mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-11-11 12:12:19 -10:00
feat/btw-qodercli-alignment
50
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
3016bf8453 |
fix(ci): keep sdk-java resolver bookkeeping and in-house jars out of the host cache (#15281) (#15286)
* fix(ci): scope the sdk-java test-job lock to the cache write-back (#15281) * fix(ci): keep sdk-java SDK resolution job-local (#15281) * test(cli): keep malformed-Unicode case titles JUnit-safe (#15281) The parametrized malformed-Unicode cases interpolate lone surrogates into the test title. Vitest's JUnit reporter drops a lone low surrogate together with the preceding character — the semicolon of an ' entity — which makes packages/cli/junit.xml invalid and fails the CI report publisher. Render the case as JSON in the title and keep the raw value in the body. * fix(ci): unlink seeded Maven metadata before the unlocked suite (#15281) Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): harden the SDK Java host-cache isolation (#15281) Widen the seeded resolver-bookkeeping unlink to every seed site and the release lane, prune pre-PR in-house coordinates inside the locked write-back, and keep the suite's exit status so a failed leg still publishes its downloads. Extend the workflow meta-tests to pin each invariant and update the bilingual design record. Co-authored-by: Qwen-Coder <[email protected]> * test(ci): pin the first mvn failure guard in the SDK Java suite-status test (#15281) * fix(ci): harden SDK Java write-back isolation and lock verdicts (#15281) Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): keep Maven resolver bookkeeping out of the shared cache (#15281) * chore(ci): restore the size baseline final newline (#15281) Co-authored-by: Qwen-Coder <[email protected]> * test(managed-agent): align workspace upload admission probes (#15281) The two Workspace upload routes joined the WORKSPACE_FILES rule class without extending the acceptance probe's request builder, so the generic JSON/empty-body request was rejected by argument binding before admission. Send the octet-stream upload its required query parameters and the status query its uploadId, and pin the status route's own not-found code for a stranger. * fix(ci): close remaining Maven cache isolation gaps Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): update Maven cache cleanup contract Co-authored-by: Qwen-Coder <[email protected]> * test(ci): create runner temp for Maven seed replay Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: qwen-autofix <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> Co-authored-by: yiliang114 <[email protected]> |
||
|
|
e99286813e |
fix(ci): preserve Maven suite results across cache write-back failures (#15274)
* fix(ci): scope the sdk-java test lock to the cache write-back (#15262) The Managed Agent fast tier can fail without reporting a test result after waiting out the per-host SDK Java lock. #15128 scoped the MariaDB lane's lock to its cache write-back, but the test job still held the same lock across the SDK and Managed Agent Maven suites, so a long full-tier suite could starve the fast tier on that host. Seed the test job's Maven repository from the host cache, run both suites unlocked from that job-local copy, and take the ticketed host lock only for the cache write-back. The write-back children close fd 9 so a cancelled job's survivor cannot retain the lock. Pin the new order and the write-back fd closures in the workflow tests, and update the fair-lock design docs and the workflow size baseline. Fixes #15262 Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): keep sdk-java cache write-back best-effort (#15262) * fix(ci): keep the sdk-java gate result across the cache write-back (#15262) The write-back runs after the suite, so the step's exit code must come from the suite: both lanes now track the Maven status, demote only a lock-wait timeout with a step-summary record, and redden when the queue itself is unusable. The wait drops to 1800 s because it guards only the bounded copy; the seed stops hiding cp's diagnosis while staying quiet on a fresh host; the design docs record the head-of-queue stall the shorter hold does not bound. * fix(ci): revert the sdk-java lock helper to the PR footprint (#15262) The previous round changed .github/scripts/sdk-java-lock.sh, which this PR never touched; the deterministic gate rejects that expansion. Restore the helper and keep both call sites on the pre-round `if !` shape, retaining the 1800 s wait and the step-summary record. Drop the status-2 pins and tests that only existed for the reverted helper, and record the unusable-queue gap as a follow-up in the design docs. The timeout-returns test stays. Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): de-alias every resolver tracking file and guard an unusable lock queue (#15262) * fix(ci): de-alias Maven install metadata in the sdk-java seed (#15262) Co-authored-by: Qwen-Coder <[email protected]> * test(ci): restore the per-job Maven seed binding (#15262) * fix(ci): keep sdk-java resolution metadata out of the host cache (#15262) The seed drops maven-metadata-*.xml hardlinks, but the write-back still published job-local metadata with cp -n, where the first publisher's copy could never be refreshed. Exclude it at both write-back sites and pin the seed and write-back name sets to each other. Also witness each suite-status exit with an exit-1 case, restore the lock test's combined-stream assertion, and bring the design docs' acceptance criteria and fault arms up to date. * test(ci): carry the deferred-status helper into the sdk-java slices The tolerated-skip arms now call mvn_report_failed_suite, which the step defines above the lock block. Every slice that starts at lock_setup_fault() or at the write-back therefore ran bash -e without the definition and died with 127, which read as a code failure rather than a missing prelude. * docs(ci): clarify remaining sdk-java cache hardening scope * fix(ci): bound failed MySQL cache waits and exclude resolver residue Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): clear inherited resolver state in the Maven cache seed prune The seed de-alias prunes carried -links +1, which restricted deletion to the hardlinks cp -aln created in this job. RUNNER_TEMP survives across jobs on the pool, so a previous job's mutable resolver state (nlink 1 *.lastUpdated, _remote.repositories, resolver-status.properties) survived in the job-local repository and could redden an otherwise green Maven lane. Drop -links +1 from all four seed prunes so inherited state is cleared again; the write-back's -links 1 delta filter is unchanged and the seed stays best-effort (2>/dev/null || true). Move the deAlias test pin with the fix and add a regression witness that plants single-link markers in the job-local repository before the seed body runs and asserts they are gone (red with -links +1 restored, exit 1; green with the fix, on macOS and Linux). Re-record the sdk-java.yml .size-baseline entry (153970 bytes) and synchronize both design-doc languages, including the nine-coordinate set the main merge brought in. --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Qwen Autofix <[email protected]> Co-authored-by: qwen-code-dev-bot <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> Co-authored-by: yiliang114 <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> |
||
|
|
7cb46d9fed |
feat(hooks): add FileChanged notifications for local sessions (#13969)
* feat(hooks): add FileChanged notifications for local sessions * fix(ci): preserve shell gate coverage and trim transcript data * fix(ci): flush debug prompts and isolate git fixtures * fix(hooks): respect ACP watcher ownership and skill registration * test: stabilize hosted recovery and failed spawn fixtures * fix(ci): budget the complete hosted integration fork * fix(runtime-broker): accept MariaDB CSI guard metadata * test: align schema baseline and hook dispatch waits * fix(ci): allow hosted shared fork to finish all classes * fix(hooks): preserve file watching across errors and cwd changes * fix(ci): isolate reference archive extraction per run * test(ci): keep reference archive checks dependency-free * fix(hooks): constrain recursive watches and repair CI * test(web-shell): synchronize verified connection return * fix(ci): correct runtime broker callback indentation * test(web-shell): match the managed workspace registration label Keep the remote workspace registration smoke checks in sync with the service label added by unified workspace navigation. Preserve exact text matching and all registration and replay assertions. * fix(ci): reduce standalone runtime fixture overhead * fix(hooks): ignore implicit atomic-write temporary files * test(managed-agent): recover initial node port conflicts * fix(hooks): observe parents before discovery anchors disappear * test(managed-agent): await stream cleanup before recovery teardown * test(managed-agent): align hosted shell fixture capabilities * test(managed-agent): let OS choose initial harness port * fix(ci): restore runner-local Java cache permissions * test(runtime-broker): use native execution profile paths * test(managed-agent): bind valid workspace upload probes * test(managed-agent): reuse the upload probe digest fixture * test(managed-agent): bind hook fault listeners to available ports * test(managed-agent): align the native profile path fixture * test(managed-agent): Wait for projection refusal retries * ci: Prepare daemon Java cache before Node preflight * test(managed-agent): check channel model calls after delivery * fix(hooks): observe explicitly registered symlink targets * test(managed-agent): separate consumption from relay snapshots * test(managed-agent): target tamper injection by resource key * test(managed-agent): exhaust attestation EOF retry in fault gates * fix(ci): bound RocketMQ release downloads * test(tui): await the restored assistant before capturing history * fix(ci): use a checksum-pinned RocketMQ mirror * fix(ci): provision missing browser test fonts * fix(ci): quote the font probe environment * fix(ci): prepare browser fonts without elevation * test(core): compare complete prune reports without ordering * fix(ci): repair only runner-local Java tool caches * test(managed-agent): qualify fixture JDBC templates * fix: isolate reconnect hooks and cancellation test fixtures Skip chat initialization so MCP reconnect cannot re-enable file hooks, and keep cancellation fixtures isolated from the background worktree scanner. * fix(ci): tolerate a missing Java cache helper on resumed releases Resuming an existing release checks out a tag that may predate the helper, which failed all five Java jobs before setup-java ran. * fix: finish the main merge for harness deadlines and workflow size Use the renamed settle-timeout accessor in the merged hosted-harness tests, and record sdk-java.yml's new size after the resumed-release cache guard. * style(managed-agent): restore import grouping in merged verification tests * test(managed-agent): require consumed child result mirrors * test(web-shell): center repository settings capture --------- Co-authored-by: yiliang114 <[email protected]> Co-authored-by: yungsen.hys <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> |
||
|
|
a5fec03684 |
fix(ci): fail Java lanes before disk exhaustion (#16068)
* fix(ci): fail Java lanes before disk exhaustion Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): gate the MySQL pool lane instead of a hosted job The disk floor gate landed in hosted-harness-mysql, which runs on ubuntu-latest, so `runner.environment == 'self-hosted'` is never true there and the step was dead code. The job that actually shares the ECS pool disk - mysql-integration, two Maven suites plus a per-leg MySQL container - stayed ungated. Move the step to mysql-integration, immediately after its checkout so the sdk-java-workflow pin still holds. This also clears the three Hosted real-process gates pins, which reject a conditioned step among the setup steps that precede managed_dependencies in hosted-harness-mysql, and reflow the new test to the repo's prettier style. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmvya43o17i * style(ci): drop the blank line left behind in hosted-harness-mysql Moving the disk floor gate out of hosted-harness-mysql left a stray blank line between its checkout and 'Set up Java'. Restoring it makes the whole workflow diff additive on mysql-integration only, so 'hosted-only jobs are unchanged' holds byte for byte and an A/B census of that job reads clean. Co-authored-by: Qwen-Coder <[email protected]> * ci(sdk-java): record the real workflow size after the disk-floor gates The six #16003 disk-floor gate steps grow sdk-java.yml from 154074 to 155650 bytes. main had already drifted 3742 bytes past the recorded 150332 — inside the 4096 allowance, but it left only 354 bytes of ratchet headroom, so this real growth tripped Lint & Static. Record the file's actual size rather than shrinking the gates: each one is a three-line step calling .github/scripts/check-disk-floor.sh, and the workflow test pins all six gated jobs. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmw02ewzoa2 * fix(ci): derive the disk-floor corpus from runs-on and narrow the broker claim Address the two blocking review findings on the Java disk-floor gate: R1-1: the meta-test skipped any job without the gate and compared a closed six-name list, so a newly pool-routed lane that forgot the gate stayed green, and a neutered gate (continue-on-error) kept every assertion true. Derive the corpus from each job's runs-on (same hazard as the setup-java corpus), require gateIndex > -1 per pool-capable lane, and assert the gate carries no continue-on-error. The derived set is the same six jobs today. Verified by mutation: adding continue-on-error to a gate reddens it, and renaming a gate (ungated pool job) reddens it with 'expected -1 to be greater than -1'. R1-2: the step comment claimed RUNNER_TEMP covers the broker store, but the absolute free-KiB floor cannot express the broker's used-ratio refusal (a 952 GiB volume at 94% used still has ample free bytes). Narrow the comment to the gate's real scope (near-full filesystem / inode exhaustion, #10035) and state the broker disk-threshold investigation stays out of scope, matching the PR description. Bump .size-baseline for the comment change (155650 -> 155888). sdk-java workflow meta-test 117 passed / 5 skipped; eslint exit 0, prettier clean; check-workflow-size.sh passes. * fix(ci): calibrate the Java disk floors and fail closed in the meta-test Review round on this PR found the gate could not fire in the two shapes it exists for, and that the meta-test could go green through the same drift it was added to prevent. R1-2: every lane ran the shared 2 GiB / 100k-inode default. The #16003 incident was a used-ratio refusal — the broker reported 0.94 while the 952 GiB volume still had tens of GiB free — so no absolute floor can express that threshold, and 2 GiB is below what these lanes write: a host with 4 GiB free passed the gate and then died mid-suite. Give the five heavy lanes the repo's build-sized 8 GiB floor, leave flyway-migrations and the shared value alone, and add an opt-in DISK_FLOOR_MAX_USED_PCT arm to check-disk-floor.sh for the two broker lanes (90%). R2-1/R2-2: the corpus came from `runs-on` text and skipped jobs outside it, so a lane routed through an expression or a job output shipped ungated while the suite stayed green, and nothing asserted the hosted-only jobs carry no gate. Fail closed: an explicit hosted-only allowlist, a gate required for every other job, a total-count assertion, and a negative assertion on those two jobs. Pin the per-lane floors so dropping one is a test failure. Verified: sdk-java-workflow suite 117 passed, 5 skipped; it goes red when a gate is deleted, when one is added to a hosted job, and when a floor is removed. check-disk-floor suite 12 passed, including four new ratio cases. --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: yiliang114 <[email protected]> Co-authored-by: qwen-code patrol <[email protected]> |
||
|
jinyeandQwen-Coder
|
90eb13e4c6 |
refactor(managed-agent): Make runtime backends optional Maven modules (#16141)
* refactor(managed-agent): Split runtime backends into optional modules Extract five backend implementations behind the shared provider SPI and support selected-backend executable distributions. Preserve SQL ownership, defer unavailable historical work, and make Spring own SSH connection cleanup. Co-authored-by: Qwen-Coder <[email protected]> * refactor(managed-agent): Narrow backend split to Maven modules Keep optional backend dependencies and safe assembly while deferring selective standalone distributions. Restore default packaging and document the provider configuration. Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
jinyeandQwen-Coder
|
4cd3372bb6 |
fix(managed-agent): close post-split verification gaps (#15927)
* test(managed-agent): close post-split verification gaps Establish an active response before probing caller cancellation, retain close deadlines, run both independent embedding hosts from the full MySQL lane, and record post-merge acceptance boundaries. Co-authored-by: Qwen-Coder <[email protected]> * ci(managed-agent): keep embedding checks within workflow size gate Move the existing embedding-host verification commands unchanged into a shell script so sdk-java.yml stays within the existing growth allowance. Extend the workflow guards to inspect the script and retain the test and cache-lock requirements. Co-authored-by: Qwen-Coder <[email protected]> * fix(cli): finish hosted settle budget call migration Replace the 25 remaining references to the removed settle timeout constant with the existing per-test budget function. This repairs the TypeScript compilation failure exposed by the main merge while preserving the new shared deadline policy. Co-authored-by: Qwen-Coder <[email protected]> * fix(managed-agent): preserve Hosted fault checks after module split Preserve the typed stream-idle failure and its duration across the SDK boundary. Update fault-injection fixtures for wrapped connectors and the verification module directory, and wait for the documented pending Items projection within the existing bounded poll. Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
jinyeandQwen-Coder
|
f3af3dd857 |
refactor(managed-agent): Split server into Maven modules (#15871)
* refactor(managed-agent): split server into Maven modules Separate contracts, orchestration, persistence, adapters, assembly, and verification while retaining the existing service delivery model. Move tests and build consumers together and document local evidence and pending CI acceptance. Co-authored-by: Qwen-Coder <[email protected]> * refactor(managed-agent): reduce configuration and SDK boilerplate Co-authored-by: Qwen-Coder <[email protected]> * refactor(managed-agent): narrow contracts and simplify test scaffolding Co-authored-by: Qwen-Coder <[email protected]> * fix(managed-agent): repair verification after module migration Resolve shared fixtures and worker paths from the Maven module root, update CI packaging assertions, and align existing test fixtures with the extracted contracts. Restore restricted Workspace constructors and remove redundant test visibility changes without altering inherited MySQL coverage. Co-authored-by: Qwen-Coder <[email protected]> * test(managed-agent): align remaining Harness and OSS fixtures Preserve SDK refusal messages and register the managed OSS adapter at fixture injection points. Keep the existing retry and client shutdown assertions intact. Co-authored-by: Qwen-Coder <[email protected]> * style(managed-agent): order Hosted cleanup Harness imports Co-authored-by: Qwen-Coder <[email protected]> * test(managed-agent): fix recovery smoke fixture and import order Supply the required transcript coverage in the recovery browser fixture and wait for history before testing a complete handoff. Preserve its existing safety and submission assertions. Order the cleanup coordinator test imports for Checkstyle. Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
jinyeandQwen-Coder
|
b969de851a |
ci(java): remove MariaDB full integration lane (#15827)
Keep the complete MySQL 8.4 integration profile and per-fork isolation. Retain JDBC precision and CAS coverage on the supported database and align workflow guards and documentation. Co-authored-by: Qwen-Coder <[email protected]> |
||
|
Shaojin Wen
|
7b09c0a940 |
fix(ci): keep the sdk-java cache write-back on a failed suite (#15555)
* fix(ci): keep the sdk-java cache write-back on a failed suite The self-hosted test step exits on the first Maven failure under errexit, so the cache write-back below it never ran for a red suite. The downloads that run had already made were dropped, and the next leg re-fetched them. Record each Maven failure in mvn_status instead, stop the remaining suites, and apply that status after the write-back. A tolerated write-back skip now reports the same status rather than turning the step green. This is the residual of #15289 after #15254 landed the suite-outside-the-lock split on main. Verified on Linux CI: the write-back publishes a stub Maven's artifact and the step exits 7 with no second Maven run; reverting the final exit, or one status capture, reddens the new pins. * fix(ci): close the sdk-java deferred-status review gaps Two harness defects shipped with the deferral: the new case never created its runnerTemp, so its load-bearing "one Maven call" assertion threw ENOENT, and the older write-back harness sliced below the `mvn_status` assignment, so the deferred exit aborted it with status 2. Both reddened the ubuntu lane, which is the only one that executes them. The tolerated-skip arms were only pinned as literal strings, so a skip that reported 0 on a red suite would have passed every test; they now run with both a green and a red status. A red run can also leave Maven's resolver tracking markers in the job-local repository, which the delta filter would publish into the host cache one consumer seeds without stripping, so both write-backs prune the names the seed already drops. The deferred exit emits an annotation naming the failing stage, because the write-back output now sits between the failure and the log tail. * fix(ci): bound the red-path wait and name the stage at every write-back exit A red leg reached the write-back but then queued for the full 9600 s behind a failure that was already decided, holding a pooled runner to publish what is often nothing; it now waits only the 300 s the copy itself may run. The stage annotation only covered the final exit, so a skip left the false "the gate result above is unaffected" warning as the last word and the fatal-flock arm reported 1 without naming the suite. One reporter now runs at each of those exits. The annotation also lands where the rerun classifiers grep, so the behavioral test pins it against INFRA_FAILURE_SIGNATURES, and the MariaDB lane's inline-failure premise — which the whole two-lane asymmetry rests on — is pinned too. A hard-killed transfer leaves *.tmp fragments that never resume, and the delta filter published them; both write-backs and every seed now drop that name, with the marker/tmp exclusions exercised by a red-suite fixture instead of only by string pins. |
||
|
|
ba051f804a |
fix(ci): run the sdk-java suite before taking the host lock (#15254)
* fix(ci): run the sdk-java suite before taking the host lock (#15242) Run 39771949573's fast-tier job spent both attempts' full 5400 s lock budget waiting: the full-tier Java 21 leg of run 39754414693 ran for 89 minutes on the same host, and the fast job failed five seconds after that leg ended. The MariaDB lane's #15128 fix scoped the lock to its cache write-back, but the test job still held the host lock across the SDK and Managed Agent Maven suites. Seed the test job's Maven repository from the host cache, run its suite from that job-local copy, and take the ticketed host lock only for the cache write-back. The write-back children close fd 9 so a cancelled job's survivor cannot retain the lock, and the workflow pins move with the new order. * fix(ci): keep the SDK Java gate green when the write-back lock expires (#15242) The write-back lock acquisition could redden a job whose suite had already passed (CI run 39814549427). Treat it like the best-effort copy it guards: warn and skip on timeout in both the helper and fallback arms, while leaving the helper's pinned lock-not-acquired signature alone. Tighten the workflow pins: assert the region below the lock instead of first-occurrence Maven indices, pin both write-back copies byte-equal, bind the job-local MAVEN_ARGS to its step, and include the write-back bound in the test job's ceiling model. Restate the hold-length derivations and record the concurrency blast radius in both design languages. Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): keep the lock helper outside this PR's footprint (#15242) Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): describe the sdk-java 89-minute leg as the leg, not the suite (#15242) Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): keep tolerated sdk-java lock timeouts out of rerun classification (#15242) The warn-and-skip downgrade left the helper's `lock not acquired within` annotation on a step that now exits 0, so a later genuine failure in the same job could be classified as infrastructure. Both call sites rewrite the timeout line before it reaches the log, and probe flock plus the cache directory first: bash suppresses errexit for a function on the left of `||`, so without the probes a setup fault spun out the full wait green. The skip test now plants a publishable delta, asserts nothing was published, checks the captured annotations against the live INFRA_FAILURE_SIGNATURES list, and adds a setup-fault arm. The workflow size baseline is re-measured, and the design docs' classifier, promotion, and budget claims are corrected in both languages. --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Qwen Autofix <[email protected]> |
||
|
Aling33
|
195029c12c |
ci(sdk-java): upload Surefire text reports on test failure (#14910)
* ci(sdk-java): upload Surefire text reports on test failure * ci(sdk-java): quote if-no-files-found for yamllint |
||
|
|
54b662ff96 |
fix(ci): raise the sdk-java test-lane lock wait above the longest hold (#15257)
* fix(ci): raise the sdk-java test-lane lock wait above the longest hold (#15243) Co-authored-by: Qwen-Coder <[email protected]> * docs(ci): restate sdk-java lock wait sizing and lane budgets (#15243) * fix(ci): pin the sdk-java lock fallback minutes and restate sizing (#15243) The bare-lock fallbacks hand-write their timeout line, so raising `flock --wait` could leave `160 minutes`/`90 minutes` stale with every test green; pin both literals. The sizing comments also cited a pre-#15128 run as evidence for a sibling-hold chain and repeated an uncited 925 s hold; frame that run as the history it is, state that 9600 s is headroom sized from the hold length rather than an observed chain, and keep the derivation in the design doc's Goals. --------- Co-authored-by: Qwen Autofix <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> |
