release-train: staging -> main - #653
Merged
Merged
Conversation
…ard every tool pin (#648) * ci(build): cross-compile only on release; lint via make lint; pin guard covers all tool pins build.yml's Build job ran all 8 release targets on every push and PR (506 s of a 920 s run, not a required check, smoke test on one leg). Keep linux/amd64 (native, smoke) + windows/amd64 (x/sys/windows compile check); the other six legs already build, sign and publish from release.yml at every tag, which is unchanged. The Lint job calls `make lint` instead of restating errcheck / ineffassign / misspell / staticcheck with their own @Version. Same four tools, same flags; the Makefile is now the only declaration. Required context name `Lint` is unchanged. scripts/check-tool-pins.sh covers every tool pin: five rows added (errcheck, ineffassign, misspell, staticcheck, golangci-lint). The golangci pin is an action `version:` input, so the guard gains a second detection shape for that and golangci.yml reads the version via a new `make print-GOLANGCI_LINT_VERSION` step. A hermetic harness, scripts/tests/tool-pins-verify.sh, runs the real guard against a fixture tree and pins six properties (both shapes redden, unrelated action's version: does not, missing inputs fail closed); wired into the Installer job and make check / make ci. mutation.yml (0 runs ever) is deliberately left alone — owner decision. BUGBOT.md and Makefile comments updated where this made them false. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(check-tool-pins): indentation-aware disarm, per-file reset, any literal version is a restatement; harness cases for each Review found three holes in the shape-2 (golangci-lint-action `version:`) state machine, each one a way the guard reports clean while the thing it exists to catch is present: - Disarm fired on ANY `- ` line, so YAML list items inside the armed step's own `with:` block (an `args:` list before `version:`) cleared the state and a literal `version: vX.Y.Z` after them passed. Now the guard records the column of the `uses:` key that armed it and disarms only on a later non-blank, non-comment line shallower than that column — a sibling step or a parent key. List items are deeper and no longer disarm. - `armed` never reset between files, so a workflow ending on the action's `uses:` line armed the next file in sort order and a `version:` there was falsely attributed. `FNR == 1 { armed = 0 }`. - The value test `v?[0-9]` only caught numeric pins; `version: latest` — an un-pinning the action honours — passed. Any value not starting with `${{` is now a copy. tool-pins-verify.sh gains one property per hole (7: with: list before a literal version reddens; 8: armed state does not leak across files, with the second file's version: indented deeper than the arming key so only the per-file reset can clear it; 9: version: latest reddens). All three redden on the previous guard and hold on this one; each rule was mutated individually and reddened exactly its own case. The harness now reports the property count it actually ran instead of a hardcoded 6. BUGBOT.md called the golangci-lint check "required"; it now says "blocking exit-code check", which is true independent of branch protection. The GATE comment in golangci.yml said marking it required was still pending — the live protection API lists it among develop's required contexts, so the comment is updated to match. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * ci(build): keep the darwin/arm64 leg on push and PR — the team's own machines try PR binaries from these artifacts Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(bugbot): the Build job is three legs — darwin/arm64 is back in the matrix (cli#648) The tip commit re-added the darwin/arm64 leg, leaving BUGBOT.md and build.yml's header asserting two. The job comment already said three. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…g-x group (#647) * chore(deps): bump golang.org/x/sys in the golang-x group Bumps the golang-x group with 1 update: [golang.org/x/sys](https://github.com/golang/sys). Updates `golang.org/x/sys` from 0.47.0 to 0.48.0 - [Commits](golang/sys@v0.47.0...v0.48.0) --- updated-dependencies: - dependency-name: golang.org/x/sys dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang-x ... Signed-off-by: dependabot[bot] <support@github.com> * chore(release): bump VERSION 0.10.24 -> 0.10.25 for the golang-x dep bump The golang.org/x/sys bump changes go.mod (a published path), so the version-bump-gate requires VERSION to advance in this PR -- the release train reads VERSION to cut the tag and never bumps it for us. v0.10.24 is already released; 0.10.25 is the next unreleased final. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Syed Saqlain <syedsaqlain@MacBook-Pro.local> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
release-train: develop -> staging
… it times their rank count (#650) The comment on DefaultTraining said the value was "quietly wrong above world_size 1" and that per-job-vs-per-rank was an open question. Since client-runtime#500 that is no longer what the runtime does with the number: a GPU pod's rank count is its nvidia.com/gpu limit, and the runtime stamps this per-rank base times that count, capped so the node's GPU pods still pack, refusing admission on a single-node edge when the scaled envelope can never be placed (client-runtime#483). A CPU pod runs a CPU-only torch, so its world_size is 1 by construction. Records the shipped behaviour where the number lives; changes no code. The package caveat about GPU pods being BestEffort is narrowed to the case where that is still true (single-GPU pods with the bound dark). Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
release-train: develop -> staging
Contributor
Author
|
bugbot run |
tracebloc-release-train
Bot
added
the
gate-nudge
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 61212a0. Configure here.
tracebloc-release-train
Bot
added
gate-nudge
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated promotion by the release train (RFC-0008 D14). Head is the train-managed
release-train/to-mainbranch (a mirror ofstaging), so it never collides with a human PR. Merged only when the fr-gate is green.Note
Low Risk
Changes are mostly CI/docs and a patch dependency; the slimmer PR build matrix defers compile checks for five release targets until tag builds in release.yml.
Overview
Release 0.10.25 with a small
golang.org/x/sysbump (v0.47.0 → v0.48.0).CI tool versions now live only in the Makefile.
build.ymlLint runsmake lintinstead of four inlinego install …@versionsteps;golangci.ymlloadsGOLANGCI_LINT_VERSIONviamake print-GOLANGCI_LINT_VERSION.check-tool-pins.shis extended to cover errcheck, staticcheck, golangci-lint, etc., including literalversion:on GitHub Actions (not justmodule@version). A newtool-pins-verify.shharness andmake tool-pins-selftestwire that guard intocheck/ciand the Installer job.PR Build job matrix is cut from eight cross-compile legs to three (linux/amd64 with smoke test, windows/amd64, darwin/arm64); full eight-target builds stay in
release.yml..cursor/BUGBOT.mddocuments the new lint gates and intentional 3-leg matrix.internal/resources: comment-only clarification thatDefaultTraining()is the per-rank base (CPU as-is; multi-GPU stamped as base × GPU count at runtime)—no behavior change in this diff.Reviewed by Cursor Bugbot for commit 61212a0. Bugbot is set up for automated code reviews on this repo. Configure here.