test(marginal): pin EAP binary64 reduction identity before optimization #552
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # github/codeql-action cannot run inside a required workflow -- GitHub | |
| # refuses to admit it, 0/43+ across every sampled repository | |
| # (docs/doctoring/codeql-pr-required-workflow-always-fails.md). This file | |
| # stays required-workflow-safe by never calling codeql-action itself: it | |
| # detects languages, fails each analyze-head shard pending to release its | |
| # runner, then one coordinator POSTs repository_dispatch to | |
| # codeql-scan-dispatch.yml (native, unrestricted, in | |
| # ContextualWisdomLab/.github) with the remaining language matrix. The | |
| # handler publishes codeql-dispatch/<language> and reruns only that exact | |
| # failed job. On rerun the shard reads the terminal status once. Design: | |
| # docs/adr/0025-codeql-required-workflow-dispatch-architecture.md. The | |
| # merge-preview scan (analyze-merge) is required nowhere (PR #1766) and was | |
| # dropped, not migrated. | |
| name: CodeQL PR | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review, closed] | |
| # Do not restrict the base ref: the org required-workflow ruleset already | |
| # scopes this to each repository's actual default branch via | |
| # ref_name: ["~DEFAULT_BRANCH"], whatever it is named. A hardcoded | |
| # [main, master, develop] list silently produced zero CodeQL checks for | |
| # any repository with a different default branch name (confirmed live: | |
| # a repository defaulting to gh-pages received every other required | |
| # check but no CodeQL check at all) and would also block coverage for | |
| # stacked PRs targeting a non-default feature branch, matching | |
| # security-scan.yml's own "do not restrict the base ref" precedent. | |
| concurrency: | |
| # NOT scoped by head SHA, unlike opencode-review.yml's group -- and that is | |
| # a deliberate, tested difference, not an oversight. This file has no | |
| # dedicated cancel-on-close cleanup job (see | |
| # tests/test_required_workflow_queue_contract.py::test_pull_request_close_events_cancel_superseded_runs_without_heavy_jobs), | |
| # so this group's own `cancel-in-progress: true` is the ONLY mechanism that | |
| # cancels a stale in-flight run when the PR closes. opencode-review.yml can | |
| # safely add head SHA to its group because it ALSO runs a separate | |
| # cancel-superseded-opencode-review-runs job that sweeps stale runs via | |
| # direct API calls regardless of head SHA; adding head SHA here without an | |
| # equivalent job would let an older, still-in-flight run for a since- | |
| # superseded head survive a close event indefinitely (it and the closing | |
| # run would land in different groups and never cancel each other). A | |
| # narrower risk remains -- a delayed dispatch for an older head could still | |
| # transiently evict a newer head's in-flight dispatch before that older run's | |
| # own live-head recheck self-aborts -- tracked as a follow-up requiring a | |
| # dedicated cleanup job, not a one-line group change. | |
| group: >- | |
| codeql-pr-${{ | |
| github.event_name == 'pull_request' && github.event.pull_request.base.repo.full_name || github.repository }}-${{ | |
| github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| detect-languages: | |
| name: Detect CodeQL languages | |
| if: github.event.action != 'closed' | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| matrix: ${{ steps.detect.outputs.matrix }} | |