||
|
|
cfd95f6abb |
fix(ci): scope the sdk-java host lock to the cache write-back (#15128)
* fix(ci): scope the sdk-java host lock to the cache write-back (#15117) Run 39627609266's fast-tier job arrived at 17:38, stayed head of the sdk-java host-lock queue, and failed at 19:15 without starting Maven. The MariaDB integration lane held the same lock across its install and full MySQL clean verify; under pool contention that hold ran from 15:54 to 18:57 (run 39628985638), past the fast tier's 90-minute budget. Both MariaDB Maven runs already resolve from a job-local repository, so they touch no host-shared state. Seed that repository before the lock, run both Maven commands unlocked, and take the host lock only for the cache write-back, the sole remaining host-shared mutation. Drop fd 9 on the write-back children so a cancelled job's survivor cannot retain the lock. Raise the lane ceiling to 300 minutes for the ~3-hour verify plus one lock wait and setup, and pin the new order and fd closes. Fixes #15117 * test(ci): exempt the OpenTUI parity suites from the no-AK gate (#15117) The main merge brought three interactive suites from #14964. The no-AK gate requires every runnable integration test to be selected or explicitly exempted, so the Test job fails until they are listed. Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen Autofix <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: jinjing.zzj <[email protected]> Co-authored-by: 易良 <[email protected]> |
||
|
|
06e59666df |
fix(ci): skip the duplicate prepare build in the daemon E2E lane (#14884)
* fix(ci): skip the duplicate prepare build in the daemon E2E lane (#14870) Co-authored-by: Qwen-Coder <[email protected]> * test(ci): pin the daemon E2E prepare-skip premises (Refs #14870) * test(ci): keep the daemon E2E step commands pinned (Refs #14870) * test(ci): pin the daemon E2E step and its install warning (#14870) --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Qwen Autofix <[email protected]> Co-authored-by: qwen-code-dev-bot <[email protected]> |
||
|
jinyeandQwen-Coder
|
288e4c481d |
perf(ci): Optimize MySQL integration verification (#15200)
Close Spring contexts before fixture database cleanup, run integration classes in isolated reusable forks, and remove redundant fixture validation and duplicate load-test execution. Document bounded local validation and preserve full CI gates. Co-authored-by: Qwen-Coder <[email protected]> |
||
|
易良andQwen-Coder
|
0b3c2f816a |
feat(ci): restore a MariaDB leg for the non-Hosted IT family (#15003)
* fix(ci): align Java integration database and lock lifetime * test(ci): re-pin the sdk-java lock and MySQL probe after the single-step merge The merge commit staged the conflict resolution before these two re-pins were written, so they land as a follow-up in the same push: - `keeps the host lock out of every Maven child` counted three lock-bearing steps; #14903 collapsed the MariaDB lane's two Maven steps into one, so the count is now two (test job + mysql-integration). - The MySQL startup probe took the step's first `mvn` line, which is now the `-DskipTests install` staging command; select the `-Pmysql-integration` command instead so the probe still exercises the consumer. Verified: vitest sdk-java-workflow.test.js 96 passed; prettier --check clean. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-conflict/jmvgz448zlp * fix(ci): skip the MySQL binlog, drop the unused database, correct the reaper bound Three independent corrections to the mysql-integration lane this PR reworks. 1. MySQL 8 enables the binary log by default (MariaDB 10.11 did not in the configuration this lane replaced), and the datadir is an uncapped tmpfs. Nothing in packages/managed-agent-server/src or packages/sdk-java reads a binlog (0 hits for binlog|log_bin|GTID|SHOW MASTER STATUS), and the container is disposable with no replica, so `--skip-log-bin` is appended after the image name beside --innodb-use-native-aio=0. Without it the ~67 MiB hex-encoded LONGBLOB query this lane already raises max_allowed_packet for is serialized a second time into host RAM. 2. `--env MYSQL_DATABASE='runtime_broker_test'` had no consumer: the lane's only connection is -Dmysql.url=.../managed_agent_test?createDatabaseIfNotExist=true. The declaration invited a cleanup that drops createDatabaseIfNotExist and dies at first connect with Unknown database. Dropping it lets the JDBC URL own the schema and shrinks the diff. 3. The cleanup comment and removal-failure warning said the host reaper reclaims a stranded container "after a 24h age gate" / "up to a day". The real bound is ~48h: qwen-docker-cleanup.sh:31 gates on a strict `now - created_at > 86400` (exactly 24h is SKIPPED) and qwen-docker-cleanup.timer fires once a day, so a container created just after a fire is skipped at the next one and reaped at the one after. Test pins updated in the same change: the start-step assertion, the exact docker-run trace literal, and the cleanup warning literal. All three were mutant-verified red (drop --skip-log-bin / re-add MYSQL_DATABASE / restore "after 24h") and restored byte-identical. Only this PR's own copy of the reaper wording is corrected; the two pre-existing copies (sdk-java.yml's event-transport-multi-node job and release-managed-agent-reference.yml) are untouched to keep this diff scoped. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmvhb9cysmc * feat(ci): restore a MariaDB leg for the non-Hosted IT family #14936 moved the mysql-integration lane onto MySQL 8.4 and removed the last real MariaDB server, leaving the published MariaDB-only V12 repair (RTRIM, error 1901) and the schema catalog's MariaDB branches without a falsifier. Both engines now run the same non-Hosted *IT family as two matrix legs of one job: the container image, its startup arguments, its client, and its readiness signal come from the leg, and the container name carries the engine so two legs on one pool host cannot collide. --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
易良andQwen-Coder
|
54a56f30ce |
fix(ci): write back only the MariaDB lane's Maven delta and size its ceiling (#15000) (#15064)
* fix(ci): bound the MariaDB lane's cache write-back and size its ceiling (#15000) Run 39563394993's mysql-integration job was cancelled at the 200-minute ceiling: 54 minutes queued for the host lock, 75 minutes of Maven work, then a 60-minute unbounded tar of the host-shared ~/.m2. The cache is an optimization, so skip it after five minutes; the ceiling now covers the 90-minute wait, the measured Maven pass, the bounded write-back and setup headroom. * fix(ci): write back only the MariaDB lane's Maven delta by hardlink The bounded tar pipeline extracted straight into the host-shared ~/.m2, so a timeout mid-member left a truncated artifact that --skip-old-files never repaired and the next seed hardlinked into its job. Its 300 s cap was also below the measured 26-61 minute whole-tree cost, so it would have tripped on every run. Publish only the files Maven fetched in this job (nlink == 1 after the hardlink seed) with per-file cp -ln, keeping the two in-house excludes. Each link is atomic and never replaces a host file, so the 300 s backstop can only leave artifacts missing. Distinguish the timeout from other failures, and fold the backstop into the derived ceiling floor instead of a second hardcoded one. * ci: record sdk-java.yml's real size in the workflow ratchet This PR grows .github/workflows/sdk-java.yml from 113473 to 114180 bytes: the MariaDB lane's timeout ceiling moves 200 -> 280 with the arithmetic that justifies it, and the Maven write-back is rewritten to publish only this job's own downloads (nlink == 1) under a 300 s backstop instead of taring the whole tree. The growth is the change, so record it rather than move the step out. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-conflict/jmvj37bcsp8 --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
|
438bcb2a8f |
fix(ci): let the fast Java tier overtake waiting full-tier lock tickets (#15035)
* fix(ci): serve the fast Java tier before full-tier lock holds (#15032) Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): keep a parked lock head's ticket alive under fast priority A head blocked in `flock --wait` could not touch its ticket, so once a hold outlasted the 1800s mtime arm another waiter reaped a live head and the next ticket, whatever its class, parked in the kernel too. With two classes that lets normal tickets take kernel positions ahead of fast tickets that arrive later during a long hold. A keepalive now refreshes the parked head's ticket at the waiters' two-second cadence; it closes the lock fd and uses `touch -c`, so it can neither hold the lock nor recreate a removed ticket. The ordering and promotion cases used a stub whose `--wait` returned every 200 ms, so they exercised a head that loops, which production never does. They now park `--wait` until release and assert the reachable paths: a fast ticket overtaking a normal ticket that is still waiting, and a promoted waiting normal ticket preceding a later fast ticket. The comments and design docs no longer claim a fast job waits at most the hold already running (a parked head still goes first) or cite #14962/#15032 as fast-behind-full evidence; they state what priority removes and that a single hold longer than the budget is outside it. --------- Co-authored-by: Qwen Autofix <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: wenshao <[email protected]> |
||
|
易良andQwen-Coder
|
a4562edb67 |
fix(ci): align Java integration database and lock lifetime (#14936)
* fix(ci): align Java integration database and lock lifetime * test(ci): re-pin the sdk-java lock and MySQL probe after the single-step merge The merge commit staged the conflict resolution before these two re-pins were written, so they land as a follow-up in the same push: - `keeps the host lock out of every Maven child` counted three lock-bearing steps; #14903 collapsed the MariaDB lane's two Maven steps into one, so the count is now two (test job + mysql-integration). - The MySQL startup probe took the step's first `mvn` line, which is now the `-DskipTests install` staging command; select the `-Pmysql-integration` command instead so the probe still exercises the consumer. Verified: vitest sdk-java-workflow.test.js 96 passed; prettier --check clean. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-conflict/jmvgz448zlp * fix(ci): skip the MySQL binlog, drop the unused database, correct the reaper bound Three independent corrections to the mysql-integration lane this PR reworks. 1. MySQL 8 enables the binary log by default (MariaDB 10.11 did not in the configuration this lane replaced), and the datadir is an uncapped tmpfs. Nothing in packages/managed-agent-server/src or packages/sdk-java reads a binlog (0 hits for binlog|log_bin|GTID|SHOW MASTER STATUS), and the container is disposable with no replica, so `--skip-log-bin` is appended after the image name beside --innodb-use-native-aio=0. Without it the ~67 MiB hex-encoded LONGBLOB query this lane already raises max_allowed_packet for is serialized a second time into host RAM. 2. `--env MYSQL_DATABASE='runtime_broker_test'` had no consumer: the lane's only connection is -Dmysql.url=.../managed_agent_test?createDatabaseIfNotExist=true. The declaration invited a cleanup that drops createDatabaseIfNotExist and dies at first connect with Unknown database. Dropping it lets the JDBC URL own the schema and shrinks the diff. 3. The cleanup comment and removal-failure warning said the host reaper reclaims a stranded container "after a 24h age gate" / "up to a day". The real bound is ~48h: qwen-docker-cleanup.sh:31 gates on a strict `now - created_at > 86400` (exactly 24h is SKIPPED) and qwen-docker-cleanup.timer fires once a day, so a container created just after a fire is skipped at the next one and reaped at the one after. Test pins updated in the same change: the start-step assertion, the exact docker-run trace literal, and the cleanup warning literal. All three were mutant-verified red (drop --skip-log-bin / re-add MYSQL_DATABASE / restore "after 24h") and restored byte-identical. Only this PR's own copy of the reaper wording is corrected; the two pre-existing copies (sdk-java.yml's event-transport-multi-node job and release-managed-agent-reference.yml) are untouched to keep this diff scoped. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmvhb9cysmc --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
|
976425cdb9 |
fix(ci): queue the sdk-java host lock first-come-first-serve (#14743) (#14912)
