You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Nightly 0.23.1-nightly.20261103.a can't pass Pack BAML wrapper candidates. #5422 made that job and Wrapper tests gate all-builds.
Run 41798478057: the BCS project and environment variables were unset. They are now set as GitHub environment variables; B-2011 tracks moving them to secrets.
Run 41823460220, on canary after feat: point baml-in-baml bcs telemetry at prod #5491: Cannot embed telemetry: API-key verification failed … requires the 200 JSON introspection response. Production BCS still answers POST /v1/auth/verify {"fullResponse":true} with 204. bcs_api/README.md notes that server support has to be deployed before embedding can work.
The candidates aren't shipped yet, so this PR stops nightlies from requiring them:
build2-baml-wrapper.reusable.yaml and wrapper-tests.reusable.yaml take a new enabled input, which defaults to true, so ci.yaml is unchanged. release-baml-language.yml passes enabled: channel != 'nightly'.
The jobs still run on nightly, as no-ops; they are not skipped. A skipped ancestor of all-builds would also skip every publisher that uses the implicit success() (see Guard release tail from expected nightly skips #4218). The pack job's steps are all guarded, and in wrapper tests only the tests matrix is skipped, while platforms still runs.
The release fingerprint gate requires every fingerprinted artifact family, so tools/release-fingerprintscheck takes a new allow_missing family name. all-builds passes --allow_missing baml-wrapper-candidates on nightly. A candidates artifact that is present is still checked.
Canary releases still require all of it.
Revert once production BCS supports key introspection and nightly packing passes.
Validation:
actionlint passes on the three workflows.
baml-cli test --from tools/release-fingerprints passes 2/2, using this branch's toolchain.
Ran check against a local artifacts directory: without the flag it reports the missing candidates; with the flag that problem goes away; a present but empty candidates artifact still fails.
Nightly dry run 41810686735, on the first commit: both wrapper jobs succeeded as no-ops and All builds gate ran instead of being skipped. It then failed only on the missing candidates artifact, which the second commit fixes.
Nightly release workflows now skip BAML wrapper candidate builds and wrapper tests. These steps remain enabled for other release channels.
Reusable build and test workflows now support an optional enable/disable setting, enabled by default, so their corresponding steps can be skipped while the workflow remains runnable.
Nightly release checks allow the BAML wrapper candidate artifact to be absent. Other release channels still require it, and commit verification remains in place.
No actionable comments were generated in the recent review.
Walkthrough
Reusable wrapper build and test workflows add an enabled input. The release workflow disables both for nightly releases and allows the wrapper candidate artifact to be missing in nightly fingerprint checks.
Both workflows add an enabled input that defaults to true. The build workflow gates its build steps on the input. The test workflow gates its tests job on the input.
Nightly fingerprint checks allow the wrapper candidate artifact to be absent. The commit check remains active, and present artifacts are still checked.
BoundaryML/baml#5483: Changes the wrapper release workflows and establishes the artifact flow modified here.
BoundaryML/baml#5491: Changes the wrapper packing workflow and BCS credential contract used by the nightly packing path.
BoundaryML/baml#5422: Adds the reusable wrapper build and test workflows changed here.
Suggested reviewers:2kai2kai2, hellovai
Merge Risk: Minimal · up to 40c39
No actionable issue is established that would block merging the nightly release change after normal checks.
Security architecture risk: Minimal · up to 40c39
Nightly releases intentionally omit unpublished wrapper candidates and the wrapper test matrix. The change preserves the remaining release gates and does not broaden permissions or secret access.
Retained concerns
No architecture-level concerns identified.
Security review details
Security Blast Radius
observed — The configured validation exception affects one nightly artifact family. Candidate uploads are named baml-wrapper-candidates, while the privileged wrapper publisher downloads wrapper-* and separately verifies that artifact set, preserving their separation.
Trust Boundaries and Controls
observed — Production releases still require the workflow SHA, immutable source tag, checkout and successful canary push CI run to identify the same source commit. The new exception neither changes these identity checks nor derives its allowed family from downloaded artifact contents.
Resilience and Maintainability Implications
observed — An absent allowed family may pass, but a present empty candidate directory, archive extraction error or binary missing the release commit still produces a validation failure. Missing other fingerprinted families also fails. These failures remain connected to the aggregate publication gate.
Pre-merge checks: 4
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title clearly and concisely describes the main change: nightly releases no longer require BAML wrapper candidates.
