(maka) 02/03: ci(windows): cover the recovery lane's install and build inputs

[wy...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

M4n5ter pushed a commit to branch ci/windows-recovery-scope-to-changed-paths
in repository https://gitbox.apache.org/repos/asf/maka.git

commit eb19b4808266b278ef36d254f99075552f0dded1
Author: AstroHan <le...@outlook.com>
AuthorDate: Wed Aug 26 17:42:30 2026 +0800

    ci(windows): cover the recovery lane's install and build inputs
    
    Adversarial review found three gaps in the previous commit.
    
    The filter omitted package.json and package-lock.json, which the
    unconditional `npm ci` step consumes. A grouped dependabot bump touches
    only those two files, so the weekly npm update would have skipped this
    lane while its crash gates sit on the native fs-native-extensions file
    lock that the Linux test lane cannot observe at all. The sibling Windows
    gate in runtime-host-owner-platform.yml already lists both. Project files,
    patches and the clean/build scripts are inputs of the same two steps and
    join them.
    
    Removing `push: branches: [main]` was outside this change's goal. The
    filter applies to pull_request alone, so the main push never cost anything
    on the pull request side, while `strict: false` lets a stale-base pull
    request go green and only the merged result proves two independently green
    halves still agree.
    
    The concurrency group stayed keyed on github.ref after push left, so the
    nightly, a dispatch and a main push shared one group with cancel-in-progress
    evaluating to false: a manual run queued behind the nightly for up to the
    job timeout, and the next dispatch discarded it while still pending. It now
    uses the sandbox lane's head_ref-or-run_id key.
    
    The filter contract test derived nothing and only restated the list. It now
    derives the executed workspaces from the dist paths the steps run, so adding
    a workspace to this lane fails until its sources and project file are
    filtered.
    
    Generated-by: Claude Opus
---
 .asf.yaml                              |  4 +++
 .github/workflows/windows-baseline.yml |  2 +-
 .github/workflows/windows-recovery.yml | 34 +++++++++++++++++++----
 scripts/ci-test-plan.test.mjs          | 51 +++++++++++++++++++++++++++++-----
 4 files changed, 77 insertions(+), 14 deletions(-)

diff --git a/.asf.yaml b/.asf.yaml
index 6ac3fe6b8..afff5f4c7 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -67,6 +67,10 @@ github:
         # Storybook. Renaming it there, or adding a paths filter that stops
         # ci.yml from running, freezes every pull request: the check never
         # reports and no committer can override it.
+        # A required context must report on every pull request, so a lane
+        # behind a paths filter cannot be listed here: the filter would keep
+        # the workflow from starting and the check would stay pending forever.
+        # windows_recovery is filtered and therefore deliberately absent.
         contexts:
           - test
 
diff --git a/.github/workflows/windows-baseline.yml b/.github/workflows/windows-baseline.yml
index a2f812c7a..06f2dafaa 100644
--- a/.github/workflows/windows-baseline.yml
+++ b/.github/workflows/windows-baseline.yml
@@ -149,7 +149,7 @@ jobs:
 
       # Full packages/storage test:dist is ~10 minutes on windows-latest and
       # mostly duplicates the Linux unit lane. Baseline keeps process/path/
-      # lock-sensitive gates here. Release-blocking crash evidence belongs to
+      # lock-sensitive gates here. Crash and owner-death evidence belongs to
       # windows-recovery.yml, so this diagnostic lane does not duplicate it.
       # Bump concurrency carefully — several suites spawn child processes and
       # fight for disk under high fan-out.
diff --git a/.github/workflows/windows-recovery.yml b/.github/workflows/windows-recovery.yml
index 38cb4c826..f4c24e8bc 100644
--- a/.github/workflows/windows-recovery.yml
+++ b/.github/workflows/windows-recovery.yml
@@ -19,26 +19,48 @@ name: Windows recovery
 
 # The paths below are a pre-filter, not this lane's real input. The real input
 # is the import closure of the crash and owner-death recovery authorities in
-# storage, runtime, and Runtime Host, which reaches well past any list worth
-# hand-maintaining. So they name the directories that own those authorities,
-# which keeps a change there blocking before merge, and the nightly run is what
-# covers transitive edits once they land.
+# storage, runtime and Runtime Host, which reaches well past any list worth
+# hand-maintaining. So they name the directories owning those authorities, plus
+# the manifests, patches and project files the unconditional install and build
+# steps consume directly. That keeps a change there reported before merge, and
+# the nightly run is what covers transitive edits once they land.
 on:
   pull_request:
     paths:
+      - 'package.json'
+      - 'package-lock.json'
+      - 'patches/**'
+      - 'tsconfig.base.json'
+      - 'tsconfig.lib.json'
+      - 'packages/storage/tsconfig.json'
       - 'packages/storage/src/**'
+      - 'packages/runtime/tsconfig.json'
       - 'packages/runtime/src/**'
+      - 'packages/runtime/scripts/**'
+      - 'packages/runtime-host/tsconfig.json'
       - 'packages/runtime-host/src/**'
+      - 'scripts/clean-build.mjs'
+      - 'scripts/clean-paths.mjs'
       - 'scripts/windows-runtime-host-local-ipc-trust.ps1'
       - '.github/workflows/windows-recovery.yml'
+  # Unfiltered on purpose: required_status_checks is `strict: false`, so a pull
+  # request goes green against a stale base and only the merged result proves
+  # two independently green halves still agree. The nightly alone would find
+  # that a day later, against a batch of commits instead of one.
+  push:
+    branches: [main]
   schedule:
     # Offset from windows-sandbox-w0 so the Windows lanes do not overlap.
     - cron: '17 8 * * *'
   workflow_dispatch:
 
