fix(hybrid-gate): filter blobs from the two metadata-only checkouts - #33
Merged
Merged
Conversation
`check-trailer` and `ai-attribution` both clone full history under a 5-minute budget, but neither reads file content — one reads commit trailers and changed path names, the other scans commit messages and PR metadata. On a large adopting repo the unfiltered clone is effectively the whole job. When it overruns, the job reports `cancelled`, which the gate cannot distinguish from a supersede. The PR goes red with nothing wrong with it, and `full-gate-build` is skipped because it needs `check-trailer`. Measured in aletheia: two runs cancelled at exactly 5m04s and 5m02s, both inside this checkout step, on unrelated PRs whose own code was fine. `blob:none` keeps every commit and tree and leaves blobs unfetched. Git lazily fetches any blob a step turns out to need, so this cannot break a future step that does read content — it only stops paying for content nothing reads. `full-gate-build` keeps its unfiltered clone: it compiles the tree.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finding
check-trailerandai-attributioneach runactions/checkoutwithfetch-depth: 0undertimeout-minutes: 5. Neither job reads file content — one reads commit trailers and changed path names, the other scans commit messages and PR metadata. On a large adopting repo the unfiltered full-history clone is effectively the entire job.When it overruns the budget, the job reports
cancelled. The gate cannot distinguish that from a supersede, so the PR goes red with nothing wrong with it — and becausefull-gate-buildhasneeds: check-trailer, the build is skipped rather than run, which reads like a build problem.Evidence
Measured in
forkwright/aletheiatoday, on two unrelated PRs whose own code was fine:31621077227check-traileractions/checkout31632599095check-traileractions/checkoutBoth land on the timeout to within seconds, both inside the checkout step, with sibling jobs in the same run succeeding. In the second run,
ai-attributioncompleted in 21 seconds whilecheck-trailersat in checkout for five minutes.This is a different root cause from the concurrency-keying issue this workflow's existing WHY comments describe (aletheia#6701). That one cancelled whole runs via the concurrency group; this cancels a single job while its siblings succeed, which is what makes it look like a code problem.
Correction
Add
filter: blob:noneto those two checkouts. This keeps every commit and tree — sogit log, trailer reads, andgit diff --name-onlyare unaffected — while leaving blobs unfetched.It is also safe against future edits: a partial clone lazily fetches any blob a step turns out to need. The change cannot break a step that reads content; it only stops paying for content nothing reads.
full-gate-builddeliberately keeps its unfiltered clone — it compiles the tree.Blast radius
This is the fleet-shared reusable gate, so it affects every adopting repo. The change is confined to two checkout steps and removes work rather than adding any; the failure mode if
blob:nonewere wrong would be a step failing to read a file, which is loud rather than silent.Adopting repos pin this workflow by SHA, so nothing moves until each repo bumps its pin.