* fix(ci): queue the sdk-java host lock first-come-first-serve (#14743) flock(2) does not order its wakeups, so under continuous arrivals one waiter can lose every release and die at the wait budget — repeatedly burning 40, then 60, then 90 minutes per starved lane across at least three hosts. Replace the inline flock --wait at all three acquisition sites with a ticketed queue: every acquirer takes the next sequence number atomically, only the head of line retries the lock, dead owners are reaped, and the lock still releases at the step boundary. The pinned infrastructure-signature error text is preserved. The .size-baseline records the workflow's new size (smaller than main's, but main itself already exceeds its recorded baseline). * fix(ci): block the queue head instead of polling the lock The first live run starved its full 5400 s budget as queue ticket 1: the head polled flock --nonblock while main and older branches still run blocking flock --wait, so every release went to a legacy waiter's kernel wakeup. The head now blocks in five-second slices, re-entering the same wake race on even terms; tickets still order every run that uses this helper. * fix(ci): serve the fast tier before full-tier holds The queue bounded the wait by position but a fast-tier PR job still queued behind every full-tier hold ahead of it. Give the fast tier its own class: the head is the first sorted ticket and fast tickets sort first, so a PR job waits at most the hold already running. A normal ticket ages into the fast class after 20 minutes, so continuous PR traffic cannot starve the full tier. * refactor(ci): keep the lock queue plain FIFO. Drops the priority/aging classes: a single first-come-first-serve line is simpler to review and reason about. The head still blocks in five-second slices so it re-enters the kernel wake race on even terms with legacy waiters, and dead owners are still reaped. The tradeoff is explicit: a fast-tier job waits its turn behind full-tier holds instead of jumping them. * fix(ci): stop leaking the host-lock ticket and reap stale orphans Three bounded defects in the fair-lock helper, all confirmed by executing it rather than by reading alone: - The EXIT/TERM/INT traps quoted `${ticket}`, a `local` that is already out of scope once the sourcing step's shell exits, so every trap ran `rm -f ''` and each successful acquisition left its head ticket behind. Drop the traps and leave the queue at acquisition instead: a holder needs no place in line once the kernel holds the lock, and SIGKILL runs no trap. - The ticket was published after `exec 8>&-` released the counter lock, so a later arrival could take seq+1, see an empty queue, name itself head and win the lock out of arrival order. Publish inside the critical section. - Orphan liveness was decided solely by `kill -0`, so a ticket whose PID had been recycled to a live process was never aged out and, being head, made an idle lock unreachable for every job on the host. Age a ticket out on mtime alone above 1800s; a live waiter re-touches every ~7s. Measured on a free lock with a live-PID, 2h-old orphan head ticket: base burns its full 6023ms budget and exits 1 with the orphan intact; this commit acquires in 19ms and reaps it. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmvhb9cysmc * style(ci): keep only the load-bearing why in the lock helper comments Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmvhb9cysmc * fix(ci): keep the lock queue head in one blocking wait The head re-entered the kernel wait queue every five seconds, so a release reached waiters that stayed blocked first; the head could lose every release and starve to its budget. Run 39472038337 still burned the full 5400 s as queue ticket 2. Wait once for the remaining budget and log the remaining time at most once a minute. A resumed release tag can predate the helper, so both acquisition sites fall back to the bare lock instead of dying before Maven and wedging the release. Pin the emitted ::error:: annotation prefix rather than a file substring a comment can satisfy, and observe the real acquisition order in the stub. * fix(ci): name the blocking ticket in the sdk-java lock timeout The timeout line reported only the dying waiter's own ticket, so a deep queue and a wedged one produced the same message and neither could be acted on from the log. Name the head of line, which separates a real sibling hold from an orphan ticket. Bring both design docs back to the shipped mechanism: two acquisition sites, the flock'd counter with no aging path, the 1800 s mtime arm and the ticket removed at acquisition, plus the operator recovery command. Refresh the stale .size-baseline entry for sdk-java.yml. * test(ci): wait for the first ticket instead of a fixed sleep The FIFO case started the second acquirer 800 ms after the first and relied on that being enough for A to take sequence 1. On a loaded runner it is not, and B wins sequence 1, so the case fails on timing rather than behavior. Poll for A's published ticket instead. * fix(ci): print the lock wait line before blocking The wait line was emitted only after `flock` returned, so a head parked behind a sibling hold printed nothing for its whole budget: run 39528681869's step sat in flock for 40 minutes and was cancelled with an empty log, which is the opposite of the attribution this change exists to add. Probe with --nonblock, print the ticket line, then block. The observability bullet in both design docs now states what the code does. --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> |
||
|
|
b05be4cd23 |
fix(ci): hold the MariaDB lane's sdk-java lock once per job (#14896) (#14903)
* fix(ci): hold the MariaDB lane's sdk-java lock once per job (#14896) Co-authored-by: Qwen-Coder <[email protected]> * test(ci): pin the merged MariaDB step's order and SpotBugs witness The single-step merge dropped guarantees that the two-step layout got for free from step boundaries, and one witness became satisfiable by prose: - spotbugs-gate matched `verify` anywhere in the step body, and the merged step's own comments explain the incident with the word 'verify' twice. A later narrowing to `clean test` would stay green. Match `clean verify` on command lines only. - seed-before-write-back was a step-order invariant; both strings now live in one body with presence assertions only, and the write-back's warning arm swallows the ordering failure. Pin seed < install < verify < write-back. - `working-directory:` applied to the whole step and could not be misplaced; its `cd` replacement is positional inside the body. Pin it between the two Maven runs. - Drop the finder arm that matched the deleted `working-directory:` property: no step in either inspected job carries it any more. --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: 易良 <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> |
||
|
qwen-code-dev-botandQwen Autofix
|
623cb40cf5 |
fix(ci): skip prepare's duplicate build in the daemon E2E install (#14861) (#14873)
The daemon E2E job's install ran prepare, which built and bundled the tree, then the job's next two steps built and bundled it again. The fast-tier lane failed inside that install-path prepare build. Set QWEN_SKIP_PREPARE so the install stays an install, matching the e2e build job. Co-authored-by: Qwen Autofix <[email protected]> |
||
|
|
848111433b |
fix(ci): retry transient pnpm installs in the SDK Java workflow (#14845) (#14851)
* fix(ci): retry transient pnpm installs in the SDK Java workflow (#14845) Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): correct the retry's failure class and exercise the loop The install step's prepare re-enters the workspace build, so an absorbed failure here can be a build failure; the warning no longer routes it at the #11726 network-transient counter, and the recorded cost counts each attempt's rebuild. The meta-test now runs the loop under a stubbed corepack to prove the retry, the absorbed warning and the exit status. --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: yiliang114 <[email protected]> |
||
|
qwen-code-dev-botandqwen-code-dev-bot
|
66807cae3f |
fix(ci): wait 90 minutes for the sdk-java host lock (#14787) (#14801)
Run 39229303984's fast-tier Java 21 job exhausted the 60-minute flock budget behind sibling Maven holds on the shared ECS host and failed before Maven started, so no test result was reported. The lock is shared by every Maven lane on the host, so an acquisition must cover a queue of holds, not one: raise each wait to 90 minutes and give the two affected ceilings room for a full wait plus their Maven work and setup. The workflow meta-test pins the new wait and derives both ceilings from it, so a future re-size cannot leave a job ceiling below the wait. Co-authored-by: qwen-code-dev-bot <[email protected]> |
||
|
|
f8b3031f73 |
fix(ci): repair Java gates and report failures on PRs (#14522)
* fix(ci): surface Java failures on PRs and manual main runs
* fix(ci): address review findings on PR failure reporting
- Gate the PR failure comment on infra_only like the issue path: an
infrastructure-only death is rerun once, not reported, and the comment
has no correction path once the retry goes green.
- Tolerate a missing or truncated run-jobs.json in the comment command so
an API failure degrades to naming no job instead of failing analyze and
losing both the PR comment and the issue.
- Drop the leftover 'main-branch ... on main' wording from the per-commit
issue body now that merged-PR failures reach it.
* fix(managed-agent): keep daemon recovery waits re-driven and deflake hosted tests
The daemon refuses a lifecycle phase with hosted_lifecycle_recovery_required
while it settles a previous prompt. The coordinator classified that refusal
as a hook refusal and published the operation RECOVERY_BLOCKED, which the
lifecycle store then refused on every later attempt even after the daemon
recovered. Treat it like the other self-clearing waits: budget-exempt, with
the daemon's own code once past the budget, still re-driven by the recovery
scan.
Deflake the gate's remaining timing-sensitive spots: give the Hosted close
the dispatch backoff's own window, allocate fault-gate ports below the
ephemeral range, widen the action renewal lease, and size the SSE stall test
off a 1200ms idle budget so a loaded runner can still answer inside it.
The E2E freeze loop now waits up to 5s for InnoDB transactions to drain.
* fix(ci): resolve fork approval runs in the Java failure reporter
An approval run records the base repository as head_repository even when
the PR head lives in a fork, so the owner:branch listing filter found
nothing and fork approval failures produced no comment, no issue and no
diagnostic. Resolve by exact head SHA instead, fail soft with a warning
when the listing errors or nothing resolves, exclude closed-unmerged PRs,
gate the infrastructure rerun to destinations that file, and publish the
issue url before the route edit can abort the step.
* fix(ci): preserve PR failure reports across issue and runner errors
* test(sdk-java): wait for the re-registered attachment's heartbeat
The close-by-id success arm asserted a new heartbeat inside a fixed 60ms
window while the heartbeat interval is 10ms. A loaded runner delayed the
periodic task past that window and failed the assertion on main, though
the attachment was still beating. Poll for the next beat with the same
5s bound the other heartbeat waits use.
* docs(managed-agent): name the recovery wait in the public contract and pin the wrapped refusal
The contract's failure_code description enumerates the codes a
recovery_blocked lifecycle operation reports; the daemon-recovery wait
this change published added a third code without touching that text or
the contract version. Name hosted_lifecycle_recovery_required in both
the public and WebShell descriptions and bump the contract to 1.63.0
with a version note; regenerate the WebShell types.
The recovery-refusal test threw the refusal directly, but the SDK wraps
it in MutationOutcomeUnknownException once the non-idempotent detach may
have been delivered — the wrapped shape is why daemonRefusalCode walks
the cause chain. Parameterize the test over the wrapped shape so a
regression that stops unwrapping fails it.
* fix(ci): cover SDK lock holds and refresh InnoDB freeze probes
* test(managed): allow writer grant latency in failover fixtures
* fix(managed-agent): name the refusing store route and pair writer grants with store heads
The Hosted failover lane failed with the store's shared writer-conflict
text and no way to tell which operation with which grant was refused
(review #14522's discriminator: a grant the wake never re-acquired vs a
grant the store already judged superseded).
ManagedSessionStoreHttpError now carries the refusing store route in its
own field (public messages pass through unchanged). On a 409 the writer
annotation captures, sanitized (boot id, never a token), the grant the
writer presented and the store-head generation/revision/committed/state
verdict probed at the same instant — reaching it from a commit retry and
from the renewal path that otherwise swallows the refusal silently. The
daemon's recovery print and turn-failed print render status, stable
remote code, route and that pairing.
Also log the sanitized acquiredWriterGeneration and the restore-head
match pair on acquire/restore, so a healthy takeover proves from both
sides that the previous boot's writer stayed fenced.
* test(managed): establish journal ownership before broker outage
* test(cli): wait for startup and saved-plan recovery before asserting
* test(sdk-java): wait for heartbeats instead of fixed windows
* test(managed-agent): isolate automation fault fixtures and await deadlock recovery
* test(ci): pin the awaitility fail-fast guard, not its exact prefix
`HostedTeamLeadMySqlIT`'s waiting helper now configures
`ignoreExceptionsInstanceOf(CannotAcquireLockException)` before chaining
`failFast`, so the class no longer contains the literal
`await().failFast("The case's @Timeout interrupted it"` and the
hosted-process-ci guard failed on the merged head.
The invariant is that every wait goes through the helper that fails on the
`@Timeout` interrupt; the single-`await()` assertion still pins that. Match
the failFast guard itself so configuring awaitility first stays legal.
* fix(ci): record the current workflow size in .size-baseline
The ratchet is meant to turn workflow growth into one reviewed line, but
main-ci-failure-issue.yml landed at 23219 bytes against a recorded 20935,
so the 2284-byte remainder rode inside the 4096-byte allowance unrecorded
and the grow-by-adding-a-step path stayed invisible.
