-
Notifications
You must be signed in to change notification settings - Fork 4
ci: preserve every LLGo binary-size revision #39
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -110,6 +110,34 @@ def repository_from_result(run, data_dir): | |
| return str(result_document(run, data_dir).get("run", {}).get("llgoRepository", "")) | ||
|
|
||
|
|
||
| def load_main_history(path): | ||
| if path is None: | ||
| return [] | ||
| with path.open(encoding="utf-8") as history_file: | ||
| commits = [line.strip().lower() for line in history_file if line.strip()] | ||
| invalid = [commit for commit in commits if not COMMIT_RE.fullmatch(commit)] | ||
| if invalid: | ||
| raise ValueError("invalid LLGo main commit in history: " + repr(invalid[0])) | ||
| return commits | ||
|
|
||
|
|
||
| def order_runs(index, main_history): | ||
| positions = {commit: position for position, commit in enumerate(main_history, start=1)} | ||
| for run in index.get("runs", []): | ||
| commit = str(run.get("llgoCommit", "")).lower() | ||
| if commit in positions: | ||
| run["llgoMainIndex"] = positions[commit] | ||
|
Comment on lines
+126
to
+129
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [P2] order_runs never clears a stale llgoMainIndex
|
||
|
|
||
| def order_key(run): | ||
| position = run.get("llgoMainIndex") | ||
| if isinstance(position, int) and not isinstance(position, bool): | ||
| return (0, position, "", str(run.get("key", ""))) | ||
| committed_at = str(run.get("llgoCommittedAt") or run.get("createdAt") or "") | ||
| return (1, 0, committed_at, str(run.get("key", ""))) | ||
|
|
||
| index.setdefault("runs", []).sort(key=order_key) | ||
|
Comment on lines
+131
to
+138
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [P3] Runs absent from main history always sort last, ignoring commit date In |
||
|
|
||
|
|
||
| def legacy_wall_times(run, document, data_dir): | ||
| native_path = document.get("native", {}).get("buildTimes") | ||
| path = result_path(run, data_dir) | ||
|
|
@@ -221,6 +249,11 @@ def parse_args(argv): | |
| "--api-url", | ||
| default=os.environ.get("GITHUB_API_URL", "https://api.github.com"), | ||
| ) | ||
| parser.add_argument( | ||
| "--main-history", | ||
| type=Path, | ||
| help="first-parent LLGo main commits, oldest first", | ||
| ) | ||
| return parser.parse_args(argv) | ||
|
|
||
|
|
||
|
|
@@ -232,6 +265,8 @@ def main(argv=None): | |
| index = json.load(index_file) | ||
| token = os.environ.get("GH_TOKEN") or os.environ.get("GITHUB_TOKEN", "") | ||
|
|
||
| order_runs(index, load_main_history(args.main_history)) | ||
|
|
||
| def lookup(repository, commit): | ||
| return github_pull_request_lookup(repository, commit, args.api_url, token) | ||
|
|
||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[P3] Untrusted payload validated after write-scoped checkout
The
update-pinjob runs withcontents: writeand performsactions/checkout@v4(persisting a write-scoped token) before thesource_repository/llgo_repository/llgo_commitallow-listing and SHA validation run in the later step. Validation does gate the URL/gitusage, so this is defense-in-depth rather than exploitable — and anyone able to send arepository_dispatchalready holds a write token. Still, validating in a minimal-permission gating job that the privileged jobsneeds:would ensure untrusted payloads never reach acontents: writecontext. The same pattern applies to thebinary-sizejob's dispatch handling.