| code: ${{ steps.scope.outputs.code }} | |
| steps: | |
| - name: Checkout PR head | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Build language matrix | |
| id: detect | |
| run: | | |
| matrix='[]' | |
| if [ -d .github/workflows ]; then | |
| matrix=$(echo "$matrix" | jq -c '. + [{"language":"actions","build-mode":"none"}]') | |
| fi | |
| if find . -type f \( -name '*.js' -o -name '*.jsx' -o -name '*.ts' -o -name '*.tsx' \) \ | |
| -not -path './.git/*' -print -quit | grep -q .; then | |
| matrix=$(echo "$matrix" | jq -c '. + [{"language":"javascript-typescript","build-mode":"none"}]') | |
| fi | |
| if find . -type f -name '*.py' -not -path './.git/*' -print -quit | grep -q .; then | |
| matrix=$(echo "$matrix" | jq -c '. + [{"language":"python","build-mode":"none"}]') | |
| fi | |
| if find . -type f \( -name '*.java' -o -name '*.kt' -o -name '*.kts' \) \ | |
| -not -path './.git/*' -print -quit | grep -q .; then | |
| matrix=$(echo "$matrix" | jq -c '. + [{"language":"java-kotlin","build-mode":"none"}]') | |
| fi | |
| if [ "$(echo "$matrix" | jq 'length')" -eq 0 ]; then | |
| matrix='[{"language":"actions","build-mode":"none"}]' | |
| fi | |
| { | |
| echo 'matrix<<EOF' | |
| jq -nc --argjson include "$matrix" '{include: $include}' | |
| echo 'EOF' | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Classify changed paths | |
| id: scope | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.event.pull_request.base.repo.full_name || github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| EXPECTED_FILES: ${{ github.event.pull_request.changed_files }} | |
| shell: bash | |
| run: | | |
| set -uo pipefail | |
| code=true | |
| if [ -n "${PR}" ] && [ -n "${EXPECTED_FILES}" ]; then | |
| changed="" | |
| for attempt in 1 2 3; do | |
| if changed="$(gh api --paginate "repos/${REPO}/pulls/${PR}/files?per_page=100" --jq '.[].filename')" && [ -n "$changed" ]; then | |
| break | |
| fi | |
| changed="" | |
| sleep $((attempt * 3)) | |
| done | |
| # GitHub caps /pulls/N/files at 3000 entries; a short list would hide | |
| # source files behind a doc-only verdict, so require an exact count. | |
| if [ -n "$changed" ] && [ "$(printf '%s\n' "$changed" | wc -l | tr -d ' ')" = "${EXPECTED_FILES}" ]; then | |
| code=false | |
| while IFS= read -r changed_path; do | |
| case "$changed_path" in | |
| *.md|*.markdown|*.rst|*.png|*.jpg|*.jpeg|*.gif|*.webp|*.bmp|*.ico|LICENSE|LICENSE.txt|COPYING|COPYING.txt|NOTICE|NOTICE.txt|.github/ISSUE_TEMPLATE/*) ;; | |
| *) code=true ;; | |
| esac | |
| done <<<"$changed" | |
| else | |
| echo "::notice::changed-scope could not read a complete PR file list; scanning everything." | |
| fi | |
| fi | |
| echo "code=${code}" >> "$GITHUB_OUTPUT" | |
| echo "changed-scope code=${code}" | |
| analyze-head: | |
| name: CodeQL compatibility analysis (${{ matrix.language }}) | |
| needs: detect-languages | |
| # No job-level `if:` on purpose: a job-level condition referencing | |
| # needs.detect-languages.outputs.* skips this job before its | |
| # matrix-derived name is expanded, publishing the literal | |
| # `CodeQL compatibility analysis (${{ matrix.language }})` check-run name | |
| # instead of one per real language -- decisive live evidence in run | |
| # 33708209086, guarded by | |
| # tests/test_docs_only_pr_runner_admission.py::test_codeql_pr_gates_analyze_head_at_step_level_not_job_level. | |
