Re: [PR] ci: hold every pull request lane to one 45-minute limit [maka]

["M4n5ter (via GitHub)" <gi...@apache.org>]

M4n5ter commented on code in PR #3948:
URL: https://github.com/apache/maka/pull/3948#discussion_r3872717761


##########
scripts/ci-test-plan.test.mjs:
##########
@@ -354,6 +354,42 @@ test('pull request triggers stay on an explicit allowlist', () => {
   ]);
 });
 
+test('every pull request lane holds a scarce runner for the same bounded time', () => {
+  // One tier, not per-lane values. The worst observed successful runs are 19
+  // minutes (ci.yml) and 20 (release-windows-check), so 45 is about 2.3x the
+  // slowest lane: enough headroom for a cold cache and a flake retry, and far
+  // short of the 120 and 90 a hung job used to hold. A lane with no limit at
+  // all inherits GitHub's 360 and fails here.
+  // `pull_request` only: a `pull_request_target` lane reads the pull request
+  // rather than gating it, so it is not competing for a runner the author is
+  // waiting on and keeps its own tighter limit.
+  const gates = readdirSync(WORKFLOW_DIR).filter((name) =>
+    /\bpull_request\b/u.test(triggerBlock(name)),
+  );
+  assert.ok(gates.length > 0, 'no pull request lane found');
+
+  for (const name of gates) {
+    // From `jobs:` on, with comment lines stripped, so prose above the triggers
+    // cannot be read as a job.
+    const workflow = readWorkflow(name).replaceAll(/^[ \t]*#.*$/gmu, '');
+    const start = workflow.indexOf('\njobs:');
+    assert.ok(start >= 0, `${name}: no jobs block`);
+    const jobs = workflow.slice(start);

Review Comment:
   **[P2] The enforced scope is wider in one direction and narrower in the other than the rule described above.** After selecting workflows with a literal `pull_request` trigger, this scans every runner job below `jobs:` without evaluating its `if`, so it forces the `cli-package-validation` Eval job from 30 to 45 minutes even though that job explicitly cannot run on `pull_request`. Conversely, `copilot-auto-review.yml` is deliberately excluded here because it uses `pull_request_target`, yet this PR still changes its secret-bearing API job from 5 to 45 minutes without a contract covering that exception. The workflow remains trusted-base-only and cancel-in-progress, so this is operational exposure rather than a P0/P1 blocker. Please keep that job at 5 minutes and make the contract enumerate jobs that can actually run on ordinary pull requests.
   
   ---
   _Posted by an automated review agent operated by @M4n5ter. This is not an
   independent human review and does not satisfy the committer review required by
   CONTRIBUTING.md. A human is accountable for this comment — please push back if
   anything here is wrong._
   
   <details><summary>简体中文</summary>
   
   _本条评论由 @M4n5ter 运行的自动化审查程序发出。它不构成 CONTRIBUTING.md
   所要求的独立人类审查，也不能替代人类审查。有人类对本条评论负责，如有错误请直接指出。_
   
   </details>



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org