Repository navigation
fix(release): standardize on ubuntu-26.04 and share Go test job - #60
Merged
Merged
Conversation
Release run 38748137720 failed because ubuntu-26.04 moves Graphviz's layout engines other than dot into a separate package, and PR checks still ran on ubuntu-latest (24.04). - Standardize Linux workflows on ubuntu-26.04; Linux archives stay on ubuntu-22.04 for the glibc floor. - Add the reusable test-go.yml, shared by PR checks and release-tag. - Add scripts/setup-graphviz.sh to install and check Graphviz engines. - Smoke-test darwin/amd64 under Rosetta on macos-15. - Bump Playwright to 1.61.1 for ubuntu-26.04.
data-douser
added
bug
* feat(abom): implement QLaaS session audit log Implements user interfaces for viewing QLaaS agent-session audit log while implementing safer orphan removal from settings page. Audit log - Record every agent session's hook, permission, tool, policy and measured test events (sanitized, capped at 16 KiB per detail) in SQLite and PostgreSQL. - Add a CodeQL > Audit log tab, plus audit icons on Requests and Runs rows. Search and filters apply as you type or choose. Filters show as named chips. Follow is on by default. Toolbar actions are icons with tooltips. - One card per session: time used against the time limit, Copilot AI credit cap and usage, and events and refusals. Its details are tabs inside the card. - Exports: the filtered log as JSONL, and a session's reproduction guide as Markdown. Both are refused in Demo mode. - Requests and Runs keep the column header and the opened row pinned while you scroll. - Tooltips stay inside the window, and a page left open on an old build offers Reload. Removing what you no longer own - Settings no longer opens a removal dialog by itself; you start it with Review removal. - A removal applies only to the preview that was reviewed. If anything that preview kept would now be removed, nothing changes and the current numbers are shown (409). - Removing half or more of what is in view needs explicit confirmation (`--most` on the command line). Deleting permanently asks first. - The owned-scope walk ignores letter case in repository names. - Remove the unused /api/prune/staleness endpoint and its startup check. Security and quality fixes - Escape all recorded text in the Markdown guide so it cannot form links or images. - Follow shows new events on the last page in oldest-first order. - Prune and compact report server failures as failures, not refusals. - Session lists and cards keep refreshing after a failed read, and until the session ends. - A session, request or run that does not exist reads as not recorded, not as the server being unavailable. - Find versions only the query it returns. - Resolve C# CodeQL findings. The Go, JavaScript and C# suites now report zero findings. * Address PR 58 review findings - Refuse request/run and a conflicting session on the session-scoped audit events and reproduction routes, instead of silently narrowing them - Sanitize a session's ending detail only in the store - Add a test showing a credit-limit request before the session exists does not hold up event delivery * Classify audit errors by kind, not wording Mark refused audit filters (limit, order, cursor) with store.ErrBadAuditFilter and map HTTP status from it in auditError, instead of matching substrings of the error message.
data-douser
marked this pull request as ready for review
October 15, 2026 22:55
Copilot stopped reviewing on behalf of
data-douser due to an error
October 15, 2026 22:55
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
4 open findings
ubuntu-26.04. If this runner label is not available (or is… · Newdotis split into separate… · Newlibgvplugin-neato-layout8, which is version/ABI-specific and likely to drift… · Newdigraphinput for every layout engine. Some Graphviz engines are… · New
What changed in this PR
This PR standardizes Graphviz installation/verification across CI (including Ubuntu 26.04 packaging changes and macOS amd64 smoke-testing under Rosetta), factors Go test execution into a reusable workflow shared by PRs and releases, and updates the UI E2E Playwright version.
