ci: run complete Go regressions independently - #5052

🤖 Generated by the Agentic Engineer

Native validation readback for unchanged head 2a90b90a8659874014f0a20ec1e5b88d24fe9c41:

• Complete Go regression job 117614218175 passed in 9m34s, independently of change detection. Its complete repository suite passed in 7m20s and the separate native race suite passed in 2m06s. The workflow diff retains the full commands, read-only permissions, deployment dependency and required-result enforcement; neither suite was narrowed or removed.
• Detect Changes 117614218350 passed in 11m18s and started at the same 07:12:11 UTC as the complete Go job. This is direct evidence of overlap, not yet a successful whole-workflow speedup.
• The full PR run 39106775841 failed: manifest and production-authorization validation remained red, and the required aggregate correctly failed. The manifest job occupied 35m25s, including 14m56s for cluster policies, 6m27s for the Flux regression family and 3m11s for nested workload scanning. These independent-family costs belong to existing performance issue Run independent Platform validation families in parallel #4569; this PR does not resolve them.

The successful base-push run 39080084066 selected a different set of jobs and skipped manifest validation, so its 20m27s completion must not be compared with this failed PR run's 47m26s as a controlled before/after result. Retain the successful comparable-run criteria on #4569.

Current-head review, a repaired base and successful full validation remain required before promotion. The recovery owner retains #5048; #5042 and #5051 remain open prerequisites. This readback adds hosted evidence only and does not claim a new local test run, recovery, merge or delivery.

🤖 Generated by the Agentic Engineer

Prerequisite integration and current validation

Earlier validated signed head: aa1f13827d4b31deedd20bf4c8ee96be6f05a8e9, tree be4b8a3a999c6e562f5b5068e6ae1ccafba88e47. GitHub independently reports the signature verified. The current-head correction and its gates are below.

The previous run's manifest and production-authorization failures both came from missing tenant/webapp RGD schema scopes. The narrow correction from #5063, signed source befe5d860a9d8486e44cc7309817322608bf2b8d, is now merged into this branch without changing its owner's source. This permits full hosted validation to overlap prerequisite delivery instead of starting only afterward. It does not change the two complete Go suites, their deployment dependencies or required-result enforcement.

After integration, all four affected Go packages passed locally: merge-group healing, ARC recovery, signing validation and production authorization. Actionlint also passed. These local observations used host Go 1.27.2; they are not a claim about the hosted Go 1.26 toolchain or production behavior.

Exact-head CI 39149585762 succeeded. The final native jobs response includes 19/19 terminal jobs, each successful or intentionally skipped for this PR event. The aggregate completed at 18:14:14 UTC, 47m52s after run creation. Against the three comparable successful baseline runs on #4569 (median 56m49s), this is one observation 8m57s / 15.8% shorter, not a repeated post-change median or causal attribution for every second. Summed occupied job time was 71m52s versus baseline median 72m04s; no billed-cost saving is claimed.

Completed current-head components

The complete Go job succeeded from 17:26:26 to 17:33:55 UTC (7m29s), including the complete repository suite (5m47s) and the separate native retirement suite (1m35s). Detect Changes started at the same 17:26:26 and succeeded at 17:36:47 (10m21s). This directly confirms concurrent, complete execution; the suites no longer precede path-dependent validation. Manifest validation still occupied 37m16s, equal to its baseline median: this change has not narrowed that family.

Fresh full-diff self-review found no remaining correctness/security or simplification issue. The native dependency and aggregate regression controls execute the actual guards, including failure and skipped results. All five commits are independently signature-verified by GitHub; the current native thread census is complete and empty. A full current-head CodeRabbit review was requested in comment 6253437400 and acknowledged, but no substantive verdict has arrived yet. Visible hosted quality checks pass; required-gate discovery still reports configured Code Quality as UNVERIFIED, not PASS. Native merge state is presently affected by the pending review status, so no merge eligibility is inferred from it.

Review correction and resolved source prerequisite

Review-correction signed, GitHub-verified head was f5a08a9b9725d87f42b6966a6b136e479c847280, tree 61d9af8938a9f27ddc7dca98ed74652f684d9cdf. It changed only the new workflow regression: step, job-default and workflow-default scope-changing working directories are rejected for both complete-suite commands. RED/GREEN ablations reproduced the original gap and verified refusal at all three scopes. That workflow was unchanged from the successful earlier observation.

All four affected Go packages passed with Go 1.26.9. The changed package passed race detection and golangci-lint, and repository-wide go vet ./... passed. Additional full local golangci-lint reported 31 findings in unchanged files outside this correction; that run is not green. The f5a08a9 CI 39155458413 was superseded and cancelled by the combined-head integration below; it is not a complete acceptance run.

