Repository navigation
ci: parallelize and stabilize manifest validation - #5099
Conversation
Local validation at
Correctness/security and simplification passes found no remaining actionable issue. This is pre-submission hygiene, not the required substantive review. Hosted exact-head checks and a current-head green review are still required before promotion. Whole-PR budget enforcement remains under devantler-tech/.github#654; this change alone does not establish portfolio-wide compliance. |
@coderabbitai full review |
Exercised behavior at
|
| Measure | Reference | Current |
|---|---|---|
| Manifest job execution | 16m24s | 13m38s |
| Repository CI creation to final actual job completion | 17m11s | 25m14s |
| Sum of successful jobs' occupied runner time | 75m22s | 73m37s |
| Native jobs, including intentional skips | 22 | 23 |
The current scan job took 3m59s including setup; its full regression step took 3m16s. Path classification completed at 17:41:13 UTC, but manifest validation did not start until 17:48:54: a 7m41s post-dependency admission interval. Policy validation started 6m57s after classification. These intervals do not establish a particular quota or service cause, and runner-cost savings cannot be attributed to this change from one sample.
The manifest job is shorter, but the complete feedback target remains unmet. Preserve #4569 and devantler-tech/.github#654 for remaining execution/admission optimization and repeated measurement. All 41 reported checks are terminal and native mergeability reads CLEAN; the required workflow/status reads pass. The code-quality rule remains API-unverifiable in the completeness helper, not a claimed helper PASS. Substantive review is still pending; no promotion is claimed here.
CodeRabbit did not acknowledge the composed request, created at 18:06:30 UTC, within the five-minute no-reaction window. Fresh reads after 18:11:39 show zero reactions, provider comments or review objects; its status still says automatic reviews are disabled, not that a manual review ran. The no-gate guard admitted progression at this head. This is a PR/head-scoped unserved request, not an account-wide outage or a green review. Continue in the authorized order at Codex. Any later substantive CodeRabbit result still counts and must be read before promotion or merge. |
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Readiness is established for The local regression, deployment-invariance and hosted behavioral evidence is recorded above. The measured evaluation explicitly retains the remaining 15-minute feedback work: a shorter manifest job is not portfolio-wide compliance. Promote this bounded increment and use the protected merge queue without bypassing its production or merge-group checks. |
✅ Action performedFull review finished. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Walkthrough
Priority: ➖ Normal Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Out of Scope Changes check |  |
The changes in scripts/tests/openbao-health-native/native_test.go and scripts/tests/openbao-health-native/listeners_test.go reserve native OpenBao listener endpoints until each server starts and t… |
Move the OpenBao endpoint-reservation implementation and tests to a separate pull request linked to the issue that requires the recovery-check fix, or link an active issue that explicitly includes this work before merging this pull request. |
| Docstring Coverage |  |
Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 4 files. (3 skipped: 3… | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Title check The title clearly summarizes the two main changes: parallelizing manifest validation and stabilizing its recovery checks. Linked Issues check Issue #5098coding requirements are met by the supplied change summary..github/workflows/ci.yamladds an independent, read-onlyvalidate-rgd-templatespull-request job with the existingk8ssel…Description check The description directly explains both main changes: parallelizing the independent template scan and stabilizing recovery-check endpoint reservations. It matches the pull request changeset and linked … Full details: Linked Issues check
-
Explanation
Issue
#5098coding requirements are met by the supplied change summary..github/workflows/ci.yamladds an independent, read-onlyvalidate-rgd-templatespull-request job with the existingk8sselection, pinned Trivy setup, and the existing regression command. The required aggregate checks the new result and preserves unselected and merge-group behavior. Wiring and result-guard tests cover selected failures, cancellations, missing results, unexpected skips, unknown evidence, source mutations, shared selection, merge-group checks, and production ordering. The summary also records the required timing distinction and does not claim that#4569is complete.
Full details: Description check
-
Explanation
The description directly explains both main changes: parallelizing the independent template scan and stabilizing recovery-check endpoint reservations. It matches the pull request changeset and linked objectives.
-
Full details: Out of Scope Changes check
-
Explanation
The changes in
scripts/tests/openbao-health-native/native_test.goandscripts/tests/openbao-health-native/listeners_test.goreserve native OpenBao listener endpoints until each server starts and test that behavior. These changes do not implement or support issue#5098's nested-template scan scheduling or required-result logic. The current PR description states this additional recovery-check objective, but no directly linked issue supplies that coding scope.Resolution
Move the OpenBao endpoint-reservation implementation and tests to a separate pull request linked to the issue that requires the recovery-check fix, or link an active issue that explicitly includes this work before merging this pull request.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 4 files. (3 skipped: 3 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
The late CodeRabbit report contains an ancillary The affected Go package and golangci-lint pass. I explicitly removed the PR from the queue and returned it to draft before this follow-up. The earlier green review and hosted results remain evidence for the previous commit only; fresh exact-head CI and review are required before promotion and requeueing. |
devantler
changed the title
The failed bootstrap exposed the independently tracked fixture defect in #5101. Repeatedly opening and immediately closing each ephemeral socket left all six initial endpoints unowned; the OS could reuse one. The synthetic failure log uses an endpoint for both protocol roles, strongly consistent with this defect, although its truncated tails do not retain the complete original assignment. Fixed in
This repairs the failed CI family rather than skipping it, increasing its timeout or retrying the same failing head. The PR remains draft for new exact-head hosted checks and review. The earlier timing observations remain limited reference samples, not proof that the complete feedback target is met. #5101 will be closed only after delivery is verified; #4569 remains open. |
@coderabbitai full review |
✅ Action performedFull review finished. |
Batch correction for the repeated documentation/scope feedback at
The source correction is pushed. The new exact-head hosted checks and substantive review are still required before promotion; the earlier head's review does not satisfy this head. Native protected queue/deployment acceptance remains mandatory after readiness. The broader fifteen-minute objective in #4569 is not complete. |
@coderabbitai review |
|
CodeRabbit declined this exact head at 20:15:30 UTC (updated 20:15:41 UTC). Its repository summary, updated at 20:15:38 UTC, reports the next included review in 11 minutes, around 20:27 UTC. A fresh complete no-gate guard admits progression at this head. The refusal is not approval; no paid continuation is enabled. The earlier documentation/scope findings were addressed together in the correction record, not discarded because of the limit. Requesting the next authorized provider only. @codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Why
Manifest validation waits for an independent template scan, delaying feedback. A disposable recovery check can also accidentally reuse a network endpoint and fail an otherwise unchanged validation run.
What
Run the independent scan alongside manifest validation while preserving all required outcomes. Stabilize the recovery check tracked in #5101 by keeping its initial endpoints separate until each server starts. An earlier pull-request check took 17m11s and the latest 14m57s; consistent feedback under fifteen minutes still needs verification.
Fixes #5098
Part of #4569