Record the byte size the file actually has at this head.
Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-pr-closeout/jmvdoiklbf5
* fix(managed-agent): normalize boolean literals in schema checks
* test(managed-agent): isolate destructive schema validation
* fix(ci): release cancelled fast PR gate concurrency
* fix(ci): release PR gate when tier selection is cancelled
* chore(web-shell): regenerate managed agent API types
The merge of origin/main brought a new
`hosted_lifecycle_recovery_required` clause into the Managed Agent OpenAPI
description, but the committed `managed-agent-api.ts` was resolved by hand
instead of regenerated, so `managed-agent-api.test.ts` drifted from its
generator and failed the required Test lane.
Regenerated with `node scripts/generate-managed-agent-api.mjs`; the only
change is the aligned description line.
Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-pr-closeout/jmveoyarfh8
* fix(managed-agent): restore the daemon recovery wait in failure_code docs
The
|
||
|
Shaojin Wen
|
948caad58f |
ci(sdk-java): run the EventTransport gate lanes on the ECS pool (#14472)
* ci(sdk-java): run the EventTransport gate lanes on the ECS pool The broker and multi-node EventTransport lanes were pinned to hosted runners because the RocketMQ cluster bound fixed ports. Their trusted runs now route like the MariaDB lane, behind the same trust clause and MAINTAINER_ECS_RUNNER_DISABLED kill-switch, and are made safe on a shared, reused pool host: - A new step picks free ports for the NameServer, broker and proxy (with the broker's listenPort - 2 and + 1 companions free too) and exports them; rocketmq-lite-broker.sh already reads them from the environment, and the gates take the proxy endpoint from the same variable. - Both lanes install and verify against a job-local Maven repository seeded from the host-shared ~/.m2, so the fixed SDK coordinates never round-trip through it, and set up Maven on the pool. - The multi-node lane's MySQL moves from a service container to a job-owned container with native AIO off and a tmpfs datadir (#14416), removed on every outcome. Node comes from the pool's own install, libfaketime is installed only when the host lacks it, and the unnecessary `corepack enable` is dropped. - Both lanes gain the pool's pre-checkout hygiene steps, and their job ceilings absorb the setup stretch a loaded host adds. hosted-harness-mysql stays hosted: it delegates a cgroup v2 root at a fixed /sys/fs/cgroup path through sudo, and its failover E2Es spawn native mysqld from the hosted image's MySQL server packages. The routing matrix, per-job ports (the chooser runs for real), the MySQL container contract, job-local Maven repos and pool hygiene are pinned in the workflow meta-tests. * ci(sdk-java): move the RocketMQ port chooser to a script and record the size Lint & Static failed the workflow-size ratchet: sdk-java.yml grew 21571 bytes over its recorded 74834. The duplicated inline port chooser moves to .github/scripts/choose-rocketmq-ports.mjs, which both lanes run and the broker lane's test still executes for real. The remaining growth is real. Every pool job in this file carries the ownership heal, the stale .qwen sweep (pinned byte-identical to ci.yml) and the .git recreation. These run before checkout, so they cannot live in a repository script, and the two newly pooled lanes need one copy each. The job-owned MySQL container and its cleanup make up most of the rest. Record 93793 bytes. |
||
|
|
1ab68e951e |
feat(ci): gate Managed Agent changes on a full SDK Java run before merge (#14397)
* feat(ci): gate Managed Agent changes on a full SDK Java run before merge
Changes to the Java modules or the harness they drive now run a fast
SDK Java subset on every push and the full suite on the first approval
of the current head. An always-reporting `Managed Agent gate` check can
be made required: a touched PR reports it only from a full run.
Refs #14392, #14381
* fix(ci): route the Managed Agent gate's own jobs off the hosted queue
The scope and gate jobs report the would-be required check; on the first
run they sat in a hosted queue holding 123 runs. Trusted runs now take
the ECS pool with the shared pre-checkout hygiene, forks stay hosted.
* fix(ci): register managed-agent-gate.yml in the PR-stage CI budget ledger
managed-agent-gate.yml triggers on pull_request and merge_group, so it is
PR-stage and needs an entry in .github/workflows/.ci-budget. That ledger is a
fail-closed whitelist: a missing entry makes check-ci-budget.mjs error out and
short-circuits the remaining Lint & Static steps, so no linter ran.
Recorded exactly as measured (3 jobs, 15 declared timeout-minutes, 1 job
without a fixed timeout) so no slack is left against the ratchet.
Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-pr-closeout/jmvb6htxaa7
* fix(ci): run the full Managed Agent unit suite in the fast tier
The fast tier skipped mysql-integration, the only lane that runs the
module's ~4,200-test H2 suite in full, so a PR push got no unit
feedback until the review-triggered full run. In the fast tier the
Java 21 leg now runs the whole module suite instead of its Runtime
Broker subset, after the same workspace install mysql-integration uses:
part of the suite loads the built Core and CLI JavaScript.
* fix(ci): harden Managed Agent gate tier selection and cancellation reporting (#14397)
* fix(ci): gate the Managed Agent full tier on a maintainer approval
The full tier was reachable by any approved review, including the
deferred APPROVE that qwen-triage-finalize.yml posts once a PR's checks
land green. That workflow now watches this gate, so its own fast tier
could buy the most expensive run in the repository with no human
involved. tier=full now also requires the reviewer's author_association
to be OWNER, MEMBER or COLLABORATOR, and fails closed when it is absent.
The concurrency group embedded the event name, so a push could never
cancel the approval run it superseded: that run kept going for about 125
minutes and then reported a head that branch protection no longer reads.
The group is now keyed on the pull request, with cancel-in-progress still
true only for pull_request, so approvals keep queueing behind each other
instead of displacing a pending full run.
The design docs also described a Maven cache composite that is not in the
tree, called the untouched-PR cost hosted-only when trusted runs take the
ECS pool, and carried a touched-push figure from before the fast tier took
on the full module suite. Non-goals now record that this gate supersedes
the separate compile gate proposed in #14385, and that the Java SDK
checkstyle step stays pinned to the Java 11 leg, so only the full tier
runs it.
* docs(ci): stop citing the Maven cache save the merge from main removed
Merging main brought in #14396, which suppresses setup-java's post-job
Maven cache save on self-hosted runners by making the cache input
conditional on runner.environment. That was the measured cause behind two
claims this branch carries, and both went stale the moment it landed.
The design doc's Cost section said removing the 14 to 37 minute save was
planned work with no implementation in the tree. It is now merged, so the
330 machine minute full run is a figure measured before the saving went
away and should come in lower; it is stated that way, without a
re-measured number this branch does not have.
The daemon-e2e budget comment and its test justified the fast tier's 90
minutes entirely by that save. The value stays: the leg's own sizing puts
stretched setup at about 44 minutes against a 45 ceiling, and the fast
tier now runs it on every touched PR push rather than nightly only, so it
meets that tail far more often. The comment now says that instead of
citing a save that no longer happens.
* fix(ci): diff a review event against its merge commit's first parent
A pull_request_review run checks out the same test merge commit as a
pull_request run (run 38997396688: "Merge
|
||
|
易良
|
880717242e |
fix(ci): start the reference distribution MySQL without native AIO (#14429)
* fix(ci): start the reference MySQL without native AIO on the pool The ECS pool shares fs.aio-nr across every job on a host. A mysql:8.4 service container reserves AIO contexts during init and dies with io_setup() EAGAIN once the budget is exhausted, before any step runs. A service container cannot take a command, so start it explicitly with native AIO disabled and own its readiness and teardown. * test(ci): pin the reference MySQL container contract Extend the routing meta-test to assert the service block stays gone, the port export reaches GITHUB_ENV, and teardown runs unconditionally; update the Maven bootstrap test for the new job-scoped container name. Make teardown best-effort so a transient docker rm cannot redden the release build; the host reaper collects the leftover. * docs(ci): correct the teardown comment to match the host reaper The host cleanup service (qwen-docker-cleanup.sh) has no state-based container prune: reap_stale filters by label/name and force-removes anything older than 86400s regardless of state. The comment claimed it only reaps exited/dead containers, which is wrong; the 24h age gate is the real reason a cancelled job would strand a running mysqld. |
||
|
|
b194ac7245 |
fix(ci): keep the setup-java Maven cache on hosted runners (#14396)
* fix(ci): keep the setup-java Maven cache on hosted runners An ECS host keeps ~/.m2 between jobs, so setup-java's post-job save tars the whole shared repository (14-37 minutes per job) and then loses the cache reservation to a parallel job, discarding the archive. * fix(ci): bootstrap ~/.m2/repository on fresh ECS hosts before the write-back * test(ci): widen the setup-java cache guard to every workflow (#14396) Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: qwen-code-dev-bot <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> |
||
|
易良
|
3bddf6e0bb |
feat(ci): route the release lane's hosted stragglers onto ECS runners (#14336)
* feat(ci): route the release lane's hosted stragglers onto ECS runners The 2026-10-15 v0.25.2 releases validated in minutes and then queued up to 64 minutes on the GitHub-hosted pool behind PR automation (FIFO, no priority). publish stayed hosted on purpose — it carries release credentials — and the shared self-hosted pool is dual-labelled onto PR CI instances, so it could not simply move back either. quality joins the pool its five checks already use, effective on merge. publish and collect move behind a new opt-in variable ECS_RELEASE_HOST_RUNNER_ENABLED onto a new release-only label ecs-qwen-release-host: unset, everything dispatches exactly as before; set, publish only reaches machines that never run PR code. publish gains the disk-floor gate, collect clears stale prebuilds fail-closed, and the meta-tests pin the new routing and credential isolation. * ci(managed-agent): fold reference version resolution into the build job The separate prepare job ran for seconds but waited 25-30 minutes for a GitHub-hosted runner before build could queue again, so each PR dry run spent close to an hour in two serial queues. The root package.json path is dropped because the packager only reads version and engines.node from it, while most unrelated PRs touch it. * test(ci): pin collect's release-host routing and stale-prebuild wipe Address the review suggestions on the collect job: nothing parsed audio-capture-prebuilds.yml, so its opt-in routing expression and the fail-closed wipe were the one behaviour in this change no test pinned. Also note in the YAML that run steps resolve against the job's working-directory while action inputs stay workspace-relative — the indirection the rm -rf and find steps depend on. * ci(managed-agent): run trusted reference dry runs on the ECS pool Trusted pull-request dry runs of the reference distribution now use the persistent pool instead of waiting on the saturated hosted queue. The job gains the pool's pre-checkout hygiene, a random MySQL host port on tmpfs, a random server port, and a job-local Maven repository so the fixed qwencode-sdk and server coordinates built from PR code never reach the host-shared ~/.m2. Dispatch builds feed the published release and stay on hosted VMs. Published release notes are anchored at the previous reference release instead of whichever tag family the API picks. |
||
|
jinyeandQwen-Coder
|
28415ddff3 |
refactor(managed-agent): Consolidate server and broker sources (#14277)
* refactor(managed-agent): Consolidate server and broker sources Move the combined Java application beside sdk-java and remove the standalone Runtime Broker artifact. Update build, development, packaging and CI references while preserving Java package identities, runtime protocols and schema resources. Co-authored-by: Qwen-Coder <[email protected]> * docs(managed-agent): Preserve historical evidence and verification guidance Restore commit-pinned H3 probe inputs and align the Java verification environment contract with the consolidated server layout. Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): Run hosted Broker tests under Bash Keep Maven property arguments intact on Windows and stop before Broker tests when the SDK install fails. Exercise both successful and failed SDK installation in the workflow regression tests. Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): Quote the hosted Broker shell value Follow the repository yamllint single-quote rule without changing the parsed workflow configuration. Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
|
5d40c8153c |
fix(ci): gate Desktop and Java SDK releases on checks of the release commit (#14259)
* fix(ci): gate desktop releases on checks of the release commit Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): gate Java SDK releases on the complete Java suite Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): update sdk-java MAVEN_ARGS count after checkstyle step addition Commit |
||
|
|
b99787e474 |
docs: remind to update workflow meta-tests when changing CI workflows (#14239)
* docs: remind to update workflow meta-tests when changing CI workflows #14205 moved Java and Desktop checks off pull_request/push triggers but forgot three scripts/tests/*.test.js files that pin those workflows' trigger shapes. The resulting red main CI run was fixed by #14227. Add a step to the general workflow so the next workflow change updates all parsing meta-tests, not just the obvious ones. * docs: preserve workflow validation guidance after renumbering Correct the self-audit reference so fixes rerun build, typecheck, and tests, and keep the workflow lookup command on one line for Prettier. * test(ci): update Java Maven step count for server Checkstyle Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: qwen-code-dev-bot <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> |
||
|
易良andQwen-Coder
|
c1b012539b |
fix(ci): repair daily failure reporting and contract guards (#14238)
Co-authored-by: Qwen-Coder <[email protected]> |
||
|
易良andQwen-Coder
|
70407feeb9 |
ci: run Java and Desktop checks daily or on demand (#14205)