The inline finding is resolved with a specific fix/ablation reply. Ancillary scope and documentation findings have explicit resolutions in comment 6253700616. CodeRabbit refused the new full review on its included rate limit; its empty inline-reply container is not a review. The ordered Codex fallback completed clean at this exact head, after request 6253766237. The thread census is complete and resolved.

The narrow source prerequisite has now landed through #5048: fresh native main and origin/main both resolve to 5e2221baa85a526d212700f6dbf829bcc91a7701, and all five #5063 source files are byte-identical there. #5062/#5063 closure and active recovery acceptance remain with their owner. Full new-head CI, final native gate readback, protected merge-queue deployment and merged-source verification remain required. The PR stays draft; no production gate or merge is waived.

Combined-workflow integration — 2026-10-18 19:26 UTC

Current signed, GitHub-verified head is d20ccc9f426c6689f713dc31146d53702cf9a686. A non-mutating merge rehearsal found a real conflict between this PR and #5069 in the required aggregate. The reviewed #5069 head 9c1bdc7c7c44caeef288c12f1bf9440482462ae4 is now integrated here, preserving both complete validation families, both aggregate dependencies/results, the unconditional Go-success guard and the selected-policy-success guard. No validation family was narrowed or disabled. #5069 should merge first.

The complete root Go suite (go test -count=1 ./...) and separate native race suite both passed with Go 1.26.9 on the combined source tree. The four affected Go packages, actual 12-case policy-result boundary on both Bash versions, all 31 deployment/consumer controls, executable-entry regressions, actionlint and whitespace checks also pass. The clean Codex review at f5a08a9b97 is historical, not approval of this new head.

Complete combined-head hosted result — 18 October

CI 39158738964 succeeded at exact head d20ccc9f426c6689f713dc31146d53702cf9a686. The complete native response contains 20/20 terminal jobs, successful or intentionally skipped. The aggregate completed 30m23s after run creation, 26m26s / 46.5% shorter than the comparable three-run baseline median 56m49s. This is one successful observation, not a repeated post-change median, and the combined result is not attributed solely to the Go split.

The full Go job occupied 7m50s, starting with detection at 19:26:19 UTC. Detection occupied 11m22s. The complete policy and manifest jobs both started at 19:37:44; policy occupied 14m41s, manifest 18m27s. This observes real concurrent complete execution. Summed occupied time is 68m44s, versus baseline median 72m04s; it is not billed minutes and no monetary saving is claimed.

All 38 visible checks are successful or intentionally skipped. CodeRabbit full review was requested once at this exact head in comment 6254465148 after acquiring its native head-bound lock; its trigger acknowledgment is not a review verdict. The PR remains draft until a substantive current-head review and final readiness readback. Current-main CD 39159625325 has independently succeeded, but retirement acceptance #5042 and the protected production queue remain separate gates.

🤖 Generated by the Agentic Engineer

@coderabbitai full review

No actionable comments were generated in the recent review. 🎉

Priority: ➖ Normal

Severity of issue fixed: Medium

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 71.43% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 6 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		The current head adds validate-go-regressions as an unconditional job. It retains go test ./..., the native retirement race suite, the kubectl prerequisite, and read-only permissions. `deploy-prod…
Out of Scope Changes check		The whole-PR change summary lists workflow scheduling and dependency changes plus focused regression-test and fixture updates. These changes support #5049. No unrelated schema, authorization, or produ…
Title check		The title clearly and concisely describes the main change: running complete Go regression tests independently.
Description check		The description directly explains why the independent Go regression checks are needed and what the pull request changes.

Full details: Linked Issues check

Explanation

The current head adds validate-go-regressions as an unconditional job. It retains go test ./..., the native retirement race suite, the kubectl prerequisite, and read-only permissions. deploy-prod and ci-required-checks depend on the job. The aggregate runs with always() and accepts only success; regression tests cover scheduling, dependencies, duplicate or narrowed commands, and all non-success results. Timing comparisons, protected-queue admission, and delivered-source verification are process requirements, not coding requirements.

Full details: Out of Scope Changes check

Explanation

The whole-PR change summary lists workflow scheduling and dependency changes plus focused regression-test and fixture updates. These changes support #5049. No unrelated schema, authorization, or product changes are present in the reviewed scope.

Full details: Docstring Coverage

Explanation

Docstring coverage is 71.43% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 6 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

🤖 Generated by the Agentic Engineer

Resolution of the explicit ancillary findings in CodeRabbit's current review summary:

• Out-of-scope schema/authorization changes: these are the unchanged signed prerequisite from separate fix(kro): declare namespaced schema scope on the tenant and webapp RGDs #5063, merged here only to overlap validation. The PR explicitly requires fix(kro): declare namespaced schema scope on the tenant and webapp RGDs #5063 to land first; once it does, those prerequisite files leave this PR's base diff without a force-push. Removing them before then would knowingly restore the schema failures. No additional schema or authorization behavior is being delivered by Run complete Go regressions independently of change detection #5049. The description now makes this dependency scope explicit. This is a sequencing/refutation record, not permission to merge ahead of fix(kro): declare namespaced schema scope on the tenant and webapp RGDs #5063.
• Docstring coverage: the previously undocumented workflow-reader helper now documents its purpose in f5a08a9b9725d87f42b6966a6b136e479c847280. It reads the actual CI artifact, not a disconnected fixture.

The inline directory-scope finding has been fixed and ablated separately. New-head review and full hosted checks remain required; the earlier review and successful CI are historical evidence, not a current-head green.

🤖 Generated by the Agentic Engineer

@coderabbitai full review

🤖 Generated by the Agentic Engineer

@codex review for Check complete-suite scope, scheduling, production dependencies and real aggregate-result refusal; the prior directory-scope finding is fixed and ablated at all three scopes.

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

🤖 Generated by the Agentic Engineer

@codex review for Review complete root-suite command preservation and repository-root execution, independent unconditional read-only Go scheduling, strict success-only aggregate/deployment dependencies, and integration with the unchanged independent policy job. The current-head ancillary findings were assessed in comment 6254604208; the ordered CodeRabbit retry was explicitly included-quota limited in comment 6254605853, and the fresh round-scoped no-gate guard admits fallback. Review source against current main as well as the historical PR base; the five schema prerequisite files already match main through #5048.

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: d20ccc9f42

🤖 Generated by the Agentic Engineer

Readiness at exact signed head d20ccc9f426c6689f713dc31146d53702cf9a686:

• Complete hosted CI 39158738964 succeeded: 20/20 terminal jobs, each successful or intentionally skipped. Fresh visible-check census: 38, comprising 30 passed / 8 intentional skips; native state CLEAN/MERGEABLE. All 11/11 commits have valid GitHub-verified signatures from the registered identity. The complete thread census has one resolved thread and none unresolved.
• Fresh Codex review completed clean at this head after authenticated request 6254618856. Its structured summary also names the full head and reports no findings. No Codex comment-form finding exists. Earlier CodeRabbit directory-scope feedback was fixed and ablated. Its current-head explicit ancillary findings are individually assessed in 6254604208: body_findings=0-resolved@d20ccc9f426c6689f713dc31146d53702cf9a686. The ordered loop then restarted; CodeRabbit returned an included-quota refusal, the resolution-round-scoped no-gate guard admitted fallback, and Codex delivered the new review. No paid fallback or review exemption was used.
• User evaluation observes the actual hosted workflow: both complete Go suites ran in the independent read-only job, which started alongside detection and finished in 7m50s. Detection completed in 11m22s; full policy and manifest jobs then ran concurrently for 14m41s / 18m27s. The required aggregate completed 30m23s after run creation. The actual result guard rejects failure, cancellation, selected skip, empty and unknown results; the root-directory regression covers workflow, job and step scope. Complete local repository tests and native race tests passed at this head; existing deployment/consumer controls and policy result controls are retained.

This is one successful combined observation, 46.5% shorter than the comparable baseline median, not a repeated post-change median or a sole-change attribution. Occupied job time was 68m44s, not billed cost. Parent #4569 remains open for the broader remaining families and post-delivery cohort.

Recovery #5042 is closed and the platform health gate passes. This validated draft can be promoted, but #5069 must merge first. Promotion is not queue admission, merge, or delivered-source acceptance; those still need a fresh final rebind after the prerequisite lands.

🤖 Generated by the Agentic Engineer

Final queue admission readback

Prerequisite #5069 has merged through the protected merge queue at 119968c6b55a7aad8d65f024136353fa02d45656, and the fresh production health gate is green.

This PR is still bound to exact head d20ccc9f426c6689f713dc31146d53702cf9a686. All 37 hosted checks are successful, neutral, or intentionally skipped; the exact-head Codex review completed with no findings; and the complete thread census remains resolved. The declared dependency is therefore satisfied.

The next write is protected merge-queue admission with the exact head pinned. No gate is waived.

