mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-08-21 22:55:16 +00:00
298 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Shaojin Wen
|
90c166585a
|
feat(release): user-facing bilingual digest for release notes (#9216)
* feat(release): user-facing bilingual digest for release notes Stable release notes read as a type-bucketed PR list, which users find hard to scan. The finalize step now asks the model to group changes into user-facing themes with short intros, mirrors highlights and themes into a Chinese digest, attaches screenshots found in merged PR bodies (host allowlist, per-release cap), and collapses the full PR list into an appendix with normalized titles. Every model failure path keeps today's v1 output byte-for-byte, and CHANGELOG.md accepts the new v2 marker. * fix(release): tighten v2 digest fallbacks and changelog skeleton (#9216) Address review round 1 findings: - usedAi only counts themes that carry content, so a release whose digest has zero model text is no longer reported as AI-generated - hasChinese is derived from what the Chinese block actually renders, not raw model output, so zh-only-on-breaking releases no longer emit an empty or English-only section - a PR repeated inside one theme is deduped instead of discarding the whole themes digest with a misleading cross-theme error - fallback titles in the v2 digest are normalized like the appendix, killing the mixed-style look in the degradation case - normalizeAppendixTitle strips only the conventional types the changelog's formatEntry strips, keeping ci/test/security prefixes - the changelog unwraps the v2 appendix at the same sibling rank as v1's Complete Change List instead of nesting it under the previous section - drop a dead summaries max_tokens scaling term and a verbatim copy of renderChangeLine's attribution rendering * fix(release): close digest image breakout and tighten fallback signals (#9216) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(release): drop camo proxy and harden digest text validation (#9216) * fix(release): neutralize markdown breakouts in digest text and images (#9216) * fix(release): close classification, image-URL, and text-validation bypasses (#9216) --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> |
||
易良
|
f9e6b67aa7
|
fix(ci): stop triaging the autofix bot's own deferred-finding tracking issues (#9264) (#9271)
* fix(ci): stop triaging the autofix bot's own deferred-finding tracking issues (#9264) Every PR that defers findings for the first time opens a tracking issue upserted by the autofix bot, and the issues trigger (opened/edited/reopened) ran a full triage agent on that bookkeeping issue per deferral — the authorize gate exempts the issues path as read-only, so nothing stopped it. Condition the triage job's issues clause on the creator not being the autofix bot (the same vars.AUTOFIX_BOT_LOGIN || 'qwen-code-dev-bot' identity qwen-autofix.yml upserts under), and route bot-created issues runs to a per-run concurrency group: GitHub evaluates concurrency before the job if, so a run left in the shared per-number group would still cancel an in-progress triage of the same issue before its own skip is evaluated. Pins: the issues-clause guard, the group routing, and the cross-workflow identity sync, all on the parsed document. * test(ci): pin triage issue guard connectors * test(ci): harden triage bot guard pins --------- Co-authored-by: yiliang114 <yiliang114@users.noreply.github.com> |
||
qwen-code-dev-bot
|
f7f78fab4a
|
fix(ci): force-push release branch so retries replace failed attempts (#9076) (#9082)
* fix(ci): force-push release branch so retries replace failed attempts (#9076) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): re-validate the release version before force-pushing (#9076) prepare's doesVersionExist check runs minutes to hours before publish pushes (validation jobs and the production-release approval gate sit in between), and --force removed the non-fast-forward rejection that used to serialize the push itself. Concurrent same-version runs could therefore diverge the npm artifacts, the git tag, and main. Serialize publish per release tag and re-validate the unshipped invariant — every published package, the tag, and the release — immediately before the push; pin all three invariants in the workflow tests. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): unify the push-time release guard and key concurrency by dry-run (#9076) * fix(ci): fail closed on push-time release probes and test the CLI seam (#9076) * fix(ci): clarify push-time release refusals and keep benign ones out of autofix (#9076) The push-time guard refused retries after a partial npm publish without saying where the version had shipped or how to recover, and every refusal failed the publish job into notify_failure, filing a "Release Failed" issue and dispatching the autofix agent against releases that did not fail. - Scan all published packages in strict mode and name every shipped location in the refusal (npm packages, origin tag, GitHub release) with partial-publish recovery guidance; a decisive hit ends the check so a flaky later probe cannot mask the refusal with a probe error. - Give the guard distinct exit codes: 3 = already shipped (decisive, benign), 2 = probe or usage failure. Exit 1 is reserved for uncaught node errors so a crash can never masquerade as the benign marker. The push step marks exit-3 refusals via the version_refusal job output, and notify_failure skips its issue + autofix dispatch for exactly that failure while genuine failures still notify. - Cover runCli's default dispatch (prepare's path), the exit-code contract, and the process.exit wiring end to end. * fix(ci): fail closed when the release ref predates the push-time guard (#9076) * fix(ci): keep refusals decisive after shipped hits and skip the POSIX-only test on win32 (#9076) * fix(ci): write push-time guard error annotations to stdout (#9076) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> |
||
|
Shaojin Wen
|
c031cc6279
|
fix(ci): self-heal failed checkouts on the reused review runners (#9220)
* fix(ci): self-heal failed checkouts on the reused review runners A checkout failure on the self-hosted review pool was terminal: either a transient network drop mid-fetch (curl 92 / early EOF), or a corrupt persisted workspace whose refs claim objects missing from its object store, after which every fetch dies in negotiation with 'remote did not send all necessary objects'. ecs-qwen-runner-64c-23 stayed in that state for two days (2026-08-13..15), failing seven review jobs on the same missing SHAs. Make the first checkout continue-on-error; on failure wipe the whole workspace (not just .git) and retry the identical checkout once. The workspace is disposable — later steps reinstall deps and tools. * fix(ci): heal with the pool wipe idiom and pin the checkout guardrails (#9220) * fix(ci): pin the heal chain's sudo leg, path guard, and survivor signal Addresses the 16:40 review round on the checkout self-heal: - The wipe-failure test leaned on the real sudo, so it covered a different branch per lane; replace it with a PATH-stubbed sudo that forces both legs to fail hermetically, and pin the survivors left in place plus their oncall-visible warning. - The '|| sudo -n find' escalation leg survived deletion mutants: add a stub-sudo test proving the leg actually runs when user-mode find fails (leg-deletion and '||'->'&&' mutants both verified red). - Reuse the triage idiom's suspicious-path guard before wiping. - Count post-wipe survivors and warn with the count — triage exits 1 here, but the heal chain must stay alive for the retry. - Disclose in the step comment that the sudo leg only helps pool members with passwordless sudo. * fix(ci): close the heal guard's trailing-slash hole and name wipe survivors (#9220) * fix(ci): canonicalize the heal guard's path match and allowlist the runner workspace (#9220) * fix(ci): strip the heal allowlist root's trailing slashes and pin the guard layers (#9220) * fix(ci): canonicalize the heal lock fixture and pin the WS strip loop (#9220) * fix(ci): keep the checkout-heal suite green on a BSD userland Addresses the 09:38 review round: three of the new tests assume the wipe script's `realpath -m` canonicalization actually ran, and `-m` is a GNU coreutils extension — Darwin ships FreeBSD's `realpath [-q]`, exits 1 on it, and the script's `|| printf` fallback silently keeps the raw path. The production script is unaffected (the review pool is Linux-only), but this suite is excluded on win32 alone, so it also runs on the macOS lane, where the assertions are red for a defect that cannot exist there. - Probe the host for `realpath -m` and skip the canonicalization test when it is absent, rather than skipping on `platform === 'darwin'`: the probe keeps the coverage on a Mac with coreutils on PATH and still skips on any other non-GNU userland. Mutation-checked on a GNU host — deleting the canonicalization line still turns the test red. - Spell both halves of the allowlist comparison the same way in the lock fixture: it resolved its workspace with realpathSync while the runner-workspace root stayed raw, so on a symlinked tmpdir (macOS /var -> /private/var) the two sat on opposite sides of the link, the guard refused, and the wipe helper threw before any assertion ran. Canonicalizing the root keeps both tests running everywhere instead of leaning on the GNU-only flag to reconcile them. - Record in the step comment that `-m` is GNU-only and that off-GNU the guard degrades to the strip loop and the allowlist. Verified by simulating a BSD userland (a PATH-fronted realpath that rejects -m): the suite goes from 1 failed / 12 passed to 12 passed on the CI lane's environment, and from 3 failed / 10 passed to 12 passed with a symlinked TMPDIR, matching the two failure shapes reported. --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> |
||
|
Shaojin Wen
|
b744248656
|
fix(ci): keep a fallback comment when the PR review runner dies (#9255)
* fix(ci): keep a fallback comment when the PR review runner dies A review job that dies abnormally never reaches its in-job fallback comment step: the runner worker crash in FinalizeJob on the PR #8894 run (EACCES creating under the runner home directory) left the PR with no review and no explanation. - Probe write access to $HOME, $RUNNER_TEMP and the runner root at job start, repair single-directory ownership with the existing sudo pattern, and fail fast with a clear message when repair is impossible instead of burning the review budget to die at finalize. - Add a fallback-comment job on an ephemeral hosted runner that posts the retry guidance whenever review-pr fails. It derives the PR number from the event payload (dead job outputs do not survive a crash) and dedupes on a qwen-review-fallback comment marker plus this run's URL, so the in-job step, the ack comment, and re-runs never double-post. * fix(ci): harden the PR review fallback comment (#9255) Review-round fixes for the fallback-comment defenses: - Probe the actual runner root (three levels above the workspace, not two) and the _diag subdirectory FinalizeJob writes in; a writable parent does not prove an existing subdirectory writable. - Open the fallback gate on authorize/review-config failures too — the incident's trigger can kill those earlier self-hosted jobs first, and a failed dependency marks review-pr 'skipped', which the old gate never matched. Guarded against resolve dispatch runs, which skip review-pr by design. - Author-scope the dedup lookup (resolved dynamically like upsert-bot-comment.sh) so a planted marker cannot suppress the fallback, and fail closed with bounded retry when the lookup or the state check fails instead of fail-open toward duplicates or a green job that never posted. - Skip the stale fallback when the PR head moved, but only on pull_request_target events where the run head is comparable — comment/review runs report main's tip, and posting wins over silence when the comparison is unavailable. - Define the marker once in a workflow-level env and pin all of the above in the workflow test suite, executing the fallback step's real bash against a stubbed gh. * fix(ci): close the fallback-comment gate gaps from round-2 review (#9255) - Exclude comment-driven /resolve runs from the fallback gate: authorize runs on `@qwen-code /resolve` issue comments where github.event.inputs is empty, so the dispatch-only exclusion never fired there and a failed resolve run was misdiagnosed as a dead review recommending the wrong command. - Enumerate precheck-pr and delay-automatic-review failures in the gate: either failure marks review-pr 'skipped' (a transient API 5xx in delay's re-check step, or the fork-PR chain root dying before it posts anything), which the old gate never matched — silence, against its own "a skipped review is as unexplained as a dead one" norm. Both are 'skipped' where they do not apply, so the gate stays closed there. - Anchor the cross-job dedup on the run URL's closing paren: run ids grow digits over time, so the unanchored substring let a later run's fallback comment (id 123450) suppress an earlier run's (id 12345) re-run comment; every marker body renders the URL as [workflow logs](...runs/<id>), so the id is always followed by ')'. - Pin the previously surviving mutants in the workflow suite: the _diag probe guard polarity, the workflow_dispatch disjunction, the ephemeral-hosted-runner placement, and the fallback body's marker-link shape the anchor relies on; add executed coverage for each head-lookup partial failure and for a distinct run's fallback not suppressing this run's comment. * fix(ci): close round-3 review gaps in the fallback-comment defenses (#9255) --------- Co-authored-by: qwen-code-ci-bot <qwen-code-ci-bot@users.noreply.github.com> |
||
|
Shaojin Wen
|
a9bff6c9b8
|
feat(autofix): defer verified out-of-footprint findings to a surviving follow-up queue (#9189)
* feat(autofix): route verified out-of-footprint findings to a surviving follow-up queue
Anti-drift closure for the review loop: a finding that is REAL but whose
fix lies outside the PR's footprint previously had only wrong outcomes —
implement it (scope drift), decline it (the finding is lost when the PR
merges and nobody re-reads its threads), or push it onto a maintainer.
- SKILL gains the fourth disposition, Defer to follow-up: verified +
out-of-footprint → record {id, path, reason} in
deferred-findings.json, reply on the thread that it is deferred, leave
the thread open. Decline stays for what is not worth doing anywhere;
defer is for what is worth doing elsewhere.
- The report step upserts these into one per-PR 'Deferred review
findings' issue (marker-keyed, append-only by rc id, agent text
token-neutralized and length-capped), for BOTH pushed and no-op
outcomes. Best-effort: an upsert failure never fails a round.
Deliberately no ready-for-agent label — feeding the bot's own
deferrals back into its issue queue is a human authorization.
- deferred-findings.json rides the artifact dump and the repair
cleanup; the neutralization ledger grows to ten sites.
- Tests: shape validation (non-empty array of numeric-id items), line
building (dedupe by rc id against the existing issue body, newline
flattening, truncation), and wiring pins for both call sites.
* fix(autofix): rebuild the deferred-findings upsert per review round 1
- Extracted to a trusted staged script callable from ALL outcome paths —
the failure/handoff path persists verified findings too (a failed
round's commit dying says nothing about the findings' validity).
- Append-only durability: the tracking issue's body is written once;
every later round POSTS a comment — no read-modify-write can race a
maintainer's edits, and a failed body/comments read SKIPS the round
(never mistaken for empty history). Success is logged only when the
write call succeeded; failures say NOT persisted.
- Structured lookup: jq filtering over the real bodies (no line-joined
awk under pipefail), pull requests excluded, lookup failure skips
rather than creating duplicates.
- Dedupe is line-anchored ('- rc:<id> ' at line start, body+comments
corpus) with intra-batch unique_by; ids the round resolved in code are
excluded (a finding cannot be implemented and outstanding at once).
- Shape gate covers path (string when present); path bytes are
charset-sanitized so a crafted path cannot forge queue bullets.
- Publication-trust posture recorded: the deferred lines are the same
agent-authored trust class as every other published output — marker
neutralization, mention-free sanitized charset, length caps, and a
20-item batch cap bound the surface.
- Tests: the real script runs against a recording gh stub — create,
append+dedupe (body and comments), PR-carrying-marker exclusion,
anchored dedupe vs free-text mentions, read-fail skip,
resolved-exclusion, shape-gate loudness, write-fail honesty, and
forged-path sanitization; the neutralization ledger returns to nine
workflow sites with the script-side tenth pinned in place.
* fix(autofix): harden deferred-findings upsert per review round 2
- Pass the known-id corpus to jq via --rawfile: a large corpus in one
--arg argv element hits Linux MAX_ARG_STRLEN and the swallowed exec
failure would silently drop the round's deferrals.
- Digest-gate the staged upsert script: record upsert_sha256 at stage
time (expression context) and verify before each of the three
invocations; RUNNER_TEMP is agent-writable in between. A mismatch
skips persistence, never the round.
- Add the gh hygiene preamble (GH_HOST pin, GH_TOKEN unset, fresh
GH_CONFIG_DIR) to the review-address failure/handoff report step —
the one PAT-bearing gh step that lacked it.
- Query the tracking-issue lookup with state=all so a maintainer-closed
issue is appended to instead of forking a duplicate.
- Enforce integer positive finding ids in the shape gate (a float id's
dot is a regex wildcard in the anchored dedupe and never
index()-matches resolved ids).
- Clip the 20-item batch loudly and qualify success messages with
kept/total counts instead of claiming full persistence.
- Tests: digest + hygiene wiring pins; stub knobs for list/comments
fetch failures; append-write failure, multiline-reason flattening,
bad-id, loud-cap, and state=all cases.
* fix(autofix): close bash/transport channel gaps and failure-path gate holes (review round 3)
- Sweep BASH_ENV/ENV and imported BASH_FUNC_*%% functions plus proxy
(HTTPS_PROXY/HTTP_PROXY/ALL_PROXY + lowercase) and SSL_CERT_FILE/DIR
at all four gh-hygiene sites: both families are GITHUB_ENV-plantable
and bypass the TRUSTED_PATH pin (child-bash startup) or reroute/
decrypt PAT-bearing HTTPS. Also de-shadow gate-critical names and
hash -r, since a planted BASH_ENV runs before the step body.
- Pin PATH to the staged trusted value (guarded for pre-stage crashes)
and drop the loader trio in the failure/handoff report step — its
digest gate previously ran under ambient PATH/LD_PRELOAD.
- Failure-path upsert: skip with a plain notice when stage never ran
(empty digest is not a tamper alarm), and verify the PAT's bot
identity before writing (POST_HANDOFF's check is skipped on the
fixed/noop-outcome path); correct the guard comment that claimed
parity with the handoff guards.
- Fold the twice-pasted digest-gate + upsert block in 'Push and report'
into a step-local run_deferred_upsert(), matching the
resolve_and_reply_threads convention.
- Dedupe corpus reads bot-authored comments only, so a third party
commenting on the public tracking issue cannot suppress a finding.
- Tests: hygiene sweep pins ordered before the first gh call; placement
assertions (function defined once, called after both resolve arms;
failure invocation inside the DRY_RUN/STALE/token guard slice);
digest/identity/notice pins; behavioral cases for foreign-author
suppression, intra-batch duplicate ids, markerless-issue create path,
creator/marker anchors, and marker neutralization through the append
path.
* fix(autofix): isolate deferred-upsert in a clean env -i child, drop the unsound in-shell sweep (review round 4)
Round 4 (R4-1, five Criticals of one class) showed the in-shell
BASH_FUNC/proxy denylist sweep the prior round added is unsound: it
bootstraps trust from the very shell namespace it sanitizes, and a
planted BASH_FUNC_env%%/unset%%/command%%, an expand_aliases alias, a
readonly -f shadow or a DEBUG trap each defeat it — ending in the
staged upsert script executing with CI_DEV_BOT_PAT in env.
- Replace it with sound isolation: both upsert sites (run_deferred_upsert
in 'Push and report', and the failure/handoff path) run the digest
gate, the PAT identity check and the staged script in a fresh
'/usr/bin/env -i … bash --norc -c' child. /usr/bin/env is invoked by
absolute path — bash never does function/alias lookup on a
slash-bearing word, so a planted BASH_FUNC_env%% cannot intercept it —
and env -i drops every BASH_FUNC_*, BASH_ENV, SHELLOPTS, alias and
trap before any gated work. GH_CONFIG_DIR is minted inside the clean
child (its mktemp cannot be shadowed there), closing the mktemp-shadow
hole in the failure step's preamble.
- Remove the sweep and the in-step gh/PATH preamble the prior round
added to all four PAT gh steps; the three pre-existing steps revert to
their prior posture. Hardening the pre-existing PAT gh calls
(handoff/report comment, push, publish) against BASH_FUNC/transport
plants is noted as separate, out of this feature's scope.
- Script: accept a contract-valid empty array as a clean no-op instead
of a false 'malformed' alarm; 'set +C' so a planted read-only
SHELLOPTS=noclobber cannot silently empty the dedupe corpus (belt to
the env -i child that already drops SHELLOPTS).
- Tests: replace the sweep pins with clean-child pins (absolute-path
env -i at both sites, GH_CONFIG_DIR/PATH inside the child, failure
launch inside the guard slice); add no-findings exit-0, empty-array
no-op and set +C cases. Behavioral probe: a fully tainted parent
(BASH_FUNC/alias/BASH_ENV plants) cannot reach into the env -i child.
* fix(autofix): strip LD_* before the env -i upsert child; tighten id gate, mktemp/cap guards (review round 5)
- R5-1 (Critical): LD_PRELOAD/LD_AUDIT/LD_LIBRARY_PATH is the one channel
env -i cannot block — ld.so maps a planted library into /usr/bin/env
itself at execve, before -i wipes anything. Neutralize it with a
command-prefix assignment (LD_PRELOAD= LD_AUDIT= LD_LIBRARY_PATH=)
before /usr/bin/env at both upsert launch sites: a pure shell
parameter assignment no BASH_FUNC can shadow, applied to env's own
environment. Probe: a parent LD_PRELOAD=/evil.so no longer reaches the
env binary or the child.
- R5-3: shape gate rejects integer-valued floats jq renders in
scientific notation past 2^53 (1e21 -> "1E+21") — the '+' is a
regex-active byte in the anchored dedupe. Add a <2^53 bound and a
tostring plain-digits belt.
- R5-4: guard mktemp failure (a known /tmp-exhaustion CI state) so it
warns and skips instead of a silent exit 0 that violates the header
contract.
- R5-2: the cap warning no longer promises 're-defer in a later round'
(impossible — the eval-watermark filters evaluated feedback out
permanently); it names the dropped bullets for a maintainer.
- Tests: LD prefix, GH_HOST-in-child and gate/exec ordering pins; tie
the two near-verbatim clean-child bodies together (R5-6); source pins
for both --paginate sites (R5-5); if-!-echo gate-condition pin (R5-9);
failure step added to the sweep-removal regression loop (R5-11);
behavioral cases for sci-notation id, mktemp failure, prefix-colliding
dedupe boundary (R5-10) and the reworded cap.
* fix(autofix): defuse mentions in deferred bullets, verify child liveness (review round 6)
- R6-9 (Critical): the reason is agent-influenced prose published under
the bot identity, so a raw @ fired real mentions from the tracking
issue. Defuse before rendering: @ gets a trailing ZWSP, and the entity
spellings GitHub decodes BEFORE its mention filter (@ @
@ @) get their & escaped. Both measured inert against the
real renderer; \@ and leaving & alone are not. Paths were already
charset-reduced. Byte-exact probe: 2/2 @ defused, all four entity
spellings escaped, no raw spelling survives.
- R6-8: LD_* cannot be enumerated — LD_TRACE_LOADED_OBJECTS is
presence-tested, so even the empty prefix assignment leaves trace mode
on and /usr/bin/env prints its libs and exits 0 without ever running
the child (probed). Verify the RESULT instead: the child prints a
liveness sentinel first and its absence is reported. The inspection
uses bash builtins only — an external grep would itself
print-and-exit-0 under trace mode, neutering the check (measured: the
first grep-based attempt failed exactly this way).
- R6-4: guard the child's own GH_CONFIG_DIR mktemp; an empty value falls
back to the shared ~/.config/gh.
- R6-6: a line-builder (jq/sed) failure warns instead of exiting
silently as 'nothing new' — the last path skipping the header
contract.
- R6-3: write-failure warnings say the findings are LOST (watermark-
gated, never retried) and name the bullets, matching the round-5 cap
wording fix.
- Tests: allow-list entry pins (R6-7), sentinel/builtin-inspection and
child-mktemp pins, identity-check ordering (R6-5), plus behavioral
cases for mention defusing, reason-type and id-0 gate clauses (R6-2)
and line-builder failure.
* fix(autofix): defer findings from all three feedback sources; carry them across repair (review round 7)
- R7-1 (Critical): only inline comments carried an id in feedback.md, so
a verified out-of-footprint finding raised in a review body or an
issue-level PR comment could not be deferred and was lost at merge.
Feedback now renders [rv:<id>] and [ic:<id>] alongside the existing
[rc:<id>], the record takes an optional "source", and bullets anchor
under a per-source prefix so id spaces cannot collide. The resolved-id
exclusion stays inline-only (that is what resolved-comments.txt holds).
SKILL documents all three sources and that only inline findings have a
thread to reply on.