* ci: run Java and Desktop checks weekly or on demand Move Java compatibility and integration checks out of PR and push events. Group Desktop Shell checks with the existing packaging dry run, replace daily packaging with weekly validation, and retain manual dispatch. Co-authored-by: Qwen-Coder <[email protected]> * ci: report weekly Java and Desktop failures as issues Include both weekly suites in the existing main failure analyzer and reuse its issue deduplication and autofix routing. Co-authored-by: Qwen-Coder <[email protected]> * ci: run Java and Desktop checks daily Co-authored-by: Qwen-Coder <[email protected]> * ci: format failure reporting workflow list Co-authored-by: Qwen-Coder <[email protected]> * ci: preserve lightweight guards after daily suite migration Co-authored-by: Qwen-Coder <[email protected]> * ci: align lint permission assertion and Java concurrency Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
jinye
|
3a9bbd7216 |
feat(sdk-java): add private CSI Session and native SQL authority (#13996)
* feat(sdk-java): connect original CSI sessions to native SQL authority * fix(sdk-java): preserve private execution and outcome boundaries * codex: address PR review feedback (#13996) * codex: address PR review feedback (#13996) * codex: address PR review feedback (#13996) * test(managed-agent): align lifecycle capability fixtures * fix(sdk-java): refuse private CSI wake claims before mutation * ci(sdk-java): record native producer workflow size |
||
|
|
1f39a80bf0 |
feat(managed-agent): consolidate persistence into a 32-table baseline (#14069)
* feat(managed-agent): consolidate persistence into a 32-table baseline Preserve journal, idempotency, runtime, physical storage and recovery boundaries in a shared fresh-database schema. Add fixed snapshots, typed operations, scoped resource collection and atomic automation projections with MySQL fault and load coverage. Co-authored-by: Qwen-Coder <[email protected]> * fix(managed-agent): restore schema CI and channel claim fencing Avoid nested snapshot connection borrowing while preserving committed read-lease expiry and retirement checks. Carry reserved channel reconciliation identities into private journal commands and retain UNKNOWN no-resend behavior. Update canonical-schema fixtures, migration discovery and application packaging. Preserve the 32-table fresh-database boundary and record local versus pending CI acceptance in both languages. Co-authored-by: Qwen-Coder <[email protected]> * fix(managed-agent): refuse system catalogs before schema initialization Co-authored-by: Qwen-Coder <[email protected]> * fix(managed-agent): restore fresh-schema E2E and MariaDB validation Port the real-stack runner and its audits to canonical tables, retain stream and approval scopes, and register fresh Linux storage before Harness admission. Validate MariaDB CHECK enforcement and InnoDB without relying on MySQL-only metadata or negative-test syntax. Add regression coverage and document current platform and acceptance boundaries. Co-authored-by: Qwen-Coder <[email protected]> * fix(managed-agent): normalize boolean CASE catalog literals Accept MariaDB's numeric representation of bare SQL boolean literals while retaining structural CHECK validation, quoted values and enforcement guards. Add alias and tamper regression coverage and synchronize the bilingual verification evidence. Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): raise managed schema MariaDB packet budget Co-authored-by: Qwen-Coder <[email protected]> * fix(managed-agent): support MariaDB load-test query plans Co-authored-by: Qwen-Coder <[email protected]> * fix(managed-agent): Restore native storage fixtures and const read witnesses Preserve measured row counts while bounding MariaDB optimization-stage page reads, and register Linux Hosted test storage through the production guard before tool admission. Keep recovery registration across restarts and resolve physical owners through aliases. Co-authored-by: Qwen-Coder <[email protected]> * test(managed-agent): Await snapshot publication in retraction checks Keep the strict terminal snapshot watermark assertion while allowing after-commit publication to finish under the concurrent materializer. Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> |
||
|
易良andQwen-Coder
|
aceb7f1223 |
fix(ci): recover reused runner checkouts and Java lock waits (#14017)
* fix(ci): recover reused runner checkouts and Java lock waits Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): refresh Git metadata across Linux validation lanes Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): refresh checkout metadata for triage jobs Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
|
06a837d768 |
fix(ci): double the sdk-java MariaDB lane's per-host lock budget (#13989) (#13991)
The mysql-integration job acquires the per-host sdk-java-tests.lock once per Maven step with a 20-minute budget sized on one quiet pool window (run 37743332082: 1193 s of waits). Main run 38258395829 exhausted it: the Managed Agent verify step starved a full 1200 s behind cross-run pool traffic and failed before Maven started. Raise each acquisition to flock --wait 2400 (two full sibling holds) and the job ceiling to 140 minutes (three 40-minute waits plus the ~14 minutes of measured Maven work, plus margin). Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> |
||
|
|
78a1d33afb |
fix(ci): route the sdk-java MariaDB lane to the ECS pool (#13623) (#13627)
* fix(ci): route the sdk-java MariaDB lane to the ECS pool (#13623) Three consecutive main runs (37636399508, 37653932541, 37654231285) lost their GitHub-hosted ubuntu lanes to runner-queue starvation: every failed job recorded zero steps and no assigned runner, and every job that got a runner passed — including this lane itself, W1c migrations and all, once a hosted runner freed up. The workflow's established answer is trusted-lane ECS routing (#13245, #13270); the MariaDB job was the last pool-safe lane still pinned to the hosted queue. Move its trusted runs (push, workflow_dispatch, same-repo and OWNER/MEMBER/COLLABORATOR PRs) to ecs-qwen and make the shared host safe: the mandated restore/sweep pre-checkout hygiene (pinned byte-identical to ci.yml), the test job's self-hosted Maven setup, the per-host sdk-java-tests.lock around every Maven run, and a random host port for the MariaDB service — a fixed 3306:3306 collides between jobs on one host. Timeout 15 → 25: the hosted lane measured ~12 minutes; the pool adds the lock wait. Hosted process fault gates stays hosted: it apt-installs mysql-server system-wide and runs a 130-minute profile, both hostile to a shared pool without a maintainer's call. * fix(ci): harden the pool-routed sdk-java MariaDB lane (#13623) - Raise mysql-integration timeout-minutes to 45 so one full 20-minute lock wait plus the ~12 minutes of measured Maven work fits the ceiling (25 cancelled the lane on its head run). - Resolve the Managed Agent install and verify steps from one job-local Maven repository under runner.temp, seeded from the shared cache inside the lock, so the fixed 0.1.0-alpha release coordinates cannot cross runs through the host-shared ~/.m2. - Record the deliberate merge-ref checkout stance at the job and pin it. - Strengthen the workflow pins: per-Maven-step lock path coverage, a timeout/lock-wait relation, byte-identical Set up Maven bootstrap across pool jobs, per-job job-local MAVEN_ARGS counts, the -Dmysql.url consumer lines, and a character-identical runs-on tie to the flyway lane. * fix(ci): recapture the pool lane's Maven cache and re-anchor MAVEN_ARGS pins (#13623) Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): recapture third-party com/alibaba artifacts and size the pool lane's lock budget (#13623) Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): keep the pool lane's MariaDB datadir on tmpfs (#13623) mariadb:10.11.18 declares VOLUME /var/lib/mysql, and the runner tears service containers down with `docker rm --force` (no -v), so every pool-routed mysql-integration run stranded one anonymous volume (~150 MB) on the shared ECS hosts, which nothing reaps. Mount the datadir on tmpfs instead: no anonymous volume is created and the storage dies with the container, cancelled runs included. --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: 易良 <[email protected]> Co-authored-by: qwen-code-dev-bot <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> Co-authored-by: qwen-code[bot] <qwen-code[bot]@users.noreply.github.com> |
||
|
Shaojin Wen
|
ba8615f4c4 |
ci(sdk-java): stop the API contract version from regressing or stalling (#13804) (#13808)
The public Managed Agent contract's info.version is allocated by hand on every contract-changing pull request, and nothing checked it: on 2026-10-09 four such pull requests were in flight with 1.34.0 claimed twice while main was already at 1.35.0, and the stall had reached main once before — #13163 changed the document with no version movement. A duplicate Flyway version refuses to boot within minutes, but a regressed or stalled contract version breaks nothing at runtime; it silently misinforms every consumer that keys capability detection on it. On every pull request the Flyway lane now also compares the merge result's document with the base branch's head copy — fetched at depth one, since the default checkout is one commit deep — and fails when a changed document declares an equal or lower version, compared numerically per segment so 1.9.0 ranks below 1.37.0, naming whether the number stalled or regressed; a pull request arriving at the base ref's own bytes owes no bump. Each refusal arm has a test that fails when its guard is removed, and any path echoed into an ::error:: line is bound to the same byte alphabet check-flyway-migrations.js applies, so a hostile name cannot forge a second error line into a decoded log. After every push to main that changes the document, and every 30 minutes, a new workflow re-checks each open pull request's changed paths and document through the API — no pull request code is fetched, checked out or run — and sets the 'API contract version uniqueness (latest main)' status, the #13770 shape for the version number instead of the migrations: failure when the declared version no longer advances past main's, success otherwise, naming the other open pull requests claiming the same version, and error when a file list or head document could not be read in full. A head that already carries the status is re-evaluated even after it stops changing the document, so a stale failure clears. Both scripts ran live before this commit: the pull-request check over four merge shapes (stall, regression, advance, untouched) against a depth-one clone and filtered base fetch, and the re-check as a dry run against the open queue, whose six contract-changing pull requests it correctly read as stalled or regressed against main at 1.38.0. Fixes #13804 |
||
|
|
34843cb9e8 |
ci(sdk-java): re-check open PRs for Flyway version collisions as main moves (#13770)
The Flyway uniqueness guard checks a pull request merged with the main of the moment it ran. Nothing re-ran it when main later gained a migration, so a PR that went green before another PR took its version stayed green and turned main red once it merged; it also cannot see several open PRs claiming one version. A new workflow runs after every push to main that changes a migration and every 30 minutes. It checks out main, reads each open PR's changed paths from the GraphQL API (no PR code is fetched), and sets the 'Flyway migration version uniqueness (latest main)' commit status on each PR head that adds a migration: failure when a version it adds is taken in the merge result, success otherwise naming the other open PRs that claim the same version, and error when the file list could not be read in full. A head whose status would not change is not written again, and a head that already carries the status is always re-evaluated so a stale failure clears. The naming rules move into a shared module used by both scripts; the guard's behaviour is unchanged and its workflow also triggers on that module. Fixes #13742 Co-authored-by: probe <probe@local> Co-authored-by: 易良 <[email protected]> |
||
|
qwen-code-dev-botand易良
|
f3642d4e45 |
fix(ci): sweep stale pool residue before sdk-java checkouts (#13506) (#13507)
A main-push SDK Java run failed its 'ubuntu-latest / Java 21' leg in the Checkout step before any test ran (run 37423974280). The leg runs on the shared self-hosted ECS pool, whose reused workspace accumulates residue from earlier jobs: ci.yml's incident history records review/autofix leftovers (.qwen, .qwen.root-orig, review worktrees and branches) failing actions/checkout's clean, and a runner-user-owned tree failing every later git call with 'detected dubious ownership' (#12648). sdk-java.yml's pool-routed jobs carried only the bare ownership restore, without the two countermeasures ci.yml grew for exactly these failures. Port both, byte-identical to the pinned ci.yml copies, to the three pool-routed jobs (test, flyway-migrations, daemon-e2e): the safe.directory trust joins the restore step, and the stale-.qwen sweep (with its quarantine ladder and review worktree/branch cleanup) runs between restore and checkout, gated to self-hosted so the hosted macOS/Windows legs stay untouched. The sdk-java workflow suite pins the restore -> sweep -> checkout order in all three jobs and pins both step bodies byte-identical to ci.yml's, so the copies cannot drift; mutation-probed by stashing the workflow change (all 9 new pins red) and restoring it (green). The size baseline records the copied recipe's growth in the same commit, per the ratchet. Co-authored-by: 易良 <[email protected]> |
||
|
易良
|
d697f98553 |
fix(ci): raise serve-ab handshake budget, report dead CodeQL nightlies, route trusted PR lanes to ECS (#13270)
* fix(ci): raise serve-ab handshake budget, report dead CodeQL nightlies, route trusted PR lanes to ECS - serve-ab-drive: pass --initialize-timeout-ms 60000 like the other serve harnesses; the 10s default expired under pool contention and the daemon killed its own ACP child (#13266). - codeql.yml: a report_failure job files or comments on one scope/ci-cd issue when a scheduled scan leg fails or is cancelled by its timeout, which the main-CI notifier never saw (#13249). - tui-parity parity/noflicker, sdk-java flyway-migrations and assign-pr-owner assign use the trusted-PR ECS routing with the ownership restore; tui-parity also gets the self-hosted Node, disk-floor and hosted-only cache split (#13245). * fix(ci): scope the no-flicker report dir per runner on the ECS pool accept-noflicker.sh defaults OUT to a fixed /tmp path; hosted runners are single-tenant, but one ECS host runs many jobs at once. |
||
|
|
d5c22d336b |
ci(sdk-java): guard Flyway version uniqueness and watch red main runs (#12965)
* ci(sdk-java): guard Flyway version uniqueness and watch red main runs
Two in-flight PRs each added a V16 managed-agent-server migration and
merged 23 minutes apart; each branch was green in isolation, and Flyway
refused to boot the merged result, leaving main red for two hours while
three more merges stacked on it (#12940).