🤖 Generated by the Agentic Engineer

@coderabbitai full review

🤖 Generated by the Agentic Engineer

Current-head assessment at 314b3646ae99a6dc8ee9f67a288e9e9f9cf35863 of the explicit ancillary output in CodeRabbit's completed review summary:

• Documentation percentage: this is the same 71.43% warning already assessed in 6254604208, not a newly missing production API contract. The workflow-reader helper documents that it reads the real CI artifact. Both new tests explain the independent scheduling and strict result boundary they exercise. Other touched functions are existing named tests whose assertions must follow the job layout. The three affected test files are byte-identical between d20ccc9f426c6689f713dc31146d53702cf9a686 and this head. Their purpose and behavior remain documented; adding percentage-only boilerplate would not address a missing contributor contract. No documentation or quality check is disabled.
• G204 scanner context: the cited subprocess executes a fixed Bash executable and fixed flags against the actual workflow guard from the trusted source under test, using six literal result values. It does not accept an issue/comment-supplied command. Replacing that with a disconnected imitation would stop testing the real refusal boundary. The finding's code and reasoning are unchanged from the earlier specific refutation; no execution or trust boundary is widened.

body_findings=0-resolved@314b3646ae99a6dc8ee9f67a288e9e9f9cf35863 for these assessed fingerprints only. This is a disclosed resolution, not review approval. The ordered semantic-review loop is restarted; full current-head checks, review and protected queue acceptance remain required.

🤖 Generated by the Agentic Engineer

@coderabbitai full review

🤖 Generated by the Agentic Engineer

cr:no-gate@314b3646ae99a6dc8ee9f67a288e9e9f9cf35863 — reason=rate-limit, scoped to the semantic-review round restarted by resolution 6256853346, 2026-10-19T00:07:08Z. The earlier completed CodeRabbit review is retained; it is not discarded by a duplicate request.

The new authenticated refusal 6256855113, updated 00:07:28 UTC, explicitly says this requested review did not run and gives a 51-minute included-allowance retry window. Conservative recovery is 00:59:28 UTC, including one minute of margin. The live no-gate guard admits fallback with the resolution's exact round-start bound. This is not an account-wide outage or a green verdict. No paid fallback is enabled; the next authorized request is Codex. The PR remains draft pending full checks and the renewed review.

🤖 Generated by the Agentic Engineer

@codex review

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 314b3646ae

🤖 Generated by the Agentic Engineer

User evaluation at exact head 314b3646ae99a6dc8ee9f67a288e9e9f9cf35863: the real CI run 39178380006 started complete Go validation and change detection together at 23:53:37 UTC. Go validation did not wait for detection's outputs. The complete root suite and the native retirement-poller race suite both passed in their independent job, which finished at 00:03:09 UTC (9m32s). Detection finished at 00:02:08 UTC; the remaining selected validators began at 00:02:11 UTC while Go validation was still running. This exercises the actual intended concurrency, not merely the workflow's shape.

The same run's complete policy job has also passed. Manifest validation is unfinished at this observation, so this comment does not assert full readiness or an end-to-end latency improvement. Runner admission time and occupied job time remain separate; the protected production queue must validate the combined source before delivery.

The earlier complete local root run failed in the Flux fixture package at 590.622s. That failure remains recorded on #4893. The same-head hosted complete suite passed, including that package in 386.257s; these are separate observations, not a retroactive local pass. Affected-package, actual policy-gate, actionlint and native-poller race checks passed locally without narrowing suite scope or changing timeouts.

Codex's completed current-head review is green after the specific ancillary-resolution record and ordered review restart. The existing review thread is resolved. All twelve PR commits are verified signed. Current-base merge rehearsal is conflict-free without changing the branch. Promotion and queue admission still require a fresh complete gate/ownership/head read, and actual merge is not yet claimed.

🤖 Generated by the Agentic Engineer

Genuine-readiness receipt at 314b3646ae99a6dc8ee9f67a288e9e9f9cf35863:

• Complete hosted CI 39178380006 succeeded; the current head has 38 reported check/status contexts, no unfinished or failed contexts, and native mergeStateStatus: CLEAN. The opaque Code Quality ruleset is not independently readable by the completeness helper; native CLEAN is the configured required-gate authority, not a claim that the helper independently verified it.
• Current-head Codex review 6256910362 and its structured summary are complete with no findings, after the explicit ancillary resolution and ordered provider restart. The complete thread census has one resolved thread and no next page; no unresolved non-thread finding or new human instruction was found.
• User evaluation 6257041467 observes the actual concurrent complete Go job and subsequent selected validators at this same head. It preserves the separate failed local fixture run and does not use static configuration as runtime proof.
• All 12 commits are verified signed. Body contract passes. Native mergeability and the latest-main merge rehearsal are clear, no other live checkout holder was found, and the prerequisite ci(policy): run complete policy validation in parallel #5069 has actually merged. WIP capacity was waived by the maintainer; safety and production gates were not.

Promote and submit this exact head to the protected queue. Queue admission is not delivery: combined-source CI, production acceptance and actual merge readback remain required.