Changes:
- Add
scripts/setup-graphviz.shand switch multiple workflows to use it instead of inline Graphviz installs. - Introduce reusable Go test workflow (
test-go.yml) and refactorbuild-and-test-go.yml/release-tag.ymlto call it. - Pin many GitHub Actions workflows to
ubuntu-26.04and update Playwright inui/tests/e2e.
| File | Description |
|---|---|
| ui/tests/e2e/package.json | Bumps Playwright test dependency for UI E2E. |
| scripts/setup-graphviz.sh | Adds a cross-platform Graphviz install + engine verification script for CI. |
| plans/tools/deployment.md | Documents release/test flow changes and Graphviz/Rosetta behavior. |
| docs/deployment/source.md | Updates source-deployment docs for Graphviz engine packaging changes and setup script. |
| .github/workflows/update-codeql.yml | Pins runner to ubuntu-26.04 and uses the Graphviz setup script. |
| .github/workflows/test-go.yml | Adds a reusable workflow for Go tests shared by PR and release flows. |
| .github/workflows/self-audit.yml | Pins self-audit jobs to ubuntu-26.04. |
| .github/workflows/release-tag.yml | Refactors tag-time Go checks to call the reusable test-go.yml. |
| .github/workflows/release-build.yml | Uses Graphviz setup script; adjusts macOS amd64 smoke-test to run on arm64 runner with Rosetta. |
| .github/workflows/query-unit-tests.yml | Pins query unit test jobs to ubuntu-26.04. |
| .github/workflows/lint-go.yml | Pins Go lint job to ubuntu-26.04. |
| .github/workflows/dependency-review.yml | Pins dependency review job to ubuntu-26.04. |
| .github/workflows/copilot-setup-steps.yml | Adds Graphviz setup script to path triggers; pins runner to ubuntu-26.04; uses setup script. |
| .github/workflows/build-and-test-ui.yml | Adds setup script to path triggers; pins multiple UI jobs to ubuntu-26.04; uses setup script. |
| .github/workflows/build-and-test-go.yml | Refactors Go CI jobs to call test-go.yml and adds it to path triggers. |
| .github/workflows/actions.lock | Updates action-lock manifest to include the newly added reusable workflow dependencies. |
Files not reviewed (1)
- ui/tests/e2e/package-lock.json: Generated file
🧠 Review effort: Lite
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Clarify Graphviz installation requirements for Ubuntu 26.04 and later. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com>
Copilot stopped reviewing on behalf of
data-douser due to an error
October 15, 2026 23:01
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
2 open findings
4 resolved since last review
dotis split into separate…ubuntu-26.04. If this runner label is not available (or is…digraphinput for every layout engine. Some Graphviz engines are…libgvplugin-neato-layout8, which is version/ABI-specific and likely to drift…
Files not reviewed (1)
- ui/tests/e2e/package-lock.json: Generated file
🧠 Review effort: Lite
Copilot stopped work on behalf of
data-douser due to an error
October 16, 2026 02:07
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com>
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 02:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
This pull request is a second attempt to fix the automated release process for test of
v2.27.2-rc1release.The broader set of
.github/workflows/**changes are intended to help detect workflow failures earlier, meaning as PR check failures here rather than as release workflow failures later.Summary of Changes
This pull request refactors the GitHub Actions workflows to improve maintainability and consistency, especially around Go build and test processes. The most significant changes include centralizing common Go test logic into a reusable workflow, standardizing the environment across jobs by upgrading to
ubuntu-26.04, and replacing direct Graphviz installation commands with a script for portability. These changes help ensure that pull requests and releases are tested in the same way, reduce duplication, and make the workflows easier to update in the future.Workflow Refactoring and Reuse:
.github/workflows/test-go.yml, which is now called by bothbuild-and-test-go.ymlandrelease-tag.yml. This centralizes the logic for running Go tests and builds, reduces duplication, and ensures consistency across pull requests and releases. [1] [2] [3]Environment Standardization:
ubuntu-26.04runners instead ofubuntu-latest, ensuring a consistent and controlled environment for all CI tasks. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13]Graphviz Installation Improvements:
apt-getorbrew) with a portable scriptscripts/setup-graphviz.shacross all workflows, making the setup more reliable and consistent across environments. [1] [2] [3] [4]Workflow Input and Trigger Enhancements:
scripts/setup-graphviz.shand.github/workflows/test-go.yml, ensuring that relevant workflows are triggered when these files change. [1] [2] [3] [4] [5] [6]macOS Runner and Rosetta Support:
These changes collectively make the CI workflows more maintainable, robust, and consistent across different environments and event types.