ci: platform tiers — .github/required-checks.txt is the tier-1 source of truth, enforced by tools/ci_tier_check.sh (#1264) - #1273
Merged
Conversation
…s colour to it (#1264) The README badge is the status of the whole ci.yml workflow on main, so any ci.yml job that can fail there colours it, required or not; main was red 2026-09-16 -> 2026-09-22 on a lane no PR had to pass (macos-15-intel, moved to nightly in #1265). - .github/required-checks.txt: ONE source of truth for tier 1 (the ruleset is synced from it). The 17 live contexts plus two: * `linux / clang` — tier 1 is "Linux gcc/clang" (#1264); it runs on every PR, and a half-required matrix leaves one leg able to colour main. * `build dev/ci image` — the required jobs that need it would be SKIPPED if it failed, and GitHub treats a skipped required check as satisfied. Until the ruleset is synced, `tools/ci_tier_check.sh --live` reports these two by name (expected). - tools/ci_tier_check.sh: every required name produced by exactly one job that reports on pull_request (trigger, no path filter, no event-gated job or ancestor); a required job's needs are required unless it is `if: always()`; every ci.yml main-lane job is required or a worker whose only consumer is a required `if: always()` aggregator that checks its result; every nightly job is read by a reporter that files an issue. Populations pinned exactly against independent counts (awk job ids, grep names). --selftest: 21 plants + a sanity start, each red through a NAMED check; PyYAML absent is exit 2, never a verdict. Wired into the `gate self-tests` job. - docs/CI.md: the stale "Required status checks" section (one required check) replaced by "Platform tiers": the model, the file, how to change it, what the gate enforces, every ci.yml job and every other workflow's check classified with the reason. - nightly.yml: the tracking-issue body no longer claims macos-15-intel runs on every push to main. - docs_claims_populations: PATHS|docs/CI.md 60 -> 63 (the new section cites three more resolved paths). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… queue cannot guarantee (#1264) Owner decision (#1264): Rust's model — GitHub's merge queue runs the full main lane on the candidate (main + PRs ahead + this PR) before anything lands, so main is green by construction and nobody rebases to update. - ci.yml, codeql.yml, pages.yml trigger on merge_group (every workflow that produces a required check). - ci.yml: the eight main-lane-only step pairs were gated `github.event_name == 'push'` / `!= 'push'`; now `!= 'pull_request'` / `== 'pull_request'`, so everything push ran also runs in the queue (clang full suite, macOS full suite + [99i], the extension/db/asan-http full suites). The post-merge push run is kept: the badge reads it and it publishes the rolling ci-main image fork PRs run in. - pages.yml: deploy only on push/workflow_dispatch (never from a queue candidate); queue runs get their own concurrency group. - tools/ci_tier_check.sh, 592 -> 229 lines (scope cut by the orchestrator): required names produced once, on pull_request AND merge_group; no condition on a required path can run work on push but not in the queue (job-level: no event reference at all; step-level: only `event_name ==/!= 'pull_request'` or the PR payload; dot and bracket syntax, any case); no continue-on-error on a required path; every ci.yml job required or a worker of one required always() job. Aggregator script correctness is left to code review. Selftest: 9 plants + sanity start + no-PyYAML, incl. round-1 P1/P2/P4 and bracket syntax. - docs/CI.md: tier model with the merge queue and the push run's purpose; corrected round-1 claims (skipped-by-if is satisfied, not blocked; scope/dev-image dependencies; trigger lists of deploy/docker/scorecard); main-lane and risk sections now say the queue catches it before landing. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…utputs (#1264) Round-2 critic: `env: X: ${{ github.event_name == 'push' }}` + a step `if: env.X == 'true'` on required tsan skipped in merge_group and ran on push, and the gate was green. - On a required path, env / job outputs / workflow env / matrix values may not derive from the event (github.event_name/event/ref*/head_ref/base_ref, dot or bracket, bare `github`), except the PR-shaped forms. - An `if:` reading env.*, vars.*, needs.*.outputs or steps.*.outputs is resolved recursively; unresolvable is red. Step outputs pass only through WAIVE, pinned to a sha256 of the reviewed step (scope's `detect`, the [99i] cache `restore`); a stale waiver is red. - ci.yml dev-image reads $GITHUB_EVENT_NAME instead of an event-derived env. - Selftest +1 plant: the critic's tsan env alias, required to red through both the `if:` resolution and the value check. - tools/ci_tier_check.sh 229 -> 260 lines (budget 260). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…imits at #1278 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
InauguralPhysicist
marked this pull request as ready for review
September 23, 2026 07:07
…not origin/main A queue candidate is main + the PRs queued ahead + this PR. Comparing its Ir against origin/main charged each PR for the cost of the PRs ahead of it: A +3% then B +3% read as B +6% > 5% and falsely ejected B (/code-review on #1273). merge_group now uses merge_group.base_sha, read from the event payload inside the script (the tier gate forbids event values via ${{ }}). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The werror audit ([99i]) reads any tools/ line naming a compiler as a possible compile invocation; the plants anchored on 'make lsp CC=clang' and 'matrix.cc == gcc' tripped it (GATE ERROR x4 on 0435dbd). Both now anchor on the macOS main-lane suite step. Selftest 12/12; gate size 262 lines. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
InauguralPhysicist
added a commit
that referenced
this pull request
Sep 23, 2026
…ction-1264 Resolve docs/CI.md (take main's merge-queue risk paragraph, keep the precheck section) and docs_claims_populations.txt (NUMBERS|docs/CI.md floor 4 -> 2: this PR removes the hand-stated section counts on purpose). precheck gains tools/ci_tier_check.sh (landed in #1273; a 1 s static gate). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This was referenced Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1264: follow Rust/CPython/Go. A tier-1 set blocks merges and decides main's colour, and every ci.yml job on the main lane is either required, a worker of a required aggregator, or nightly.
.github/required-checks.txt: the 17 live contexts, pluslinux / clang(both Linux compilers are tier 1; otherwise clang can redden main without ever having blocked a merge) andbuild dev/ci image(required jobs depend on it, and a skipped required check reads as passing).tools/ci_tier_check.sh(ingate self-tests): the required set, pull_request coverage, dependency closure, aggregator coverage, matrix legs and nightly reporting.--selftestcovers 20 planted faults and the PyYAML-missing case.--livecompares against the ruleset read-only.After merge: sync ruleset 17713865 to the file (
ci_tier_check.sh --liveshould then print OK).Draft while the blind-critic round runs.
Refs #1264
🤖 Generated with Claude Code