Repository navigation
feat(ci): select checks by semantic mise config changes (shadow mode) - #194
Merged
Merged
Conversation
Scan workflow and action run steps for mise task calls, map each to the checks it selects, and fail the self-test when a call has no table entry or an entry has no call. Config tasks named in scripts or file tasks are Full roots. All table rows were confirmed against the job conditions; none changed.
load_ci_inputs now returns CiInputs with roots and forced Full reasons for unresolved calls, roots absent from the task graph and template prefixes that match no task. Backslash-continued run lines are joined before the scan.
load_revision copies .config/mise, .github and scripts of a revision out of the checkout and lists its tasks with mise isolated from the developer's global, system and environment config. impact compares two revisions: head drift exits 1, every other failure selects full with a config reason. The raw TOML table of each config task joins its body, so a run_windows-only edit counts.
…ables --lenient reads head workflow calls without a task_table entry as Full roots, for the replay of historical commits only; CI never passes it. The isolated mise run also sets MISE_PROFILE, MISE_OVERRIDE_CONFIG_FILENAMES and MISE_DEFAULT_CONFIG_FILENAME empty, so a developer's own values cannot change the result.
When .config/mise/config.toml changes, ci-changes runs ci-mise-impact.mbtx from the merge base (pull_request, merge_group and the local BASE HEAD form) or PUSH_BASE (push) to head, and logs each reason and the selection it would make on stderr. The path rule still decides while mise_selection_enforced is false, so the key=value output and GITHUB_OUTPUT do not change. select takes an optional MiseImpact. With it, the config path leaves the path rules and the impact adds its checks; a full impact or an unknown check name selects every check. When enforced, table drift fails and any other child failure selects full.
Exit 1 of ci-mise-impact.mbtx counts as table drift only when stderr has the drift message; a crash, a compile failure or another uncaught error that also exits 1 now gives a full impact. The child run has a 120 s timeout that gives a full impact; @process.run stops the child before it returns. The shadow event test now compares stdout and the appended GITHUB_OUTPUT with the path-only rendering.
- setup:llvm runs only in a macOS step, which no focused job has, so it is Full. The task table comment now says that step-level if: counts. - The mention scan skips ci-mise-impact.mbtx: its fixtures named the real opt-in task test:codec-adapter-mck and made it a Full root. The fixtures now use names that are not in the config. - Git reads each revision from the top level of the work tree, with ls-tree --full-tree, so a run from a subdirectory sees the config. A config absent at both revisions is Full. - shell_words splits on < and > and reads a trailing backslash as white space. A CI-reached task that calls a name which is a task at neither revision is Full. Tests: redirection and backslash calls, unknown calls, a run from a subdirectory, a config absent at both revisions, setup:llvm Full, and real-config opt-in edits and an add that select nothing.
Before the reason lines, ci-changes prints on stderr which revisions the impact compared and the mise version the child reported. Stdout and GITHUB_OUTPUT do not change. The shadow test checks the header line and its order.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
3 of 5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Any change to
.config/mise/config.tomlselects full installation and platform qualification, even when the change only adds an opt-in task. In 9 of the 17 config changes since #125, the config path was the only reason for full qualification. Those PR runs took a median of 27 min, against 13 min for focused runs.Tracked in beads:
morphir-ukvn.5.62(design stored in the bead), plan epicmorphir-ukvn.5.62.1, under the CI landing-speed epicmorphir-ukvn.5.90.What this PR does (shadow mode)
scripts/ci-mise-impact.mbtx. It compares the mise configuration at two revisions and prints one JSON impact (full,checks,reasons).[tools],[env],[hooks],[settings]) are parsed with the pinnedbobzhang/[email protected]and mapped to checks by a rule table. An unknown key selects full.mise tasks ls --json, run in an isolated copy of the revision, plus each task's raw TOML. A task change selects the checks of the workflow-called tasks that reach it throughdepends,depends_post,wait_forormise run. Shadowing by name or alias counts as a change. A task named in a script or file task selects full.test:cialso fails on unmapped or stale entries).scripts/ci-changes.mbtxruns it only when the config path changed and logs on stderr what it would select. The selection CI uses does not change: stdout andGITHUB_OUTPUTstay byte-identical, the child has a 120 s timeout, and any child failure is logged and ignored.test:ciruns the new self-test.Enforcement is a separate one-line PR (
morphir-ukvn.5.62.1.8). It waits until at least 5 merged config PRs have shadow logs in which no dropped check failed.Validation
mise run test:ci,mise run lint,mise run lint:moonbitandmise run validatepass at4046644.run_windows-only edits, renames, invalid TOML, missing revisions, config added or deleted, a subdirectory working directory), 51 task mutations that must keep their checks, and 35 opt-in task edits that must select nothing.--lenientfor old workflows): 8 would skip full (feat(workbench): verify and download generated artifacts #147, Package production codec adapters as Wasm artifacts #148, feat(workbench): add authenticated HTTP checking policies #140, Enable capability checking policies in desktop Workbench #136, Replace Workbench job terminology with execution #135, Retain Scheme job policy through worker execution #128, feat: qualify MoonBit String libraries and workbench #130, feat: check Scheme capabilities as code executes #126). e2f85a3 (Add rich-design workflow and beads companion skills #138) keeps full because it changestest:ci. No check the new selection drops failed on any of those PRs.This PR changes
scripts/ci-changes.mbtx, so its own CI runs full qualification.