| # `needs: detect-languages` (only) matches the original, proven-safe | |
| # dependency exactly; the only case where it's genuinely skipped is a | |
| # closed PR, where this job being implicitly skipped too is fine because | |
| # closed PRs need no required check. | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJSON(needs.detect-languages.outputs.matrix) }} | |
| steps: | |
| - name: Read current-head CodeQL dispatch verdict | |
| # Shards never dispatch. They re-check the live head, consume an | |
| # authenticated codeql-dispatch/<language> verdict when one exists, | |
| # and otherwise fail pending so the runner is released. One | |
| # coordinator job POSTs the remaining language matrix after every | |
| # shard has a job id. | |
| id: dispatch | |
| if: needs.detect-languages.outputs.code == 'true' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TARGET_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.repository }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| LANGUAGE: ${{ matrix.language }} | |
| RUN_ATTEMPT: ${{ github.run_attempt }} | |
| run: | | |
| set -euo pipefail | |
| live_pr="$(gh api "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}")" | |
| live_head="$(printf '%s' "$live_pr" | jq -r '.head.sha // empty')" | |
| live_state="$(printf '%s' "$live_pr" | jq -r 'if (.state | type) == "string" then .state else empty end')" | |
| if [ -z "$live_head" ] || [ -z "$live_state" ]; then | |
| echo "::error::Could not validate live pull request state before CodeQL dispatch." | |
| exit 1 | |
| fi | |
| if [ "$live_state" = "closed" ]; then | |
| echo "PR is closed on the live exact head; a current-head CodeQL scan is not requested." | |
| exit 0 | |
| fi | |
| if [ "${live_head,,}" != "${PR_HEAD_SHA,,}" ]; then | |
| echo "Pull request head moved on the live open PR; a fresh dispatch will fire for the current head." | |
| exit 0 | |
| fi | |
| statuses="$(gh api "repos/${TARGET_REPOSITORY}/commits/${PR_HEAD_SHA}/statuses")" | |
| verdict_state="$(printf '%s' "$statuses" | jq -r --arg ctx "codeql-dispatch/${LANGUAGE}" ' | |
| [ | |
| .[] | |
| | select(.context == $ctx) | |
| | select( | |
| (.creator.login // "" | ascii_downcase) as $creator | |
| | $creator == "opencode-agent" or $creator == "opencode-agent[bot]" | |
| ) | |
| ] | |
| | first // {} | .state // empty | |
| ')" | |
| case "$verdict_state" in | |
| success|failure|error) | |
| echo "verdict=${verdict_state}" >>"$GITHUB_OUTPUT" | |
| echo "Found authenticated current-head CodeQL verdict for ${LANGUAGE}: ${verdict_state}." | |
| exit 0 | |
| ;; | |
| esac | |
| if [ "$RUN_ATTEMPT" != "1" ]; then | |
| echo "::error::Exact CodeQL job was rerun without an authenticated terminal verdict." | |
| exit 1 | |
| fi | |
| echo "verdict=pending" >>"$GITHUB_OUTPUT" | |
| - name: Release runner or enforce current-head CodeQL verdict | |
| if: always() && needs.detect-languages.outputs.code == 'true' | |
| env: | |
| LANGUAGE: ${{ matrix.language }} | |
| DISPATCH_OUTCOME: ${{ steps.dispatch.outcome }} | |
| VERDICT_STATE: ${{ steps.dispatch.outputs.verdict }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$DISPATCH_OUTCOME" != "success" ]; then | |
| echo "::error::CodeQL scan dispatch or exact-head verdict read did not succeed (outcome=${DISPATCH_OUTCOME})." | |
| exit 1 | |
| fi | |
| case "$VERDICT_STATE" in | |
| success) | |
| echo "Current-head CodeQL dispatch verdict for ${LANGUAGE}: success." | |
| ;; | |
| failure|error) | |
