{{ message }}
Repository navigation
Fix CI contracts and custom grader download failures - #70217
Merged
Merged
Conversation
Surface registered custom grader artifact download failures without changing best-effort log downloads. Align grader help, token validation, checkout command recording, and Agy caller permissions with current runtime contracts. Document newly introduced work-queue diagnostics within the guidance budget. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
Contributor
|
🔎 PR Code Quality Reviewer is reviewing code quality for this pull request... |
Contributor
|
🧠 Matt Pocock Skills Reviewer is reviewing this pull request using Matt Pocock's engineering skills... |
Contributor
|
🔬 Test Quality Sentinel is analyzing test quality on this pull request... |
Contributor
|
✂️ Ponytail Reviewer has started processing this pull request |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Expired optional grader artifacts can prevent audits from rendering otherwise available results.
2 open issues
What changed in this PR
Repairs gh-aw CI contract checks and surfaces registered custom-grader download failures while preserving best-effort bulk downloads.
Changes:
- Updates diagnostic guidance within the playbook’s word budget.
- Aligns test fixtures and Agy permissions with current contracts.
- Propagates custom-grader download errors and tests cleanup and recovery.
| File | Description |
|---|---|
pkg/workflow/security_architecture_rs05a_formal_test.go |
Records checkout output-command calls for safety assertions. |
pkg/workflow/github_token_validation_test.go |
Expects rejection of conclusion token-minting steps. |
pkg/workflow/agy_engine_test.go |
Checks caller and job-scoped permissions. |
pkg/cli/logs_download.go |
Adds strict download-error option. |
pkg/cli/logs_download_artifacts.go |
Returns download failures when requested. |
pkg/cli/graders_integration_test.go |
Updates grader help expectations. |
pkg/cli/audit_custom_graders.go |
Enables strict custom-grader downloads. |
pkg/cli/audit_custom_graders_test.go |
Tests failed-download cleanup and later recovery. |
.github/workflows/credentials-check.yml |
Grants the Agy caller read-only PR access. |
.github/aw/debug-playbook.md |
Documents expiry and hard-clear codes; condenses guidance. |
Review effort: Max
| } | ||
| if err := downloadArtifactsByName(ctx, downloadArtifactsOptions{ | ||
| runID: cfg.runID, outputDir: cfg.outputDir, owner: cfg.owner, repo: cfg.repo, hostname: cfg.hostname, verbose: cfg.verbose, | ||
| failOnDownloadError: true, |
Comment on lines
+166
to
+168
| if opts.failOnDownloadError { | ||
| return fmt.Errorf("failed to download artifact %q: %w", name, cmdErr) | ||
| } |
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix the failures observed in main CI run 39229760817 and the related CGO run 39226402518:
getExecOutputcalls in the checkout bridge so existing fetch-safety assertions observe the current implementation.Validation
make buildandmake fmtmake test-guidance(15 tests)go test ./pkg/cli ./pkg/workflow -run '^(TestAuditCustom|TestAgyProductionConformancePermissionsAreBoundedAndScoped|TestFormalRS05a_|TestDownloadArtifactsByName)' -count=1go test -tags integration ./pkg/cli ./pkg/workflow -run '^(TestGradersCommandIntegration|TestGitHubTokenValidation.*)$' -count=1actionlint -oneline .github/workflows/credentials-check.ymlmake agent-report-progress: impacted unit tests passed; lint initially encountered another session's shared linter lock. Retried the non-test gate with an isolatedTMPDIR:make agent-report-progress-no-testpassed lint, schema freshness, and workflow drift checks (345 workflows in sync).No workflow runs were dispatched.