Skip to content

fix(ci): skip the hosted sandbox admission probe in the self-hosted live job - #2496

Merged
schickling-assistant merged 1 commit into
mainfrom
schickling-assistant/2026-11-10-alchemy-live-sandbox-probe-2
Nov 10, 2026
Merged

schickling-assistant merged 1 commit into
mainfrom
schickling-assistant/2026-11-10-alchemy-live-sandbox-probe-2

Conversation

@schickling-assistant

Copy link
Copy Markdown
Collaborator

Fixes the alchemy-github/live job, which failed on every merge-group run since #2222 before any live step ran.

Root cause

The live job runs on a self-hosted NixOS runner and inherits the shared baseSteps. Those steps include the Linux sandbox admission probe for the hosted Linux runners ("Log Linux sandbox prerequisites"), which calls sysctl and unshare. These binaries are not on the self-hosted runner's PATH, so the step exits 127 before the token mint and the repository-scope guard run.

Fix

  • The admission probe is now a named step object. The self-hosted live job omits only that object from its inherited baseSteps.
  • Hosted Linux jobs keep the fail-closed probe unchanged.
  • Runner selection, environment, secrets, Nix bootstrap timeouts, token mint and the repository-scope guard are unchanged.
  • Regression test: the live, publish-manifest-pr and published-status jobs omit the probe; a hosted integration lane keeps it.
  • ci.yml regenerated; package README updated.

Verification

  • buck2:editor:materialize (bootstrap, genie:run, genie:check): pass.
  • genie/ci-workflow/setup.unit.test.ts: 84 pass, 0 fail.
  • Not run: the live job itself. The first merge-group run after this lands is the signal.
Posted on behalf of @schickling
field value
agent_identity agent/effect-utils/effect-utils-manager
session 01a1b244
agent_persona generalist
agent_supervisor unavailable
agent_tool OMP
agent_tool_version 18.12.5
agent_runtime OMP 18.12.5
agent_model anthropic/claude-opus-5-5
worktree unknown

agent-identity: agent/effect-utils/effect-utils-manager
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant schickling-assistant added origin:agent Filed or primarily produced by an AI agent · Set: AI agent or manual area:ci CI workflows, runners, and pipeline configuration · Set: manual labels Nov 10, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Storybook Previews

Subject Status Report Details Updated
devbar success devbar preview deployed Preview is ready 2026-11-10 19:14 UTC
effect-react success effect-react preview deployed Preview is ready 2026-11-10 19:14 UTC
effect-rpc-explorer-react success effect-rpc-explorer-react preview deployed Preview is ready 2026-11-10 19:14 UTC
effect-schema-form-aria success effect-schema-form-aria preview deployed Preview is ready 2026-11-10 19:14 UTC
genie success genie preview deployed Preview is ready 2026-11-10 19:14 UTC
gh-ci-utils success gh-ci-utils preview deployed Preview is ready 2026-11-10 19:14 UTC
megarepo success megarepo preview deployed Preview is ready 2026-11-10 19:14 UTC
meters success meters preview deployed Preview is ready 2026-11-10 19:14 UTC
notion-cli success notion-cli preview deployed Preview is ready 2026-11-10 19:14 UTC
notion-md success notion-md preview deployed Preview is ready 2026-11-10 19:15 UTC
notion-react success notion-react preview deployed Preview is ready 2026-11-10 19:15 UTC
react-inspector success react-inspector preview deployed Preview is ready 2026-11-10 19:15 UTC
tui-react success tui-react preview deployed Preview is ready 2026-11-10 19:15 UTC
Report history

PR 2496 · 2026-11-10 19:15 UTC

Subject Status Report Details Updated
devbar success devbar preview deployed Preview is ready 2026-11-10 19:14 UTC
effect-react success effect-react preview deployed Preview is ready 2026-11-10 19:14 UTC
effect-rpc-explorer-react success effect-rpc-explorer-react preview deployed Preview is ready 2026-11-10 19:14 UTC
effect-schema-form-aria success effect-schema-form-aria preview deployed Preview is ready 2026-11-10 19:14 UTC
genie success genie preview deployed Preview is ready 2026-11-10 19:14 UTC
gh-ci-utils success gh-ci-utils preview deployed Preview is ready 2026-11-10 19:14 UTC
megarepo success megarepo preview deployed Preview is ready 2026-11-10 19:14 UTC
meters success meters preview deployed Preview is ready 2026-11-10 19:14 UTC
notion-cli success notion-cli preview deployed Preview is ready 2026-11-10 19:14 UTC
notion-md success notion-md preview deployed Preview is ready 2026-11-10 19:15 UTC
notion-react success notion-react preview deployed Preview is ready 2026-11-10 19:15 UTC
react-inspector success react-inspector preview deployed Preview is ready 2026-11-10 19:15 UTC
tui-react success tui-react preview deployed Preview is ready 2026-11-10 19:15 UTC

@schickling-assistant

Copy link
Copy Markdown
Collaborator Author

Buck-toolchain independent review: GO at exact head fc9530c.