A new flyway-migrations job runs scripts/check-flyway-migrations.js on
every SDK Java pull request and push: a filename scan of the two
migration locations that share one version sequence, failing in seconds
and naming both files when two claim one version. Versions compare the
way Flyway compares them — numerically per segment — so V016 collides
with V16, and a location rename that would empty the guard fails instead
of passing vacuously.
The main-CI failure watcher now watches the SDK Java workflow, whose
path-filtered push run on main is the only signal for a merge result
neither PR could fail, and the failure-signature helper reads Surefire's
per-test error lines, so a red Java lane files one deduped issue naming
the failing tests instead of a per-commit stub.
Refs #12940
* ci(sdk-java): harden the Flyway guard and dedupe its main-red issues
Review on #12965:
- compare versions across every module of one invocation — Flyway resolves
classpath:db/migration across jars, so a version claimed in two modules
collides exactly like two files in one module
- fail when the SQL location yields no migration even if the Java location
still does, so renaming one location away can no longer pass vacuously
- escape %/CR/LF in module names and file paths before emitting ::error::
(the runner parses workflow commands from stderr too, and the job scans
contributor-controlled filenames on pull_request)
- match the migration suffix case-insensitively, as Flyway does
- keep the fully qualified Surefire id as the dedupe identity so same-named
tests in different packages no longer merge into one issue; the cosmetic
package strip moves to shortenForTitle
- give the guard's ::error:: line a stable flyway:<module>:<version>
identity, so a standing red dedupes to one issue instead of one per
stacked merge, and render the failed jobs in the test-keyed body
- pin the workflow_run watch entry to sdk-java.yml's name key
Co-authored-by: Qwen-Coder <[email protected]>
* ci(sdk-java): fix the Flyway dedupe on runner-rendered logs and close review findings
The Actions runner consumes ::error:: workflow commands and writes
##[error] into the downloadable job log, so the dedupe pattern anchored
on ^::error:: never matched production input and every merge stacked on
a standing red would have opened a fresh autofix issue. The anchor now
accepts both forms, the guard's two non-collision failure modes (moved
migration location, missing module directory) get their own stable
module+mode identity, and the synthesized flyway id is written to be
read since it doubles as the issue title and body bullet.
The issue body's "- Failed jobs:" block is now machine-owned like
"## Also failing": stripped and re-emitted from the current run on every
merge instead of freezing the lanes recorded at filing time, with the
empty-list case pinned against a dangling heading.
The guard itself now reports a multi-module collision once after all
modules are scanned, naming every claimant (a second line would file a
second issue), never prints a clean summary for a claimant, and only
requires the SQL location of a module that owns a db/migration*
directory — which lets the workflow invocation cover runtime-broker, the
module that shares the classpath:db/migration namespace without carrying
migrations today.
escapeWorkflowCommand moves to scripts/release-script-utils.js (the
byte-identical copy would have drifted from the tested original), and
the filename-forgery tests gain a runner-decoding oracle and a
capability probe so the Windows lane skips instead of failing on
filenames Win32 cannot hold.
Co-authored-by: Qwen-Coder <[email protected]>
* ci(sdk-java): close the guard's blind spots and validate its dedupe captures
Review and sandboxed verification on #12965 found the moved-location
probe keying on the two exact directory names: a rename outside the
migration* family (db/migration -> db/changelog) passed silently with
the whole sequence inside it, a renamed Java location printed "all
versions unique" from a scan that skipped it, and a Java-only module
red-lit as "moved" with its real collision never named. The probe is
now derived from the LOCATIONS table: a versioned-migration file
anywhere under a source root but outside the configured location fails
with the files named, the sibling check is per location and fires only
when the location directory itself is gone, and a repeated module
argument no longer fabricates a collision of a file with itself.
The invocation now names qwencode too — managed-agent-server depends on
it at compile scope, the same namespace premise that admitted
runtime-broker — and the .size-baseline entry is re-recorded at the
file's current size.
On the consumer side, both Flyway patterns feed their captures through a
module-shape validation before they become a dedupe identity, so a
filename-borne forgery rendered by the runner's annotation decode can no
longer inject a second identity into the issue this files, and the
guard's run-level diagnosis is ordered ahead of first-seen test ids so a
mass failure in another lane cannot crowd it past the search and body
caps. A closure pin keeps the spawned guard importable in the
dependency-free helper lane.
Refs #12940
* ci(sdk-java): close the Windows-drive forgery and split the stray-file message
The drive-prefix alternative in the module validator re-opened the
forgery it closed: backslash and colon are ordinary characters in a
POSIX filename, so a migration name could supply a `C:\evil` prefix and
pass the path-shape check. No lane that runs this consumer ever
produces a backslashed module — the producer and analyze jobs are
ubuntu-latest and the suite runs only on the Linux lint_and_static
lane — so the branch is dropped, backslashes are rejected outright, and
the fixtures hand the guard a slash-bearing argument (a no-op on POSIX)
instead of teaching the consumer a shape only a forgery can produce.
The unsafe-character half of the validator is now pinned for
whitespace, backticks and backslashes across both call sites.
A populated location with a migration-shaped stray elsewhere under the
source root no longer prints "found no migration under": the guard
names the stray as the cause, and the consumer's config identity learns
the new phrase, so the standing red still files one issue. The dep-free
closure pin now walks the guard's relative-import closure instead of a
hardcoded depth-one list, so a new hop carrying an npm import cannot
slip through.