| echo "::error::CodeQL dispatch scan for ${LANGUAGE} did not pass (state=${VERDICT_STATE}). See the linked dispatch run for SARIF evidence." | |
| exit 1 | |
| ;; | |
| pending) | |
| echo "::error::CodeQL scan dispatched. The dispatch workflow will rerun this exact failed CodeQL job after publishing its terminal verdict." | |
| exit 1 | |
| ;; | |
| *) | |
| echo "::error::CodeQL shard has no authenticated current-head verdict or dispatch receipt." | |
| exit 1 | |
| ;; | |
| esac | |
| dispatch-current-head: | |
| name: Dispatch current-head CodeQL scan | |
| needs: [detect-languages, analyze-head] | |
| if: >- | |
| always() | |
| && github.event.action != 'closed' | |
| && github.event.pull_request.state != 'closed' | |
| && github.run_attempt == 1 | |
| && needs.detect-languages.result == 'success' | |
| && needs.detect-languages.outputs.code == 'true' | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| actions: read | |
| steps: | |
| - name: Dispatch current-head CodeQL scan | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| OIDC_AUDIENCE: opencode-github-action | |
| OPENCODE_API_BASE_URL: https://api.opencode.ai | |
| TARGET_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.repository }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| PR_BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| REQUIRED_RUN_ID: ${{ github.run_id }} | |
| MATRIX: ${{ needs.detect-languages.outputs.matrix }} | |
| run: | | |
| set -euo pipefail | |
| live_pr="$(gh api "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}")" | |
| live_head="$(printf '%s' "$live_pr" | jq -r '.head.sha // empty')" | |
| live_state="$(printf '%s' "$live_pr" | jq -r 'if (.state | type) == "string" then .state else empty end')" | |
| if [ -z "$live_head" ] || [ -z "$live_state" ]; then | |
| echo "::error::Could not validate live pull request state before CodeQL dispatch." | |
| exit 1 | |
| fi | |
| if [ "$live_state" = "closed" ]; then | |
| echo "PR is closed on the live exact head; a current-head CodeQL scan is not requested." | |
| exit 0 | |
| fi | |
| if [ "${live_head,,}" != "${PR_HEAD_SHA,,}" ]; then | |
| echo "Pull request head moved on the live open PR; a fresh dispatch will fire for the current head." | |
| exit 0 | |
| fi | |
| if ! [[ "$REQUIRED_RUN_ID" =~ ^[1-9][0-9]*$ ]]; then | |
| echo "::error::CodeQL dispatch requires a canonical current run id." | |
| exit 1 | |
| fi | |
| include_json="$(printf '%s' "$MATRIX" | jq -c '.include // empty' 2>/dev/null || true)" | |
| if [ -z "$include_json" ] || | |
| [ "$(printf '%s' "$include_json" | jq 'type == "array" and length >= 1')" != "true" ]; then | |
| echo "::error::CodeQL coordinator received an empty or malformed language matrix." | |
| exit 1 | |
| fi | |
| jobs_json="$( | |
| gh api --paginate "repos/${GITHUB_REPOSITORY}/actions/runs/${REQUIRED_RUN_ID}/jobs" --jq '.jobs[]' | | |
| jq -s '{jobs:.}' | |
| )" | |
| required_jobs='[]' | |
| while IFS= read -r entry; do | |
| language="$(printf '%s' "$entry" | jq -r '.language // empty')" | |
| expected_name="CodeQL compatibility analysis (${language})" | |
| job_id="$(printf '%s' "$jobs_json" | jq -r --arg name "$expected_name" ' | |
| [.jobs[]? | select(.name == $name) | .id] | |
| | if length == 1 then .[0] | tostring else empty end | |
| ')" | |
| if ! [[ "$job_id" =~ ^[1-9][0-9]*$ ]]; then | |
| echo "::error::CodeQL coordinator missing current-head job id for ${language}." | |
| exit 1 | |
| fi | |
| required_jobs="$( | |