+# Pull request pushes supersede each other. Scheduled, manual and main-push
+# runs each get a unique group, because github.ref is refs/heads/main for all
+# three: a shared group made a dispatch queue behind the nightly and let the
+# next dispatch discard it while still pending.
 concurrency:
-  group: windows-recovery-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: windows-recovery-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
diff --git a/scripts/ci-test-plan.test.mjs b/scripts/ci-test-plan.test.mjs
index 2bbf27f21..03d00ba37 100644
--- a/scripts/ci-test-plan.test.mjs
+++ b/scripts/ci-test-plan.test.mjs
@@ -352,27 +352,64 @@ test('pull request triggers stay on an explicit allowlist', () => {
   ]);
 });
 
-test('the recovery lane pairs its path filter with a nightly run', () => {
+test('the recovery lane pairs its path filter with a nightly run and a main push', () => {
   const workflow = readWorkflow('windows-recovery.yml');
 
   // Same contract as the sandbox lane: the filter is a pre-filter, not the
   // lane's import closure, so dropping the schedule would silently lose every
   // transitive edit it cannot match, and dropping the filter would put every
-  // Windows recovery run back on every pull request.
+  // Windows recovery run back on every pull request. The main push carries no
+  // filter because `strict: false` lets a stale-base pull request go green,
+  // and only the merged result proves two green halves still agree.
   assert.match(workflow, /\n {2}pull_request:\n {4}paths:/u);
+  assert.match(workflow, /\n {2}push:\n {4}branches: \[main\]/u);
   assert.match(workflow, /\n {2}schedule:/u);
   assert.match(workflow, /\n {2}workflow_dispatch:/u);
   assert.match(workflow, /\n {4}name: windows_recovery/u);
-  assert.match(workflow, /cancel-in-progress: \$\{\{ github\.event_name == 'pull_request' \}\}/u);
 });
 
-test('the recovery lane filter names the authorities its steps execute', () => {
+test('the recovery lane keeps scheduled and manual runs out of one shared group', () => {
   const workflow = readWorkflow('windows-recovery.yml');
 
+  // github.ref is refs/heads/main for the nightly, a dispatch and a main push
+  // alike, so a ref-keyed group made a dispatch queue behind the nightly for
+  // up to the job timeout and let the next dispatch discard it while pending.
+  assert.match(
+    workflow,
+    /group: windows-recovery-\$\{\{ github\.head_ref \|\| github\.run_id \}\}/u,
+  );
+  assert.match(workflow, /\n {2}cancel-in-progress: true/u);
+});
+
+test('the recovery lane filter covers every workspace its steps execute', () => {
+  const workflow = readWorkflow('windows-recovery.yml');
+  // Derived from the dist paths the steps actually run, so adding a workspace
+  // to this lane fails here until its sources and project file are filtered.
+  const executed = [
+    ...new Set([...workflow.matchAll(/packages\/([^/]+)\/dist\//gu)].map((match) => match[1])),
+  ].sort();
+
+  assert.deepEqual(executed, ['runtime', 'runtime-host', 'storage']);
+  for (const workspace of executed) {
+    assert.ok(workflow.includes(`      - 'packages/${workspace}/src/**'`), workspace);
+    assert.ok(workflow.includes(`      - 'packages/${workspace}/tsconfig.json'`), workspace);
+  }
+});
+
+test('the recovery lane filter names what its install and build steps consume', () => {
+  const workflow = readWorkflow('windows-recovery.yml');
+
+  // `npm.cmd ci` and `npm.cmd run build:test` run unconditionally, so their
+  // inputs are first-class inputs of this lane rather than transitive edits
+  // the nightly can be left to cover. A grouped dependabot bump touches only
+  // the manifests, and the crash gates below sit on a native file lock that
+  // the Linux `test` lane cannot observe at all.
   for (const path of [
-    'packages/storage/src/**',
-    'packages/runtime/src/**',
-    'packages/runtime-host/src/**',
+    'package.json',
+    'package-lock.json',
+    'patches/**',
+    'tsconfig.base.json',
+    'tsconfig.lib.json',
     'scripts/windows-runtime-host-local-ipc-trust.ps1',
     '.github/workflows/windows-recovery.yml',
   ]) {


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org