mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
4afb949223
The merge assertion was a job nobody depended on. ci-orchestrator needed the scope, the branch prefix and the affected roles -- not it -- so a PR whose base was not merged in went on to spend five distros on a deploy sweep and reported a single red job beside a chain that had already finished. Validation is now a reusable workflow every entry calls, and what it checks follows the event and the inputs rather than the caller: a pull request gets its branch prefix and merge base asserted, a run carrying a selection gets that selection checked, a fork PR waits here for the privileged run's images. The wait and its gate move in with it, so the orchestrator no longer keeps a second copy of that logic. Every downstream job depends on the gate. The selection check is what the last two nights needed. cli.meta.ci.validate resolves every token against the branch that would deploy it -- role, variant, mode, onion state -- and reports all offenders at once. Until now the matrix builder raised on the first bad token from inside a chunk job, so a stale priority line cost one full CI round per entry and only ever showed the next problem after the previous one was fixed. Measured on a real list: three unusable tokens, one pass. A bare role name that matches nothing is a warning, not an error: the diff-derived whitelist legitimately names roles the lifecycle envelope filters out. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
28 lines
995 B
Bash
Executable File
28 lines
995 B
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Validate a run's selection inputs against the branch it would deploy from,
|
|
# before any runner is spent on it.
|
|
#
|
|
# Inputs via env:
|
|
# INPUT_WHITELIST whitelist value of the run ('' = nothing to check)
|
|
# INPUT_PRIORITY priority line of the run ('' = nothing to check)
|
|
# INPUT_MODE deploy modes the run draws from
|
|
# INPUT_TOR tor axis of the run
|
|
# INPUT_LIFECYCLES lifecycle envelope of the run
|
|
#
|
|
# Exits non-zero when a token names a row this branch does not have or pins an
|
|
# axis the row cannot take; cli.meta.ci.validate reports every offender at once,
|
|
# so a stale list is fixed in one pass rather than one CI round per entry.
|
|
|
|
set -euo pipefail
|
|
|
|
# shellcheck source=scripts/meta/env/load.sh
|
|
source scripts/meta/env/load.sh
|
|
|
|
"${PYTHON}" -m cli.meta.ci.validate \
|
|
--whitelist "${INPUT_WHITELIST:-}" \
|
|
--priority "${INPUT_PRIORITY:-}" \
|
|
--modes "${INPUT_MODE:-auto}" \
|
|
--tor "${INPUT_TOR:-auto}" \
|
|
--lifecycles "${INPUT_LIFECYCLES:-}"
|