Repository navigation
ci: run maestro CI on GitHub Actions owned runners; retire Buildkite - #1123
Conversation
Owner retired Buildkite on 2026-09-14 (billing). The maestro-ci pipeline is archived, the repo webhook is deleted, and buildkite/maestro-ci was removed from required checks, so this repository had no broad CI. Port every former pipeline and advisory step to .github/workflows/maestro-ci.yml on owned runner labels (evalops-internal-arc / evalops-internal-arc-light), rename scripts/run-buildkite-*.sh to scripts/run-ci-*.sh, and delete .buildkite/. Verified with node --test on the touched contract files, actionlint on maestro-ci.yml, bash -n on touched shell scripts, and git grep -il buildkite (CHANGELOG.md only). First live run is not verified.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR. Link the matching evalops/mono source PR (legacy maestro-internal links remain accepted), then re-run the check:
Mirrored files touched:
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0c3dc3a46d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…rror of mono#9080) Fork pull_request events must not run contributor-controlled scripts on evalops-internal-arc* runners. Mirror mono#9080 (25d2821dc0): gate every maestro-ci job on trusted head, invoke linux-check with bash, and map hosted-orb live smoke from workflow_dispatch input or repo vars. The public hosted-orb-delegation-acceptance.test.mjs had drifted from mono, so the rejected hunk was applied by hand: the managed acceptance test now asserts the trusted-head if: and vars.MAESTRO_HOSTED_ORB_LIVE_SMOKE. Verified with node --test on the two contract files, actionlint on maestro-ci.yml, and bash -n on ci-linux-check.sh.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 028587137f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ed-orb smoke a hard gate (mirror of mono#9086) Source: dx-corp/mono#9086 (products/maestro). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014mGdZdLHUANa66S3RGuHMr
1 participant
Issue
No-Issue: owner retired Buildkite on 2026-09-14 (billing); maestro-ci had no remaining CI until this port
What changed
Port the retired
maestro-cipipeline to GitHub Actions on the org's owned runner labels. Workflowname: maestro-ciwith a terminal aggregate job also namedmaestro-ci(if: always()) fails unless every needed job succeeded or was skipped. Nextest runs as a 4-way hash partition matrix. Coverage, perf, and hosted-orb stay advisory (schedule / workflow_dispatch, continue-on-error). Shell wrappersscripts/run-buildkite-*.sharescripts/run-ci-*.shwith GitHub Actions env instead of Buildkite..buildkite/is deleted.Screenshots
No-Visual-Change: CI workflow, scripts, and contract tests only; no rendered web surface changed
Verification
bash -n scripts/run-ci-tooling.sh scripts/run-ci-coverage.sh scripts/run-ci-jetbrains.sh scripts/run-ci-supply-chain.sh scripts/run-ci-perf.sh scripts/run-nextest-partition.sh scripts/ci-linux-check.sh→bash -n: all oknode --test scripts/check-ci-concurrency.test.mjs→ 20 pass, 1 skip (JetBrains stdin test is Linux-only)node --test scripts/check-integration-required-gate.test.mjs→ 5 passnode --test scripts/build-profile-contract.test.mjs→ 4 pass, 1 skip (internal release workflow)node --test scripts/check-new-deps-supply-chain.test.mjs→ 14 passnode --test scripts/generate-protocol-compatibility-manifest.test.mjs→ 21 pass, 2 skip (internal GHCR publisher)node --test .github/workflows/release-branch-admission.test.mjs→ 2 passnode --test --test-name-pattern='required CI tooling lane|release admission requires' .github/workflows/check-release-workflow-contract.test.mjs→ 2 passactionlint .github/workflows/maestro-ci.yml→ no findings (exit 0)node scripts/check-workflow-footguns.mjs→Workflow footgun guardrails passed.git grep -il buildkite→CHANGELOG.mdonlyNot verified: first live run of
.github/workflows/maestro-ci.ymlon owned runners.Risk / rollback
Until this workflow is green, the repo still has no broad required CI (required checks are
require-internal-prandunresolved-review-threads). Revert this commit to restore.buildkite/if a rollback is needed before the first live run is green.Provenance
Change-Origin: agent
Agent-Contributor: role=implementation; harness=grok; provider=xai
Human-Edited: false
Human-Reviewed: false
Buildkite step mapping
