From e156d9506218a825318ce62521fd30bb583d486c Mon Sep 17 00:00:00 2001 From: Drew Newberry Date: Tue, 5 May 2026 22:54:33 -0700 Subject: [PATCH 1/2] fix(ci): ignore mise lock header drift Signed-off-by: Drew Newberry --- .github/workflows/branch-checks.yml | 2 +- architecture/ci-e2e.md | 2 ++ mise.lock | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/branch-checks.yml b/.github/workflows/branch-checks.yml index 115e0b5c17..bda410bedf 100644 --- a/.github/workflows/branch-checks.yml +++ b/.github/workflows/branch-checks.yml @@ -54,7 +54,7 @@ jobs: - name: Verify mise.lock is in sync with mise.toml run: | mise lock - if ! git diff --exit-code mise.lock; then + if ! git diff --exit-code -I '^# @generated - this file is auto-generated by `mise lock` ' -- mise.lock; then echo "::error::mise.lock is out of sync with mise.toml. Run 'mise lock' locally and commit the result." >&2 exit 1 fi diff --git a/architecture/ci-e2e.md b/architecture/ci-e2e.md index 6b86c5043c..6e8c66a860 100644 --- a/architecture/ci-e2e.md +++ b/architecture/ci-e2e.md @@ -32,6 +32,8 @@ OS-49 Phase 5 added non-required shadow workflows for the non-release workflows `branch-checks.yml` uses `pr-gate` without a required label. That still verifies the mirror SHA matches the source PR head SHA, but does not require a new GitHub label for ordinary required checks. `branch-e2e.yml` keeps the existing `test:e2e` gate because it publishes temporary images and runs the expensive E2E suite. `ci-image.yml` now builds amd64 and arm64 CI images natively on shared CPU runners and merges the multi-arch manifest after both per-arch images are pushed. +The `mise-lockfile` job regenerates `mise.lock` with the CI image's pinned mise version and compares the result against the checked-in file. The comparison ignores only mise's generated comment header, because mise has changed that documentation URL without changing lockfile semantics; all tool entries, URLs, checksums, and platform records remain enforced. + OS-49 Phase 7 moves the release-facing CPU jobs in `release-canary.yml`, `release-dev.yml`, and `release-tag.yml` to the same shared CPU labels. The release workflows also call `driver-vm-linux.yml` and `deb-package.yml`, so those reusable workers use the same labels to avoid retaining a hidden ARC dependency in the release path. `release-vm-dev.yml` and `release-vm-kernel.yml` remain on the old labels until the VM runtime decision is recorded for OS-131. ## Trigger taxonomy diff --git a/mise.lock b/mise.lock index 4cff5b4a16..6ab204f6ec 100644 --- a/mise.lock +++ b/mise.lock @@ -1,4 +1,4 @@ -# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html +# @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html [[tools."cargo:cargo-zigbuild"]] version = "0.22.3" From 207e3a33a686b69d682886f59021502c63044178 Mon Sep 17 00:00:00 2001 From: Drew Newberry Date: Tue, 5 May 2026 23:04:06 -0700 Subject: [PATCH 2/2] fix(ci): enforce mise lock equality Signed-off-by: Drew Newberry --- .github/workflows/branch-checks.yml | 2 +- architecture/ci-e2e.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/branch-checks.yml b/.github/workflows/branch-checks.yml index bda410bedf..115e0b5c17 100644 --- a/.github/workflows/branch-checks.yml +++ b/.github/workflows/branch-checks.yml @@ -54,7 +54,7 @@ jobs: - name: Verify mise.lock is in sync with mise.toml run: | mise lock - if ! git diff --exit-code -I '^# @generated - this file is auto-generated by `mise lock` ' -- mise.lock; then + if ! git diff --exit-code mise.lock; then echo "::error::mise.lock is out of sync with mise.toml. Run 'mise lock' locally and commit the result." >&2 exit 1 fi diff --git a/architecture/ci-e2e.md b/architecture/ci-e2e.md index 6e8c66a860..0041f981b4 100644 --- a/architecture/ci-e2e.md +++ b/architecture/ci-e2e.md @@ -32,7 +32,7 @@ OS-49 Phase 5 added non-required shadow workflows for the non-release workflows `branch-checks.yml` uses `pr-gate` without a required label. That still verifies the mirror SHA matches the source PR head SHA, but does not require a new GitHub label for ordinary required checks. `branch-e2e.yml` keeps the existing `test:e2e` gate because it publishes temporary images and runs the expensive E2E suite. `ci-image.yml` now builds amd64 and arm64 CI images natively on shared CPU runners and merges the multi-arch manifest after both per-arch images are pushed. -The `mise-lockfile` job regenerates `mise.lock` with the CI image's pinned mise version and compares the result against the checked-in file. The comparison ignores only mise's generated comment header, because mise has changed that documentation URL without changing lockfile semantics; all tool entries, URLs, checksums, and platform records remain enforced. +The `mise-lockfile` job regenerates `mise.lock` with the CI image's pinned mise version and requires the checked-in file to match exactly. This intentionally includes generated metadata so contributors catch toolchain-version drift instead of letting different mise versions churn the lockfile. OS-49 Phase 7 moves the release-facing CPU jobs in `release-canary.yml`, `release-dev.yml`, and `release-tag.yml` to the same shared CPU labels. The release workflows also call `driver-vm-linux.yml` and `deb-package.yml`, so those reusable workers use the same labels to avoid retaining a hidden ARC dependency in the release path. `release-vm-dev.yml` and `release-vm-kernel.yml` remain on the old labels until the VM runtime decision is recorded for OS-131.