From 62fe0d1ff9457925482dcefe1344031ce3fbe697 Mon Sep 17 00:00:00 2001 From: Jonas Toelke Date: Mon, 4 May 2026 19:56:24 -0500 Subject: [PATCH] ci(os-49): remove obsolete shadow PR workflows --- .github/workflows/shadow-branch-checks.yml | 183 --------------------- .github/workflows/shadow-branch-e2e.yml | 84 ---------- .github/workflows/shadow-ci-image.yml | 96 ----------- architecture/build-containers.md | 2 +- architecture/ci-e2e.md | 5 +- 5 files changed, 3 insertions(+), 367 deletions(-) delete mode 100644 .github/workflows/shadow-branch-checks.yml delete mode 100644 .github/workflows/shadow-branch-e2e.yml delete mode 100644 .github/workflows/shadow-ci-image.yml diff --git a/.github/workflows/shadow-branch-checks.yml b/.github/workflows/shadow-branch-checks.yml deleted file mode 100644 index b0311ca0f8..0000000000 --- a/.github/workflows/shadow-branch-checks.yml +++ /dev/null @@ -1,183 +0,0 @@ -name: Shadow Branch Checks - -# OS-129 Phase 5: non-required branch-check coverage on supported shared CPU -# runners. Pull request coverage uses copy-pr-bot's trusted pull-request/* -# mirror branches; workflow_dispatch is for ad hoc bake runs. - -on: - push: - branches: - - "pull-request/[0-9]+" - workflow_dispatch: - -permissions: - contents: read - packages: read - -env: - CARGO_TERM_COLOR: always - CARGO_INCREMENTAL: "0" - MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - SCCACHE_GHA_ENABLED: "true" - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - pr_metadata: - name: Resolve PR metadata - runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: read - outputs: - should_run: ${{ steps.gate.outputs.should_run }} - steps: - - uses: actions/checkout@v6 - - - id: gate - uses: ./.github/actions/pr-gate - - mise-lockfile: - name: mise Lockfile - needs: pr_metadata - if: needs.pr_metadata.outputs.should_run == 'true' - runs-on: linux-amd64-cpu8 - container: - image: ghcr.io/nvidia/openshell/ci:latest - credentials: - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - steps: - - uses: actions/checkout@v6 - - - name: Mark workspace as safe for git - run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - - - name: Verify mise.lock is in sync with mise.toml - run: | - mise lock - if ! git diff --exit-code mise.lock; then - echo "::error::mise.lock is out of sync with mise.toml. Run 'mise lock' locally and commit the result." >&2 - exit 1 - fi - - license-headers: - name: License Headers - needs: pr_metadata - if: needs.pr_metadata.outputs.should_run == 'true' - runs-on: linux-amd64-cpu8 - container: - image: ghcr.io/nvidia/openshell/ci:latest - credentials: - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - steps: - - uses: actions/checkout@v6 - - - name: Install tools - run: mise install --locked - - - name: Check license headers - run: mise run license:check - - rust: - name: Rust (${{ matrix.runner }}) - needs: pr_metadata - if: needs.pr_metadata.outputs.should_run == 'true' - strategy: - fail-fast: false - matrix: - runner: [linux-amd64-cpu8, linux-arm64-cpu8] - runs-on: ${{ matrix.runner }} - env: - SCCACHE_GHA_VERSION: shadow-branch-checks-rust-${{ matrix.runner }} - container: - image: ghcr.io/nvidia/openshell/ci:latest - credentials: - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - steps: - - uses: actions/checkout@v6 - - - name: Install tools - run: mise install --locked - - - name: Configure GHA sccache backend - uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9 - - - name: Cache Rust target and registry - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 - with: - shared-key: shadow-branch-checks-rust-${{ matrix.runner }} - cache-directories: .cache/sccache - - - name: Format - run: mise run rust:format:check - - - name: Lint - run: mise run rust:lint - - - name: Test - run: mise run test:rust - - - name: sccache stats - if: always() - run: | - set +e - stats_bin="${SCCACHE_PATH:-sccache}" - "$stats_bin" --show-stats - status=$? - if [[ $status -ne 0 ]]; then - echo "::warning::sccache stats unavailable (exit $status)" - fi - exit 0 - - python: - name: Python (${{ matrix.runner }}) - needs: pr_metadata - if: needs.pr_metadata.outputs.should_run == 'true' - strategy: - fail-fast: false - matrix: - runner: [linux-amd64-cpu8, linux-arm64-cpu8] - runs-on: ${{ matrix.runner }} - container: - image: ghcr.io/nvidia/openshell/ci:latest - credentials: - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - steps: - - uses: actions/checkout@v6 - - - name: Install tools - run: mise install --locked - - - name: Install dependencies - run: uv sync --frozen - - - name: Lint - run: mise run python:lint - - - name: Test - run: mise run test:python - - markdown: - name: Markdown - needs: pr_metadata - if: needs.pr_metadata.outputs.should_run == 'true' - runs-on: linux-amd64-cpu8 - container: - image: ghcr.io/nvidia/openshell/ci:latest - credentials: - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - steps: - - uses: actions/checkout@v6 - - - name: Install tools - run: mise install --locked - - - name: Lint - run: mise run markdown:lint diff --git a/.github/workflows/shadow-branch-e2e.yml b/.github/workflows/shadow-branch-e2e.yml deleted file mode 100644 index c75e25dd45..0000000000 --- a/.github/workflows/shadow-branch-e2e.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Shadow Branch E2E - -# OS-129 Phase 5: non-required Branch E2E coverage on supported shared CPU -# runners. Trusted PR mirrors stay gated by the existing test:e2e label. - -on: - push: - branches: - - "pull-request/[0-9]+" - workflow_dispatch: - -permissions: {} - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - pr_metadata: - name: Resolve PR metadata - runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: read - outputs: - should_run: ${{ steps.gate.outputs.should_run }} - steps: - - uses: actions/checkout@v6 - - - id: gate - uses: ./.github/actions/pr-gate - with: - required_label: test:e2e - - build-gateway: - needs: [pr_metadata] - if: needs.pr_metadata.outputs.should_run == 'true' - permissions: - contents: read - packages: write - uses: ./.github/workflows/docker-build.yml - with: - component: gateway - platform: linux/arm64 - image-tag: shadow-branch-e2e-${{ github.sha }} - secrets: inherit - - build-cluster: - needs: [pr_metadata] - if: needs.pr_metadata.outputs.should_run == 'true' - permissions: - contents: read - packages: write - uses: ./.github/workflows/docker-build.yml - with: - component: cluster - platform: linux/arm64 - image-tag: shadow-branch-e2e-${{ github.sha }} - secrets: inherit - - build-supervisor: - needs: [pr_metadata] - if: needs.pr_metadata.outputs.should_run == 'true' - permissions: - contents: read - packages: write - uses: ./.github/workflows/docker-build.yml - with: - component: supervisor - platform: linux/arm64 - image-tag: shadow-branch-e2e-${{ github.sha }} - secrets: inherit - - e2e: - needs: [pr_metadata, build-gateway, build-cluster, build-supervisor] - if: needs.pr_metadata.outputs.should_run == 'true' - permissions: - contents: read - packages: read - uses: ./.github/workflows/e2e-test.yml - with: - image-tag: shadow-branch-e2e-${{ github.sha }} - runner: linux-arm64-cpu8 - secrets: inherit diff --git a/.github/workflows/shadow-ci-image.yml b/.github/workflows/shadow-ci-image.yml deleted file mode 100644 index ce8b4765a6..0000000000 --- a/.github/workflows/shadow-ci-image.yml +++ /dev/null @@ -1,96 +0,0 @@ -name: Shadow CI Image - -# OS-129 Phase 5: non-publishing CI image builds on supported shared CPU -# runners. This builds each architecture natively with the local Buildx driver -# instead of the EKS remote builder. - -on: - push: - branches: - - "pull-request/[0-9]+" - workflow_dispatch: - -env: - CI_IMAGE: ghcr.io/nvidia/openshell/ci - -permissions: - contents: read - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - pr_metadata: - name: Resolve PR metadata - runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: read - outputs: - should_run: ${{ steps.gate.outputs.should_run }} - steps: - - uses: actions/checkout@v6 - - - id: gate - uses: ./.github/actions/pr-gate - - build-ci-image: - name: Build (${{ matrix.arch }}) - needs: pr_metadata - if: needs.pr_metadata.outputs.should_run == 'true' - strategy: - fail-fast: false - matrix: - include: - - arch: amd64 - platform: linux/amd64 - runner: linux-amd64-cpu8 - - arch: arm64 - platform: linux/arm64 - runner: linux-arm64-cpu8 - runs-on: ${{ matrix.runner }} - timeout-minutes: 60 - steps: - - uses: actions/checkout@v6 - - - name: Resolve BuildKit config - id: buildkit - run: | - if [[ -r /etc/buildkit/buildkitd.toml ]]; then - echo "config=/etc/buildkit/buildkitd.toml" >> "$GITHUB_OUTPUT" - else - echo "config=" >> "$GITHUB_OUTPUT" - fi - - - name: Set up Docker Buildx - uses: ./.github/actions/setup-buildx - with: - driver: local - buildkitd-config: ${{ steps.buildkit.outputs.config }} - - - name: Build CI image - env: - MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - SHADOW_IMAGE: ${{ env.CI_IMAGE }}:shadow-${{ github.sha }}-${{ matrix.arch }} - run: | - set -euo pipefail - docker buildx build \ - --builder openshell \ - --platform "${{ matrix.platform }}" \ - --secret id=MISE_GITHUB_TOKEN,env=MISE_GITHUB_TOKEN \ - --cache-from "type=gha,scope=ci-image-${{ matrix.arch }}" \ - --cache-to "type=gha,mode=max,scope=ci-image-${{ matrix.arch }}" \ - --load \ - -t "$SHADOW_IMAGE" \ - -f deploy/docker/Dockerfile.ci \ - . - - - name: Smoke check CI image - env: - SHADOW_IMAGE: ${{ env.CI_IMAGE }}:shadow-${{ github.sha }}-${{ matrix.arch }} - run: | - set -euo pipefail - docker run --rm --platform "${{ matrix.platform }}" "$SHADOW_IMAGE" mise --version - docker run --rm --platform "${{ matrix.platform }}" "$SHADOW_IMAGE" gh --version - docker run --rm --platform "${{ matrix.platform }}" "$SHADOW_IMAGE" docker buildx version diff --git a/architecture/build-containers.md b/architecture/build-containers.md index ba13899cf7..a76c997323 100644 --- a/architecture/build-containers.md +++ b/architecture/build-containers.md @@ -23,7 +23,7 @@ The supervisor binary (`openshell-sandbox`) is built before the image build, sta ## Image Build Pipeline -`deploy/docker/Dockerfile.images` no longer compiles Rust. CI calls `.github/workflows/shadow-rust-native-build.yml` through `workflow_call` to build `openshell-gateway` or `openshell-sandbox` natively on the target architecture. `.github/workflows/docker-build.yml` downloads the resulting artifact, stages it at `deploy/docker/.build/prebuilt-binaries//`, builds the per-arch image with the local Buildx driver, and merges multi-arch pushes with `docker buildx imagetools create`. Callers normally publish the GitHub SHA tag, but shadow workflows can pass `image-tag` to publish isolated temporary tags for validation. +`deploy/docker/Dockerfile.images` no longer compiles Rust. CI calls `.github/workflows/shadow-rust-native-build.yml` through `workflow_call` to build `openshell-gateway` or `openshell-sandbox` natively on the target architecture. `.github/workflows/docker-build.yml` downloads the resulting artifact, stages it at `deploy/docker/.build/prebuilt-binaries//`, builds the per-arch image with the local Buildx driver, and merges multi-arch pushes with `docker buildx imagetools create`. Callers normally publish the GitHub SHA tag, but can pass `image-tag` to publish isolated temporary tags for validation. Local Docker builds use `tasks/scripts/stage-prebuilt-binaries.sh` through `tasks/scripts/docker-build-image.sh` before invoking Docker, so clean checkouts do not need to create the staging directory manually. diff --git a/architecture/ci-e2e.md b/architecture/ci-e2e.md index 45b8e18912..2a43bfb9c9 100644 --- a/architecture/ci-e2e.md +++ b/architecture/ci-e2e.md @@ -20,8 +20,7 @@ These three goals do not compose cleanly: the safety goal forces `push: pull-req | `.github/workflows/branch-checks.yml` | `push: pull-request/[0-9]+` + `workflow_dispatch` | Runs required branch checks on `linux-amd64-cpu8` and `linux-arm64-cpu8`. | | `.github/workflows/branch-e2e.yml` | `push: pull-request/[0-9]+` + `workflow_dispatch` | Runs non-GPU E2E on `linux-arm64-cpu8`. | | `.github/workflows/test-gpu.yml` | `push: pull-request/[0-9]+` + `workflow_dispatch` | Runs GPU E2E on self-hosted GPU runners. | -| `.github/workflows/shadow-branch-e2e.yml` | `push: pull-request/[0-9]+` + `workflow_dispatch` | Historical non-required shared-runner E2E shadow coverage for OS-49 Phase 5. | -| `.github/actions/pr-gate/action.yml` | (composite) | Resolves PR metadata for a `pull-request/` push and decides whether the run should proceed. Label enforcement is optional, so non-required shadows can validate mirror metadata without introducing another PR label. | +| `.github/actions/pr-gate/action.yml` | (composite) | Resolves PR metadata for a `pull-request/` push and decides whether the run should proceed. Label enforcement is optional so ordinary branch checks can validate mirror metadata without introducing another PR label. | | `.github/workflows/e2e-gate.yml` | `pull_request` + `workflow_run` | Posts the required `E2E Gate` check on the PR. Re-evaluates after the gated workflow completes. | | `.github/workflows/e2e-gate-check.yml` | `workflow_call` | Reusable gate logic shared by E2E and GPU E2E. | | `.github/workflows/e2e-label-help.yml` | `pull_request_target: [labeled]` | Posts a PR comment when a `test:e2e*` label is applied, telling the maintainer the next manual step (re-run an existing run, or `/ok to test ` to refresh the mirror). Does *not* dispatch the workflow itself - see "Why we don't auto-dispatch" below. | @@ -29,7 +28,7 @@ These three goals do not compose cleanly: the safety goal forces `push: pull-req ## OS-49 runner migration -OS-49 Phase 5 added non-required shadow workflows for the non-release workflows being prepared for shared-runner cutover. Phase 6 promotes the validated shared-runner path into the real non-release workflows. +OS-49 Phase 5 added non-required shadow workflows for the non-release workflows being prepared for shared-runner cutover. Phase 6 promoted the validated shared-runner path into the real non-release workflows and removed the obsolete PR-triggered shadow workflows to avoid duplicate PR checks. `branch-checks.yml` uses `pr-gate` without a required label. That still verifies the mirror SHA matches the source PR head SHA, but does not require a new GitHub label for ordinary required checks. `branch-e2e.yml` keeps the existing `test:e2e` gate because it publishes temporary images and runs the expensive E2E suite. `ci-image.yml` now builds amd64 and arm64 CI images natively on shared CPU runners and merges the multi-arch manifest after both per-arch images are pushed.