Refactor bridged acceptance workflow ordering#2218
Conversation
|
Tested this on pulumi-aws in pulumi/pulumi-aws#6366 Before: ~1h30m After: ~1h 
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5c42d49f05
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Restore makefile progress | ||
| run: make --touch provider |
There was a problem hiding this comment.
In the new build_schema job, running make --touch provider right before make schema causes schema generation to be skipped for traditional bridged providers: provider depends on .make/schema (via bin/$(PROVIDER) in base/Makefile), so --touch creates/updates .make/schema, and the subsequent make schema becomes a no-op. That means schema validation/comment steps run against the checked-in schema instead of a freshly generated one, so acceptance fanout can miss schema drift introduced by the PR.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 2677d2b by removing the make --touch provider step from build_schema, so the split schema job runs make schema directly after restoring prerequisites.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
The new test_provider and build_schema jobs lack a runtime inputs.acceptance_fanout guard. When the flag is false (default), these jobs still run and build_sdk waits for them — regressing the non-fanout path. See inline comment for details and suggested fix.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
proxy.golang.org
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "proxy.golang.org"See Network Configuration for more information.
Reviewed by Internal Trusted PR Reviewer
To install this agentic workflow, run
gh aw add pulumi-labs/gh-aw-internal/.github/workflows/gh-aw-pr-review.md@8a92f53fac170563f7727cacab2dbedb5d5b9e29
|
On the
For So adding |
build_provider_cmd rendered as a single opaque ;-chained shell command, so a provider build logged one undifferentiated span with no signal for where time went across schema generation, module download, compilation, and linking. Prepend set -x in both template branches so each chained sub-command is traced with a timestamp (language-agnostic; the only change non-Go buildProviderCmd overrides receive). In the default branch, split go mod download into its own statement and add -v to go build so the module-fetch phase is distinct and per-package compilation is observable. The rendered value still collapses to a single sh -c invocation with the same ;/&& joins as before (cosmetic multi-line via backslash continuations). Error semantics are preserved: the final command still determines the recipe exit status, exactly as the previous single-line form. Part of #2218 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Split traditional bridged-provider acceptance validation so lightweight prerequisites can unblock provider and SDK builds while provider tests and schema checks run in parallel. Keep the old prerequisite behavior for non-acceptance callers, NoSchema providers, and providers using binary schema generation. Co-authored-by: Codex <noreply@openai.com>
pose
force-pushed
the
refactor-workflow-ordering
branch
from
2677d2b to
0984f86
Compare
2 participants
Summary
test_providerandbuild_schemajobsNoSchema,UseProviderBinarySchemaGen, and non-acceptance workflow callersMotivation
pulumi/pulumi-awshas been spending too much wall-clock time inrun-acceptance-testsbecause theprerequisitesjob serializes work that does not need to block provider builds, SDK builds, or example tests.We prototyped this ordering change directly in
pulumi-awsbefore moving it intoci-mgmt. In that experiment, the improvement came from workflow ordering rather than dropping validation. The old critical path was roughly 1h50m+, while the refactored ordering finished closer to 1h00m. The key behavioral change was that examples could start once provider and SDK artifacts were ready, instead of waiting fortest_provider.This PR brings that ordering into generated bridged-provider acceptance workflows while keeping the scope conservative. Only traditional schema-based acceptance workflows opt into the split. Release, prerelease, main, and nightly workflows continue to use the full existing
prerequisitesbehavior unless they explicitly opt into the fan-out path later.Details
acceptance_fanoutinput toprerequisites.yml, defaulting tofalseschema_embed, buildstfgen, and uploads prerequisite artifactstest_providerandbuild_schemajobs torun-acceptance-tests.ymltestdoes not needtest_provider, while sentinel still depends ontest,build_provider,build_schema,test_provider, andlicense_checkschema_embedMakefile target for traditional bridged providersNoSchemaandUseProviderBinarySchemaGenTesting
cd provider-ci && make gengit diff --checkcd provider-ci && make all