- R7-2 (Critical): every abort path said "skipping ... this round",
implying a retry that cannot happen (the eval watermark filters this
round's feedback out of every later round and the next reset wipes the
file). All six now report the findings as LOST and dump the raw
deferrals for manual recovery, with :: neutralized — the dump is
agent-influenced and a raw :: at line start is a workflow command.
- R7-3 (Critical): 'Repair deterministic rejection' deleted
deferred-findings.json before any upsert site ran, so run 1's
deferrals died in a repaired round. It now carries them into a sidecar
the upsert unions in (merging if an earlier repair left one), and the
sidecar rides the artifact dump. A/B probe: base arm loses run 1's
deferral, fix arm persists both.
- R7-4: a present-but-non-string path (false) passed the gate because //
treats false as absent; the gate now tests .path|type directly.
- R7-5: LD_PROFILE/LD_PROFILE_OUTPUT/LD_DEBUG/LD_DEBUG_OUTPUT are
non-blocking loader file-write channels the liveness sentinel cannot
catch, so they join the command-prefix neutralization (probed inert
when empty).
- Tests: per-source anchoring and dedupe, unknown-source rejection,
path:false, carry-only and carry-merge cases, LOST dump with ::
neutralization, plus wiring pins for the carry, the feedback ids and
the extended LD prefix.
* perf(autofix): bound the deferred-issue lookup and name gh failure causes
Clears the two backlog items the review has re-raised every round since
round 2 (R2-6, R2-10); both live in the file this PR adds.
- R2-6: the tracking-issue lookup ran a full --paginate over every issue
the bot has ever opened, on every round that defers anything, keeping
only the first match. It now walks newest-first pages and stops at the
first marker match: one request in the common case, a short page ends
the scan (corpus exhausted -> create), and a 10-page cap bounds the
worst case. Reaching the cap without a match SKIPS rather than opening
a second tracking issue for the same PR.
- R2-10: every gh call discarded stderr, so a rate limit, an expired PAT,
a transport error and a 404 rendered identically in the feature's only
signal. All five calls now capture stderr to one sink and the warnings
name the cause, :: neutralized like every other echoed API/agent
content.
Measured on the shipped script with a recording gh stub: first-page hit
1 request, empty corpus 1 request + create, page-2 hit 2 requests, cap
10 requests + skip, and the 403/401 bodies reaching the warning text.
* test(autofix): close the pin gaps the round-8 mutation sweep found
Round 8 raised 15 findings, none Critical: two behavioural, the rest
test pins the reviewer proved vacuous by mutation.
- R8-3: the carry-merge failure branch discarded THIS run's deferrals
with no raw dump — the one loss path in the feature without recovery
output. It now prints the set (:: neutralized) before deleting it.
- R8-1/2/5/6/7/8/9/10/11/12/13/14/15: pins that survived their own
mutations. Notably: the negative sweep pins now assert the PROPERTY
(no BASH_FUNC / unset -f / hash -r in non-comment lines) instead of
round 3's exact spelling; allow-list entries must sit inside the
env -i argument list, not merely somewhere in the step; the identity
check is pinned whole so a fail-OPEN mutation cannot pass; the repair
cleanup's deletion pin is spelling-independent and allows exactly the
one delete that follows a merge; the staging pins are scoped to the
stage step with cp ordered before the digest record; and the script's
<!-- escape site gets the count+canonical treatment its workflow
siblings already had.
Each new pin was mutation-verified: 8/8 injected regressions turn the
suite red (differently-spelled sweep, relocated allow-list entry,
deleted GH_CONFIG_DIR export, fail-open identity check, re-added
cleanup deletion, deleted re-print loops, ascending lookup order,
no-op sed spelling).
* fix(autofix): close the upsert TOCTOU and the per-id deferral collapse (review round 9)
- R9-1 (Critical): the digest gate was check-then-use — sha256sum read
the staged path and bash re-opened it, two opens of a path this PR
itself calls agent-writable. The child now reads the script ONCE and
runs those exact bytes (bash -c "$UPSERT_SRC"), so the bytes hashed
are the bytes executed. A/B against an inotify-driven same-user
rename(2) watcher: old shape 20/20 payload executions with the gate
never firing, new shape 0/20 (legit 20/20, control 20/20).
- R9-2 (Critical): unique_by([source, id]) collapsed DISTINCT findings
sharing one review-body or issue-comment id — the two sources this PR
adds — and reported success while losing them. Dedupe identity and the
corpus check are now per rendered line for those sources (inline
comments keep id identity and the cross-round anchor). Probe: two
findings under one review id now both persist ("3 of 3 new"),
byte-identical records still collapse, inline behaviour unchanged.
- R8-4 (re-raised): fixed structurally instead of by the suggested
prefix entry, which is a no-op — LD_SHOW_AUXV is presence-tested, so
an empty assignment still dumps 22 auxv lines (measured; env -u does
not help either). Loader side channels write to the LAUNCH process's
stdout, so that stdout is discarded and the child logs to a private
file; path and read-back are fork-free ($$ expansion, $(<file)) so a
polluted parent cannot leak noise into the value. Measured: with
LD_SHOW_AUXV planted the log holds 0 auxv lines and the child still
runs; with LD_TRACE planted the sentinel is absent and the warning
fires.
- R9-3/4/5: the manual-recovery dumps now say when they truncate, and
name the full byte count.
- R9-11: the artifact dump neutralizes :: in the agent-written files it
prints, like every other echo of them.
- Tests: pins for the single-read exec, the private log, the fork-free
parent handling, the identity check's ENFORCEMENT (R9-9), an
allow-list that must hold ONLY the sanctioned entries (R9-10), the
sentinel comparison inside the re-print loop (R9-13), and R9-2's
multi-finding cases. Also fixes an argList slice that anchored on a
comment mention and silently widened to the whole step.
* fix(autofix): keep a poisoned carry from sinking the round; clear the pin backlog
Clears the eleven items carried from round 9.
- R9-18: a carried sidecar that PARSES but fails the shape gate used to
abort this round's valid deferrals too — asymmetric with the
unparseable-carry branch, which persists this round only. The gate is
now a function applied to the merged set, with a retry on this round's
own file; the carry is dumped and named LOST. Measured on the real
script: valid own + gate-invalid carry -> own persisted, carry dumped;
valid own + unparseable carry -> own persisted; invalid own -> loud
total abort, nothing written.
- R9-20 / R9-7: the union argument order IS the freshness guarantee
(jq unique_by keeps first-of-group in original order), pinned at both
sites; measured: a duplicate id keeps this round's text, not the
carried one.
- R9-3/4/5 follow-up: the three truncation dumps became one dump_file
helper instead of a fourth copy.
- Pins: --paginate anchored to the comments call (R9-8), the stale
two-sites comment corrected (R9-6), the no-in-shell-sweep property
widened past function-unset spellings to alias/trap/proxy forms
(R9-12), the repair cleanup's deletion pin extended to rm -rf and to
any second multi-line list (R9-16), runUpsert's spawnSync bounded like
its sibling harness (R9-17), the explicit review_comment spelling
covered (R9-19), and the 20-item cap's survivor set pinned from a
MEASURED run whose sort order and input order disagree (R9-14) — the
four records written first are the ones dropped.
Mutation-verified 6/6: relocating --paginate, an alias-form sweep, an
rm -rf deletion, either union order swapped, and dropping the
poisoned-carry fallback all turn the suite red.
* test(autofix): widen the denylist-sweep guards past their word-boundary hole
`\btrap -\b` cannot match `trap - ERR EXIT`: the boundary sits between
`-` and a space, both non-word characters. The same hole was in two
sibling guards — `\bunset -f\b` misses `unset -fv name`, and
`\bhash -r\b` misses any suffixed spelling. Drop the trailing
boundary on all three.
Mutation-verified: injecting `trap - ERR EXIT INT TERM`, `trap -- EXIT`
or `unset -fv sha256sum` into a PAT-bearing step now turns the suite
red; each passed before.
* fix(autofix): two -e-fatal paths, an escape-order dedupe hole, and a rewording duplicate (review round 10)
Six Criticals; four were defects this PR introduced.
- R10-19 + R10-22 (Critical): the PAT steps run under 'bash -eo
pipefail' (defaults.run.shell: bash). Measured: 'rm -f' on a planted
DIRECTORY at the predictable log path exits 1 and kills the step, ': >'
onto one likewise, and $(<missing) is fatal in a way NEITHER '|| true'
NOR 'if !' rescues. Creation is now 'rm -rf' + '(set -C; : >)' with a
warn-and-skip, and the read-back tests -f/-r first while staying
fork-free. Probed all four planted shapes (fresh/file/symlink/dir):
the step survives each.
- R10-5 (Critical): the <!-- neutralization ran in a sed AFTER the jq
corpus comparison, so an rv/ic line carrying <!-- compared its RAW
rendering against the ESCAPED stored form — never matched, republished
every round. Escaping moved inside jq, before the compare.
- R10-17 (Critical): rv/ic identity was the exact rendered line, so any
reworded re-emission (routine: the repair flow re-runs the agent)
published a permanent duplicate. Identity is now a normalized digest —
case-folded, punctuation-collapsed, trimmed, capped — which absorbs
phrasing churn while keeping distinct findings apart. The tension with
R9-2 is real and resolved deliberately toward a visible duplicate over
a silent loss.
- R10-1 (Critical): the sweep tripwire is a spelling denylist over an
unbounded space. Reframed as what it is — a drift alarm, not the
boundary (the boundary is the env -i child, pinned separately) — and
aimed at the ENUMERATION PRIMITIVES a sweep needs (compgen -e,
declare -x, env pipes, export -n) instead of more name vocabulary.
- R10-6 (Critical): the jq stub hardcoded /usr/bin/jq, which does not
exist on macOS; it now resolves through the original PATH.
- R10-13: the child's log comes from agent-writable RUNNER_TEMP, so ::
is neutralized on re-emission via parameter expansion (no fork).
- R9-5 leftover: the third truncation dump now names the clipped size.
Mutation-verified 5/5 and behaviour-probed 5/5 (escape-before-compare,
reworded re-emission, distinct sibling, R9-2 no-regression, planted-path
shapes).
* fix(autofix): make the deferral identity lossless; keep the unmerged set on disk (review round 11)
Two Criticals, both defects this PR introduced, plus the eleven items
carried from round 10.
- Identity key (Critical): the normalized key stripped every non-[a-z0-9]
byte and capped at 160 chars, so CJK siblings collapsed to one key (this
repo is bilingual) and a long path pushed the reason out of the identity
entirely — silent loss, the exact outcome the feature exists to prevent
and the opposite of what its own comment claimed. The key now normalizes
case and PUNCTUATION only, keeping every letter of every script and no
cap, at both the build and corpus sites. Rewording tolerance is
unchanged. Probed: 2 CJK siblings -> 2 of 2; 2 siblings on a 200-char
path -> 2 of 2; reworded duplicate -> 1 of 1.
- Repair merge failure (Critical): the branch deleted
deferred-findings.json before 'Show run artifacts' and the artifact
upload ran, so its own pointer at the artifact dump was false past the
4000-byte clip. It now renames the set to deferred-findings.unmerged.json
(kept in WORKDIR, added to the dump list) on the failure path and deletes
only on the merge-success path. Probed: 6245 bytes preserved where the
dump clipped at 4000.
- R10-12: neither side is known to be the corrupt one (jq -s fails if
either input is unparseable), so both merge-failure warnings say that
instead of blaming this round.
- R10-18: a second identity anchor — the derived title — so an edited body
that loses the marker no longer orphans the issue into a duplicate; the
marker still wins when both are present, and a same-titled PR is still
never adopted.
- R10-3: the carry branch is unreachable in today's topology (WORKDIR is
wiped at run start, one repair step); kept as defensive with that stated.
- R10-10: the builtins-only discipline is scoped to the child-output
INSPECTION, which is what it always meant.
- Pins: delimited-token allow-list incl. UPSERT_LOG's value (R10-7), every
respelling of executing the staged path (R10-8), the tripwire extended to
the issue-autofix failure steps (R10-11), launch-line anchoring in both
steps (R10-15), flagless rm counted (R10-16), and behavioural cases for
the 200/500 caps (R10-4), CJK and long-path siblings, and the title
anchor.
Mutation-verified 7/7.
* refactor(autofix): remove the agent-writable paths the upsert depended on (review round 12)
Rounds 9-12 each closed one hole in a design that read the staged script
from an agent-writable path and buffered the child's output through
another. Round 12 found four more of the same class (TOCTOU on the log
reopen, a plantable FIFO and an unbounded read on each path). Rather than
patch a fifth time, remove both paths.
- The script travels as CONTENT: the stage step captures it from the
trusted checkout into a step output (random heredoc delimiter), and the
clean child runs `bash -c "$UPSERT_SRC"`. With no agent-writable copy
there is nothing to verify — the digest gate, its check-then-use
window, the staged cp and the FIFO/huge-file read all disappear.
- The child's messages travel on fd 3, which the parent captures, while
fd 1/2 are discarded. Every loader side channel writes there, so the
noise still cannot reach the parsed output — and there is no log file
to plant, race, bound, or clean up. Probed with LD_SHOW_AUXV and
LD_TRACE planted: clean output, sentinel behaviour unchanged.
- RC-1: resolved-comments.txt went to jq as one argv element, the exact
MAX_ARG_STRLEN failure the neighbouring comment describes and that
`known` already avoided. Both corpora use --rawfile now. Measured on a
348 KB corpus: the old form dies with "Argument list too long", the new
one publishes normally.
Net -113 lines, and the pins follow: no-path invariants replace the
digest/log battery. Mutation-verified 6/6.
* fix(autofix): reject multi-document deferral files; survive a base without the script (review round 13)
- Multi-document JSON (Critical): `jq -e` without -s evaluates each
document in turn and its exit status reflects only the LAST, so
`[valid]\n[]` exited 0 silently (findings lost, no warning) and
`[bad-id]\n[valid]` passed the shape gate outright. A single_doc gate
now runs first, with the asymmetry the earlier rounds settled on: a bad
OWN file is a total abort, a bad CARRY costs only the carry.
- R13-7: the stage step reads the script from the TRUSTED BASE, where it
does not exist until this PR merges — under -e that killed every
pre-merge pull_request-triggered round (true of the old cp too, so this
has been latent since the script was added). It now tolerates the
absence and lets the consumers' own empty-content guard skip the round.
- R13-2: the carry union requires both inputs to BE arrays; `add` on two
non-arrays yields whatever they add to.
- RA1R4-B: the resolved-corpus test is -f/-r, so a directory or FIFO at
that path is treated as unusable rather than present.
- R13-1: nine rationale comments still described the staged copy and the
digest gate that round 12 removed.
Probed: both multi-document shapes are rejected loudly with zero writes;
a bad carry still leaves this round publishing 1 of 1.
* docs(autofix): retire the last stale rationale comments (R13-1)
Six of the nine locations were in the test file: comments still describing
the digest gate, the staged copy and the read-once invariant that round 12
removed. Same honesty issue as their three workflow siblings.
* fix(autofix): strip BSD wc padding; let wrapper warnings stay annotations (review round 14)
- BSD wc (Critical): `wc -l` pads its count with leading spaces on
macOS, and TOTAL_NEW is interpolated into the cap warning and the
success line — the sibling `wc -c` already stripped it, this one did
not. Tested with a padding `wc` stub, since GNU wc never pads and the
regression is invisible on Linux CI otherwise.
- The re-emit loop demoted the feature's own failure signal: every `::`
became `;;`, including the wrapper's trusted messages. Wrapper-authored
lines now carry a marker and are emitted VERBATIM (so they render as
annotations again); the script's output, which interpolates agent
content, stays neutralized.
- \b on `declare -x`/`export -n` had the same word-boundary hole already
fixed for `trap -`/`unset -f`.
- Pins: the heredoc CLOSING delimiter, the merge-failure quarantine
rename, and an allow-list comparison that is a sorted multiset rather
than a Set — a symmetric same-name addition is exactly what that check
exists to catch and a Set hid it.
Mutation-verified 5/5.
* fix(autofix): un-truncate the sibling identity; align the carry precedence (review round 15)
Zero Criticals this round; five behavioural findings among the pins.
- The rv/ic intra-batch identity was derived from the RENDERED line, i.e.
after the 500-char reason cap, so two siblings differing only past the
cap collided and one vanished silently — the same silent-loss class as
the CJK and long-path entrances. It now comes from the uncapped
path+reason; the corpus check still compares rendered forms (that is
all the issue stores), so cross-round the cap can cost a duplicate,
never a loss.
- The repair carry union put the OLDER set first, inverting the
newer-wins precedence the script documents for its own union.
- The resolved-id parser dropped any line with stray surrounding
whitespace, so a padded `rc:<id>` no longer suppressed its finding.
- The clean child's catch-all warning lacked the trusted marker added
last round, so the feature's most common failure message was still
demoted out of annotation form.
- The truncation notice pointed at the artifact dump even when the
dumped file is a merge temp outside WORKDIR, which is never uploaded.
Pins: the stage step's `id: 'stage'` (the link whose break empties every
UPSERT_SRC), the empty-content skip branch, the capture's `|| true`, and
the trusted marker on every warning inside the child.
Mutation-verified 6/6.
|
||
|
Shaojin Wen
|
337da2143c
|
fix(ci): stop dropping agent settings in resolve and follow-up workflows (#9252)
Some checks are pending
E2E Tests / E2E Test (Linux) - sandbox:docker - shard 1/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:docker - shard 2/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:docker - shard 3/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none - shard 1/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none - shard 2/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none - shard 3/3 (push) Waiting to run
E2E Tests / E2E Test - macOS - shard 1/2 (push) Waiting to run
E2E Tests / E2E Test - macOS - shard 2/2 (push) Waiting to run
E2E Tests / channel-plugin E2E (nightly) (push) Waiting to run
E2E Tests / cron-interactive E2E (nightly) (push) Waiting to run
E2E Tests / web-shell Browser Regression (push) Waiting to run
Security Checks / Dependency CVE audit (push) Waiting to run
Security Checks / Secret scan (TruffleHog) (push) Waiting to run
* fix(ci): stop dropping agent settings in resolve and follow-up workflows Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): pin remaining agent-settings guard gaps from review Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> |
||
|
Shaojin Wen
|
f9bc8cb250
|
fix(autofix): re-anchor growth divergence on measurement time and external head moves (#9192)
* fix(autofix): re-anchor growth divergence on measurement time and external head moves Tightens the growth-divergence comparability window (PR #9104 follow-up, tracked as #9114): - measured_at (R2-6): the growth-now marker now carries the prepare-time measurement instant, and the divergence read filters on it instead of the comment's created_at. The report posts the marker only after the agent's ~120-minute run, so a round in flight when a concurrent base update landed would otherwise pass a created_at filter while carrying sums measured against the old base. - external head move (R2-8, subsumes R6-3): prior sums are measured against origin/main, so any commit an external actor (author push) or a stale-base merge added since the bot last evaluated the branch inflates this round's sum relative to them. BASE_UPD_AT only tracks the bot's own update-branch merge; the new GROWTH_NOW_CUTOFF also re-anchors (drops all prior sums) whenever the checked-out head is not the bot's last judged head (LIVE_RED_HEAD), covering author pushes and base updates alike. The reader now dedups/orders per run by measured= (a re-run's fresh measurement wins). Contract tests cover the measured-based cutoff, the external-head-move re-anchor (both branches), and the writer→reader round-trip with the new field. 172/172. R6-6 (markers don't store the effective budget, so a mid-window budget raise counts old rounds against the new regime — fail-safe, one round early) stays tracked in #9114. * fix(autofix): drop the head-move re-anchor, keep the measurement-time filter Review found the head-move half of this change broken in three ways (all probe-verified), so it is withdrawn and returned to #9114 rather than patched under review: - R1-1 (regression): `autofix-redcheck` records the head the agent was GIVEN, frozen before its push — so after any pushing round the next round's head differs and the cutoff was set to now, dropping every prior sum. In the push regime OVER_ROUNDS_PRIOR could never reach the threshold and the #9104 handoff would never fire at all. - R1-2: the cut was stateless — the round after a correct re-anchor fell back to an empty cutoff and re-admitted every pre-move sum. - R1-3: with no redcheck marker (a crash round) the `-n` guard skipped re-anchoring across a genuine external move. A correct version needs both a bot-authored-move test and a PERSISTED cut; that is its own change. What remains is the measurement-time filter (R2-6), which stands on its own: the marker carries the prepare-time instant and the divergence read filters/orders on it instead of the comment's post-agent created_at. Also from this review: - R1-4: `measured=` is OPTIONAL in the scan, falling back to the comment's created_at, so deploying does not blank an in-flight window's census. - R1-9: the per-run collapse now runs BEFORE the over/window/cutoff filters — a re-run whose fresh attempt came back under budget was still represented by its stale over=true attempt. - R1-7: comments corrected — run= is the DEDUP identity, measured= the ORDER key (four sites). - R1-8: recorded as a known residual next to the sibling growth-base reader, which still filters on created_at; tracked in #9114. - R1-5/R1-6: fixtures decouple created_at from measured=, cover a legacy marker (with and without the cutoff), and pin the measured_at source line in prepare. * fix(autofix): keep the failure-path growth marker scannable when prepare never ran * fix(autofix): prefer explicit measured= over created_at fallback in the per-run growth collapse * test(autofix): pin the explicit-measured preference in the per-run collapse |
||
|
Shaojin Wen
|
e93da9e387
|
feat(autofix): escalate stopped takeover PRs and age out unanswered pauses (#8960)
* feat(autofix): escalate stopped takeover PRs and age out unanswered pauses
Takeover PRs that hit the round cap (or a circuit breaker) went silent:
no label, no dashboard entry, no escalation — five PRs had been paused
for days. The fleet shepherd only tracked bot-authored PRs, so the whole
35-PR human takeover pool was invisible.
The autofix scan now applies an autofix/needs-human label whenever a PR
reaches its cap (the write rides every cap detection, so already-paused
PRs backfill on the regular scan rotation), and removes it wherever
management resumes or a human releases the PR. The fleet shepherd
enumerates the takeover pool onto its dashboard (state, stop reason,
pause age, plus an awaiting-human section for released PRs) and gains a
single bounded lever: a takeover whose pause went unanswered for
AUTO_RELEASE_DAYS days gets its takeover label removed with a bilingual
summary, keeping the needs-human label as the filterable TODO. Resume
evidence newer than the pause notice — bot markers, trusted re-arm
commands, fresh labeled events — vetoes the release; every read fails
closed and a per-tick cap bounds blast radius.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(autofix): harden the takeover auto-release against review round 1
Addresses the PR review's two Criticals and eleven Suggestions:
- Command-comment resume evidence now counts only while FRESH (2h grace)
and UNSUPERSEDED by a refusal ack (fork-refused/base-refused/
skip-blocked) — an ignored command expires instead of vetoing the
release forever, and no permission logic is mirrored from the route.
- The release lever's population comes from the needs-human enumeration
(needs-human ∩ takeover), never the display window; both enumerations
cap at 100 with saturation warnings, and a failed enumeration degrades
to an error row so the dashboard write (and its liveness watermark)
always runs.
- The auto-release summary posts before the label DELETE, dedup'd by its
own marker — neither half can strand the other on a transient failure.
- Awaiting-human rows use neutral wording (capped bot PRs land there too)
and a shepherd-side heal clears stale needs-human labels left by manual
UI releases on fork PRs (human unlabeled event, budgeted, skip-vetoed).
- Fail-closed deferrals now still render a dashboard row (the row append
moved outside the evaluation arms); tick summary and dashboard header
report the same counters; days_since() replaces pasted epoch math.
- Tests: command-evidence gate replays (fresh/refused/expired/acked),
refusal-variant and command-string cross-file pins, DELETE-target and
fallback-assignment pins, heal jq replays, unified-row-render pin.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(autofix): close review round 2 — cycle-scoped heal, retryable summary
- The stale-label heal now only counts a human unlabel NEWER than the
latest label-apply, so an unlabel from an earlier takeover cycle can no
longer heal the current cycle's needs-human after an auto-release (R2-1).
- The summary dedup marker is scoped to the current pause cycle (markers
older than the latest cap notice are ignored), so a re-armed and
re-capped PR still gets its second release summary (R2-4).
- The two DELETE levers no longer redirect act()'s stdout, keeping the
DRY-RUN preview and failure warning visible (R2-5).
- AUTO_RELEASE_DAYS is base-10 normalized after the numeric guard, so a
zero-padded repo variable can't silently kill the lever (R2-6).
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(autofix): close review round 2 — cycle-scoped markers and mutation-tested pins
- Heal is cycle-correlated: only a human unlabel NEWER than the latest
label-apply counts (an earlier cycle's unlabel can't heal this cycle).
- The release summary dedup marker is scoped to the current pause cycle,
so a re-armed and re-capped PR still gets its second summary.
- act() stdout is no longer redirected on the two DELETE levers (DRY-RUN
preview and failure warning stay visible).
- AUTO_RELEASE_DAYS is base-10 normalized so a zero-padded repo variable
cannot silently kill the lever.
- Doc/workflow-header text corrected to the implemented order (summary
first, marker-dedup'd) and to the idle-backoff backfill timing.
- Mutation-tested test pins for every gap the reviewer probed: days_since
replay, NH_PREFIX interpolation + truth map, loop-1 deferral, full
cross-file marker/refusal-set equality, label-constant cross-pin,
EVENT_TS merge + promotion ordering, CLEANUPS increment, unclassified
headline classification, filter byte-identity, exit-spelling ban,
@uri encoding, sort/field-list attribution, paginate shapes, scope
--arg bindings, LIVE_LABELS_JSON wiring, positional append pin,
label-create idempotence + POST guard, and per-branch removal
attribution in the toggle replay.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(autofix): close review round 3 — release-ack label gate and shared classifiers
- R3-1 (Critical): the every-scan cap-branch label POST is now suppressed
when a release ack (takeover-ack released) is newer than the last re-arm,
so a released bot PR is not re-labeled each scan (which would fight every
release-side removal and ping-pong with the shepherd cleanup). A re-arm
advances the window past the release ack, re-enabling the label.
- R3-7: the /retry re-arm's needs-human removal now honors autofix/skip,
mirroring the takeover-command guard — a frozen PR keeps its only
filterable escalation state.
- R3-2 (Critical): the takeover-enum error row no longer claims 'no release
evaluation ran' — the lever is fed by the needs-human enumeration.
- R3-8: the conflict-dispatch lever refuses a paused (needs-human) PR
instead of spending a dispatch slot the scan would refuse.
- R1-10: extracted pending_checks()/failed_test_url() helpers so both
dashboard loops share one CI-status classifier (the round-1 reply was
wrong that the restructure removed this duplication — it did not).
- Hardened the mutation-tested pins: exact terminal-headline count (5),
full rearm DELETE line + single-API-write, AUTO_RELEASE_DAYS guard order,
runRearm env/stub/assertion for the /retry DELETE + skip guard, and the
scope-guard comparison operator.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(autofix): close review round 4 — label-lifecycle hardening
- R4-C1: the conflict-dispatch lever reads needs-human from the LIVE label
payload (after live_skip), not the tick-start snapshot, so a label applied
after enumeration is still honored.
- R4-C2: a re-armed PR that still carries needs-human (a resume-side removal
failed) now gets a bounded, skip-vetoed cleanup retry instead of staying
pinned in the paused population forever.
- R4-C3: the per-tick release budget is consumed before the first external
write — a DELETE outage can no longer mutate many PRs while RELEASES=0.
- R4-C4: dashboard row routing follows post-action label state — a released
PR moves to Awaiting human, a healed one drops off entirely.
- R4-C5: the AUTO_RELEASE_DAYS guard also rejects over-long digit strings
before any arithmetic (Bash-int overflow would wrap negative and pass -ge).
- R4-32: takeover-command stop only removes needs-human when the takeover
release actually landed (REMOVED_OK; 404 counts) — a failed release no
longer strands the escalation label while latching RELEASE_ACKED.
- R4-2: the /retry skip guard fails closed — an unreadable label state keeps
the label (mirrors takeover-ack's exit-1 convention).
- R4-3: the takeover-ack released arm and the stop branch both honor
autofix/skip when removing needs-human.
- R4-S1: producer headlines must be explicitly classified terminal or
transient — an unclassified headline now fails the cross-file test.
- Pins updated/added for every behavior above.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(autofix): close review round 4 — robust release detection and marker-true gates
- R4-1/R4-5: release detection now uses the takeover unlabeled EVENT
(recorded on every removal path, unlike the tolerated-lost ack comment),
and the suppression only applies to human-authored PRs — a bot PR
released from takeover returns to standard management and keeps the cap
notice + escalation label.
- R4-6: the conflict-dispatch lever requires marker truth (conflict_paused)
— an armed PR with a stale needs-human label is dispatched normally.
- R4-C1: the pause check reads needs-human from the live label payload.
- R4-C2: re-armed PRs with a stale label get a bounded cleanup retry.
- R4-C3: the release budget is consumed before the first external write.
- R4-C4: dashboard rows route on post-action label state.
- R4-C5: AUTO_RELEASE_DAYS rejects over-long digit strings before arithmetic.
- R4-32/R4-2/R4-3: stop/ack/retry removal paths gate on REMOVED_OK and skip.
- R4-9/R4-10/R4-13: membership check, STATE escaping, HM_OK-branched error row.
- R4-14: command evidence requires a write/maintain/admin commenter.
- R4-11/R4-15/R4-24: behavioral replays for the classifiers, the release
jq, and the gate nesting.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(autofix): keep the label-DELETE idiom byte-identical across workflows
R4-32's REMOVED_OK tracking reworked the takeover-command stop branch's
404-tolerance block, breaking the pr-self-report-label ↔ qwen-autofix
contract test that pins the two workflows' label-DELETE idiom
byte-identical. Keep the canonical idiom and derive REMOVED_OK from
REMOVE_ERR's content afterward (empty = landed, 404 = already off,
anything else = release did not land) — same behavior, contract intact.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* test(autofix): close review round 4b — mutation-tested harness hardening
- R4-4: re-bound the conflict-lever regex spans and anchor on
conflict_paused so the pin can't resolve live_skip against the sync
lever's call site.
- R4-16: runAck records gh calls and asserts per-branch needs-human DELETE
counts (engaged/released=1; base-refused/skip=0).
- R4-17: pin the first-pickup scan DELETE inside the engage-ack success
branch.
- R4-18/R4-19: ordering pins — takeover POST before needs-human DELETE
(engage), marker comment before cleanup DELETE (/retry).
- R4-20: deleteFail stub branch replays non-404 (warns, status 0) and 404
(silent) DELETE outcomes.
- R4-21: identity-failure paths assert no DELETE ran.
- R4-22: runRearm stub serves labels only when --json labels is requested.
- R4-23: full api-write census pinned (exactly api user + one DELETE).
- R4-25: skip fixture uses the production multi-label shape.
- R4-28: loop-2 fetch pins include the jq -s 'add // []' merge program.
- R4-29: cmdGate scenario where a refusal is OLDER than the fresh command.
- R4-30: takeoverEnum asserts its own sort:updated-asc qualifier.
- R4-31: multi-entry fixtures pin the max/last/length aggregation operators
on CMD_TS, EVENT_TS, REASON, SUMMARY_POSTED, and the heal lever's
LATEST_LABEL_TS/UNLABEL_ACTOR programs.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(autofix): close review round 5 — trust boundaries and evidence freshness
- R4-5 residual: PR_META now fetches author so IS_BOT_AUTHOR actually
resolves (the exemption was dead on arrival), with a behavioral replay.
- R5-1: REMOVED_OK derives from the captured stream ('HTTP ' non-404 = not
landed) instead of output emptiness — GitHub returns a body on success.
- R5-2: /retry only drops needs-human when management actually resumes
(takeover label present or bot-authored) — an auto-released human PR
keeps its escalation label.
- R5-3: conflict_paused requires a real cap notice AND a newer resume
marker — label-present/notice-absent now fails closed toward paused.
- R5-4: a failed permission read defers the release (PERM_READ_FAILED),
never counts as no-permission — at both evaluation points.
- R5-5: compute_resume_ts scans in-grace commands newest-first and
permission-checks each (≤2 reads), so a stranger's echo can't shadow a
maintainer's command.
- R5-6: the release branch re-fetches evidence and recomputes resume state
immediately before the first write.
- R5-8: the heal re-checks the takeover label from the live payload before
clearing needs-human.
- R5-9: same-second ties resolve toward resume/release suppression in both
files (RESUME>=TERM; RELEASE_ACKED >= window).
- R5-10: the heal anchors to the current pause boundary (latest needs-human
apply event); an absent anchor skips the cleanup, fail closed.
- Tests: whole-function compute_resume_ts replay (permission/shadow/tie/
grace/refusal cases), heal anchor fixtures, toggle stub models the real
DELETE body, runRearm orphan case.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(autofix): close review round 6 — contract-safe gates and subshell flag fix
- B5: the bot-fleet enumeration failure now degrades to a loud error row
and falls through (FLEET_OK gate) instead of exiting before the
independently-fed takeover/needs-human processing and the dashboard's
liveness-watermark write.
- B12: the cap-branch LIVE_LABELS consent re-read fails closed on an
unreadable gh pr view (a collapse to '' ignored a concurrently added
skip for standard bot PRs).
- R6-1/R6-19: the takeover-release landed flag is keyed on the DELETE exit
status (LBL_DEL_FAILED set inside the pinned idiom's failure branch) —
never on output text, which lies in both directions. The
pr-self-report-label idiom evolves identically to keep the cross-workflow
contract green (and its own 'removed' log line no longer lies either).
- R5-4 residual: compute_resume_ts now returns via globals
(RESUME_OUT/PERM_READ_FAILED) and both call sites invoke it directly —
the previous subshell silently dropped PERM_READ_FAILED, leaving
the fail-closed defer branches dead.
- R6-3: command candidates are deduped by author before permission reads,
so a stranger posting N commands can't burn the 2-read budget and shadow
a maintainer's command.
- R6-4: an unreadable release history is reported as such, not as
'released'.
* fix(autofix): close review round 7 — lever starvation, re-arm anchoring, permission shadows
- R5-7: the release lever gets its OWN enumeration of the paused population
(takeover+needs-human, stale-first) instead of the long-lived needs-human
display window — released-awaiting PRs aging back into that window could
truncate exactly the fresh pauses that become release-eligible, starving
the lever and making the zombie state permanent and self-feeding.
- R6-3: the 2-read permission budget now sets PERM_READ_FAILED on exhaustion
(it was failing open), and the candidate walk sorts newest-first per author
(group_by+max_by+sort) instead of unique_by's alphabetical order, so two
read-only strangers can't shadow a maintainer's newer command.
- R7-1: the stale-label cleanup anchors on the current pause boundary (latest
needs-human apply) and is marker-confirmed only — not keyed on TERM_TS, and
never on command/label evidence — so a re-paused PR with a lost cycle-2
notice isn't read as re-armed on stale cycle-1 evidence.
- R7-7: the /takeover stop success echo is gated on REMOVED_OK — a failed
DELETE no longer logs 'removed'.
- R7-2: TAKEOVER_COMMAND/RETRY_COMMAND mirrored into the shepherd env and
passed via --arg, so the resume matcher can't drift from the route.
- Tests: conflict_paused + re-arm guard behavioral replays, mirrored-command
cross-file pin, engaged/released-with-skip ack matrix cells, LBL_DEL_FAILED
branching, gnuDateShim hoisted to module scope, R4-24 nesting indices.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* test(autofix): complete the R4-16 ack-matrix DELETE-count coverage
Add fork-refused and skip-blocked ack cases to the takeover-ack harness
— management never resumed on either, so zero needs-human DELETEs, each
asserted by total DELETE count (not just toContain).
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(autofix): close review round 8 — reachable re-arm cleanup, release race guards, pin census
* fix(autofix): close review round 9 — honest release-failed ack, cleanup attempt budgets, dashboard single-owner routing
- /takeover stop whose label DELETE failed no longer posts a
'Takeover released' ack: a release-failed variant names the retry
(R9-4), and the R7-7 echo pair gains symmetric log pins (R9-3)
- stale-label cleanups count ATTEMPTS like the release budget, so a
DELETE outage trips the cap instead of leaving it inert (R9-5)
- dashboard renders each both-label PR exactly once: loop 1 defers by
paused membership, loop 3 is the render of last resort (R9-1/R9-13)
- a 404 from the collaborators-permission endpoint classifies the
author read-only instead of renewably deferring the release (R9-10)
- cap-branch release evidence reuses the per-iteration events fetch
under a success flag (R9-18); release-clock comment corrected (R9-11)
- harness gates end-anchor the --json field list (R9-14/R9-15); the
escalation POST and the ack-body census gain count pins (R9-16);
the date shim answers only the +%s shape it emulates (R9-9)
* fix(autofix): close review round 10 Criticals — exact HTTP 404 release classification, isolated replay fixtures
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(autofix): close review round 11 Criticals — engaged stale-ack guard, exact HTTP 404 permission classification
---------
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com>
|
||
|
Shaojin Wen
|
90f754e73e
|
fix(ci): keep no-op review requests out of the PR review concurrency group (#9210)
* fix(ci): keep no-op review requests out of the PR review concurrency group Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): pin precheck-pr bot login to the review constants * test(ci): share one bot-login extraction across review-workflow suites * fix(ci): route every review request to a per-run concurrency group A bot-directed review_requested run joined the shared PR group on the requested reviewer's identity, but whether it reviews anything is decided later by authorize on the requester's write permission. A requester without write produces a guaranteed all-skipped run that can still supersede a lifecycle run sitting PENDING behind a still-terminating review — the same lost-review race as #9091, through the bot-request door. Gate the shared group on the action alone so no review_requested run can supersede a pending lifecycle run; an authorized bot request still reviews immediately, at the cost of an occasional duplicate review of the same head. --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com> |
||
|
易良
|
9b39280078
|
fix(ci): skip non-bot review_requested siblings before jobs spend compute (#9204)
Opening a same-repo PR that touches CODEOWNERS-covered paths auto-requests every owner individually, so one PR open emits one review_requested run per owner (five within the same second on #8830/#9142). Only the bot-requested run can reach review-pr; the human-requested siblings used to spend a review-config runner plus an authorize job (CI_BOT_PAT permission API) each before no-op exiting. Mirror the requested_reviewer predicate precheck-pr already applies to fork PRs into authorize.if and review-config.if so the siblings complete as instant all-skipped runs. Co-authored-by: yiliang114 <yiliang114@users.noreply.github.com> |
||
|
Shaojin Wen
|
e7a7ac1bfb
|
feat(autofix): deny-by-default footprint gate and positional window censuses (#9156)
* feat(autofix): deny-by-default footprint gate, positional window censuses, review-loop backlog Follow-up to #8981/#8996, closing the structural causes behind their review-round non-convergence: - Deny-by-default footprint: every file a round touches maps to an AREA (declared workspace, else top-level directory, else the root file itself); areas outside the PR's own footprint are surfaced in a gate-authored advisory, or rejected retryably once the repo variable QWEN_AUTOFIX_FOOTPRINT_ENFORCE is staged to 'reject'. The enumerated class gate keeps rejecting regardless — this inverts the default for everything it cannot enumerate (a denylist is not a boundary). - The three window censuses (PRIOR_TIMEOUTS, WIN_HEADS, PRIOR_HEADS) attribute comments positionally over their own scan-parsed eval markers instead of whole-body win= substrings: a neutralized marker quoted in a handoff excerpt, or any future marker embedding win=, can no longer double-attribute a comment (decoy fixture included; the census fixture's non-numeric round= placeholder is corrected). - BITE_ENFORCE's reply arm inherits the thread root's CHANGES_REQUESTED membership, not just its body tag. - Backlog tests: the bite restore-failure crash contract (verdict-less exit with the rejection document, driven by a ref-deleting runner), merge-base-anchored footprint compares under an advanced main (afterPr fixture hook), and the shrink+bite advisory append order. - SKILL: cap each round's implemented batch (~8 findings, Critical first, defer the rest via comment-replies) — nine review rounds of evidence that oversized fix batches breed fix-of-fix defects — and document the footprint gate. * fix(autofix): close the R1 footprint-gate findings - Advisory lifecycle: one reset at gate start, every writer appends — the footprint advisory no longer dies to the shrink section's rm or its truncating write. - Footprint membership is REF-ANCHORED: areas derive from the pre-round root manifest's workspaces globs (longest ancestor wins, nested workspaces correct), so a round cannot redefine its own boundary and the on-disk resolver is out of this path entirely; non-workspace paths under packages/ keep two segments so sibling projects stay distinct areas; emitted areas are newline-sanitized against phantom footprint grants. - The enforcement knob rides step-level env at both verify gates — $GITHUB_ENV writes from earlier steps cannot downgrade 'reject'. - TESTSIDE's critical() mirrors cr_attached (root and self), keeping enforcement and demotion on one comment set. - Census ownership is LAST-WINS over scan-parsed markers (a stray quoted-or-appended marker cannot double-attribute), the replay decoy is now genuinely discriminating (old whole-body → 0, new → 1), and the growth-gate comment stops citing retired whole-body matchers. Queued per the batch cap: per-line advisory bullets and the third sink charset, discriminating fixtures at the two remaining census sites, the reply-arm bite fixture, freight and merge-base footprint fixtures, and digest-pinning the staged resolver for its remaining consumers. * fix(autofix): close the R2 footprint-gate findings - list_areas reads and translates the ref's workspaces globs ONCE per invocation and matches ancestors in-bash (was ~21ms git+jq+sed per file×ancestor call), emits printf %q keys — line-safe AND injective, so distinct areas can never collapse into one comparison key — and both render arms print one bullet per area from those keys. - Producer failures are a STATE: a failed round- or PR-side diff (orphan history, transient git error) skips the footprint check loudly instead of shrinking one side into a verdict. - The workflow-level FOOTPRINT_ENFORCE env is gone (the step-level pins are the only consumers and outrank it — dead config removed); the two step wirings are count-pinned. - Fixtures: nested-workspace membership discriminates against the packages/ two-segment fallback (sibling nested workspaces stay distinct areas), and the advisory-lifecycle discriminator proves an earlier section's advisory survives the shrink section. Queued: consolidating the six eval-marker regex variants behind one grammar constant (touches six jq programs; its own change). |
||
|
Shaojin Wen
|
4ee6a087e5
|
feat(autofix): judge review-feedback validity by content, not author (#8996)
* feat(autofix): judge review-feedback validity by content, not author
Wrong feedback drives wrong rounds regardless of who wrote it: maintainers
increasingly draft comments with models, so author identity carries no
correctness signal. The trust gate stays as the injection/authorization
boundary it always was, but the validity layer becomes source-blind and
execution-based, enforced by the verification gate rather than prose.
Three mechanisms:
- Bite check: a round changing both source and tests has its changed tests
re-run against the pre-round tree (origin/<branch> sources with the
round's test files overlaid). All green there means the claimed defect
never reproduced — the shape of a plausible-but-false finding implemented
as a fix — and the round is rejected, non-retryable, with the measurement
in LAST_REJECTION so the next round can decline or escalate the finding.
Fails open on every scope limit: single-workspace rounds only (gitignored
dist carries the round's build across the detach, the same confound that
A/B-exempts typecheck), runnable unit tests only, and any pre-round
failure counts as biting.
- Sensitive-area footprint: a round may not expand into CI/verification
machinery the PR itself never touched — .github/, .husky/, eslint/vitest/
tsconfig configs, and the scripts section of existing root or first-level
workspace manifests (the gate's own command surface). Judged by area
class so takeover on an infra PR keeps full freedom; round-added
workspace manifests are exempt. Rejected retryably (the repair pass can
revert).
- Test-deletion advisory: shrinking coverage is surfaced by a gate-authored
section in the round report (deleted files, net test lines), never by the
agent's own prose, so a maintainer reads the agent's justification next
to the machine measurement.
SKILL.md rewrites the address-review protocol to match: identical
verification for every author, probe evidence outranks any assertion,
refuted maintainer claims are escalated with the measurement instead of
silently obeyed or overridden, and severity tags alone no longer make an
item Required — the claim must be checkable and reproduced.
* fix(autofix): harden the validity gates per review round
- Scan round/PR diffs NUL-delimited with --no-renames: a rename out of a
sensitive area now classifies the vacated source path (moving a
workflow out of .github/ is a removal of verification machinery), and
specially named files are no longer core.quotePath-mangled past the
case patterns.
- Narrow the capability classes: .github/workflows|actions, .github/
scripts, and passive .github metadata are separate areas (an
issue-template PR no longer licenses workflow rewrites), and the
transitive executable surface — repo scripts/ (minus scripts/tests/)
and .npmrc/.nvmrc — joins the protected set.
- Gate the bite consequence on machine-read intent: rejection now
requires the round to RESOLVE a Critical-tagged or CHANGES_REQUESTED
finding (resolved-comments.txt matched against rc.json/rv.json);
every other src+test round gets a gate-authored advisory on all-green
instead — a behavior-preserving refactor pinning existing behavior is
no longer rejected.
- Drop the blanket *.md exclusion from bite source detection: skill
markdown is executable agent behavior, and the intent gating now keeps
doc-only rounds safe from rejection.
- Sanitize deleted-test filenames in the gate advisory through a safe
character set: a backtick in a legal git filename could close the code
span and forge gate-authored markdown.
- Replace per-path basename spawns with parameter expansion.
- Tests: rename-evasion, metadata-vs-workflow class split, repo-scripts
class with the scripts/tests carve-out, filename-forgery rendering,
enforce-vs-advisory bite consequences (Critical tag and CR review),
and tree-state-proving runners that flip on pre-round source with the
round's test overlaid (plus the round-leak negative control).
One reviewed finding is declined with evidence in the thread: existential
batch semantics for mixed Critical rounds (per-behavior probe binding
needs test-result parsing; documented as a known limit at the check).
* fix(autofix): close the round-2 validity-gate findings
Sensitive-area scan: read NUL records directly (no tr re-mangling — a
newline filename cannot mint phantom footprint grants); resolve declared
workspace manifests and workspace-root configs through the trusted
resolver (nested workspaces protected, src-tree scaffolds exempt); split
root vs workspace manifest classes; guard the root workspaces array; give
the loop's own workflow and gate script their own class; classify .qwen/
(skills are executable agent behavior); anchor footprint content compares
at the merge base; sanitize violation paths in the rejection document.
Bite check: tolerate rc:-prefixed and CRLF resolved-comment ids (the
handle format SKILL prescribes — enforcement never fired without this);
count replies resolved in Critical-rooted threads as defect claims; skip
non-vitest workspaces (a vacuous --if-present pass must never reject),
self-package-name imports (dist confound), and rounds with paths outside
the resolved workspace; include renamed tests and changed snapshots in
the overlay; drop nested fences from the rejection document; surface
test-only defect claims as an advisory; document the already-fixed
re-raise limit and steer it to a no-code round.
Tests: classifier probe over every arm, footprint cases for the new
classes, enforce-vs-advisory negatives, reply-root enforcement, and the
rc:/CRLF handle round-trip.
* fix(autofix): close the round-3 Critical findings on the validity gates
- Gate-consumed helper scripts (resolve-owning-packages, settings-schema
and contracts checks) join the autofix-loop class: an unrelated
.github/scripts footprint no longer licenses rewriting machinery the
gate executes.
- Skip round-scan files whose content equals current origin/main: a
round that merges main (the flow SKILL prescribes on conflicts) made
ROUND_RANGE degenerate and attributed all incoming main churn to the
round, false-rejecting ordinary base updates.
- Round-added workspace-root configs are the round's own surface (same
cat-file exemption manifests have); deleted workspace manifests are
classified from pre-round existence instead of the on-disk resolver
that can no longer see them.
- The bite vitest guard reads the PRE-ROUND manifest — the tree whose
test script the detached runner actually executes.
* fix(autofix): close R4 validity-gate findings — gate-consumed surfaces join the taxonomy
- Supply-chain surfaces classify: lockfiles/shrinkwraps (root and nested)
and patches/ (patch-package runs on every install) as supply-chain;
.gitattributes (root and nested) as measurement-config — a -diff rule
could blind numstat-based advisories.
- manifest_scripts_changed inspects resolution fields too: workspace
manifests compare {scripts, exports, main, types}; the root manifest
adds exports alongside workspaces.
- resolve-sandbox-image.mjs joins the autofix-loop class (it establishes
the loop's isolation boundary).
- The noop path emits verified_head, making the prescribed no-code
re-verification round mechanically able to resolve threads.
- The bite transcript is cleaned at gate start like its sibling logs;
the advisory's test definition aligns with the growth brake's six
globs (__tests__/, test-utils/ included).
R4-3 (post-round on-disk workspace resolution racing a same-round
workspaces negation) is declined in-thread: it requires the PR footprint
to already license manifest-scripts-root, which is the accountability
boundary working as designed; pre-round-tree resolution is queued with
the census follow-up. R4-5 (advisory in failure paths) queued likewise.
* fix(autofix): deflake the bite harness and align the test taxonomy
- Isolate fixture git from ambient global/system config (the sibling A/B
fixture's GIT_CONFIG_GLOBAL=/dev/null pattern) and fail loudly on spawn
errors with the exit status in the assertion message — the advisory
sub-case intermittently died spawn-level under load with empty streams
and no diagnostic (reproduced 1/6 locally, once on CI).
- BITE_SRC excludes __tests__/ like the gate's own TEST_PATHSPEC.
- SKILL's boundary enumeration names the supply-chain and
measurement-config classes and the full protected manifest fields.
* fix(autofix): close R6 validity-gate findings
- Test-side defect claims take the advisory arm: when every resolved
Critical thread sits on a test file (rc.json .path), the fixed test
legitimately passes pre-round — enforcement grade 'advisory', never a
rejection; the test-only advisory also no longer requires a matching
*.test.* glob (snapshot-/helper-only resolutions surface too).
- Classifier arms: newline-bearing paths fail CLOSED as their own class;
qwen-pr-safety-precheck.yml + pr-safety-precheck.mjs join autofix-loop;
nested .npmrc/.nvmrc; eslint.legacy-filenames.mjs (imported by the lint
leg's config); root manifest filter carries main/types.
- The self-import dist-confound guard matches the package name delimited
(quote or subpath), so @qwen-code/qwen-code no longer swallows its
-core sibling's imports.
- Test isolation extends to the footprint and advisory spawns (R5's
rationale applied everywhere), spawn errors fail loudly there too, the
classifier probe pins the supply-chain/measurement-config arms, the
coverageOnly fixture asserts the advisory text, and the neutralization
ledger header matches its count.
- The resolve-threads design doc records the widened no-op
verified_head rule and its safety argument.
Deferred to the backlog per the convergence note: the bite-side restore
crash-contract test (shared-fixture work), origin/main-advanced footprint
fixtures, and advisory append-order pins.
* fix(autofix): close R7 validity-gate findings
- The resolve/reply pass is a shared function serving BOTH the pushed and
no-op outcomes: the no-code re-verification escape can now actually
resolve threads, and no-op declines finally post their in-thread
replies (a pre-existing silence gap). The design doc states the shared
path, its guards, and the named first-round residual.
- TESTSIDE demotion votes only over resolved CRITICAL threads (a source
Suggestion resolved alongside no longer breaks it; a source Critical
alongside keeps full enforcement) — three fixtures pin the matrix.
- The shrinkage advisory measures with --no-renames (a rename out of
runner discovery is a shrink) and NUL-safe deleted names.
- Bite inputs pass through the merge-freight filter the class scan
already applies, and BITE_SRC collects NUL-safe.
- Demoted rounds get their own advisory text (all-green is their
expected shape, not a failed reproduction).
- The manifest block comment matches the resolver-backed code; the
footprint and advisory test spawns get the isolation and loud
spawn-error handling previously claimed — the R6 reply overstated
that fix and this commit is the correction.
* fix(autofix): close the review-body re-checks on the validity gates
- Deleted-manifest classification honors the fixture exemption from the
PRE-ROUND root manifest's workspaces globs (was_workspace_dir) — a
deleted src-tree fixture manifest is no longer false-rejected, while a
deleted declared workspace still classifies; the PR-footprint scan
gets the same treatment anchored at the merge base, so a PR-deleted
workspace keeps licensing later rounds.
- A config added into a PRE-EXISTING workspace is machinery (the gate's
legs execute it); only a config born with its round-added workspace
keeps the exemption.
- The shrinkage advisory applies the merge-freight skip per file (NUL
numstat records), so a base-merging round is not charged main-side
test churn in trusted-voice text.
- The bite rejection document renders filenames through the safe
charset and collapses backtick runs in the runner tail below the
outer fence length.
- AGENTS.md/CLAUDE.md classify as agent-policy; the root-manifest
comparator covers lint-staged and config (sandboxImageUri) too.
Still standing by recorded design, acknowledged in the review body:
R1-9 (already-fixed re-raise), R1-27 (existential batch semantics),
R4-5 (post-round resolver vs same-round workspaces negation).
* fix(autofix): close the round-9 validity-gate re-checks
- TESTSIDE's critical() carries the CHANGES_REQUESTED review-state arm
and receives rv.json, mirroring BITE_ENFORCE — a CR-enforced test-side
claim demotes to the advisory arm, and a CR-enforced source claim can
no longer collapse into it (R8-1, both directions).
- was_workspace_dir matches workspaces globs PATH-AWARE ('*' stops at
'/', '**' spans, '?' single, '!' entries skipped conservatively): a
nested src-tree fixture manifest deletion no longer false-rejects
while a declared workspace deletion still classifies (R9-1); both
pinned by fixtures.
- The PR-footprint manifest arm answers aliveness and membership from
refs (origin/<branch> / merge base), never the round's on-disk tree —
a PR-added workspace a round later deletes keeps its footprint class
instead of walling the deletion (R9-3).
---------
Co-authored-by: verify <verify@local>
|
||
|
Shaojin Wen
|
22bacfe249
|
feat(autofix): escalate a non-converging diff to a maintainer handoff (#9104)
#8981's growth brake trims non-Critical feedback once a window's diff grows past budget, but when the growth is Critical-driven (a complex feature whose every fix opens the next fail-open gap the reviewer then flags — e.g. PR #8777, 8 rounds, 13k additions) Critical-only cannot help: the Criticals ARE the growth, so the diff keeps climbing and the agent keeps patching. Two additions on the autofix side: - Feed the growth trajectory to the agent. feedback.md now opens with a "Diff growth this window" section (net src/test vs budget + how many prior rounds were over budget) whenever growth is measured, telling the agent to prefer minimal/subtractive fixes and to read a rising trajectory as a signal to escalate for a split, not add another guard. - Detect divergence and hand off. A new per-round autofix-growth-now marker records each round's growth + over-budget flag; prepare reads the window's history and, once the brake has been over budget for >= GROWTH_DIVERGENCE_ROUNDS prior rounds (default 2, tunable) AND the diff has not shrunk from its worst, injects a "Needs a maintainer's decision — this PR is not converging" block. It is framed as a defer-to-human item, so the address run stops BLOCKED with a handoff (split / accept core + track the tail / redesign) instead of patching again. A diff that is over budget but shrinking, or a one-off overshoot, stays in ordinary Critical-only. SKILL.md documents both blocks. Contract tests pin the knob, run the extracted divergence detector against fixture history (climbing → diverged, shrinking → not, sub-threshold → not, wrong-window → not), and assert the growth-now marker is written on both report paths. |
||
|
Shaojin Wen
|
b286875e72
|
fix(review): harden the pipeline against four live-run failures (#9086)
* fix(review): harden the pipeline against four live-run failures
Measured on three parallel PR reviews (qwen3.8-max, 2026-08-13, PRs
#9013/#9014/#9045) run via `qwen review run`:
- run.ts: pin the composed-verdict and report scans to the run's own
target. The generic newest-composed scan captured a concurrent run's
artifact — two of the three runs republished a neighbour PR's verdict
(one reported REQUEST_CHANGES for a review whose own report said
Comment). Also keep re-reading while the child runs: a coverage
re-check legitimately recomposed a verdict 12 minutes after the first
write, and the first-snapshot capture would republish the superseded
one.
- budget.ts: drop placeholder gaps whose completion word carries a
trailing budget adverbial. Three "none — all checks … completed
within budget" non-answers reached two posted bodies because the
completion idiom required the completion word to end the text.
- coverage.ts: label a non-chunk agent by the brief codename found
anywhere in its launch prompt. Launchers prepend context lines, so the
first-line label gave twelve finders one shared PR-summary sentence,
and every budget-gap disclosure rendered as the same truncated PR
quote instead of a name.
- copy_bundle_assets.js: emit dist/cli.js with a shebang and the execute
bit. shellContextEnv blanks a QWEN_CODE_CLI a POSIX shell cannot exec,
so every review subcommand issued from a session launched off the
bundle silently fell back to the PATH's global install — all three
runs executed the machine's auto-updated release instead of the tree
they were launched from.
* test(review): follow the codename label into compose-review's fixtures
The backtick-collapse fixture's first line was itself the brief codename
shape, so the new codename extraction labels it `agent security` and the
first-line assertion no longer holds. Keep the sanitization intent on a
prose-only first line, and pin the codename behaviour — a prepended
context line must not reintroduce the shared-PR-quote label — as its own
case.
* fix(review): classify the run target with the child's own parser
Review feedback on the target pin: prNumberFromTarget re-derived PR
classification with a narrower regex than parse-args — /pull/<n>/files
URLs went unpinned, 0042 pinned pr-0042- while the child writes pr-42-,
and docs/pull/42 pinned a file target as a PR — so a completed (and
posted) review could be reported as one that produced no verdict.
Delegate to parseReviewArgs, whose verdict is what the child names its
artifacts from, and pin the divergent shapes as tests.
Also gate the bundle's shebang/exec-bit block with a package-assets
case (mode asserted off-win32, double-run must not stack shebangs), and
document the accepted same-target residual race on composedPatternFor.
* fix(review): pin run artifacts by exact target identity, share the identity-line parser
Round-2 review feedback, all six findings:
- run.ts: replace name-shape pins with the exact composed filename each
target class produces (pr-<n> / file basename / the fixed 'local' token,
per the skill's --out template). The (?!pr-\d+-) lookahead rejected a
file run's own artifact whenever the reviewed file was named
pr-<digits>-…, the PR branch's .* wildcard claimed that same artifact,
and the pooled null class let concurrent file and no-target runs
cross-capture each other's verdicts. Target classification now comes
from classifyRunTarget (parse-args' verdict, basename for files).
- run.ts: newestArtifactSince returns {path, mtime}, so the capture poll
reuses the scan's own stat instead of re-statting the path — the
scan-vs-sweep window (and its untestable catch branch) is gone
structurally.
- lib/agent-identity.ts: one parser for the identity line agent-prompt
bakes into every launch, shared by cost-ledger's row labels and
coverage's disclosure labels — the two hand-rolled copies could drift,
and coverage's copy dropped the (round N) and owned-file suffixes,
folding reverse-audit rounds into indistinguishable disclosure lines.
cost-ledger still feeds it only the first line (quoted identity lines
below must never be credited); coverage scans for the first
line-anchored identity line (launchers prepend context lines).
- lib/budget.ts: one vocabulary for the budget-idiom family — 'below'
joins the completion tail's position words, and the stayed idiom takes
the same qualifiers ('stayed inside the tool-call budget').
- run.test.ts: handler-level assertion that the report scan is pinned
(a strictly newer neighbour report must not become this run's
reportPath), alongside the pattern-level cases for every shape the
review probed.
* fix(review): round-3 review polish — CRLF identity lines, producer-side no-gap rule, edge-case pins
- agent-identity: tolerate a trailing CR (CRLF-recorded prompts fed
through \n-splitting callers failed every parse and fell back to
first-line prose); scan the launch prompt with one multiline match
instead of materializing a line array per agent record; pin the
round-over-file precedence with a both-suffixes test.
- agent-prompt: state the no-gap rule at the producer — write NO
'Budget gap:' line when nothing was cut short — instead of leaving
each agent to improvise a 'none' phrasing the consumer-side
placeholder filter must chase forever.
- run.ts: strip trailing path separators before taking a file target's
basename (a tab-completed 'src/' pinned 'qwen-review--composed.json',
which no child artifact carries — fail-closed exit 1 on a completed
review); pin file-run reports by their filename slot so a file named
'pr-1234.md' claims its own report; document the two collision
classes the basename-keyed pin defines (same-basename files,
basenames spelling 'local'/'pr-<n>').
- budget.test: pin the parenthesis-form exception keep case beside the
dash form.
* fix(review): round-4 polish — one budget vocabulary, named pin expectation, honest prompt claim
- budget.ts: spell the budget-position vocabulary once (BUDGET_QUALIFIED /
COMPLETION_TAIL) and build PLACEHOLDER_GAP_RE from it — the literal
carried three hand-copies that had already drifted twice in two review
rounds; the space-separated 'tool call' form is pinned in both branches.
- agent-prompt.ts: the no-gap rule now states what actually happens to a
'none' disclosure — at best filtered, and any unrecognized wording is
published as a phantom coverage gap — instead of claiming the parser
treats it as a gap, which was the negation of the filter shipped beside
it.
- run.ts: derive the composed pin from composedNameFor and name the
expected filename in both the no-verdict prose and the JSON result
(expectedComposedName) — a naming drift between the pin and the skill's
template was undiagnosable once Step 9 swept the near-miss.
- compose-review.ts: publicAgentSubject's provenance note now describes
the codename labels coverage prefers, with first-line prose as the
fallback.
* test(review): guard the no-verdict diagnostic and the pinned capture; align the chunk-role grammar
- run.test.ts: assert the no-verdict report names the artifact it waited
for, in prose and as expectedComposedName — mutation-verified: dropping
the suffix now fails.
- run.test.ts: force the neighbour's composed artifact strictly NEWER in
the concurrent-run fixture. With it older, an unpinned newest-composed
scan landed on the right file anyway and the regression passed;
mutation-verified: reverting composedPatternFor to the generic scan now
fails the handler test, not only the pattern units.
- agent-identity.ts: CHUNK_ROLE_RE takes coverage's CHUNK_RE shape
(whitespace-tolerant, case-insensitive) so a hand-edited 'Chunk 3 of 7'
cannot resolve as a chunk owner in the posted body and a role agent in
the ledger row.
* fix(review): keep the bundle's write time across the shebang rewrite; hold the pins to the skill
Round-6 review feedback, all five findings:
- copy_bundle_assets.js: preserve dist/cli.js's atime/mtime across the
shebang rewrite. stampReviewSourceDigest reads that mtime as the build
time, so a bumped one certifies a bundle as newer than review sources
edited before it and the staleness warning the skill's Step 0 stops on
never fires. A full bundle stamps before reaching here, but a
standalone run of this script — a flow the gate's own comment
contemplates — was exposed.
- package-assets.test.js: pin both halves the block owes. The mtime is
asserted against a fixture built 60s in the past, and the second run
now arrives at mode 0644 so the exec bit must be re-set — demoting the
chmod inside the shebang guard previously stayed green.
- run-skill-parity.test.ts: new. composedNameFor and reportPatternFor
encode the bundled skill's Step 6 --out template and Step 8 report
stems, and were pinned only against self-referential literals. This
reads the templates out of SKILL.md and renders them per target class,
so a skill-side edit fails next to the code that must follow it
instead of silently in a later review.
- cost-ledger.test.ts: pin the first-line-only invariant — a launch
whose prepended context sits above the identity line keeps the
transcript's own id, never a label lifted from below. Consolidating
both callers on labelFromLaunchPrompt now fails.
- agent-identity.test.ts: assert the two entry points genuinely differ
on that prompt, so neither caller's policy can be collapsed into the
other unnoticed.
* fix(review): stop the mtime assertion from pinning libuv's timespec truncation
The assertion compared the recorded mtime against the Date handed to
utimesSync, so it also pinned libuv's double-seconds → timespec
conversion: about half of all millisecond values read back 1 ns low
(X - 0.001), and builtAt is a fresh Date.now() - 60_000 every run — a
~50% coin flip that would have landed intermittent reds on unrelated
PRs through test:ci.
Capture what the filesystem actually recorded after the setup and
compare against that; the invariant under test is only whether the
shebang rewrite moves the stored time. 10/10 green through the CI entry
point, and it keeps its teeth: removing the production
fs.utimesSync(cliEntry, atime, mtime) restore fails it 3/3.
|
||
|
易良
|
6e21f72f57
|
fix(autofix): hold autofix rounds while review-pr is in flight (#8899)
* fix(autofix): hold rounds while review-pr is in flight (#8888) * fix(ci): harden autofix review-in-flight gate * fix(ci): ack deferred review fallback runs * fix(ci): hold only cancelable automatic reviews in the gate (R2-1) * fix(ci): bound review run fallback * fix(ci): gate infra reruns behind review liveness |
||
|
易良
|
fb6637f0d3
|
chore(ci): Add security hygiene: CODEOWNERS for release workflows, least-privilege permissions, security checks and Scorecard (#9008)
* chore(ci): add security hygiene: CODEOWNERS for release workflows, least-privilege permissions, security checks and scorecard workflows * chore(ci): pin TruffleHog scanner version and drop invalid path input * fix(ci): close security workflow review gaps * fix(ci): fail package audit on install errors * test(ci): pin security workflow guardrails * fix(ci): pin security workflow test assertions for SHA refs, status edges, and push trigger * test(ci): pin security workflow edge guards * test(ci): pin security workflow contracts * test(ci): pin secret-scan push guard * fix(ci): quote secret-scan condition * fix(ci): audit workspace package locks directly * fix(ci): scope security checks concurrency * docs(ci): explain mobile audit skip * test(ci): link trufflehog version pin |
||
Michael Yochpaz
|
60c338f144
|
fix(install): avoid Get-FileHash for Windows checksums (#9112)
* fix(install): avoid Get-FileHash for Windows checksums * refactor(install): simplify Windows checksum verification * test(install): require checksum resource disposal |
||
|
易良
|
8e0033d64d
|
fix(ci): reduce ENOSPC and load-sensitive test flakes (#8982)
Some checks failed
E2E Tests / E2E Test (Linux) - sandbox:docker - shard 1/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:docker - shard 2/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:docker - shard 3/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none - shard 1/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none - shard 2/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none - shard 3/3 (push) Waiting to run
E2E Tests / E2E Test - macOS - shard 1/2 (push) Waiting to run
E2E Tests / E2E Test - macOS - shard 2/2 (push) Waiting to run
E2E Tests / channel-plugin E2E (nightly) (push) Waiting to run
E2E Tests / cron-interactive E2E (nightly) (push) Waiting to run
E2E Tests / web-shell Browser Regression (push) Waiting to run
SDK Java / ubuntu-latest / Java 11 (push) Waiting to run
SDK Java / ubuntu-latest / Java 17 (push) Waiting to run
SDK Java / macos-latest / Java 21 (push) Waiting to run
SDK Java / ubuntu-latest / Java 21 (push) Waiting to run
SDK Java / windows-latest / Java 21 (push) Waiting to run
SDK Java / Real daemon E2E / Java 11 (push) Waiting to run
npm cache producer / Save npm cache (push) Has been cancelled
* fix(ci): deflake the idle-watchdog env-parse script test
The test spawned three full agent subprocesses (~10s of wall time) to
pin a parse guard that is read once at module load. Under load spikes
on the shared self-hosted runner pool, one of those spawns failed or
stalled, failing CI at random (e.g. run 31556596385); the assertion
also discarded the script's failure.md, hiding the cause.
Collapse it to one run with the nastiest value (-1) — any armed
instant-true window kills the healthy stub agent at the first idle
tick — and assert on {status, failure} so a future flake names its
cause. Add retry: 2 to the script-test vitest config for the
remaining load-sensitive spawn tests; a real regression fails every
attempt.
* fix(ci): size test thread pools to the machine and retry load flakes
test:ci runs every workspace in parallel, and the cli/core suites each
pinned a fixed 8-16 thread pool regardless of the machine — on a 4-core
hosted runner that is an 8x oversubscription before any neighbor job
exists, and the shared self-hosted hosts run several registrations at
once. The contention is what blows the 15s ceilings those configs
already complain about: tests that pass locally in milliseconds time
out, and vitest workers lose their RPC under the pile.
Size the pools to os.cpus() (capped at the old fixed values so large
machines lose nothing) and add retry: 2 for the residual load spikes a
real regression still fails through every attempt of.
* fix(ci): restore the 0-boundary probe and right-size the deflake comments
Review feedback: the single -1 run could not catch a > 0 → >= 0
boundary edit (0 is the operator's documented disable sentinel and
would arm a zero-length window), and the comments overstated what the
run and the retry guarantee. Probe-verified: a >= 0 mutant now fails
the idleMs: 0 arm with the value named in the assertion diff. Two
short runs still halve the old three-run spawn volume. Reword the
retry comments to claim only deterministic regressions fail every
attempt.
* fix(ci): remove dead pool-resizing config and pin idle-timeout guard
The poolOptions.threads changes had no effect because vitest 3 defaults
to pool: 'forks', making minThreads/maxThreads inert. Revert to the
original fixed 8-16. The script-test deflake (idle-watchdog improvements,
retry: 2) is kept. Add a source-text pin for the Number.isFinite guard
in run-agent.mjs, covering the non-numeric class that subprocess-based
tests cannot exercise.
* fix(ci): capture the transient ENOSPC and shrink the manifest suite's inode hold
ENOSPC failed the Test step mid-suite on two different self-hosted
machines (actions-runner-test-22, actions-runner-test-11) in ~20s
bursts — 132 of 147 errors were mkdtemp failures — while the hosts
look healthy afterwards, so a post-mortem df finds nothing. Two
changes:
1. Sample /tmp space and inodes every 10s during the test step and
dump the full df state when it fails, so the next occurrence
records whether inodes or a tmpfs cap is what exhausts.
2. The manifest-repository-context suite held every 16k-file fixture
tree until afterAll (~164k live inodes for the whole file); tear
down per test instead so at most one tree is live at a time,
removing the suite's own spike contribution either way.
* test(ci): pin the idle-timeout parse guard's source text for the NaN class
A healthy-agent run can never pin the non-numeric rejection class: a
NaN window never satisfies the >= kill comparison, so no run shape
fails on it. Pin the guard expression itself in the runner source
instead (this file's existing source-text pin style), and rename the
test to claim only the non-positive classes the runs actually pin.
* fix(ci): sample available memory alongside the ENOSPC diagnostics
The hosts' disks are verifiably not full, so byte exhaustion is out.
ENOSPC on a healthy disk points at a memory-backed limit instead: a
tmpfs /tmp or a job cgroup ceiling fails tmpfs writes with ENOSPC
while host memory is spiked by concurrent jobs, and clears within
seconds once they finish — matching the ~20s failure bursts. Sample
MemAvailable every 10s and dump /proc/meminfo on failure so the next
occurrence separates memory from inodes.
* fix(ci): limit retries to script tests
* fix(ci): route test temp files to the runner's disk-backed temp area
The ENOSPC bursts hit a host whose disk is verifiably not full, which
points at a memory-backed limit on /tmp (tmpfs mount or cgroup ceiling)
under concurrent-job memory spikes. Export TMPDIR=$RUNNER_TEMP for the
test step so mkdtemp traffic lands on the per-registration disk area
instead of the shared /tmp — curing the tmpfs case outright and also
stoping temp state from mixing across the several runner registrations
on one host. The sampler now reports the effective TMPDIR's filesystem.
* test(core): support long temporary workspace paths
* fix(ci): keep routed temp paths socket-safe
* fix(ci): use real short Linux temp paths
* test(ci): remove remaining teardown races
* test(ci): harden temp routing regression
* test(ci): stop leaked server reconcilers
* fix(ci): clean up test sampler reliably
* fix(review): keep skill context within manifest bounds
* test(web-shell): wait for image ingestion completion
* test(cli): avoid timed status line module import
* test(ci): remove remaining load-sensitive waits
* fix(ci): cap test forks on shared runners
* fix(ci): keep temp cleanup from failing tests
---------
Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>
|
||
|
Shaojin Wen
|
5a6452a2a5
|
fix(ci): make autofix verification gates hermetic to runner git config (#8961)
* fix(ci): make autofix verification gates hermetic to runner git config A leaked global exec knob on the persistent pool (run 31516789251: diff.external=global-driver in the runner user's ~/.gitconfig) failed four per-hunk probe tests in packages/cli on #8613. The rejection was charged to the round (package tests are A/B-exempt), which burned the 18-minute repair on a failure no repair can reach and ended the round as a timeout — attempt 4 of the failure window, with nothing pushed. Three layers against that class: - Both verification gates (the review script and the issue-fix inline twin) now export a per-run throwaway GIT_CONFIG_GLOBAL (seeded with the workspace safe.directory) and GIT_CONFIG_SYSTEM=/dev/null before their first git command, so every check they spawn — vitest fixture repos included — is hermetic to the host, and a branch-authored `git config --global` dies with the run instead of poisoning the next one. - The sanitize step (all three byte-identical copies) now also scrubs the runner USER's global config — denylist of the command-execution families only, so infra-owned routing/credential keys survive. This self-heals the live pollution on the affected runner on its next job and removes (not merely bypasses) a planted global core.hooksPath. - test-efficacy.integration.test.ts gets the same GIT_CONFIG_GLOBAL / HOME isolation as git.integration.test.ts: the code under test pins --no-ext-diff, but the test scaffolding's plain `git diff` did not, so a hostile user git config could fail the suite anywhere. Contract tests pin the gate redirects (before the first git command, truncated per run) and functionally run the extracted scrub pipeline against a poisoned fixture config, asserting the kept/removed sets. * fix(ci): widen the config scrub and re-sanitize before PAT-bearing steps Address the #8961 review findings (2 Critical, 8 Suggestions across two reviews), all probe-verified by the reviewers: - Denylist regex: subsection slots are .+ (git subsection names may contain dots — diff."a.b".command flattened past [^.]+), and the missing exec families are added: gpg.(*.)program, pager.*, interactive.diffFilter, difftool./mergetool., remote.*.uploadpack/ receivepack. The functional fixture now covers every alternation plus dotted subsections, non-exec/corrupt/missing-config arms pin the two load-bearing '|| true' guards. - The global scrub moved above the .git early-exit: host hygiene owes nothing to the workspace existing. - New resanitize-git-config.sh (staged from the trusted base) re-runs the local allowlist sweep and the global denylist scrub at the top of both PAT-bearing git steps — the gates run branch test code on the host after the job-start sanitize, and the env redirect is not a filesystem boundary. Contract tests pin script/step lists equal, the staging in both jobs, the call-before-credential ordering, and run the script functionally against planted local+global keys. - All three one-shot credential helpers lead with -c credential.helper= (empty resets the helper list; the first helper to answer wins, so a planted one must never run first). Count-pinned in the contract test. - comment-status.integration.test.ts gets the same git-config isolation as its siblings; test-efficacy gains an isolation tripwire test that goes red if the redirect is removed, instead of only on hostile hosts. - Comment fixes: the copies are cross-referenced as contract-test-pinned, and the system-config bypass is documented in both gates. * fix(ci): close the XDG/env/transport bypasses around the config scrub Address the #8961 round-2 review findings (5 Critical + 8 Suggestions, probe-verified by the reviewers; the XDG listing gap independently reproduced on git 2.55): - The global scrub sweeps BOTH files of the global scope: with ~/.gitconfig and $XDG_CONFIG_HOME/git/config both present, `git config --global` lists/unsets only the former, so keys planted in the XDG file survived every copy. The scrub is now a loop that redirects GIT_CONFIG_GLOBAL at each file in turn. - Denylist adds url.*.insteadOf/pushInsteadOf (transport rewrite of the PAT push/fetch; rest of url.* stays) and http.*.sslVerify/sslCAInfo (turns a kept http.proxy into a TLS-terminating interceptor); the three PAT helper chains lead with -c http.sslVerify=true. - The staged resanitize script's provenance holds at cp time only — RUNNER_TEMP is writable by the branch code that runs in between — so the staging steps record its sha256 in GITHUB_OUTPUT and the PAT steps verify before executing. - Both gates and both PAT steps export GIT_CONFIG_COUNT=0: GITHUB_ENV-injected GIT_CONFIG_KEY/VALUE entries apply at command-line precedence and outrank every file-level guard. - Gates emit a ::notice when /etc/gitconfig exists (bypassed by the redirect — replicate needed settings via per-job env). - Tests: the scrub's functional harness drives HOME/XDG fixtures and covers the new families; the resanitize run plants worktree-scoped config (deleting the rm -f line previously stayed green); the gate redirect block is executed against a hostile HOME and an env-planted GIT_CONFIG_* key; the isolation tripwire pins the NOSYSTEM leg and probes system-scope leakage. - The process-env git isolation pattern is extracted into isolateHostGitConfig() in review/lib/test-utils.ts and adopted by all five suites that duplicated it; comment-status gains the same tripwire. * fix(ci): take PAT git steps off host scopes and close the env channels Address the #8961 round-3 review (5 Critical + 6 Suggestions, probe-verified by the reviewer): - Both PAT-bearing steps now run fully hermetic, same shape as the gates: a per-run throwaway GIT_CONFIG_GLOBAL + GIT_CONFIG_SYSTEM= /dev/null, so a concurrent job rewriting the shared ~/.gitconfig in the sweep->push window (max-parallel, one HOME across ~27 runner registrations) can no longer steer the push, and a URL-scoped sslVerify=false there can no longer override the -c pin. Both steps and both gates also strip the git ENV channels that outrank file config: GIT_CONFIG_PARAMETERS, GIT_SSL_NO_VERIFY/CAINFO, GIT_PROXY_COMMAND, GIT_EXEC_PATH, GIT_DIR/WORK_TREE, GIT_ASKPASS, GIT_SSH/_COMMAND, plus GIT_CONFIG_COUNT=0. - The push-race salvage merge runs -c commit.gpgsign=false: a global commit.gpgsign=true with no key would exit 128 and be misread as a content conflict, discarding a verified round (R2-10). - The maintainer-fork fetch, the one PAT-bearing network site the round-2 rollout skipped, leads with -c http.sslVerify=true -c credential.helper= (anonymous; public fork heads need no auth, so it fails closed on a 401 instead of feeding a planted helper the PAT). - Denylist widens protocol.ext.allow to protocol.(ext.)?allow (the top-level fallback policy arms ext:: too) in all four copies. - Tests: the two PAT hermetic blocks and the two gate blocks are pinned equal; the sha256 verify line is pinned verbatim and asserted to carry no bypass; the resanitize fixture plants a live XDG exec key (drops of the loop's XDG leg now fail); the gate redirect functional exec adds the env-channel unsets; diff-plan adopts isolateHostGitConfig (sixth suite) keeping its GIT_TERMINAL_PROMPT delta; comment-status tripwire gains the GIT_CONFIG_GLOBAL assertion. * fix(ci): pin PATH, seal repo-redirect and env channels, harden all PAT sites Address the #8961 round-4 review (6 Critical + suggestions, probe-verified by the reviewer): - PATH is pinned to a value the stage step records before any branch code runs, and LD_PRELOAD/LD_AUDIT/LD_LIBRARY_PATH are dropped, at the top of every PAT step and both gate steps — a $GITHUB_ENV-planted PATH or preload would otherwise swap the git/sha256sum/bash the digest gate itself runs on. - The Prepare step (PAT-bearing, previously unhardened) now takes the same hermetic preamble as the push steps; all three PAT preambles are pinned identical by the contract test. - The throwaway global config is created with mktemp, not a fixed literal path a same-user watcher could re-plant into after the seed. - The env-strip list gains GIT_ALLOW_PROTOCOL (env twin of protocol.allow), GIT_COMMON_DIR / GIT_OBJECT_DIRECTORY / GIT_ALTERNATE_OBJECT_DIRECTORIES / GIT_SHALLOW_FILE (repo-redirect twins), across all PAT and gate copies; the salvage/fork fetches carry -c fetch.recurseSubmodules=false -c protocol.ext.allow=never so a planted submodule cannot execute an ext:: URL with the PAT. - resanitize removes .git/commondir and .git/shallow (the file twins of GIT_COMMON_DIR/GIT_SHALLOW_FILE), and Push-and-report refuses to push a HEAD that is not the gate's recorded verified_head — closing the repo-redirect path that pushed attacker content. - The gate runner (run-autofix-review-verification.sh) is now digest- verified before both gate passes, like resanitize already was: the branch runs its own build/test between the passes, so an unverified copy would let it define its own verdict. - Contract tests pin every new surface: the three identical PAT preambles, the full unset var set, the mktemp path, the trusted-PATH wiring, the two gate-runner digest checks, the recurse/protocol pins, the HEAD==verified_head guard, and the commondir/shallow removal. * fix(ci): pin gh env channels, harmonize allowlist subsection slots Round-4 follow-ups: - Pin GH_HOST=github.com and unset GH_TOKEN/GH_ENTERPRISE_TOKEN/ GH_CONFIG_DIR before the first gh call in all three PAT steps, so a $GITHUB_ENV-planted GH_HOST cannot spoof the identity check and a planted GH_TOKEN cannot outrank the inline one. - Harmonize the local allowlist's remote/submodule subsection slots to .+ (matching the denylist comment and preventing a dotted-name remote from silently losing its url/fetch on every resanitize). * fix(ci): pin gh config dir and push the exact verified object Round-5 closable findings before landing: - R5-7: pin GH_CONFIG_DIR to a fresh mktemp -d instead of unsetting it, so PAT-bearing gh calls no longer fall back to the attacker-writable ~/.config/gh (whose config.yml can carry http_unix_socket and other transport reroutes) on the shared HOME. - R5-8: push the exact verified commit object (PUSH_SHA:refs/heads/...), not symbolic HEAD which the push would re-resolve — closing the check-then-use race the verified-HEAD guard was added to close. PUSH_SHA is pinned to VERIFIED_HEAD under the guard and re-pinned to the merge result after each salvage merge. The remaining round-5 Criticals (BASH_ENV/BASH_FUNC_* and LD_PRELOAD executing at step-shell startup before any unset runs; GITHUB_OUTPUT writable by gate-run branch code) are not closable from inside a Actions step — they require runner-level isolation and are tracked as a follow-up. |
||
|
Shaojin Wen
|
9d55fab5f8
|
feat(autofix): brake review-round diff growth with per-window src/test budgets (#8981)
Some checks are pending
E2E Tests / E2E Test (Linux) - sandbox:docker - shard 1/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:docker - shard 2/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:docker - shard 3/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none - shard 1/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none - shard 2/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none - shard 3/3 (push) Waiting to run
E2E Tests / E2E Test - macOS - shard 1/2 (push) Waiting to run
E2E Tests / E2E Test - macOS - shard 2/2 (push) Waiting to run
E2E Tests / channel-plugin E2E (nightly) (push) Waiting to run
E2E Tests / cron-interactive E2E (nightly) (push) Waiting to run
E2E Tests / web-shell Browser Regression (push) Waiting to run
npm cache producer / Save npm cache (push) Waiting to run
SDK Java / ubuntu-latest / Java 11 (push) Waiting to run
SDK Java / ubuntu-latest / Java 17 (push) Waiting to run
SDK Java / macos-latest / Java 21 (push) Waiting to run
SDK Java / ubuntu-latest / Java 21 (push) Waiting to run
SDK Java / windows-latest / Java 21 (push) Waiting to run
SDK Java / Real daemon E2E / Java 11 (push) Waiting to run
* feat(autofix): brake review-round diff growth with per-window src/test budgets Managed PRs bloat while still under the round threshold: #8853 grew from 315 to 1393 net lines in four bot rounds (86% of the growth was test lines; one 'harden per review feedback' round alone added 609), and #8276 grew ~2700 net lines under management. Every push regenerates review suggestions, and every window re-arm reopens the five suggestion-capable rounds, so the round-based Critical-only brake never binds on the size dimension. The prepare step now measures the branch's net diff vs the merge base, split into test lines (*.test.* / *.spec.* files, __snapshots__/, test-utils/, integration-tests/) and source lines, anchors a per-counting-window baseline marker (autofix-growth-base, first-wins, riding the window's first report comment like autofix-redcheck), and engages Critical-only mode early once either dimension outgrows its budget (vars.QWEN_AUTOFIX_GROWTH_BUDGET_{SRC,TEST}_LINES, default 400). Two budgets rather than one because the measured bloat concentrates in tests; a single budget cannot be tightened on tests without strangling source fixes. The deferral preamble names the actual cause, and /retry or re-engaging takeover re-anchors the baseline with the fresh window. Critical findings, Request changes reviews, in-budget maintainer feedback, failed checks, and conflict resolution flow exactly as before. * feat(autofix): exclude mechanical churn from the growth measurement Lockfiles (root and nested package-lock.json, npm-shrinkwrap.json) and the regenerated settings schema arrive hundreds of lines at a time from a single command and are skimmed rather than reviewed, so counting them would burn the source budget on churn that carries no review burden. The exclusion list names generated artifacts exactly — a broad glob would silently exempt hand-written files from the budget. The fixture test now proves a root lockfile ('**/' glob-magic at depth zero), a nested one, and the exact schema path all stay out of the measured nets. * fix(autofix): harden growth-brake measurement per review round - Anchor the baseline marker under the window key prepare READ it with (LIVE_REARM_KEY), not the matrix WINDOW: supersede-exempt conflict rounds could write the live window's first marker under a dead key, letting the round's pushed growth escape the budget for the window. - Apply GENERATED_EXCLUDES to the test-side measurement too: a lockfile under integration-tests/ would otherwise be excluded from NET_TOTAL but counted in NET_TEST, corrupting the NET_SRC subtraction. - Count __tests__/ as test code, matching AGENTS.md's triage rule and repo-hygiene's PROD_EXCLUDE; suffix-less helpers there were charged to the source budget. - Reject zero-padded budget values in the sanitize guard: [[ -gt ]] parses them as octal ('0400' brakes 144 lines early, '0900' silently disables the brake). - Render signed growth values without a hardcoded '+' ('+-120' read like a misfire in the cause preamble, both languages). - Fail open to zero when the three-dot diff has no merge base (orphan- history branches via fork takeover/adoption), mirroring the merge-tree conflict probe's fail-open. - Retry the report post (3 attempts): that one comment carries the round's entire persisted state — watermark, round, redcheck head, and now the growth baseline — and the push has already landed by then. - Behaviorally replay the sanitize fallback and the cause construction (three engagement shapes, both languages, sign rendering) instead of text-pinning them; extend the measurement fixture with a __tests__ helper and a lockfile under a test directory. * fix(autofix): close the round-2 review findings on the growth brake - Spell the growth marker's window field key= instead of win=: the same report comment can legitimately carry a different window key than its autofix-eval marker (supersede-exempt conflict round after a re-arm), and three censuses attribute comments to windows by the whole-body substring win=<key> -->, which would double-attribute that comment to both windows (probe-flipped PRIOR_TIMEOUTS, WIN_HEADS, PRIOR_HEADS). A distinct token immunizes every such census without touching them. - Make the deferred preamble's batch-budget sentence conditional: the OVER_BUDGET census only builds spans in round-brake territory, so a growth-only engagement below the threshold now states that maintainer feedback flows unaffected instead of promising accounting the census cannot produce. - Special-case the report-post retry's final attempt: no trailing 'retrying' + 10s sleep before giving up. - Include __tests__/ in the env comment's test-line enumeration (the tunables doc must match the pathspec). - Replay coverage for everything the mutation probes showed unpinned: the baseline wiring block (parseable/empty/malformed baselines), the no-merge-base fail-open (0/0/0 under -eo pipefail with the origin ref deleted), the report-post retry (single post on success; exactly three attempts, 'giving up', exit 1 on outage), the writer→scanner marker round-trip (negative src rendered from the real template and parsed back), and the budget-sentence branches in both languages. * fix(autofix): close the round-3 growth-brake findings - Invalidate growth anchors older than the latest stale-base auto-update: the update merges main into the branch and moves the merge base the nets are measured against, so an earlier anchor is no longer comparable — the next round re-anchors at the post-update size instead of misattributing overlap-resolution deltas to review growth. - Pin the merge-base (three-dot) semantics: the measurement fixture now advances main past the divergence, so a two-dot regression changes the expected numbers instead of shipping green. - Pin the sanitize guard's 7-digit cap (9999999 accepted, 10000000 falls back): past it bash integer literals wrap at 64 bits. The census-side hazard (whole-body win= attribution vs multi-key comments) is declined for this PR with the invariant documented at the scanner: the growth marker's key= token cannot match any win= census, and hardening the three censuses to positional attribution is queued as its own change. * fix(autofix): skip growth measurement when a managed fork head is named main Prepare's fork path re-points refs/remotes/origin/main at the fork head for a fork:main PR, so the three-dot measurement would compare the branch against itself and report 0/0 every round — silently disabling the brake while appearing to run. Unmeasurable is unmeasurable: skip and say so, matching the no-merge-base fail-open. * fix(autofix): treat an unmeasurable diff as a state, not zero nets Zero-substitution anchored a bogus 0/0 baseline on the window's first round (and manufactured phantom growth against an existing anchor). NET_MEASURED now gates the whole brake: no anchor written, no growth computed, no engagement — for both the no-merge-base and fork-head- named-main cases, which are replayed with the skip line and flag asserted. * fix(autofix): close R6 — shadowed-base guard, loud unmeasured skip - A local head branch literally named 'origin/main' shadows the remote ref in rev disambiguation, so the measurement would silently self-compare with NET_MEASURED still true — guard it alongside 'main'. - The unmeasured state now announces itself instead of printing the same 0/0 line as a genuinely empty PR. - SKILL: the batch-budget sentence is scoped to round-threshold engagements, matching the workflow's cause-aware preamble. R6-1 (.gitattributes steering numstat) is declined in-thread: the brake is takeover-quality tooling on the accountability axis — a collaborator with push access holds overt equivalents (removing the label), and a .gitattributes flip is itself a visible diff. --------- Co-authored-by: verify <verify@local> |
||
|
易良
|
f159100c8e
|
chore(deps): bump sharp to ^0.35.0 to resolve GHSA-f88m-g3jw-g9cj (#8952)
* chore(deps): bump sharp to ^0.35.0 to resolve GHSA-f88m-g3jw-g9cj * chore(vscode): regenerate NOTICES.txt for sharp 0.35 bump * fix(scripts): read sharp pin from core package.json to prevent drift The published CLI's sharp version was hardcoded in prepare-package.js, which drifted from the workspace dependency on every bump. Read it from packages/core/package.json so the publish pin always matches the declared dependency. Add a test assertion to catch future drift in CI. * fix(scripts): read sharp pin from package-lock.json instead of core package.json range The previous approach read the sharp version from packages/core/package.json (which has ^0.35.0) and stripped the caret, producing 0.35.0. This is the range floor, not the lockfile-resolved version (0.35.3). Read from package-lock.json so the published CLI ships the same version CI tests. * fix(scripts): pin published sharp to core resolution Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(scripts): validate sharp pin against core manifest and add hoisted fallback test - Align the lockfile reader with the sibling pattern in build-standalone-release.js: validate the resolved version against packages/core's declared sharp range - Wrap the lockfile read in try/catch so a missing or malformed file surfaces a clear error instead of an opaque ENOENT/SyntaxError - Add a test for the hoisted fallback path (node_modules/sharp) that actually executes in the current production release - Add a comment explaining why sharp is exact-pinned like all other native optional deps in the published manifest * fix(scripts): accept compatible sharp lock versions --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> |
||
|
易良
|
ca44971815
|
fix(ci): cache downloaded linters on ECS runners (#9001)
* fix(ci): cache downloaded linters on ECS runners * fix(ci): verify cached linter archives * fix(ci): make linter cache writes optional * test(ci): cover linter cache fail-closed paths * fix(ci): harden linter cache setup |
||
|
易良
|
464e8910e8
|
fix(desktop): harden release pipeline (#9009)
* fix(desktop): harden release pipeline * fix(desktop): resolve release hardening review |
||
|
易良
|
a32ec1ee4a
|
feat(desktop): add Aliyun OSS release mirror (#8976)
* feat(desktop): mirror releases to Aliyun OSS * fix(desktop): harden OSS mirror workflow and tests - Add ref guard to sync-desktop-to-oss.yml (dispatch only from main) - Add diagnostic error messages for missing Windows/Linux installers - Harden test: pin verify-index > 0 before ordering comparison - Harden test: pin confirm-before-publish ordering and source comparison - Add test: stable-only release validation in reusable sync job * fix(desktop): harden OSS mirror permissions, stable-version guard, and non-latest repair - Remove workflow-level actions:read; grant it only to the sync-oss caller job - Reject suffixed versions for published stable releases in prepare - Turn latest-feed comparison into a non-fatal check; condition publish/verify on match - Assert both check_for_update call sites in release test - Add jq stable-only guard assertion and endpoint default alignment test Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> |
||
|
Shaojin Wen
|
3a59332361
|
fix(ci): seed the dist-rebuild warning on every retryable A/B exit (#8958)
* fix(ci): seed the dist-rebuild warning on every retryable A/B exit The baseline leg rebuilds dist/ from baseline sources, and every retryable exit of the verify gate hands that tree to the repair agent — but the "run npm run build first" steering note only reached the green-baseline rejection. The comm -23 comparison failure and different-signature exits sent the repair agent in blind, free to trust or test against stale baseline artifacts (the different-signature exit carried the note on #8765's branch; the #8878 port kept it on the green exit only). #8765's post-close round-3 review flagged the comm path as Critical. Append the note on both missing exits and pin all three paths: the DIFFERENT-reason test now asserts the note, a new test stubs comm to fail and asserts the same, and the pre-existing test pins the note OUT of its document — no repair runs for that verdict. Mutation-tested, 3 of 3 caught: comm-path note dropped, different-reason note dropped, note leaked into the pre-existing document. * fix(ci): single emit point for the dist note, name the comm-failure exit Address the two review suggestions on #8958: - The steering note existed as three byte-identical copies, and the "every retryable exit seeds the note" invariant depended on copy-paste — the exact drift this PR was patching (one exit seeded on #8765's branch, one lost in the #8878 port). Both reviewers flagged it. The string now lives in seed_dist_note(), called from all three exits. - The comm-failure exit seeded the note but, unlike its sibling retryable exits, emitted no verdict-rationale line — an oncall could not distinguish "the comparison itself failed" from "baseline is green" without re-running the A/B. It now says so. Mutation-tested: mutating the string inside the helper fails all three path assertions at once; mutating the rationale line fails the comm-exit test. * test(ci): pin the no-identity baseline arm of the A/B gate (#8958) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> |
||
顾盼
|
2cff1e7ad3
|
fix(ci): restore Live Host release mirroring (#8917) | ||
|
Shaojin Wen
|
9946d13a35
|
ci: install tmux and zip tooling on the Linux test lane, and pin it (#8792)
* ci: install tmux and zip tooling on the Linux test lane, and pin it Two suites go quiet on a runner without their tooling. capture-tui's real-tmux block is `describe.skipIf(!hasTmux)`-gated, so on the hosted ubuntu image — which ships no tmux — every real-tmux behavior skips inside a green required check. The install-script packaging suite needs zip and unzip the same way. This installs both where apt exists, bounded (timeout-minutes) and advisory (continue-on-error absorbs the bound), so a stalled mirror or dpkg lock neither hangs the job toward its 60-minute cap nor reds the check. A step that silently stops installing is the same outage as no step at all, so it comes with a pin that reads the workflow the way bash does rather than the way it looks. The parser is quote-aware (a `#` inside a message is literal; a `;` inside one does not split statements), continuation-aware (only an odd run of trailing backslashes continues a line, and a comment never continues), and wrapper-aware (an apt-get behind sudo/env/nice/ timeout/time/nohup, with or without their options, or inside a subshell, is still an apt-get). On top of that it pins what actually keeps the step working: the if-condition whole (a one-character `&&`→`||` took the already-installed branch on a lane with zip but no tmux), the elif whole (a near-miss falsifier like `false2 &&` killed the install branch), the else fallback (deleting it removed the only signal on a lane with neither tmux nor sudo), exact package tokens (`powerline-tmux` is not tmux), the flags that make it work unattended (-y, sudo) and the ones that make it a no-op (-s, --download-only and friends exit 0 having installed nothing), that nothing may hard-fail the step in any errexit spelling or through a subshell exit, that every apt-get REACHES a `|| echo` guard (an AND-list is transparent, a pipeline or a `;` is not), and that every annotation reaches stdout unredirected with `:⚠️:` at line start — a workflow command the runner cannot see is just log noise. Split out of #8388, whose capture-tui command is what made the tmux half load-bearing. Each pin was mutation-verified against this workflow file. * test(ci): close the pin's own escapes, and give its bash model tests Thirteen findings on this PR, all against the pin rather than the step, and two of them were the pin being WRONG rather than weak — those matter most, because a pin that reds a legitimate edit is worse than one that misses. Wrong: the redirect check matched `>` anywhere in an echo statement, including inside the quoted message, so a semantics-preserving reword was rejected — exactly what this file says it must not pin. And the sudo requirement demanded literal `sudo apt-get` adjacency, which rejects `sudo -n apt-get`, the sibling workflow's own convention. Both now ask the question at the right level: quoted spans are blanked before any question about shell syntax, and "runs through sudo" is asked of the raw statement. Weak, each mutation-verified against ci.yml: `&>` was split as a separator, so `echo ':⚠️:…' &> /dev/null` tore into a clean echo and an unchecked redirect; apt's `-o APT::Get::Simulate=true` reached simulate mode through a door the token blacklist never saw; the package pin matched the whole logical line, so a package dropped from the install survived if its token appeared in the guard's message; `apt-get update` was required by nothing; `-y` and sudo were checked only on the FIRST install statement, and nothing kept a foreign command off the install's chain to short-circuit it; the step's `shell:` key — the one key that decides which interpreter parses the entire block — was unpinned; the closing `fi` was unpinned, so deleting it passed 5/5 while bash rejects the block and the step runs nothing; and the else branch's annotation was a substring check unanchored to any emitting command, so `: ':⚠️:…'` muted it. The ~180 lines of bash-semantics helpers are the ORACLE every pin reasons through, and they had no tests of their own. They do now — a table per rule, each rule traceable to a mutation that escaped an earlier version. Writing them corrected one of my own assumptions: `echo a \` + newline + `b` joins to `echo a b`, not `echo ab`, because the space before the backslash survives. Also corrected the rationale in both files: they asserted in the present tense that a real-tmux suite exists in this tree. It does not — it arrives with #8388, and the tmux half of this step is deliberately pre-landed for it. Saying so is the honest version. * test(ci): close the pin's remaining escapes, and finish its bash-model fixtures Four gaps survived the first pass, each probe-verified against the suite before the fix: - an always-failing `apt-get install` prefixed in the same && chain short-circuited the real install with every pin green, because every per-statement pin binds to a statement on the line and none sees the skip — now the step must carry exactly one install statement; - `apt-get update` could be deleted or moved behind the install — now it must exist AND precede the install in statement order; - `return` and `exec` were missing from the hard-fail blacklist, the same family as `exit`/`false` under the runner's `bash -e`: either leaves the required check green with nothing installed and not even the else-branch warning emitted (sandboxed verification's F1) — now blacklisted, with an end-to-end splice fixture pinning the axis; - the guard walker's operator alphabet still split on the `&` of `&>` although statementsOf no longer does, reddening a guarded `apt-get … &> /dev/null || echo` — both now share the exemption. Also finished the bash-model fixtures round one asked for: a quote spanning a newline, and `timeout -k 1 5 sudo …` wrapper stripping. Writing them exposed one oracle bug the round's own failure scenario had measured: `set -- -e` assigns positional parameters, it does not enable errexit — `--` now ends option parsing for the check. Mutation battery against ci.yml: the five escape mutants (prefixed install, return 0, exec true, update deleted, update reordered) all flip red; the five tolerated forms (sudo -n sibling, dropped --no-install-recommends, wrapper-wrapped update, &> redirect with the guard intact, reworded warning) all stay green. * test(ci): close the escapes a real edit would take, and stop there Seven of sixteen findings, chosen by one question: would an honest edit hit this? Each is mutation-verified against ci.yml. - apt's long option spellings reached simulate mode past a `-o`-anchored regex (`--option APT::Get::Simulate=true`, `--simulate=yes`), as did `--version`/`--help`, which print and exit having installed nothing. - The chain allowlist checked only a statement's leading word, so `&& sudo apt-get remove -y tmux` appended after the install passed while undoing it. It checks the subcommand now. - `apt-get update` was pinned as load-bearing but never required to run through sudo, though that is the whole reason the install is. - A quoted redirect target (`>'/dev/null'`) muted an annotation: blanking quoted spans leaves the operator, so the pin matches the operator itself. - The already-installed branch's BODY was unpinned — emptying it to `:` left a broken-but-installed tmux undetected on the lane that takes it. - The step was pinned before the test step but not AFTER the `ci_profile` step its `if:` reads; above it the condition is always false and the step silently never runs. - The separator alphabet was encoded three times and the copies had already drifted. One definition now, used by all three consumers: a model of bash that depends on which function you ask is not a model. The nine I did not take are recorded on their threads with reasons. Most are adversarial rewrites — swapping branch bodies, wrapping the block in a never-executing loop, nesting a conditional inside a pinned branch, hiding the chain in a heredoc — and this file cannot win that game: anyone who can restructure the step can also delete it. It guards accidental drift, which is the failure that actually happens. One asks for a composite action shared with qwen-autofix.yml; that is a repo-wide refactor and does not belong in this PR. * ci: make the install fail fast, bound its apt calls, and verify all three tools Four review findings, all about the step rather than its pin, and all four taken — they are the shapes a real runner produces. `sudo` becomes `sudo -n`, the convention nine other steps in this file and the sibling workflow already use: without it, a runner without passwordless sudo gets a password PROMPT on stdin and the step hangs to its timeout instead of falling through to the warning. The `elif` tests sudo's USABILITY (`sudo -n true`) rather than its presence: `command -v sudo` passes on a runner where sudo exists and cannot be used, which takes the install branch straight into that hang. The apt calls carry their own `timeout 280` inside the step's 5-minute bound. When the STEP timeout fires there is no `|| echo` — the lane loses its tooling and says nothing. A shorter command-level bound lets the guard run and the annotation reach the check UI. The already-installed branch verifies zip and unzip too, not just tmux: it is taken when all three are present, so a broken-but-present zip failed the packaging suite with no warning explaining why. The pins moved with the step: "runs through sudo" now walks the wrapper prefix (a bounded install is `timeout 280 sudo -n apt-get …`, and requiring sudo FIRST would have redded it), the elif equality carries the new condition, and all three tool probes are pinned to exist AND to be guarded. That last pin needed a second pass: matching by substring reported the zip probe present after deletion, because `unzip -v` contains `zip -v` — it is word-anchored now, and each of the three deletions turns it red. * fix(ci): install the tooling on root lanes too, where sudo does not exist The Test check reds on a lane that ships no zip: install-script.test.js throws at module load on a CI host missing zip/unzip — loudly, by design — and this step could not prevent it on a root-container lane, because its only install branch required `sudo -n true`, and root lanes have no sudo (and need none). The step fell through to the advisory warning, nothing installed, and the packaging suite threw inside the required check. Add a root branch ahead of the sudo branch: uid 0 runs the same bounded, guarded chain as-is. Lane probes under the runner's exact bash flags: a root lane installs without sudo, a sudo lane installs through sudo -n, a bare lane warns and exits 0, and an apt failure still reaches the guard. The pins moved with the step: each branch must carry its own update-then-install chain with exactly one install, and the branch decides the sudo shape — the root chain must NOT reach for sudo (on a lane with no sudo binary that exits 127, the guard fires, nothing installs), the sudo chain must. Six mutants red, pristine green. * fix(ci): fit the apt bounds inside the step cap, and pin what still escaped * test(ci): close the pin's round-4 escapes, and stop reddening its rewordings Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): close the pin's round-5 escapes with a branch-body allowlist --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> |
||
qqqys
|
a86f1e5c0a
|
fix(ci): stream autofix agent progress (#8895)
Some checks are pending
E2E Tests / E2E Test (Linux) - sandbox:docker - shard 2/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:docker - shard 3/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none - shard 1/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none - shard 2/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none - shard 3/3 (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:docker - shard 1/3 (push) Waiting to run
E2E Tests / E2E Test - macOS - shard 1/2 (push) Waiting to run
E2E Tests / E2E Test - macOS - shard 2/2 (push) Waiting to run
E2E Tests / channel-plugin E2E (nightly) (push) Waiting to run
E2E Tests / cron-interactive E2E (nightly) (push) Waiting to run
E2E Tests / web-shell Browser Regression (push) Waiting to run
* fix(ci): stream autofix agent progress * fix(ci): preserve autofix API error retries * fix(ci): trust structured autofix results * fix(ci): bound autofix stream processing * fix(ci): ignore oversized autofix stream lines --------- Co-authored-by: qqqys <266654365+qqqys@users.noreply.github.com> |
||
|
Shaojin Wen
|
5dc98240c7
|
fix(ci): port the verify gate's remaining hardening from #8765 (#8878)
#8816's branch accidentally carried #8765's early commits, and the takeover loop evolved the gate further there (subset identity via comm -23, the retryable third arg, subset fixtures) — so #8765 closes as subsumed, and this PR ports what main still lacks: the two improvements its reviewers named for porting, plus the open round-6/7 findings that survive on main's gate. - Pre-detach short-circuit: an empty head signature (vite/esbuild/ crash — the KNOWN LIMIT class) fails closed regardless of the baseline, so decide it BEFORE paying the detach + full baseline re-run + restore. - Build-dirt guard: the A/B'd build REWRITES a tracked file (the vscode companion settings schema), and the undiscarded rewrite makes either checkout refuse — degrading a real verdict into the crash path. `git restore -- .` before both checkouts; tracked-only, and the tree was asserted clean before the deterministic checks. - Restore-failure semantics: a plain outcome=failed is an EVALUATED rejection — the watermark advances and a transient git failure strands the item as a permanent human handoff. The gate now leaves outcome unset (the gate-crashed path retries next scan) and still writes the detail document so the crash comment explains itself. - The dist-rebuilt steering note seeds the repair feedback on both retryable A/B exits — the repair agent's only warning that dist/ holds baseline-built artifacts. - The stale-base retry handoff prefixes its embedded rejection with a the-base-has-moved note, so the retry agent is not steered toward no-action by framing written before the auto-update. - The two A/B side logs joined the repair step's cleanup list. - Tests: identity-less short-circuit, tracked-dirt survival, verdict-less restore crash, long-preamble render cap, PREEXISTING clause selection through the executable report harness, and the stale-framing note pin. Mutation-tested, 5 of 5 caught: short-circuit dropped, restore guards dropped, restore-failure reverted to the evaluated rejection, dist note dropped, stale-framing note dropped. Co-authored-by: verify <verify@local> |
||
|
Shaojin Wen
|
7f61e03b82
|
perf(ci): make the triage budget operator-tunable and raise it (#8810)
* perf(ci): make the triage budget operator-tunable and raise it The triage job's fixed 30-minute cap was killing every substantial PR's triage at exactly the budget — five observed (8723, 8726, 8731, 8764, 8801), each a full agent run discarded — and the successful-run distribution shows why: 22 jobs sampled ran median 5.8m / p90 22.3m / max 29.5m. A max just under the cap is a distribution being clipped, not one that fits. Back the budget with QWEN_TRIAGE_TIMEOUT_MINUTES (fallback 60), the same pattern as the autofix fleet caps in #8731 and probe-verified there for expression-valued job fields. Triage is advisory: the worst case a longer budget risks is one held runner, while a killed run wastes the same runner and the work it was about to publish. Pinned by a test asserting the variable-backed form with its fallback; reverting to the fixed literal fails it. * Address review: sanitize the knob, pin the active line Both findings verified before fixing. The knob was unvalidated, and the failure mode is nasty precisely because the knob exists to be changed WITHOUT a PR: a malformed repository variable — '60 minutes', '1h', a 6O typo, quotes, a decimal — would make fromJSON throw at expression time, killing the triage job before any step runs: no always() finalize, no status comment, a silent stop whose run log blames fromJSON rather than the variable. And '0' parses fine into an instantly-cancelled job. timeout-minutes cannot be validated by the job that consumes it, so the authorize job (which triage already needs, and which can run bash) sanitizes it: bare-integer check, floor 10, ceiling 600, every rejection warning with the VARIABLE's name. The triage job consumes the sanitized output; || 60 covers the events where authorize is skipped. The pin was an unanchored substring over raw YAML, satisfied by a commented-out line while the job silently inherits GitHub's 360-minute default — the review probe-verified that mutant surviving. The pin now matches active lines only, and the sanitize step is replayed verbatim against the review's whole enumeration: unset, sane, zero, runaway, and five malformed shapes, each asserted to fall back and name the knob. Mutation-tested, 3 of 3 caught: the timeout line commented out, the floor clamp dropped, the integer check bypassed. * fix(ci): clamp over-long triage budgets before bash arithmetic (#8810) A repository variable with more than 18 digits overflows bash's 64-bit arithmetic, and the wrapped residue can land inside [10,600], silently skipping both clamps with no warning — the one malformed shape where the sanitizer's diagnostics go dark. Check the digit count before the arithmetic and clamp such values to the ceiling with a warning. Also pin the seams the replay test cannot see: which repository variable feeds RAW, that the sanitize step is unconditional, the exact clamp boundaries, the 10# decimal guard, and the overflow clamp. * fix(ci): strip leading zeros from triage budget before the width guard (#8810) * fix(ci): pin triage timeout seams on parsed YAML and runner shell flags (#8810) --------- Co-authored-by: verify <verify@local> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> |
||
|
顾盼
|
c0c0352e25
|
feat(cli): mirror Live Host releases through OSS (#8674)
* feat(cli): mirror Live Host releases through OSS * fix(cli): harden Live Host OSS mirror fallback |
||
|
Shaojin Wen
|
358091833b
|
fix(ci): watchdog silent sandbox hangs and reap the containers they leak (#8816)
* feat(ci): A/B deterministic gate rejections against the pre-round ref A deterministic rejection in the autofix verification gate is only chargeable to the round if the same check passes without the round's commit. The gate charged every red to the fix unconditionally, and run 31276008548 measured what that costs when the premise is false: PR 8614's branch predated #8693's tsconfig guard while node_modules came from the post-#8693 trusted base, so `npm run build` was equally red at origin/<branch> — 63 minutes of accepted agent work discarded, an 18-minute repair burned on a failure the repair agent is forbidden to touch (it may only amend the round's own fix), thirteen rounds in a row, and the same again on the #8616 leg. On rejection the gate now re-runs the failing check at origin/<branch> (the branch as pushed, before the round) in the same environment: - baseline green: today's path exactly — outcome=failed, retryable=true, the repair pass gets its chance. - baseline red too: outcome=failed with preexisting=true and NO retryable. The repair step keys on retryable and is skipped — it cannot reach a failure outside the round's diff by construction — and gate-rejection.md says outright that the branch needs a base update (merge main), which flows into the failure comment as-is. Fail-closed toward today's semantics: any A/B infrastructure problem (missing ref, checkout failure) charges the fix as before, and a restore failure after the baseline run rejects outright since the tree can no longer be trusted. The round's work is still not pushed — this changes the verdict's honesty and cost, not the push policy. Tested by executing the real script in a real two-remote git repo with an npm stub whose failures are keyed by commit SHA: round-caused red (baseline green), pre-existing red (both red), and the untouched green path. Mutation-tested, 3 of 3 caught: skipping the A/B, claiming pre-existing without measuring, and dropping the tree restore. * Address review: bound the A/B to checks it can honestly compare All seven findings verified before fixing; the three Criticals were each a way the A/B compared something other than the check that failed. R1-1 — the contracts check feeds on stdin, which its first run drains; the baseline leg re-ran against EOF and checked an empty file list. R1-3 — the schema check's verdict rides on packages/core/dist, which the core-rebuild guard built from ROUND sources and which, being gitignored, survives the detach. Both checks are now A/B-exempt (run_check_no_ab): their baseline verdicts prove nothing, and their rejections stay where the repair agent can actually act on them. R1-2 — a workspace the round ADDS does not exist at the baseline, and npm exits 1 there with "No workspaces found" (measured; --if-present forgives a missing script, not a missing workspace) — a round-caused failure misread as pre-existing, skipping the one repair that can fix the round's own package. The per-package loop now A/Bs only when the workspace exists at origin/<branch>. R1-4 — a chatty PASSING baseline used to flood the tail -c 3000 evidence window and push the actual failure text out of gate-rejection.md, the sole carrier into the repair feedback, the PR comment, and the next round's LAST_REJECTION. The baseline transcript now goes to a side log and only a FAILING tail is merged back, where it is the evidence. R1-5 — the pre-existing paragraph pushed gate-rejection.md past the report's head -c 3500 cap, truncating the closing fence for branch names past 44 characters. Cap raised to 3900, invariant comment updated with the new arithmetic. R1-6 — preexisting=true had no read site. It now flows verify → Finalize verification → the failure report, whose headline swaps the generic gate clause for "PRE-EXISTING failure … needs a base update (merge main)". R1-7 — the no-round-commit guard was unpinned (deleting it kept all tests green). Now exercised through the core-rebuild path, the one A/B-eligible check that runs before the commit gate. Four new behavioral scenarios (chatty baseline, no-commit round, A/B-exempt checks, round-added workspace) plus workflow pins for the forwarding, the clause, and the cap. Mutation-tested, 4 of 4 caught: schema back to A/B (3 tests), guard dropped, side log reverted, no-commit guard dropped. * Address review round 2: A/B only what it can prove, prove what it claims Ten findings across two rounds, each verified before fixing. The three deepest share one lesson: the A/B is only sound for a check whose inputs travel entirely with the git ref, and whose failure it can IDENTIFY, not merely observe. R2-1 — rc=1 at both legs does not make them the same failure: the branch can fail for reason A while the round fails for reason B, and a baseline infrastructure hiccup is a nonzero exit too. Pre-existing now requires a MATCHING failure identity — tsc diagnostics normalized to file + error code (positions shift with the round's edits), compared via comm(1) on a per-check transcript. No diagnostics on either side means identity cannot be established and the round stays charged. R2-2 / R2-7 — gitignored dist survives the detach carrying the ROUND's build, so any dist-consuming check A/Bs reverted sources against round-built artifacts: package tests (channel-base resolved through dist exports) and typecheck (sdk-typescript resolves core's d.ts — probe-verified three-arm flip). Both are now A/B-exempt, as is lint, leaving `npm run build` — the incident class, and the one check that rebuilds its own inputs from the checked-out sources — as the sole A/B candidate. The workspace-existence guard dissolves with it. R2-3 — the fixture inherited the caller's global git config; a failing global pre-commit hook broke all seven cases. The harness now isolates GIT_CONFIG_GLOBAL/SYSTEM for every git child, and the suite is proven green under a deliberately hostile hooksPath. R2-4 — Finalize verification now selects preexisting from the same attempt whose outcome it selects (repair verification included). R2-5 / R2-8 — the "merge main" advice is now conditional at both layers: the script paragraph states the measured fact and hedges the remedy; the report headline uses the compare the step already ran — behind/diverged gets the base-update clause, an up-to-date branch is told its own pre-round code needs attention. R2-6 — the rejection document now sizes its evidence tail against its preamble (floor 500 bytes, total under the 3900-byte render cap), so the closing fence can no longer be truncated off by a long branch name. R2-9 — dissolved by R2-2: package tests no longer A/B, the guard and its uncovered positive branch are gone. R2-10 — the baseline-evidence merge is now pinned: the pre-existing scenario asserts the baseline leg's own failure line (keyed by its SHA) reaches gate-rejection.md. Eight behavioral scenarios; mutation-tested 5 of 5: identity dropped, typecheck re-enrolled, package tests re-enrolled, evidence merge dropped, fixed tail restored. * Address review round 4: sharpen identity, stage the git failures, sync prose Nine findings, all refinements — the design held, the edges did not. Identity now keeps the diagnostic MESSAGE (file + code collide: two unrelated TS2339s in one file compared equal, skipping a repair that could have shipped — probe-reproduced by the review), and the fixture emits a SHIFTED position on the baseline leg so the position strip is load-bearing instead of decorative (deleting the sed survived every test before; it fails one now). vite/esbuild failures still yield an empty signature by design — documented as the fail-closed limit rather than half-widened. The fail_signature assignments take `|| true`: grep exits 1 on the normal no-match case and survives errexit today only because the caller sits in an if-condition — a future unconditional call site would crash the gate verdict-less. The restore-failure branch is now stageable and staged: the baseline leg recreates (untracked) a file the branch tracks, the checkout back refuses, and the test pins retryable-not-preexisting with the 'could not restore' label. Relaxing the branch to `|| true` fails it. Prose synced to the mechanisms that replaced it: the render-cap invariant restates against the dynamic tail budget (the old 3000-based arithmetic would misguide the next retune), the no-round-commit guard comment names the core rebuild (schema/contracts left the A/B last round), the describe wording counts both A/B-eligible builds, and the pre-existing clauses no longer claim "the repair pass was skipped" — with REPAIR_PREEXISTING forwarded, repair may have RUN; they now state the invariant that is true either way: repair may only amend the round's own fix, so it cannot reach this failure. Mutation-tested, 3 of 3 caught: position strip dropped, message dropped from the identity, restore rejection relaxed. * fix(ci): watchdog silent sandbox hangs and reap the containers they leak Four autofix rounds have died the same way (#8663 twice, #8761 r3, #8763 r4): the agent's last output is the sandbox wrapper's "ContainerName (regular): …" line at docker container entry, then nothing — not one event — until the 2-hour absolute budget kills the round. Four different runners, two image versions: systemic, not a bad machine. Where exactly the container wedges is still unknown (that needs docker state on the runner); what is certain from the logs is the shape — a wedged sandbox produces NOTHING, and a legitimate run is never silent for long (the fleet's longest tolerated quiet is the review pipeline's 10-minute stream-idle window for thinking phases). Two mitigations, each aimed at a measured half of the damage: - run-agent.mjs gains an idle watchdog (QWEN_IDLE_TIMEOUT_MS, default 20 minutes = 2x that longest legitimate silence): zero output for the window kills the agent with a distinct "idle-timeout … the sandbox likely hung at startup" detail, so the failure comment names the right knob and a hung round costs 20 minutes instead of 120. Polled, not reset-per-chunk — a busy stream should not spend its time re-arming timers. - Both sandboxed jobs reap stale qwen-code-* containers at job start: a budget kill reaps the HOST-side docker client, not the container, so every killed sandbox keeps running on the persistent runner — observed directly when a later leg's container-name counter found qwen-code-0.21.8-0 already occupied and picked -1. One job per runner at a time makes any container alive at job start stale by definition. Tested by executing the real run-agent.mjs end to end with stub agents: the hang shape (one line, then silence) dies at the idle window naming the idle limit, and a slow-but-talking agent that outputs every 400ms across a 1500ms window survives to a clean exit — the test that distinguishes a watchdog from a disguised absolute timer. Mutation- tested, 3 of 3 caught: watchdog disabled, last-output tracking dropped (the disguised-timer regression), cleanup dropped from a job. * Address review round 5: the gate's verdict defects and the reaper's live kill Budget-warning round — the five Criticals from both reviewers, no suggestions (each deferred with a recorded reply). fail_signature: `[^\n]*` in an ERE bracket expression does not mean "rest of line" — in POSIX bracket expressions `\` is literal, so it matched "neither backslash nor the letter n" and truncated every tsc message at its first n. Nearly every real message has an early n ("Cannot find name", "is not assignable"), so distinct same-file failures collapsed into identical signatures and a round-caused failure could be labeled pre-existing, skipping the repair. grep is line-oriented: `.*` is exactly the rest of the line. New fixture: two messages differing only after their first n. Pre-existing verdict: the intersection test mislabeled in both directions. A round that ADDS a diagnostic sharing one normalized line with the baseline was called pre-existing (repair skipped for a round-caused, repairable failure); and `comm -12 | grep -q` under `set -eo pipefail` SIGPIPEs comm (exit 141) once the shared output outruns the pipe buffer, charging true pre-existing failures to the round — the exact 18-minute repair waste the gate exists to kill. Pre-existing now means the round's failing set is a SUBSET of the baseline's, and the difference is captured before testing. New fixture: a round adding a second diagnostic to a failing baseline. Restore failure after the baseline leg: was retryable=true with HEAD still detached at the baseline commit — the repair agent works in that very checkout and does no git recovery, so its commit would land on the baseline and be orphaned. Now rejected non-retryable (reject_fix grows a third arg); the next round starts clean from the trusted checkout. The restoreClash test pins the new semantics. Stale-container reap: the premise "a runner runs one job at a time, so any live qwen-code-* container is stale" holds per runner registration, but the filter queries the docker daemon, which is per host — and this pool runs several registrations on one OS. With per-issue/PR serialization only, a concurrent job's sandbox is a substring match away from `docker rm -f`. The reap now takes only provably-dead containers (--filter status=exited/dead, both jobs) and the comment says why a running one is left alone. Preamble printf: the `\`` escapes sat inside a single-quoted format where backslash is literal, so every pre-existing rejection rendered raw backticks instead of code spans (shellcheck SC2016). Backticks need no escaping there. Also syncs the side-log comment to the dynamic tail_budget it actually renders. Verified: scripts suite 140/140 (was 138; the two new fixtures and the rewritten restoreClash test all fail against the pre-fix script), npm run build / typecheck / lint pass, bash -n clean. * Address review round 6: reap the kill's own orphan, tolerate the reaper * Address review: hang-bound the reaper, unblock the kill path, pin the unpinned arms - Wrap every docker call in the stale-container reap with timeout 30: an alive-but-wedged daemon blocks docker ps indefinitely, and the existing || guards only catch nonzero exits, not hangs (R3-1). - Make the kill-path container removal async in run-agent.mjs: the spawnSync blocked the event loop between SIGTERM and the 10s SIGKILL backstop for up to its 30s timeout — in exactly the wedged-daemon scenario the watchdog exists for. The main flow awaits the removal so the leak warning stays deterministic (R3-6). - Split the pre-existing gate clause for an empty CMP_R: a transient compare-API failure is "never measured", not "measured not-behind", and must not assert the branch's own code is at fault (R3-7). - Swap the timeout breaker's closing remedy to the sandbox investigation when every counted timeout was idle, mirroring the round-level split (R3-11). - Tests: pin the budget kill path separately from the idle kill path (R3-3), parameterize the idle-window parse guard over -1/0/NaN (R3-5), add a stderr-only liveness case (R3-12), pin the strict-subset A/B arm via a baseline-superset fixture knob (R3-15), and pin the breaker's current-round idle increment (R3-18). --------- Co-authored-by: verify <verify@local> Co-authored-by: qwen-code-ci-bot <qwen-code-ci@service.alibaba.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> |
||
|
Shaojin Wen
|
e60d182241
|
perf(ci): tighten the automatic review kill switch for micro diffs (#8774)
* perf(ci): tighten the automatic review kill switch for micro diffs Below the review skill's sweep floor (25 changed lines) an automatic review keeps --effort high and its inline comments — a medium downgrade would drop exactly the inline findings a source fix deserves, and with the file-scoped suites and the one-round reverse audit the pipeline itself is what shrinks on a micro diff. What a micro run must not keep is a multi-hour kill switch: the small-PR budget halves with the same 90-minute floor the docs-only downgrade uses, so a hung run dies at the scale of its work. Reuses the PR_SIZE_LINES the size-aware budget already fetched — no new API call; an unknown size never tightens, an explicit --timeout wins (the size block is skipped), and a docs-only run is already halved, never twice. Gate tests drive the extracted step source with seeded sizes: the 24/25 boundary, the floor, the docs-only interaction, and the unknown-size fallback. * fix(ci): share one halve-with-floor implementation and pin the guard states Review rework. The docs-only branch and the micro tightening now call one halve_budget_floor() — a / 2 → / 3 mutant survived every test because both micro inputs land on the floor under any divisor ≥ 2, and two verbatim copies let a one-sided edit diverge the branches while the comments claimed they matched; the floor cases now execute the shared function and a structural pin asserts one definition, two calls, one occurrence of the arithmetic. The threshold comment states the unit honestly (total churn rides the skill's source-weighted sweep floor in the direction that cannot over-tighten). Two surviving guard mutants get pins: a manually requested review with a populated size is never tightened (the caller owns its timeout), and a failed docs classification still tightens a micro automatic run (the guard keys on != "true", not = "false"). * fix(ci): state the micro-tightening's true justification, not a false invariant The comment claimed "total churn < 25 implies the skill's source-weighted measure < 25", which is backwards: srcDiffLines counts raw unified-diff lines (file/hunk headers, context), so it is LARGER than churn — a scattered micro diff (churn 10 across 5 files) computes srcDiffLines ~65 and keeps sweep on, un-shrunk, while the gate still halves its budget. The threshold is now stated as what it is: an independent "small PR" churn bound, deliberately not SWEEP_FLOOR (the two measures differ, so a micro diff may still run the sweep and the full reverse audit). The tightening is justified by "churn < 25 bounds the reviewed territory and 90 minutes is ample for it even on the full pipeline" — measured, a 23-line PR runs high end to end in ~30 min — not by the pipeline shrinking. With the SWEEP_FLOOR coupling claim removed, there is no cross-file coupling left to drift, so no equality pin is owed. * fix(ci): reword the micro test comment to the independent churn bound Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): reword the micro gate comment to the 180-minute budget it actually halves Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: verify <verify@local> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> |
||
|
Shaojin Wen
|
3c3084e78a
|
fix(ci): route workflow label mutations through REST (#8761)
* fix(ci): route workflow label mutations through REST `gh pr edit` cannot mutate anything on this repository: its GraphQL lookup requests repository.pullRequest.projectCards, and with Projects (classic) attached GitHub returns the deprecation as an error, so the command exits 1 before applying the change. Reproduced from a live clone against PR #8755 — the error names the field outright. Three workflows carried label mutations through it: - pr-self-report-label.yml: every add/remove arm failed — 43 straight run failures from 2026-08-04 on; the green runs were all the nothing-to-do arm. Self-reported PRs (like #8755, whose author also opened #8750) never got the label. - qwen-autofix.yml: the `@qwen-code /takeover` and `/takeover stop` COMMAND paths never toggled the label — only the UI label events worked, so the command was dead weight wearing an ack. - repo-hygiene.yml: the add was `|| echo`-guarded, so it never failed the run — it just never labeled anything, while the fallback message blamed a label that exists. All five sites now use the REST issues/labels endpoints, which never touch that query. Two traps handled on the way: - Every label involved contains a slash, and in the DELETE the label is a PATH SEGMENT — unencoded it 404s. Encoded via jq @uri, and the tests assert the literal %2F because a real jq runs in the replay. - The REST add auto-creates a missing label, which repo-hygiene explicitly promises never to do — that site gets an existence probe first, and its misdiagnosing fallback message is corrected. Verified live on #8755 before editing anything: the exact gh pr edit call fails with the projectCards error; REST POST applies the label (backfilling the one it was owed), DELETE with %2F removes it. Tests: the stub-driven replays for both the self-report step and the takeover toggle now pin the full REST method + path (encoding included), and a repo-wide guard bans `gh pr edit --add-label/ --remove-label` in every workflow so the class cannot return. Mutation-tested, 6 of 6 caught: each of the five sites reverted to gh pr edit, and the DELETE stripped of its encoding. * fix(ci): harden REST label mutation steps per review (#8761) * fix(ci): pin REST label failure policies per review (#8761) Review round for the REST migration: - The DELETE arms tolerated EVERY failure (`|| true`), masking 403/5xx/network errors behind a green run and a false "removed" log. They now tolerate only the documented 404 race — any other failure emits a :⚠️: while keeping the step green (pr-self-report-label) and the release ack alive (qwen-autofix). - Neither replay harness could make a `gh api` call fail, so both failure policies were unpinned. They gain failure knobs (knob value on stderr like a real gh HTTP error) and now pin: 404 race silent, other DELETE failures warned, POST loud. The toggle replay also moves to -eo pipefail like the runner's bash default, reproducing the step's real failure semantics. - The jq stub enforced only the --arg shape; it now also enforces the `$l|@uri` program, so a filter mutation fails the suite instead of riding the stub's unconditional percent-encoding. - The gh-pr-edit guard misfired on comments and miscounted lines after joining continuations: comments are stripped before matching, and offenders are reported at the physical line where the (possibly wrapped) command starts. Mutation-tested with 8 probes, all caught: blanket || true on either DELETE, || true on either POST, dropped |@uri, a comment quoting the ban (stays green), an executable and a wrapped violation (both red, correct line). * Address review round 3: close the guard evasions, convert the release path Four round-3 findings, each reproduced before fixing, plus the release path the round-1 scope note deferred. - The ban guard now scans what bash executes, not the YAML surface: the decoded run: values of every parsed workflow, whole-line comments stripped, continuations joined the way bash joins them (backslash- newline removed, nothing inserted), matched whitespace-tolerantly. All three reproduced evasions — a # inside a quoted string eating the trailing backslash, wraps inside the command prefix or a flag token, and folded scalars — are fixture-pinned. Offenders report as file » job » step; line numbers stopped meaning anything after joins. - classify-release-notes.mjs mutates labels through REST now, and the guard grew an argv-form scan over .github/scripts/*.mjs that flags the old file (negative-controlled) — the release path was the last gh pr edit label site, failing silently behind continue-on-error. - JQ_STUB enforces the full invocation: -rn (with -r alone real jq evaluates zero inputs and prints nothing), the binding name l (real jq exits 3 on $l undefined), and the program. Either reproduced mutation previously expanded the substitution empty, sent the DELETE to …/labels/ with no name segment, and the 404 tolerance swallowed it. - The takeover engage POST gets the idempotent create its siblings carry, pinned to the label's real color (1D76DB): the REST add would re-create a deleted label silently with a random color. - runToggle captures writes on throw, and the engage-failure assertion now pins the ORDER its comment claims: a failing apply must leave no "takeover-ack engaged" in the captured writes — the bare toThrow passed even with the ack moved above the POST (reproduced). - The two REMOVE_ERR DELETE idioms are drift-pinned byte-identical modulo the label variable, the honest substitute for sharing shell across workflow files. Mutation-tested, 6 of 6 caught: the evadable regex restored, -rn and the binding name mutated in the workflow, the create dropped, the ack posted before the POST, and the old .mjs flagged by the new scan. --------- Co-authored-by: verify <verify@local> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> |
||
|
Shaojin Wen
|
afcc937ec5
|
fix(ci): render the queued-acknowledgement comment (#8726)
* fix(ci): render the queued-acknowledgement comment The ack comment posted on every PR that requests a review was built as <!-- qwen-review-ack -->_Qwen Code review request accepted. …[workflow run](URL)._ with the prose glued straight onto the marker. A line opening with `<!--` starts an HTML block, and that block runs to the line containing the closing delimiter INCLUSIVE — the rest of that line is still inside it and never parsed as Markdown. So the comment shipped as raw source: no emphasis, and the link to the workflow run was dead text. That link is the only pointer a PR author gets to their review run — `issue_comment` runs are not attached to a commit, so they never appear in the PR's checks list. Losing it leaves no way to reach the run from the PR. Measured through GitHub's own renderer (POST /markdown, mode=gfm) on the exact bodies: marker + text -> 0 <a>, 0 <em> marker + \n + text -> 1 <a>, 1 <em> marker + \n\n + text -> 1 <a>, 1 <em> Use the blank-line form, matching how autofix-status already builds its body. The marker text is unchanged, so the `contains(...)` upsert lookup still finds prior acks and updates them in place. Pinned by a test that scans every marker in the workflow and rejects one with prose glued to it, skipping comment lines. It fails against main, naming the offending line. * fix(ci): harden the marker guard per review round 2 Pin the workflow-run URL weaving into the ack printf, bound the marker scan to the marker's physical line, anchor the newline exemption to the literal the marker opens, widen it to double-quoted printf formats, and flag unquoted command-substitution concatenation. Declare the remaining coverage gaps in the test instead of papering over them. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): widen marker-guard regex and declare known gaps per review * fix(ci): pin ack link shape and dedupe workflow scan per review --------- Co-authored-by: verify <verify@local> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> |
||
|
Shaojin Wen
|
9381827c88
|
fix(ci): enter Critical-only mode after five change rounds (#8751)
The suggestion cutoff sat at ten change-producing rounds, but the strict round cap discards a plain PR at round ten before that threshold can engage — so in practice it only ever bound takeover PRs, which spent ten rounds growing their diff on lower-severity feedback before the brake applied. Lower it to five so the loop stops implementing suggestions while the diff is still reviewable. The autofix skill already documented the five-round boundary; the workflow now matches it. |
||
|
Shaojin Wen
|
d91c66119b
|
fix(ci): match /review commands followed by a newline (#8723)
A comment of `@qwen-code /review` plus a newline and a body has never
triggered anything. The shape match tried to accept it with
startsWith(body, format('@qwen-code /review{0}', '\n'))
but GitHub expression string literals are NOT escape-processed: that
'\n' is a literal backslash + n, so the branch matched nothing. The
command was silently ignored — no run, no feedback, in a path whose
whole job is to be the manual escape hatch.
Measured on a live runner rather than assumed:
startsWith(<LF body>, format(…, '\n')) => false
startsWith(<LF body>, format(…, fromJSON('"\n"'))) => true
startsWith(<CRLF body>, format(…, fromJSON('"\n"'))) => false
startsWith(<CRLF body>, format(…, fromJSON('"\r"'))) => true
fromJSON parses JSON, which IS escape-processed, so it yields a real
newline. Both endings are needed: the REST API sends LF, the web UI
sends CRLF, and an LF pattern does not match a CRLF body. Applied to all
7 shape matches (6 /review, 1 /resolve).
The shell half had the matching gap: the command line is taken as
everything before the first LF, which on CRLF keeps a trailing CR. IFS
has no CR, so word splitting produced tokens like `--timeout=300<CR>`
that failed the numeric check with no visible cause. Strip it.
Three tests pin this: no shape match may use a non-escape-processed
literal, every shape match must carry both endings, and the CR strip
must follow the first-line split. All three fail against the workflow on
main. Mutation-tested: dropping the CR branches or the CR strip each
fails exactly its own test.
Found while re-triggering the PRs stranded by the #8648 outage — 19
multi-line trigger comments were accepted by `authorize`, then silently
dropped by this branch.
Co-authored-by: verify <verify@local>
|
||
|
Shaojin Wen
|
ee98f7420b
|
perf(ci): make the autofix fleet caps operator-tunable and raise them (#8731)
The three caps that bound the autofix review loop were compiled-in literals sized for a much smaller takeover pool, so growing the pool meant editing the workflow, opening a PR and waiting for review every time. The takeover pool is not static — it grew to 37 PRs by 2026-08-08, and it keeps growing. Back all three with repository variables, keeping the literals as fallbacks, so the loop is resized in Settings → Variables with no code change: QWEN_AUTOFIX_MAX_PARALLEL (fallback 20, was 5) QWEN_AUTOFIX_MAX_TARGETS_PER_SCAN (fallback 30, was 10) QWEN_AUTOFIX_MAX_CANDIDATE_INSPECTIONS (fallback 60, unchanged) Verified on a live runner that `max-parallel` accepts the expression and schedules by it — a 6-leg matrix resolving to 3 started exactly 3 legs and began the 4th only after a slot freed. Not assumed: an invalid expression here makes the whole file invalid, which this repository just paid 12.9 hours of dead review automation for. The raised fallbacks are sized against measurements, not guesses. At 5 slots the fleet served ~14% of the takeover pool at once, reproducing at a larger scale the 81-minute tail measured back at 3. The ecs-qwen fleet is 84 runners, so 20 concurrent legs take under a quarter of it, and the legs sampled that day finished in 3-28 minutes. Worst case rises to 100 runner-hours across the fleet (20 slots x the 300-minute job cap), and per-PR head-write concurrency groups are per-PR, so this adds no push contention. MAX_TARGETS_PER_SCAN has to stay above max-parallel or the scan cannot emit enough legs to fill the matrix. That relation is pinned for the fallbacks by an existing test and stated at both definitions for the variables, where it becomes an operator invariant. Mutation-tested, 4 of 4 caught: fallback equal to the budget, fallback above it, and dropping either variable back to a literal. Co-authored-by: verify <verify@local> |
||
|
Shaojin Wen
|
6cae50c7ea
|
fix(ci): keep the review workflow under the expression-length limit (#8720)
The review workflow has been invalid since #8648 merged, so every event it declares has been dead for ~12 hours: Invalid workflow file: .github/workflows/qwen-code-pr-review.yml#L1 (Line: 751, Col: 14): Exceeded max expression length 21000 A `run:` body containing `${{ }}` is evaluated as ONE expression template, and GitHub caps a single expression at 21000 characters. "Run review" went 17705 -> 22282 chars in #8648 (17:00:32 on 2026-08-07); the first startup failure is stamped 17:00:50. #8683 took it to 24042. An over-limit expression does not fail a job — it invalidates the whole file, so no run is created at all. Across the 400 runs since that merge there is not one success, not one `pull_request_target` and not one `issue_comment`: both automatic review and `@qwen-code /review` were unreachable, while CI stayed green throughout because nothing covered it. Pass the three context values the script reads through the step's env, leaving the body free of `${{ }}`. The runner then never templates it and its length stops mattering. No behaviour changes: each substitution is a rename of the same value. Pin it with a test that walks every workflow and fails any templated run block over the limit, plus one that keeps this body untemplated — it is past 21000 on its own, so a single `${{ }}` added back takes the whole workflow down again. Both fail against the file currently on main, naming it: `qwen-code-pr-review.yml > review-pr > Run review: 24042 chars`. Mutation-tested, 4 of 4 caught: restoring a `${{ }}` in the body (3 tests), dropping either env binding, and hardcoding the value the env used to carry. Co-authored-by: verify <verify@local> |
||
|
Shaojin Wen
|
ee2e5be666
|
fix(review): stop the agent transcript from executing workflow commands (#8683)
* fix(review): stop the agent transcript from executing workflow commands The review agent streams its entire transcript to stdout, and the runner scans every line for workflow commands. A tool result that quotes a file containing one therefore gets EXECUTED. Observed on run 31167034020 (PR #8681). That PR changes an `actions/setup-node` input, so the agent read the action's own main.ts, which legitimately contains: core.info(`##[add-matcher]${path.join(matchersPath, 'tsc.json')}`); The runner took the rest of the JSON line as a matcher path: ##[error]Unable to process command '{"type":"user","uuid":...' successfully. ##[error]The path '...' is too long, or a component of the specified path is too long. Three of those, and the step failed after 1h37m — a full review discarded for quoting a file. Nothing about that PR is unusual: any review whose transcript quotes `##[...]` or `::...::` breaks the same way, including every review of this repository's own workflows. Wrap the agent invocation in `::stop-commands::`, with a token randomised per attempt so no output the agent produces can guess it and re-enable parsing early. Parsing resumes immediately after PIPESTATUS is captured: `echo` clobbers PIPESTATUS, so resuming any earlier would read the echo's status instead of the agent's and report every timeout or crash as a clean run. Resuming is on the errexit-disabled straight line, so it is reached on success, crash and timeout alike — leaving it off would silence the job's own ::error:: and the fallback comment's diagnostics for the rest of the run. Tested by driving the real extracted retry loop with a stub agent that emits `##[add-matcher]`, asserting the bracket contains it, that the token is random rather than fixed, and that parsing resumes on success, hard exit and timeout. Mutation-checked: removing the guard, never resuming, resuming before the status capture, and using a fixed token each fail. * fix(review): resume workflow commands on a line the runner can see Round-2 review follow-ups on the stop-commands guard. The resume was `echo`d, so a `--kill-after` SIGKILL that cut the agent off mid-line appended it to that fragment. The runner matches `::cmd::` at a line start only, so parsing stayed off for the rest of the job — losing the retry `:⚠️:` and every later diagnostic on the one path the guard exists to survive. Emit it with a leading newline. The ordering assertions had no teeth: `indexOf` returns -1 when a line is deleted or reworded, and -1 satisfies `toBeLessThan`. Deleting the stop line left the suite green. Every anchor is now asserted present. Cover the outcomes no scenario reached: an agent that streams and then dies (the stub `timeout` exited before ever running it), a failing log write (the only early return left unpinned), and a retry, which pins the bracket as per-attempt with a token the previous attempt cannot reuse. Mutation-tested, 7 of 7 caught: reverting the printf, moving the resume past the tee check or before the PIPESTATUS capture, hoisting the bracket out of the function, fixing the token, and deleting either end. --------- Co-authored-by: verify <verify@local> |
||
|
Shaojin Wen
|
7b7ff19bc3
|
fix(tests): avoid blocking integration test cleanup (#8688)
* fix(tests): avoid blocking integration test cleanup Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(tests): avoid failing fast on telemetry waits for live CLIs (#8688) * fix(tests): drop dead telemetry-ready return and gate rig tests (#8688) * fix(tests): pin the gated rig test in the no-AK guard (#8688) --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> |
||
|
Shaojin Wen
|
7942197666
|
fix(tests): apply integration worker limits to forks (#8689)
* fix(tests): apply integration worker limits to forks Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(tests): keep no-AK integration gate at two fork workers (#8689) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-ci-bot <25325202+qwen-code-ci-bot@users.noreply.github.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> |
||
|
Shaojin Wen
|
f4802031d0
|
perf(ci): run docs-only automatic reviews at medium effort (#8648)
* perf(ci): run docs-only automatic reviews at medium effort
A 1-line docs PR costs the same 57-180 minute high-effort review as a code
change, and on a diff with zero source lines the passes medium drops - the
adversarial personas and the reverse audit - have no failure mode to hunt.
Counterfactual analysis over six dissected CI runs showed the one case
where those passes caught a real Critical was a source PR, which this gate
never touches: classification reuses the Test workflow's conservative
classify-profile.mjs (docs/**.md(x) + root prose only; markdown under any
src/ tree stays full, matching the review skill's own source rule), and
any fetch or classifier failure falls back to the full review.
Only the automatic pull_request_target review downgrades; every explicit
request (workflow_dispatch, @qwen-code /review) keeps full high effort.
Because an effective --comment forces high and medium never posts, the
downgrade drops --comment and a new step relays the review CLI's verbatim
"Review complete:" line - its machine-readable completion contract - as a
single PR comment, with a pointer for requesting the full review. The
docs-only budget is the size-aware timeout halved with a 90-minute floor.
* perf(ci): address review feedback on the docs-only medium gate
All nine review suggestions, each verified before fixing:
- review_requested is an explicit ask: the AUTO_REVIEW flag now excludes
that action (authorize write-permission-checks its requester), so a
maintainer requesting the bot's review gets the full high-effort run.
- The fetch-and-classify wrapper is extracted to
.github/scripts/ci/classify-pr-profile.sh and consumed by both ci.yml
and the review gate, so the classifier's input contract lives in one
place; distinct exit codes preserve each caller's fallback messages.
- Neither completion-line fallback mints the reserved "Review complete: "
prefix anymore, and the relayed line passes a strict not-posted
disposition allowlist - on this never-posts path any posted-form
disposition is false by definition (the measured phantom APPROVE
posted), so it falls back to a neutral non-scrapable form.
- The relay upserts by its marker (mirroring the queued-acknowledgement
step) instead of stacking a comment per push, retries the POST/PATCH
three times, and never fails the job - a failed relay after a
successful review must not trip the failure fallback into announcing
a review failure that never happened.
- The Chinese relay copy no longer parses as "发行" and renders
high-effort as 高强度 rather than 高档.
- The qwen-review docs-only-medium marker is registered in all six
BOT_COMMENT_FILTER sites in qwen-autofix.yml, so clean docs-only
relays cannot select PRs into autofix rounds as actionable feedback.
- The gate's behavioral invariants are pinned in
scripts/tests/qwen-pr-review-workflow.test.js by executing the
extracted bash: prompt-branch order (--effort medium instead of
--comment), the halve-with-90-minute-floor arithmetic, the
completion-line allowlist including the phantom shapes, AUTO_REVIEW
exclusivity, the six-site marker registration, and the shared-wrapper
routing in both workflows.
* perf(ci): harden the docs-only gate against round-2 review findings
Thirteen findings across two review passes; every fix is executed by a
test rather than asserted as text where the finding was behavioral.
- The relay marker exclusion in qwen-autofix.yml is author-scoped at all
six filter sites: only the relay bot's own marker comment is filtered,
so a human quoting the marker stays actionable feedback.
- classify-pr-profile.sh guards the 3,000-file listing cap (any mismatch
against the PR's declared changed_files classifies full), uses
mktemp+trap instead of a fixed path on the shared persistent pool, and
ships its own node:test suite (renamed source→docs pins the projection
contract; exit codes 2/3 pinned) registered in HELPER_TESTS.
- classify-profile.mjs restricts reserved root prose basenames to inert
extensions - README.js / SECURITY.ts / LICENSE.sh classify full.
- The completion-line allowlist binds to pr-<number> and to the only
verdict a medium run can produce (Comment, not posted) - a stale line
for another PR or an Approve-shaped injection falls back to neutral.
- A dedicated review_completed output gates the relay: the state/head
guards exit 0 without running the review, and outcome==success alone
would have announced a review that never ran.
- The relay upsert filters by the authenticated bot login, re-resolves
the comment id on every attempt, and falls back to POST when the PATCH
target is gone - a participant posting the marker can no longer capture
the upsert, a transient listing failure no longer mints duplicates.
- The gate and relay are now executed under stubbed executables in
qwen-pr-review-workflow.test.js (docs_only/full/failure/explicit
scenarios; POST/PATCH/never-fail branches), the AUTO_REVIEW pin covers
both guard halves, and the marker contract is pinned producer-side and
filter-side.
* perf(ci): fix the medium Request-changes swallow and the stale docs badge
Round-3 review findings (2 Critical, 8 test-gap Suggestions), each fix
executed by a test where the finding was behavioral:
- The completion-line allowlist accepts `Request changes, not posted` -
compose-review caps only Approve at medium, so a docs-only run that
verifies a Critical legitimately emits Request changes, and the old
Comment-only allowlist swallowed exactly the blocker-finding outcome
into the neutral fallback. Target binding to pr-<number> is unchanged
and now pinned by a test, as is the last-line selection over a stale or
injected earlier completion line.
- A stale docs-only badge can no longer outlive its revision: the full
automatic review path now supersedes the bot-authored marker comment
(strikethrough + superseded note) via a new --update-only mode that
never mints a badge where none existed.
- The marker+author upsert protocol is extracted to
.github/scripts/upsert-bot-comment.sh - one implementation shared by
the relay and the supersede step (the per-step copies had already
drifted), with its own node:test suite covering the author scope, the
per-attempt re-resolution (deleted-mid-retry falls back to POST), and
the --update-only no-op; registered in HELPER_TESTS.
- The classify-pr-profile gh stub now applies the wrapper's own --jq
argument with real jq over API-shaped fixtures, so the projection
contract is genuinely under test (negative control: dropping `status`
turns the renamed-source scenario red).
- New pins: review_completed wiring end to end (run-step emit + both
consumers' if clauses), the auto_review output->env wiring at both
links, and both AUTO_REVIEW guard halves.
* perf(ci): never let a failed lookup mint or keep a stale docs badge
Round-4 review findings (1 Critical, 7 Suggestions):
- The upsert script no longer conflates failed lookups with empty
results: the authenticated login, the listing, and the jq extraction
are all resolved inside the retry loop as one prerequisite chain, an
attempt whose prerequisites failed retries instead of falling through
to POST (the shape that minted a permanent duplicate badge off one
transient 5xx), and --update-only exits 1 on a failed lookup so the
supersede warning fires instead of a false no-op success. New tests
pin the failed-listing-then-PATCH path, the persistent identity
failure, the update-only failure exit, and the update-only PATCH.
- Supersede now covers every path that owes the correction: a FAILED
full review and an EXPLICIT requested review (the badge's own CTA)
both retire the badge, gated only on docs_only_medium == 'false' -
empty on runs that failed before classifying, so a badge is never
superseded on ignorance. The body is cause-neutral: it asserts only
that the badge described an earlier revision.
- The marker literal is defined once per step (MARKER variable, the
qwen-triage convention) and shared between body and lookup argument;
a pin requires the definition and --update-only on the supersede
invocation.
- New behavioral pins: the Approve verdict stays rejected by the
allowlist, github_ci_only never downgrades (CI helpers are
executable), and review_completed's emit position is asserted AFTER
the closed-PR and stale-head guards (the hoist mutant survived
position-independent contains checks).
* perf(ci): make docs_only_medium three-valued and pin the untested guards
Round-5 review findings (1 Critical, 6 Suggestions):
- docs_only_medium no longer conflates "determined not docs-only" with
"never determined": the output is three-valued ('' when the
classification failed or never ran), so a transient classifier failure
or a dispatch dry-run can no longer retire a still-accurate badge. The
supersede condition names its two licensed paths explicitly - a
POSITIVE not-docs-only determination (without requiring review
success), or an explicit comment-mode review that completed (the
badge's CTA; report-mode dry runs retire nothing).
- The count-mismatch fallback in classify-pr-profile.sh logs to stderr,
so a systematic divergence is distinguishable from every PR genuinely
classifying full.
- Six probed surviving mutants now each turn a test red: the supersede
body is executed (existing-badge PATCH and the never-fail guard),
ci.yml's rc-handling fragment is executed (exit 0/2/3 with the
full fallback), the changed_files fetch failure exits 2, duplicate
badges PATCH the last (newest) comment, and the relay's POSTed body
must carry the marker that keys both the upsert and the supersede.
* perf(ci): bind the docs badge to the reviewed head and retire it on failure
MDX pages are executable (imported components, expressions), so the
classifier no longer treats them as inert docs-only changes. The relay
and supersede writes re-read the live PR state/head immediately before
the mutation and skip unless the PR is still open at the reviewed SHA,
the badge body names that SHA, a failed docs-only review now retires the
singleton badge instead of leaving the previous revision's outcome
visible, and the retired wording is cause-neutral (an explicit review
can complete on the very head the badge describes).
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
---------
Co-authored-by: verify <verify@local>
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com>
|
||
|
Shaojin Wen
|
20b9504276
|
feat(autofix): bridge fork-PR reviews into the credentialed review lane (#8676)
* feat(autofix): bridge fork-PR reviews into the credentialed review lane
A workflow run tied to a pull request whose head lives in a fork is
created with `Secret source: None`, so `secrets.CI_DEV_BOT_PAT` is empty
and the autofix review lane cannot authenticate. Those reviews therefore
wait for the scheduled scan, which GitHub throttles hard — the `*/10`
cron lands every 40-70 minutes on this repo.
Reading the PR with `github.token` instead would not help: review-address
still needs the PAT to push and comment, and it is empty for the whole
run. The credential has to come from a different run.
This is the standard `workflow_run` bridge for that.
- `qwen-autofix-fork-signal.yml` runs on `pull_request_review`, where the
fork PR's event can reach it, and records only which PR was reviewed.
It is deliberately powerless: `permissions: {}`, no checkout, no
repository code, and the hosted pool rather than the persistent
self-hosted one.
- `qwen-autofix-fork-bridge.yml` runs on `workflow_run`, which GitHub
creates on the default branch with the repository's own token, and
dispatches `qwen-autofix.yml` for that PR using `actions: write` — the
same lever Fleet Shepherd already pulls. It holds no PAT.
The dispatched run re-derives admission from live API state, so the PR
number says when to look, never who may be touched. It is bound to
`workflow_run.head_sha` regardless: the signal run carries the reviewed
PR's head SHA, and only that PR has that head.
Measured, not assumed:
- `workflow_run.pull_requests` is empty for fork PRs, and
`/commits/{sha}/pulls` does not resolve a fork head either (it does
resolve an in-repo one), so the artifact is the only way to learn the
number.
- `pull_request_review` runs the workflow file from the BASE branch: run
31152873061's PR branch predates a main-only change to
`qwen-autofix.yml` and it still executed the new file. A fork cannot
edit what the signal writes.
- That run's `head_sha` equals PR #8436's `headRefOid` exactly, which is
what makes the binding possible.
The bridge's validate-and-dispatch block is replayed under bash against a
stub API: forgery, an unreadable head, both heads empty, non-numeric and
path-shaped artifacts, a closed or retargeted PR, download and read
failures, and dispatch retry then exhaustion.
* fix(autofix): align fork bridge with route admission and coalesce bridged dispatches
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(autofix): harden the fork-review bridge per review feedback (#8676)
---------
Co-authored-by: verify <verify@local>
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
|
||
|
Shaojin Wen
|
188802719b
|
fix(ci): give review runs upstream-timeout headroom (#8673)
* fix(ci): give review runs upstream-timeout headroom PR 8507's automatic review aborted twice on 2026-08-07 with "Request timeout after 483s" - a classification message printing elapsed time, not a configured threshold. Two distinct guards fired under a degraded upstream: the 17-agent fan-out generation on a ~1.27M-token context stalled chunk delivery past the 240s stream-idle default (the pipeline-level retry doubled the loss to ~16 minutes), and on the fresh retry an early small turn burned three ~120s connect/TTFB timeouts through the SDK's internal retries. Three knobs, applied to CI review runs only: - model.generationConfig.timeout 600000 via the per-run QWEN_HOME settings.json (no env knob exists for the SDK request timeout); - QWEN_STREAM_IDLE_TIMEOUT_MS 600000, tolerating a long thinking phase between chunks; - QWEN_STREAM_MAX_LIFETIME_MS 1800000, keeping the drip-feed hard bound strictly above the idle window. The outer GNU timeout and the review deadline still bound the job; the knobs trade hang-detection latency for survival on slow-but-alive upstreams. A test pins all three and the lifetime>idle ordering. * fix(ci): deliver review timeout headroom via step env (#8673) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): pin stream-guard env values and bound stream-retry trade-off (#8673) --------- Co-authored-by: verify <verify@local> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> |
||
|
Shaojin Wen
|
6668c876a6
|
perf(autofix): stop restoring a 2.65 GB npm cache to protect a 29 s install (#8681)
* perf(autofix): stop restoring a 2.65 GB npm cache to protect a 29 s install `actions/setup-node` is configured with `cache: 'npm'` in all three heavy autofix jobs. Measured on one review-address leg, that step took 339s: Node itself was free (`Found in cache @ .../_tool/node/22.23.2/x64`) and 2,654,052,865 bytes arrived at ~10 MB/s. The `npm ci` it protects ran in 29s in the very next step. The bill is per job, not per run: build-cli pays it once (280s measured), issue-autofix once, and EVERY review-address leg once — up to ten legs a scan, five at a time. Observed leg costs ranged from 446s to 1207s. The persistent pool keeps ~/.npm across jobs, so the download buys nothing there. The hosted fallback is ephemeral and still wants it, so the cache is chosen from `runner.environment` rather than from a copy of the runs-on expression, which differs per job and would drift. Also narrows an existing negative pin. `expect(workflow).not.toContain( "runner.environment == 'self-hosted'")` was added to keep the reverted dedicated-runner design out, whose artefact was a `command -v node` step gated on exactly that expression (removed in #6261). That step is pinned out by name on the following line, so the substring form only forbade the `runner` context by accident — the same test requires `RUNNER_ENVIRONMENT: '${{ runner.environment }}'` a few lines below. It now matches the shape that was actually reverted: a step whose entire `if:` is that expression. Mutation-checked: re-adding that step still fails the test. * fix(autofix): actually disable the npm cache restore on the persistent pool --------- Co-authored-by: verify <verify@local> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> |
||
|
Shaojin Wen
|
18b925103a
|
fix(triage): finalize the status comment on cancellation too (#8436)
* fix(triage): finalize the status comment on cancellation too The 'Finalize triage status comment' step ran under success() || failure(), so a job-timeout (timeout-minutes: 30, reachable on large PRs) or a manual cancel skipped it and the early '🔄 Qwen Triage is running' lifecycle comment kept claiming the run was in progress forever — the verify lane has publish-verify to catch its cancelled case, but the triage lane has no other publisher. Run the step under always() (still gated on a resolved number), branch on job.status to say the run was cancelled rather than 'ended early', and point the reader at re-running. The step body is already best-effort throughout, so widening the condition cannot fail the job. * test(triage): pin the cancelled finalize condition in the shape test * fix(triage): finalize status comment only on this run's own comment The cancelled finalize PATCHes whatever lifecycle comment the marker lookup finds. When a run is cancelled before its own status claim posts, the lookup lands on a previous run's comment — including the terminal verdict wording written by qwen-triage-finalize.yml, which shares the marker — and rewrites it to "was cancelled". Only PATCH a comment this run owns: the claim embeds the run link, so ownership is observable as the found body containing $RUN_URL. A found but foreign comment is left untouched; a missing one is still POSTed. Also pin what the shape test could not: the cancelled branch's Chinese wording, and an executed-composer test that runs the step's script against a stubbed gh to assert the posted body for each (TRIAGE_OUTCOME, JOB_STATUS) combination plus the ownership cases — swapping the success and cancelled bodies no longer survives the suite. * test(triage): pin the last-comment selector in the finalize ownership lookup Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(triage): harden finalize ownership pins and document lane race Round-4 review feedback: - Negatively assert the ZH terminal wordings too, so a composer body mixing two terminal states cannot pass the combos loop. - Cross-pin the claim and finalize steps' RUN_URL env definitions, which the ownership contract couples; one-sided drift would otherwise make finalize classify its own claim as foreign. - Document the accepted lane race with qwen-triage-finalize.yml's update_status writer at the ownership rule. * fix(triage): bound finalize ownership match to the exact run link * fix(triage): never strand a running claim in the finalize step A foreign lifecycle comment made finalize skip every write, so a claim whose POST had failed — or a legacy marker body that carries no run URL — stayed at "running" forever. Post a fresh terminal comment for unowned markers instead; the rare lane race costs one extra comment but the thread always ends in a terminal state. The marker lookup also picked the newest comment before asking who owns it, letting a newer foreign comment mask this run's own claim. Select the last comment this run owns so the classifier is order-independent, and treat an unreadable comment list as its own state (warn and skip) instead of conflating it with "no comment" and posting a duplicate. The success wording is now gated on the job not failing: 'Check triage response' exits 1 on an empty summary while steps.triage.outcome stays 'success'. The behavioral test ran the step body without errexit even though GitHub adds -eo pipefail, so such regressions stayed green; align the harness with the real shell flags and add the missing {success, failure} combo. Also reword the cancelled message, which prescribed a re-run the run cannot know is necessary — cancellation is usually cancel-in-progress supersession — and switch the two Chinese strings to full-width punctuation per the file's convention. * fix(triage): reclaim stranded running claims in the claim step (#8436) The finalize foreign arm posts a second lifecycle marker, and once two markers exist the claim step's newest-wins pick never touches an older stranded "running" claim again — the base tree healed those by overwriting its single slot. Select this run's own marker first (a re-run keeps its run_id), then the oldest still-running marker, then the newest. Also reword the stale "no second post" comments to the ownership semantics, soften the finalize invariant to its best-effort boundary, and pin the previously untested behavior: one write-failure scenario per finalize write arm, the empty-vs-foreign diagnostic, the legacy marker path, and the last-own-marker rerun selection. * fix(triage): keep the finalize status flip off live running claims (#8436) qwen-triage-finalize.yml's update_status is the third writer of the lifecycle marker and still picked the newest one unconditionally. When it fires while a triage run is in flight, that newest marker is the run's live "running" claim: PATCHing it erases the run URL the run's finalize keys on, so the run classifies foreign and posts a second comment, while the overwritten one — never the newest again and no longer "running" for the claim step's reclaim — strands forever. Prefer the newest marker that is not a live running claim, falling back to the base newest-wins overwrite only when running markers are all the thread has. Pin the selector with an executed test. Also give the claim step's marker selection the one-line stderr diagnostic the finalize step's arms already have, so a maintainer investigating "the bot overwrote the wrong comment" can see which arm fired and which id was chosen without refetching the comment list. The two lifecycle harnesses each pasted their own gh-stub + runner and had already diverged (only the finalize stub had the failure arms), so a contract fix would have to land twice or silently degrade one test. Extract one shared makeGhHarness, and use the arms it brings to pin the claim step's previously untestable guards: one write-failure scenario per `|| echo` arm, the `|| EXISTING_ID=''` list-failure fallback, the legacy marker slot, the last-own-marker rerun selection, and the claim body starting with the lifecycle marker every selector is gated on. Also pin the finalize composer's `[view run]($RUN_URL)` embedding, the finalize-side twin of the claim-side coupling already pinned above it. * fix(triage): key the status finalize on the claim's exported comment id (#8436) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(triage): pin claim --jq '.id' extraction and document finalize empty-id loss (#8436) --------- Co-authored-by: verify <verify@local> Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> |
||
|
Shaojin Wen
|
63a99c2c11
|
fix(autofix): decline fork PR reviews instead of routing them to a scan that cannot authenticate (#8671)
GitHub hands no repository secrets to a workflow run tied to a pull request whose head lives in a fork — the run header reads `Secret source: None` — so `secrets.CI_DEV_BOT_PAT` arrives empty and every `gh` call made with it is unauthenticated. Route admitted those PRs anyway. The real-time fork branch spent two API reads deciding it, then review-scan spent three more failing and exited 1 on `metadata_fetch_failed` — a reason whose blocked comment promises "a later scheduled scan will retry", true for a 5xx and false for a credential the run was never handed. Every review of a fork PR reddened the workflow while changing nothing, and that noise buried the failures that do need a human. The branch's comment explained the admission by saying the event "runs in BASE-repo context". That holds for the workflow FILE, which is read from base, but not for the credentials. So decline in route, exactly as the `pull_request` label branch already does for the same reason. Nothing that functioned is lost: the admitted path could never authenticate, and the scheduled scan admits fork takeover PRs in repo context on its own. Real-time pickup for fork PRs needs a credentialed lane, which a `workflow_run` bridge provides separately. Chosen over gating the PAT-backed jobs on a route output: that reached the same outcome through a new output, two job conditions and a concurrency expression that hand-mirrored them, while route already declines this class of event one branch away and the two API reads still got paid for. Also add a hard guard on an empty PAT at the top of review-scan. No job `if:` can read the `secrets` context, so a deleted or renamed secret — or a lane nobody has modelled — is invisible until the step looks, and it must stop there: unauthenticated reads answer as if the repository held no PRs, which the scan would report as a healthy fleet of zero and stay green while the loop is dead. Tests: the fork-admission replay becomes a fork-decline replay over the same shapes (including the two the removed branch existed to admit), and pins that the decline costs no API call; the new guard is replayed under bash with a present-PAT negative control. Co-authored-by: verify <verify@local> |
||
|
易良
|
5fdcdb28e2
|
fix(ci): avoid root-owned npm cache workspace files (#8669) |