Refs #12940
* ci(sdk-java): re-record the sdk-java.yml size baseline after merging main
The rebase onto
|
||
|
|
bb8afc3356 |
feat(java): Add managed runtime state foundation (#12301)
* feat(java): add managed runtime state foundation Co-authored-by: Qwen-Coder <[email protected]> * test(java): strengthen runtime broker state coverage Co-authored-by: Qwen-Coder <[email protected]> * build(java): Require JDK 25 for runtime broker Set the new runtime broker module's release target to Java 25 and run its CI checks only on Java 25 across Linux, macOS, and Windows. Preserve the existing SDK compatibility matrix and align the bilingual documentation. Co-authored-by: Qwen-Coder <[email protected]> * build(java): Use JDK 21 for runtime broker Set the new runtime broker module's compilation and runtime baseline to Java 21. Reuse the existing Java 21 matrix across Linux, macOS, and Windows while preserving the SDK's Java 11 compatibility coverage. Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> |
||
|
|
38fae41ddc |
fix(release): stop one flaky test from failing a stable release (#10842)
* test: wait for state instead of fixed timing in three flaky tests Release run 33633468180 failed with all three workspace test shards red, each for an unrelated reason, and all three are timing assumptions that only hold on an idle machine. The message list pagination test polled a fixed budget of 32 animation frames before asserting a load had fired. A frame count does not stretch when the host is loaded and the queued effect lands late, so poll against a wall-clock deadline instead. The scroll-restore test in the same file asserted the restored offset exactly one frame after the load resolved, and now waits for the restore to land. The hook process test read the descendant's pid file the moment the hook returned, but the hook is killed by its own 300ms timeout, which can fire before the descendant has started far enough to write that file. Poll for it the way every other pid read in that file already does. The session PR refresh teardown removed its temp tree with a plain recursive delete. dispose() stops the next tick but does not await the sweep already in flight, so a sweep can still be writing under the tree while teardown walks it, and the delete fails with ENOTEMPTY when a file lands between the readdir and the rmdir. Retry so cleanup waits the writer out. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * fix(release): retry a flaky workspace test instead of failing the release A stable release ran its workspace tests with no retry at all, while nightly and preview retried twice. With ~30k tests behind that gate, any single flaky one reddened the release outright: six consecutive stable runs failed on one test each while build, typecheck, lint, scripts and both integration suites stayed green, and the same test passed on the next attempt. Retry every release schedule, behind a repository variable so the count can be retuned or switched off without a PR. A real break still fails all three attempts; what this stops is a contended runner deciding whether a release ships. Widen the timing bounds the process-tree hook tests impose on themselves. Every test in that file spawns real `node --import=tsx/esm` processes and then waits on a hard wall-clock deadline — 5s for startup, 3-4s for reaping. Process startup is not something a smarter wait can speed up, so on a shared runner those deadlines report host load rather than hook behaviour. Size them for the busiest host; a genuine hang still fails, only later, and the passing path is unchanged at 24s for the file. Assert the recall scan latency against the fastest of its samples rather than the median. Three release shards land on one machine, so a wall-clock median moves with the neighbours' load: it measured 131ms against a 50ms ceiling on a run whose every other gate passed. The fastest sample is the one least contaminated by contention and the closest available estimate of the intrinsic cost, and the shared lane gets a ceiling only a real regression can cross. The printed table now carries best, median and worst so the detail survives. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * fix(acp): keep a failing late-drain recovery from ending the process The mid-turn drain recovery is fired and forgotten with a bare `void`. Its own comment says it "bounds the wait and swallows a late rejection", but it only swallows a rejection of the drain promise: anything that throws after that race escapes as an unhandled rejection, and Node ends the process on one. The debug logger is among the things that can throw there, so a logging failure could take a session down — from a path whose entire purpose is best-effort recovery. This is also what made a release shard red while reporting no failing test. The throw lands on a later tick, so on a loaded host it arrives after the test that installed it has finished: Vitest attributes it to no test, counts it as an error, and exits non-zero with every one of the 8147 tests passed. A test retry cannot help, because nothing failed. Swallow silently rather than log, since the logger is itself one of the things that can throw here. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * fix(release): let the surviving-hook test's descendant outlive the deadline The previous commit polled for the descendant's pid file after the hook returned. That could not help the case it targeted: the hook's 300ms timeout has the supervisor SIGTERM then SIGKILL the whole process group, and the descendant is in that group, so by the time executeHook resolves the file either already exists or never will. On a host where node takes longer than 300ms to start, the poll only moved the same failure 30s later. Raise the hook deadline instead, so the descendant is alive to write its pid before the group is reaped; the poll stays as a harmless guard against filesystem visibility. Give the release retry an honest off switch. `vars.X || '2'` could not disable the retry safely: an empty variable falls back to the default, and '0' passes --retry=0, which outranks a workspace's own config-level retry — the very thing the comment said to avoid. 'off' now omits the flag, and the contract test pins it alongside the stale schedule wording it replaces. Say what the shared-lane latency bound actually checks. A 3x ceiling still read as a budget check while letting a 2.5x regression through. Make it an order-of-magnitude guard and label it as such; the budget itself is asserted off shared runners. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * fix(deps): update vulnerable production packages Co-authored-by: Qwen-Coder <[email protected]> * chore(vscode-ide-companion): regenerate NOTICES.txt for bumped deps The dependency bump in this PR (fast-uri 3.1.5->3.1.7, qs 6.15.2->6.16.0, side-channel 1.1.0->1.1.1) left NOTICES.txt stale, failing the CI notices freshness gate. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-conflict/jmtkdz88hdi * test(release): align widened waits with per-test budgets and lane-aware deadlines - hook-runner.process.test.ts: raise the 'reaps an active %s hook tree on parent %s' (15s) and 'lets %s write output and finish' (10s) per-test budgets to 90s, matching every sibling — the widened 30s/15s inner waits can never complete inside the stale budgets on oversubscribed ECS runners. - recall-scan-latency.test.ts: the row tuple gained a 'best' column, so the strict bound silently asserted best-of-5; assert the median off shared runners and keep the loose best-of-5 bound on shared ECS lanes. - MessageList.dom.test.tsx: make FLUSH_DEADLINE_MS lane-aware (10s on ecs-qwen- runners, 4s elsewhere) so it stays inside vitest's 5s default testTimeout off the ECS lanes that grant 60s. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmtklu5f5dz * docs(test): correct two comments that now describe the opposite of the code The retry test's retained comment still said the stable path must omit the flag rather than zero it. That was true before this PR and is false after it: every schedule now retries by default, and only the operator sentinel omits the flag. The pinning test three lines down asserts exactly that, so the comment told the next reader the opposite of what the file checks — and a future edit justified by it would revert the fix. The process-test header claimed every test spawns `node --import=tsx/esm`. Four of eleven blocks do; four spawn plain node over `node:` builtins and three spawn nothing. The header carries the deadline-sizing rationale, so the claim invites applying a seconds-scale tsx startup model to processes that pay tens of milliseconds. Say which fixtures pay it, and that the budgets are generous rather than tight for the rest. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * test(ci): give the autofix workflow suite headroom over host contention `upserts deferred findings into a per-PR issue that survives the merge` scans the whole rendered workflow repeatedly and measures ~14s idle against the suite's 30s default. On a contended release runner it exhausted that budget in two consecutive Release runs, failing Quality Checks (Scripts) as the only red file out of 76. Claude-Session: https://claude.ai/code/session_01MCE9CXnMVrX4fUxHpQoUr8 * test(cli): pin the late drain recovery guard against unhandled rejections The `.catch(() => {})` on `#recoverLateDrain` had no committed regression test: removing it kept the drain suite green while anything thrown after the drain race — the debug logger among them — escaped as an unhandled rejection. The new test drives a real prompt through a mid-turn drain timeout, faults the module-graph logger exactly on the recovery's debug line, and asserts zero escaped rejections. Mutation-verified: deleting the guard turns it red. Co-authored-by: Qwen-Coder <[email protected]> * test(core): size the surviving-hook timeout fixture for loaded startup 'enforces a surviving hook timeout after the parent exits' configured its fixture deadline at 300ms, but the supervisor's clock starts at hook spawn, so on loaded hosts the group was killed before the hook wrote its ready/pid files; the driver's busy-wait then never broke and the test burned its 90s vitest budget instead of exercising the reap assertions. Use HOOK_GROUP_TIMEOUT_MS, the way the byte-similar group test was converted. Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): isolate Maven config per SDK Java job Concurrent self-hosted runner instances share HOME, so deleting or updating ~/.m2/toolchains.xml races with Maven startup in neighboring jobs. Point setup-java at the per-runner temp directory and make every Maven invocation consume those job-local settings and toolchains files. Co-authored-by: Qwen-Coder <[email protected]> * test(serve): wait for the shared session/list waiter before cutting a connection The release gate went red on this test for the first time on run 33701581941: `session/list scan alive when one connection is destroyed` failed with `-32603` instead of the empty session list, twice in a row. `PersistedSessionListCache` aborts an in-flight scan the moment its waiter count reaches zero, and a request only becomes a waiter once it reaches `lookup()`. The test posted both requests, waited for the loader, and then deleted the first connection — which proves the *first* request attached but says nothing about the second. On a loaded runner the second can still be resolving params when the DELETE lands, so the count drops to zero, the shared scan is aborted, its promise rejects, and the second request answers out of that rejection as an internal error. Watch `lookup()` for the single-flight join so the DELETE can never land before the second waiter is attached. The waiter count is bumped synchronously inside `lookup()`, so observing the `single_flight` status is exactly the "second waiter attached" edge the test needs — and it holds whichever of the two requests wins the race to start the scan. The cache's own unit test already covers the invariant deterministically ("cancels one waiter without aborting the shared load"), so this is a test-side race only; no production behavior changes. Claude-Session: https://claude.ai/code/session_012797rgiteWJxLT9TLkKq8G * test(serve): skip an interface that vanished mid-suite instead of failing on it `isOwnInterfaceAddress` re-reads `networkInterfaces()` on every call, while the suite snapshots the host's addresses once at collection. A shared CI host adds and drops veth interfaces continuously, so an address captured at collection can be gone minutes later when a case asserts on it — the function then correctly answers false and the case fails on a host that changed rather than on the lost normalisation it exists to guard. That is what reddened Workspace Tests (2/3) of release run 33676423730: `strips an RFC 6874 zone identifier before matching` and `matches an own address case-insensitively` — the two cases that run last here — failed `expected false to be true`, while the bare and bracketed cases that run before them passed on the same addresses. Intersect the collection snapshot with a fresh read per case. The fresh read comes from `node:os`, not from the function under test, so no case can confirm itself, and the vacuity guard stays: the loopback never churns, so the intersection never runs empty. Claude-Session: https://claude.ai/code/session_012797rgiteWJxLT9TLkKq8G --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: yiliang114 <[email protected]> Co-authored-by: yiliang114 <[email protected]> |
||
|
易良andQwen-Coder
|
3aa1b14624 |
ci: stabilize tests under shared ECS host contention (#10552)
* ci: tolerate shared runner scheduling delays Co-authored-by: Qwen-Coder <[email protected]> * test(ci): inherit ECS contention budgets Co-authored-by: Qwen-Coder <[email protected]> * test(cli): extend PTY request budget on ECS Co-authored-by: Qwen-Coder <[email protected]> * test(cli): synchronize ACP archive race Co-authored-by: Qwen-Coder <[email protected]> * test(ci): isolate visuals publisher fixture modules Co-authored-by: Qwen-Coder <[email protected]> * test(ci): cover hostile parent package scopes Co-authored-by: Qwen-Coder <[email protected]> * test(sdk-java): isolate finite SSE fixture connections Co-authored-by: Qwen-Coder <[email protected]> * test(cli): make timer-range deadline deterministic Co-authored-by: Qwen-Coder <[email protected]> * test(sdk-java): tolerate shared CI scheduling delays Co-authored-by: Qwen-Coder <[email protected]> * test(sdk-java): preserve timeout contract on CI Co-authored-by: Qwen-Coder <[email protected]> * test(sdk-java): include request submission in timeout bound Co-authored-by: Qwen-Coder <[email protected]> * ci: extend no-AK shared runner timeout Co-authored-by: Qwen-Coder <[email protected]> * test(ci): guard no-AK integration budget Co-authored-by: Qwen-Coder <[email protected]> * ci(sdk-java): serialize ECS test execution Co-authored-by: Qwen-Coder <[email protected]> * test(sdk-java): relax stalled-response setup on CI Co-authored-by: Qwen-Coder <[email protected]> * test(ci): align no-AK timeout contract Co-authored-by: Qwen-Coder <[email protected]> * ci: extend Serve A/B shared runner budget Co-authored-by: Qwen-Coder <[email protected]> * ci: scope extended ceilings to ECS routing The extended job ceilings (test 60->90, integration_no_ak 30->60) were unconditional even though runs-on falls back to GitHub-hosted ubuntu-latest for fork PRs from untrusted authors and when MAINTAINER_ECS_RUNNER_DISABLED=true. Derive each ceiling from the runner classify_pr selected so hosted paths keep the pre-contention bound and a genuine hang there does not burn the extra 30 minutes. The lane contract now evaluates the real timeout expression for both routings instead of pinning a bare number, matching the substitute-then-evaluate technique ci-runner-routing.test.mjs uses on runs-on. Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): address closeout review feedback Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
Shaojin Wenand易良
|
06cc41ee3f |
ci: route trusted-author fork PRs and no-checkout jobs to the ECS pool (#8502)
* ci: route trusted-author fork PRs and no-checkout jobs to the ECS pool Fork PRs whose author has write access (OWNER/MEMBER/COLLABORATOR association) now run Linux CI on the self-hosted ECS pool instead of the saturated GitHub-hosted quota, and bot workflows that check out no code move to ECS unconditionally. Everything stays gated on the MAINTAINER_ECS_RUNNER_DISABLED kill-switch. * ci: address review — real write-permission routing, watchdog independence, timeouts Route the triage agent on the collaborator-permission API result computed by authorize instead of the coarse author_association, which admits org members and read-only collaborators; the two permission-gate jobs revert to the same-repo guard. Keep the fleet watchdog and the CI-failure reporter hosted so they stay independent of the pool they watch. Add missing timeouts, wipe serve-ab's reused workspace, and pin the routing logic with drift and negative-case tests. --------- Co-authored-by: 易良 <[email protected]> |
||
|
易良
|
fddcda86ed |
ci: reduce SDK Java runner queueing (#8441)
* ci: cancel stale SDK Java pull request runs * fix(ci): preserve SDK Java push scheduling * ci: route trusted SDK Java jobs to ECS * ci: simplify SDK Java runner routing * fix(ci): provision Maven on ECS Java jobs * fix(ci): clean SDK daemon ECS test state * fix(ci): satisfy SDK Java lint |