| jq -c --arg language "$language" --argjson job_id "$job_id" \ | |
| '. + [{language:$language,job_id:$job_id}]' <<<"$required_jobs" | |
| )" | |
| done < <(printf '%s' "$include_json" | jq -c '.[]') | |
| statuses="$(gh api "repos/${TARGET_REPOSITORY}/commits/${PR_HEAD_SHA}/statuses")" | |
| pending_matrix='[]' | |
| while IFS= read -r entry; do | |
| language="$(printf '%s' "$entry" | jq -r '.language // empty')" | |
| verdict_state="$(printf '%s' "$statuses" | jq -r --arg ctx "codeql-dispatch/${language}" ' | |
| [ | |
| .[] | |
| | select(.context == $ctx) | |
| | select( | |
| (.creator.login // "" | ascii_downcase) as $creator | |
| | $creator == "opencode-agent" or $creator == "opencode-agent[bot]" | |
| ) | |
| ] | |
| | first // {} | .state // empty | |
| ')" | |
| case "$verdict_state" in | |
| success|failure|error) | |
| echo "Found authenticated current-head CodeQL verdict for ${language}: ${verdict_state}." | |
| ;; | |
| *) | |
| pending_matrix="$(jq -c --argjson entry "$entry" '. + [$entry]' <<<"$pending_matrix")" | |
| ;; | |
| esac | |
| done < <(printf '%s' "$include_json" | jq -c '.[]') | |
| if [ "$(printf '%s' "$pending_matrix" | jq 'length')" -eq 0 ]; then | |
| echo "All detected CodeQL languages already have authenticated terminal verdicts; skipping dispatch." | |
| exit 0 | |
| fi | |
| required_jobs="$( | |
| jq -nc --argjson pending "$pending_matrix" --argjson jobs "$required_jobs" ' | |
| ($pending | map(.language)) as $langs | |
| | [$jobs[] | select(.language as $l | $langs | index($l) != null)] | |
| ' | |
| )" | |
| if [ "$(printf '%s' "$required_jobs" | jq 'length')" != "$(printf '%s' "$pending_matrix" | jq 'length')" ]; then | |
| echo "::error::CodeQL coordinator could not bind a job id to every pending language." | |
| exit 1 | |
| fi | |
| if [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then | |
| echo "::error::CodeQL scan dispatch requires GitHub OIDC." | |
| exit 1 | |
| fi | |
| separator='&' | |
| [[ "$ACTIONS_ID_TOKEN_REQUEST_URL" == *\?* ]] || separator='?' | |
| oidc_token="$(curl -fsS -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}${separator}audience=${OIDC_AUDIENCE}" | jq -r '.value // empty')" | |
| if [ -z "$oidc_token" ]; then | |
| echo "::error::CodeQL scan dispatch could not obtain its OIDC token." | |
| exit 1 | |
| fi | |
| app_token="$(curl -fsS -X POST -H "Authorization: Bearer ${oidc_token}" "${OPENCODE_API_BASE_URL}/exchange_github_app_token" | jq -r '.token // empty')" | |
| if [ -z "$app_token" ]; then | |
| echo "::error::CodeQL scan dispatch could not obtain its repository-scoped app token." | |
| exit 1 | |
| fi | |
| echo "::add-mask::$app_token" | |
| jq -cn \ | |
| --arg target_repository "$TARGET_REPOSITORY" \ | |
| --arg pr_number "$PR_NUMBER" \ | |
| --arg pr_base_ref "$PR_BASE_REF" \ | |
| --arg pr_base_sha "$PR_BASE_SHA" \ | |
| --arg pr_head_ref "$PR_HEAD_REF" \ | |
| --arg pr_head_sha "$PR_HEAD_SHA" \ | |
| --argjson matrix "$pending_matrix" \ | |
| --arg required_run_id "$REQUIRED_RUN_ID" \ | |
| --argjson required_jobs "$required_jobs" \ | |
| '{event_type:"codeql-scan",client_payload:{target_repository:$target_repository,pr_number:$pr_number,pr_base_ref:$pr_base_ref,pr_base_sha:$pr_base_sha,pr_head_ref:$pr_head_ref,pr_head_sha:$pr_head_sha,matrix:$matrix,required_run_id:$required_run_id,required_jobs:$required_jobs}}' | | |
| GH_TOKEN="$app_token" gh api -X POST repos/ContextualWisdomLab/.github/dispatches --input - |