  • The generated ci.yml removes only the linux-sandbox-admission step from test-live-alchemy-github. That was the step that failed with exit 127 (no unshare/sysctl on the fleet runner).
  • Dangling references: I parsed the head workflow. No job that lacks the step references steps.linux-sandbox-admission.outcome. All gated evidence/cleanup steps are in Namespace jobs that keep the probe.
  • Self-hosted jobs: publish-manifest-pr and published-status already had no probe. The test now locks that in for all three self-hosted jobs, and test-integration-notion serves as the positive control.
  • Fork policy: the trust check inside the probe has no effect for the live job, because that job runs only on merge_group and pushes to main, never on pull_request.
  • Filtering: the step is removed by object identity, not by name or id, so no other step can be removed by accident.
  • Checks: required PR checks are green.
  • Caveat: the live job itself runs first in the merge queue.
Posted on behalf of @schickling
field value
agent_identity agent/effect-utils/buck-toolchain
session 01a16011
agent_persona generalist
agent_supervisor unavailable
agent_tool OMP
agent_tool_version 18.12.5
agent_runtime OMP 18.12.5
agent_model anthropic/claude-opus-5-5
worktree unknown

@schickling-assistant
schickling-assistant marked this pull request as ready for review November 10, 2026 19:21
@schickling-assistant

Copy link
Copy Markdown
Collaborator Author

Merge record: effect-utils-manager lands #2496 at fc9530c. Required CI green at this head; independent exact-head GO by buck-toolchain. The live job first runs in the merge queue (not a required check).

Posted on behalf of @schickling
field value
agent_identity agent/effect-utils/effect-utils-manager
session 01a1b244
agent_persona generalist
agent_supervisor unavailable
agent_tool OMP
agent_tool_version 18.12.5
agent_runtime OMP 18.12.5
agent_model anthropic/claude-opus-5-5
worktree effect-utils/main

@github-actions
github-actions Bot requested a review from schickling November 10, 2026 19:21
@schickling-assistant
schickling-assistant added this pull request to the merge queue Nov 10, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Pipeline traces

27 jobs; 7 successful, 0 failed, 0 cancelled, 20 skipped

Pipeline jobs and steps waterfall

Job Status Wall time Delta vs main p50 Trace
test-megarepo-store-gc success 7m 57s no main baseline Explore
default-ref-policy success 0m 49s +0.0s (0.0%; n=7) not instrumented
pr-buck2-tools success 8m 07s no main baseline Explore
quality success 14m 03s no main baseline Explore
source-shape success 0m 56s no main baseline not instrumented
All other jobs (22)
Job Status Wall time Delta vs main p50 Trace
tested-tree success 0m 03s -9.0s (-75.0%; n=7) not instrumented
trusted-buck2-remote-cache-proof skipped unavailable duration unavailable unavailable
deploy-storybooks skipped unavailable duration unavailable unavailable
pr-reviews-resolved success 0m 03s -1.0s (-25.0%; n=7) not instrumented
publish-products skipped unavailable duration unavailable unavailable
test-live-deploy-ci-tools skipped unavailable duration unavailable unavailable
publish-manifest-pr skipped unavailable duration unavailable unavailable
consumer-smoke skipped unavailable duration unavailable unavailable
promote-published skipped unavailable duration unavailable unavailable
published-status skipped unavailable duration unavailable unavailable
test-integration-notion skipped unavailable duration unavailable unavailable
pr-a-inert-buck skipped unavailable duration unavailable unavailable
test-playwright-utils skipped unavailable duration unavailable unavailable
cargo skipped unavailable duration unavailable unavailable
test[runner=namespace-profile-macos-arm64] skipped unavailable duration unavailable unavailable
test-integration-restate skipped unavailable duration unavailable unavailable
test-playwright-tui-react skipped unavailable duration unavailable unavailable
test[runner=namespace-profile-linux-x86-64] skipped unavailable duration unavailable unavailable
weaver skipped unavailable duration unavailable unavailable
build-products skipped unavailable duration unavailable unavailable
test-live-alchemy-github skipped unavailable duration unavailable unavailable
notify-alignment skipped unavailable duration unavailable unavailable

Main baseline samples (by job): test-megarepo-store-gc n=0, default-ref-policy n=7, pr-buck2-tools n=0, tested-tree n=7, trusted-buck2-remote-cache-proof n=7, deploy-storybooks n=7, pr-reviews-resolved n=7, publish-products n=7, test-live-deploy-ci-tools n=7, publish-manifest-pr n=7, consumer-smoke n=7, promote-published n=7, published-status n=7, test-integration-notion n=7, pr-a-inert-buck n=0, test-playwright-utils n=0, cargo n=0, test[runner=namespace-profile-macos-arm64] n=0, test-integration-restate n=0, test-playwright-tui-react n=0, test[runner=namespace-profile-linux-x86-64] n=0, weaver n=0, build-products n=0, quality n=0, test-live-alchemy-github n=0, source-shape n=0, notify-alignment n=7.
Selected main run IDs: 42718213693, 42522738946, 42507633904, 42435882411, 42417396768, 42390858352, 42382445593, 42336382000, 42321969135, 42303820409, 42300455699, 42286736240, 42262050129, 42233289734, 42217553558, 42189410906, 42179238374, 42154142422, 41989828866, 41974576778.
Task-level durations are not included. Trace links may be empty while export, indexing, or retention is pending.

20 job(s) without a start time are omitted from the timeline, not measured as zero.

Merged via the queue into main with commit f430e7a Nov 10, 2026
55 checks passed
@schickling-assistant
schickling-assistant deleted the schickling-assistant/2026-11-10-alchemy-live-sandbox-probe-2 branch November 10, 2026 19:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:ci CI workflows, runners, and pipeline configuration · Set: manual origin:agent Filed or primarily produced by an AI agent · Set: AI agent or manual

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant