Skip to content

ci(build-release): gate smoke to tag/schedule/dispatch only #878

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danielmeppiel merged 2 commits into from
Apr 23, 2026
Merged

ci(build-release): gate smoke to tag/schedule/dispatch only #878

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8ed2cf0
ci(build-release): gate smoke to tag/schedule/dispatch only
danielmeppiel Apr 23, 2026
58c40e7
ci(build-release): sync .apm canonical + add PR ref to changelog
danielmeppiel Apr 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/instructions/cicd.instructions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ integration suite runs only at merge time via GitHub Merge Queue
- `.github/CODEOWNERS` requires Lead Maintainer review for any change
to `.github/workflows/**`.
4. **`build-release.yml`** - `push` to main, tags, schedule, `workflow_dispatch`
- **Linux + Windows** run combined `build-and-test` (unit tests + binary build in one job).
- **Linux + Windows** run combined `build-and-test` (unit tests + binary build in one job). Unit tests run on every push for platform-regression signal; **smoke tests are gated to tag/schedule/dispatch only** (promotion boundaries) to avoid duplicating `ci-integration.yml`'s merge-time smoke and to cut redundant codex-binary downloads.
Copy link

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This update changes the CI/CD behavior described here, but there are still other in-repo copies of these CI/CD instructions that will now drift (e.g., .apm/instructions/cicd.instructions.md and custom-instructions/repo/.github/instructions/cicd.instructions.md still state that build-and-test includes smoke on every push). Since .github/instructions/ is regenerated from .apm/ (per the repo changelog), consider updating the canonical .apm/ copy and re-running the regeneration so all instruction copies stay consistent.

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Collaborator Author

@danielmeppiel danielmeppiel Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right call. The .apm/ copy was stale by three PRs (#874, #875, this one). I synced .apm/instructions/cicd.instructions.md to the .github/ copy in 58c40e7 and verified apm install --target copilot regeneration produces identical .github/ content (no further drift). Thanks for flagging the systemic dogfooding issue.

- **macOS Intel** uses `build-and-validate-macos-intel` (root node, runs own unit tests - no dependency on `build-and-test`). Builds the binary on every push for early regression feedback; integration + release-validation phases conditional on tag/schedule/dispatch.
- **macOS ARM** uses `build-and-validate-macos-arm` (root node, tag/schedule/dispatch only - ARM runners are extremely scarce with 2-4h+ queue waits). Only requested when the binary is actually needed for a release.
- Secrets always available. Full 5-platform binary output (linux x86_64/arm64, darwin x86_64/arm64, windows x86_64).
Expand Down
20 changes: 18 additions & 2 deletions .github/workflows/build-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,11 +69,27 @@ jobs:
- name: Install dependencies
run: uv sync --extra dev --extra build

- name: Run tests
# Unit tests run on every push for fast platform-regression signal.
# Smoke is intentionally NOT included here: it duplicates ci-integration.yml's
# merge-time smoke gate and burns a real codex binary download per platform
# per push (~15 redundant runs/day). Smoke is gated to promotion boundaries
# below (tag/schedule/dispatch) where it actually serves as a pre-ship gate.
- name: Run unit tests
env:
GITHUB_TOKEN: ${{ secrets.GH_MODELS_PAT }}
GITHUB_APM_PAT: ${{ secrets.GH_CLI_PAT }}
run: uv run pytest tests/unit tests/test_console.py -n auto --dist worksteal

# Smoke runs only at promotion boundaries:
# - tags (pre-ship release gate; only place tag-cut releases get smoke validation)
# - schedule (nightly regression catch for upstream codex URL drift)
# - workflow_dispatch (manual safety net)
- name: Run smoke tests
if: github.ref_type == 'tag' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
env:
GITHUB_TOKEN: ${{ secrets.GH_MODELS_PAT }}
GITHUB_APM_PAT: ${{ secrets.GH_CLI_PAT }}
run: uv run pytest tests/unit tests/test_console.py tests/integration/test_runtime_smoke.py -n auto --dist worksteal
run: uv run pytest tests/integration/test_runtime_smoke.py -v

- name: Install UPX (Linux)
if: matrix.platform == 'linux'
Expand Down
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Changed

- CI: smoke tests in `build-release.yml`'s `build-and-test` job (Linux x86_64, Linux arm64, Windows) are now gated to promotion boundaries (tag/schedule/dispatch) instead of running on every push to main. Push-time smoke duplicated the merge-time smoke gate in `ci-integration.yml` and burned ~15 redundant codex-binary downloads/day. Tag-cut releases still run smoke as a pre-ship gate; nightly catches upstream codex URL drift; merge-time still gates merges into main.
Copy link

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changelog entries in this repo appear to require a PR reference at the end (e.g., "(#123)"). This new Unreleased entry does not include a PR number, which will break the established changelog format and makes it harder to trace changes back to the originating PR. Please append the PR number in the same style as adjacent entries.

See below for a potential fix:

- CI: smoke tests in `build-release.yml`'s `build-and-test` job (Linux x86_64, Linux arm64, Windows) are now gated to promotion boundaries (tag/schedule/dispatch) instead of running on every push to main. Push-time smoke duplicated the merge-time smoke gate in `ci-integration.yml` and burned ~15 redundant codex-binary downloads/day. Tag-cut releases still run smoke as a pre-ship gate; nightly catches upstream codex URL drift; merge-time still gates merges into main. (#869)
- CI docs: clarify that branch-protection ruleset must store the check-run name (`gate`), not the workflow display string (`Merge Gate / gate`); document the merge-gate aggregator in `cicd.instructions.md` and mark the legacy stub workflow as deprecated. (#869)

### Removed

- CI: deleted `ci-integration-pr-stub.yml`. The four stubs were a holdover from the pre-merge-gate model where branch protection required each Tier 2 check name directly. After #867, branch protection requires only `gate`, so the stubs are dead weight. Reduced `EXPECTED_CHECKS` in `merge-gate.yml` to just `Build & Test (Linux)`. (#869)

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Collaborator Author

@danielmeppiel danielmeppiel Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch — appended (#878) to the entry in 58c40e7. Thanks!

- CI docs: clarify that branch-protection ruleset must store the check-run name (`gate`), not the workflow display string (`Merge Gate / gate`); document the merge-gate aggregator in `cicd.instructions.md` and mark the legacy stub workflow as deprecated.

### Removed
Expand Down
Loading