos member · dataflow device absent
237 runs, each holding a gate in the longest queue, and every real job blocked
behind it. Not only `linux` jobs: `macos`, `linux-hw`, `linux-arm64-hw` and
`macos-m3-ultra` jobs were blocked too. The measured effect was `linux-arm64`
263 deep against `linux` **zero**, with jetson-hub's 20 cores taking no job for
a full hour -- starved not for want of work but because the work could not be
unblocked. A gate waiting on the resource it is rationing is head-of-line
blocking, and it makes every other runner in the fleet idle on its behalf.
The gates move to `linux`. Nothing else changes: the diff is 55 `runs-on` lines
and no others, and every touched file still parses.
Why `linux` and not elsewhere. The gate is not free -- it compares
`BASE...HEAD`, which needs the merge base, so `fetch-depth: 0` is a full clone
rather than a ten-second script. `macos` is served by hosts on a Mac Studio
sitting at load 185; `linux` is a separate 20-core box that was measurably
empty. This moves a serialisation point to the least contended label; it does
not remove it, and the gate is still a single point of failure for its
workflow. The structural fix is an early-exit first step inside each job, which
costs one checkout per leg and is a larger change.
Follow-up, deliberately not bundled: jetson-hub runs at capacity 2 with 15 GB of
RAM, so 55 clones still serialise two at a time. Raising capacity helps gates
and hurts the heavy emulated-architecture jobs that share the label, so it wants
measuring on its own.
Co-Authored-By: Claude Opus 5 <[email protected]>
88 lines
3 KiB
YAML
88 lines
3 KiB
YAML
name: wai-key-proxy
|
|
|
|
# The signing proxy and key server of extensions/key-release.md (wai/wai-key-proxy): its
|
|
# tests, which run the proxy, the key server and a fixture licence server on loopback, clippy
|
|
# with warnings as errors, and the release binary run end to end by smoke.sh.
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'wai/wai-key-proxy/**'
|
|
- 'wai/wai-rs/src/key_release.rs'
|
|
- 'wai/wai-rs/src/key_release/**'
|
|
- 'wai/wai-rs/src/wai_video_keys.rs'
|
|
- 'wai/wai-rs/Cargo.toml'
|
|
- 'wai/live-conformance/keys/**'
|
|
- 'rust-toolchain.toml'
|
|
- '.github/workflows/wai-key-proxy.yml'
|
|
pull_request:
|
|
paths:
|
|
- 'wai/wai-key-proxy/**'
|
|
- 'wai/wai-rs/src/key_release.rs'
|
|
- 'wai/wai-rs/src/key_release/**'
|
|
- 'wai/wai-rs/src/wai_video_keys.rs'
|
|
- 'wai/wai-rs/Cargo.toml'
|
|
- 'wai/live-conformance/keys/**'
|
|
- 'rust-toolchain.toml'
|
|
- '.github/workflows/wai-key-proxy.yml'
|
|
|
|
jobs:
|
|
relevant:
|
|
name: does this change touch it
|
|
runs-on: linux
|
|
outputs:
|
|
run: ${{ steps.gate.outputs.run }}
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
fetch-depth: 0
|
|
- id: gate
|
|
run: |
|
|
set -euo pipefail
|
|
r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-key-proxy.yml \
|
|
"${{ github.event.pull_request.base.sha }}" \
|
|
"${{ github.event.pull_request.head.sha }}")
|
|
echo "this change touches wai-key-proxy: $r"
|
|
echo "run=$r" >> "$GITHUB_OUTPUT"
|
|
|
|
proxy-linux:
|
|
name: proxy · linux
|
|
needs: relevant
|
|
if: needs.relevant.outputs.run == 'true'
|
|
runs-on: linux
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- name: Install Rust 1.98.0
|
|
shell: bash
|
|
run: |
|
|
export PATH="$HOME/.cargo/bin:$PATH"
|
|
command -v rustup >/dev/null 2>&1 || \
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
|
|
rustup toolchain install 1.98.0 --profile minimal --component clippy
|
|
rustup default 1.98.0
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
- name: Tests and clippy
|
|
shell: bash
|
|
working-directory: wai/wai-key-proxy
|
|
run: |
|
|
set -euo pipefail
|
|
cargo test --locked 2>&1 | tee "$RUNNER_TEMP/test.log"
|
|
grep -qE '^test result: ok\. 2 passed; 0 failed' "$RUNNER_TEMP/test.log" || { echo "::error::the end-to-end tests did not run"; exit 1; }
|
|
cargo clippy --locked --all-targets -- -D warnings
|
|
# smoke.sh runs a fixture licence server and picks free ports with Python.
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
- name: The release binary end to end
|
|
shell: bash
|
|
working-directory: wai/wai-key-proxy
|
|
run: |
|
|
set -euo pipefail
|
|
cargo build --locked --release
|
|
bash smoke.sh
|