:lock: Protocol compatibility lockprotocol-contractsevalops-internal-arc-lightnpm ci --ignore-scriptsthennpm run check:workspace-contract,check:protocol-manifest,check:runtime-passport,check:rust-only-runtime,check:helm-probes,check:hook-dispatch,check:session-transfer,check:hosted-orb-delegation,check:macos-signature:lint-roller: Contracts, format, and Clippylintevalops-internal-arcnpm run check, node contract tests,npm run lint, advisory-expiry:test_tube: Full Rust workspacerust-tests(matrix1..4)evalops-internal-arcscripts/run-nextest-partition.sh N/4; partition 1 alsocargo test -p maestro-local-host ci_auth_conformance,cargo test --doc,npm run smoke:tui:package: Native build and conformancenative-releaseevalops-internal-arcnpm run build,npm run smoke:release-native-only,node scripts/run-runtime-conformance.mjs --binary $CARGO_TARGET_DIR/fast-validation/maestro:docker: Control-plane integrationintegrationevalops-internal-arccargo test --locked -p maestro-runtime-gateway,cargo test --locked -p maestro-tui --test tools_integration:repeat: Deterministic scenario replayscenario-replayevalops-internal-arccargo build --locked -p maestro-scenario,npm run check:scenario-replay-gate:pipeline: CI configuration contractsci-contractsevalops-internal-arc-lightnode --test scripts/check-ci-concurrency.test.mjs,check-rust-only-runtime.mjs,check-hook-dispatch-coverage.mjs:github: Workflow and shell toolingworkflow-toolingevalops-internal-arc-lightscripts/run-ci-tooling.sh:lock: Supply chainsupply-chainevalops-internal-arc-lightscripts/run-ci-supply-chain.sh:idea: JetBrains pluginjetbrains-pluginevalops-internal-arc-lightscripts/run-ci-jetbrains.shlinux-checkevalops-internal-arcscripts/ci-linux-check.sh:bar_chart: Coverage (advisory)coverageevalops-internal-arcscripts/run-ci-coverage.sh(schedule / workflow_dispatch, continue-on-error):stopwatch: Performance baseline (advisory)perf-baselineevalops-internal-arcscripts/run-ci-perf.sh(schedule / workflow_dispatch, continue-on-error):orb: Hosted Orb delegation acceptancehosted-orb-delegation-liveevalops-internal-arc-lightnpm run smoke:hosted-orb-delegationwhenMAESTRO_HOSTED_ORB_LIVE_SMOKE=1maestro-cievalops-internal-arc-lightHeavy jobs use
${{ vars.MAESTRO_CI_HEAVY_RUNNER || 'evalops-internal-arc' }}; light jobs use${{ vars.MAESTRO_CI_LIGHT_RUNNER || 'evalops-internal-arc-light' }}.status: passed
evidence: bash -n on 7 shell scripts (ok); node --test check-ci-concurrency (20 pass, 1 skip), check-integration-required-gate (5 pass), build-profile-contract (4 pass, 1 skip), check-new-deps-supply-chain (14 pass), generate-protocol-compatibility-manifest (21 pass, 2 skip), release-branch-admission (2 pass), check-release-workflow-contract name-pattern (2 pass); actionlint .github/workflows/maestro-ci.yml (exit 0); node scripts/check-workflow-footguns.mjs (passed); git grep -il buildkite (CHANGELOG.md only)
decision: single-purpose
reason: replace the retired maestro-ci pipeline with GitHub Actions on owned runners and drop Buildkite scripts
Follow-up commit
ci: gate fork PRs off internal runners and fix first-run failures (mirror of mono#9080)Mirror of mono#9080 (
25d2821dc0). Everymaestro-cijob now skips unless the event is not a pull_request or the head repo is this repository, so fork PRs never land onevalops-internal-arc*. Advisory jobs keep that conjunct plus schedule/workflow_dispatch. Hosted-orb live smoke readsgithub.event.inputs.hosted_orb_live_smoke || vars.MAESTRO_HOSTED_ORB_LIVE_SMOKE. Linux-check is invoked asbash scripts/ci-linux-check.sh(executable bit set). The publichosted-orb-delegation-acceptance.test.mjshad drifted from mono, so the rejected hunk was applied by hand: the managed hosted-acceptance test now asserts the trusted-headif:andvars.MAESTRO_HOSTED_ORB_LIVE_SMOKE.Verified:
node --test scripts/hosted-orb-delegation-acceptance.test.mjs scripts/check-ci-concurrency.test.mjs→ 27 pass, 1 skip;actionlint .github/workflows/maestro-ci.yml→ exit 0;bash -n scripts/ci-linux-check.sh→ exit 0.🤖 Generated with Claude Code
https://claude.ai/code/session_014mGdZdLHUANa66S3RGuHMr
Source PR: https://github.com/evalops/mono/pull/9080 (evalops/mono#9080 — products/maestro is the source of truth; this PR is the mirror-side copy of that change)
Also mirrors https://github.com/evalops/mono/pull/9086 (evalops/mono#9086): supply-chain job permissions and hard-gated hosted-orb smoke.