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks the nightly queue The wrapper waits; the tests do too A missing bundle may pass the gate If found, its fingerprints still rate At dawn, the other channels run And hop along when checks are done
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Repository UI
Review profile: CHILL
Plan: Advanced
Run ID: c71687f3-cb3e-4e0f-a33a-7bef6acc2f8d
Commits
Reviewing files that changed from the base of the PR and between 15b1845 and 40c39b8.
Files skipped from review as they are similar to previous changes: 1
.github/workflows/release-baml-language.yml
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.
⚠️ Please fix the size gate issues or acknowledge them by updating baselines.
Artifact
Platform
File
Gzip
Gated on
Baseline
Delta
Status
✅
baml-cli
Linux
🔒 64.3 MB
27.3 MB
file
73.1 MB
-8.8 MB (-12.0%)
OK
❌
packed-program
Linux
🔒 39.1 MB
16.0 MB
file
29.2 MB
+9.9 MB (+34.0%)
FAIL
❌
bridge_wasm
WASM
25.9 MB
🔒 7.6 MB
gzip
5.7 MB
+2.0 MB (+35.0%)
FAIL
🔒 = the size this artifact is GATED on (ceiling + delta). Binaries gate on file size (installed binary); WASM gates on gzip (download size). The other size is shown for information only.
Details & how to fix
Violations:
packed-program (Linux) file_bytes: 39.1 MB exceeds limit of 30.1 MB (exceeded by +9.0 MB, policy: max_file_bytes)
packed-program (Linux) file_delta_pct: +34.0% exceeds limit of 3.0% (exceeded by +31.0pp, policy: max_delta_pct)
bridge_wasm (WASM) gzip_bytes: 7.6 MB exceeds limit of 5.9 MB (exceeded by +1.8 MB, policy: max_gzip_bytes)
bridge_wasm (WASM) gzip_delta_pct: +35.0% exceeds limit of 3.0% (exceeded by +32.0pp, policy: max_delta_pct)
#5422 made `Pack BAML wrapper candidates` and `Wrapper tests` gate
`all-builds`, but the wrapper BCS release variables
(BAML_WRAPPER_BCS_PROJECT / BAML_WRAPPER_BCS_ENVIRONMENT) are not
configured, so every nightly now fails before publishing
(0.23.1-nightly.20261103.a, run 41798478057).
Nightlies now run both jobs as no-ops. They are not skipped, because a
skipped ancestor of `all-builds` would also skip every publisher that
relies on the implicit success(). Canary releases still require both.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
…ates
The nightly dry run reached `All builds gate`, which then failed with
"no baml-wrapper-candidates artifact was downloaded", because the
fingerprint gate requires every fingerprinted family. Add an
`allow_missing` parameter to the checker and pass it for
baml-wrapper-candidates on nightly releases. A candidates artifact that
is present is still checked.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions
Inactive
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Nightly
0.23.1-nightly.20261103.acan't passPack BAML wrapper candidates. #5422 made that job andWrapper testsgateall-builds.Cannot embed telemetry: API-key verification failed … requires the 200 JSON introspection response. Production BCS still answersPOST /v1/auth/verify {"fullResponse":true}with204.bcs_api/README.mdnotes that server support has to be deployed before embedding can work.The candidates aren't shipped yet, so this PR stops nightlies from requiring them:
build2-baml-wrapper.reusable.yamlandwrapper-tests.reusable.yamltake a newenabledinput, which defaults totrue, soci.yamlis unchanged.release-baml-language.ymlpassesenabled: channel != 'nightly'.all-buildswould also skip every publisher that uses the implicitsuccess()(see Guard release tail from expected nightly skips #4218). The pack job's steps are all guarded, and in wrapper tests only thetestsmatrix is skipped, whileplatformsstill runs.tools/release-fingerprintschecktakes a newallow_missingfamily name.all-buildspasses--allow_missing baml-wrapper-candidateson nightly. A candidates artifact that is present is still checked.Revert once production BCS supports key introspection and nightly packing passes.
Validation:
actionlintpasses on the three workflows.baml-cli test --from tools/release-fingerprintspasses 2/2, using this branch's toolchain.checkagainst a local artifacts directory: without the flag it reports the missing candidates; with the flag that problem goes away; a present but empty candidates artifact still fails.All builds gateran instead of being skipped. It then failed only on the missing candidates artifact, which the second commit fixes.🤖 Generated with Claude Code
Summary by CodeRabbit