mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-11-07 06:19:43 -10:00
ca7d487ce9
* ci: route Lint & Static to ECS for every pull request * ci: isolate HOME and complete routing pins for lint_and_static - lint_and_static admits untrusted forks to the shared pool, so pin a job-level HOME/USERPROFILE under runner.temp and create it before the first write (git safe.directory, npm config). - Derive the classifier output from each job's own runs-on in the ceiling helper, so a timeout pointed at the wrong output throws instead of being substituted; parameterise runnerOn the same way. - Pin test's own runs-on to ubuntu_runner and add the HOME-isolation guard for every lane routed past the association gate. - Correct the qwen-autofix premise and the integration_no_ak comment, and record the routing decision in a bilingual design note. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmvvwdojb45 * fix(ci): isolate lint lane HOME and restore routing guard strength Resolve R1-1 (Critical): per-job HOME for lint_and_static so untrusted fork code cannot plant git/npm config a later trusted job inherits; shared warm caches re-pointed via getent + XDG_DATA_HOME/COREPACK_HOME. Resolve R1-2: timeout ceilings derive the output name from each job's own runs-on. Resolve R1-3: explicit ubuntu_runner pin for test. * docs(ci): record lint ECS fork-routing design and correct stale premises Resolve R1-5: bilingual design record (container tradeoff, acceptance, residual risks), qwen-autofix.md section 38 premise, no_ak scoping comment. * fix(ci): publish run-unique isolated HOME from step env, not job env Resolve P1/R1-1: jobs.<job_id>.env cannot read the runner context, so the workflow failed GitHub validation entirely; publish HOME/USERPROFILE via GITHUB_ENV from the first step instead. Resolve R2-1: RUNNER_TEMP survives across jobs on this pool, so the path is run-unique, cleared before create, and reclaimed by an always() step before the failure collector. Resolve R2-3: share content-verified linter/corepack caches via RUNNER_TOOL_CACHE. Resolve R2-5: move the HOME guard into the PR-gated routing battery with a single-lane set pin; resolve wenshao R2-4 with one fleet ladder for both outputs. Witness: actionlint 1.7.12 exits clean on ci.yml; six mutations each red the matching guard. * docs(ci): correct lint routing record per round-2 review Supersede link points at qwen-autofix.md section 38 (R2-4); read-only token and HOME-relative write class stated precisely (R2-2); residual risks are examples not a census, naming web_shell_e2e_smoke and other PAT pool jobs (wenshao R2-3); association gate recorded as throughput policy, not an enforceable boundary (R2-6); dispatch-over-fleet priority and per-lane hosted ceilings (P3); cache cost list and PR-gated test placement updated. * chore(ci): bump ci.yml size ratchet for merged tmpdir routing and HOME isolation Growth is real: #15979's helper-test tmpdir routing arrived via the main merge the freshness gate required, plus this PR's run-unique HOME mechanism. 156377 -> 161281 bytes. * fix(ci): keep COREPACK_HOME per-run; shared cache is a poisoning channel Corepack does not re-verify extracted entries on cache hit (reproduced locally on 0.36.0 with the repo's pnpm pin: tampered entry executes with the recorded hash unchanged, network disabled). Move COREPACK_HOME inside the run-unique HOME; XDG_CACHE_HOME stays shared because lint.js SHA-256-verifies linter archives on every hit. Guard and bilingual record updated; shared-corepack mutation reds the guard. --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Shaojin Wen <[email protected]>