|
| 1 | +name: Hort quarantine triage |
| 2 | +description: > |
| 3 | + Diagnose a FAILED hort dependency-resolution gate (`cargo fetch` against hort |
| 4 | + could not acquire the locked dependency set). Classifies each blocked pin |
| 5 | + against hort's authoritative status (the discovery endpoint) and posts one |
| 6 | + explanatory PR comment. |
| 7 | +
|
| 8 | + It does NOT change job status. The resolve step's failure already reds the gate |
| 9 | + (which is the merge-blocking signal) — this only explains WHY the gate is red |
| 10 | + and whether a retry is the right move. A green gate always means the code was |
| 11 | + actually built against a clean dependency set. |
| 12 | +
|
| 13 | +inputs: |
| 14 | + active: |
| 15 | + description: "'true' only on the same-repo MR gate (never fork PRs)." |
| 16 | + required: true |
| 17 | + hort_url: |
| 18 | + required: false |
| 19 | + default: 'https://registry.hort.rs' |
| 20 | + repo_key: |
| 21 | + required: false |
| 22 | + default: 'cargo-virtual' |
| 23 | + hort_token: |
| 24 | + description: Short-lived hort reader bearer (the `token` output of hort-auth). |
| 25 | + required: true |
| 26 | + |
| 27 | +runs: |
| 28 | + using: composite |
| 29 | + steps: |
| 30 | + - name: Classify blocked dependencies |
| 31 | + id: classify |
| 32 | + if: ${{ inputs.active == 'true' }} |
| 33 | + shell: bash |
| 34 | + env: |
| 35 | + HORT_URL: ${{ inputs.hort_url }} |
| 36 | + REPO: ${{ inputs.repo_key }} |
| 37 | + HORT_TOKEN: ${{ inputs.hort_token }} |
| 38 | + run: | |
| 39 | + set -uo pipefail |
| 40 | + # `cargo fetch --locked` failed, so some locked dep could not be acquired. |
| 41 | + # Classify each registry pin via hort's authoritative status. Cargo.lock |
| 42 | + # is the committed, network-free pinned set; discovery's `status.kind` is |
| 43 | + # the source of truth. Wire contract — |
| 44 | + # hort_domain::entities::discovery::DiscoveryVersionStatus, |
| 45 | + # #[serde(tag="kind", rename_all="snake_case")]: |
| 46 | + # released | quarantined{quarantine_until} | |
| 47 | + # quarantined_awaiting_release{...} | rejected | scan_indeterminate | unknown |
| 48 | + rejected=(); quarantined=(); stuck=(); unknown=(); latest_until="" |
| 49 | + while read -r name ver; do |
| 50 | + entry=$(curl -sS --max-time 15 -H "Authorization: Bearer ${HORT_TOKEN}" \ |
| 51 | + "${HORT_URL}/api/v1/repositories/${REPO}/discovery/versions/${name}" 2>/dev/null \ |
| 52 | + | jq -c --arg v "$ver" '.versions[]? | select(.version==$v)' 2>/dev/null || true) |
| 53 | + [ -z "$entry" ] && continue |
| 54 | + case "$(printf '%s' "$entry" | jq -r '.status.kind // empty')" in |
| 55 | + rejected|scan_indeterminate) rejected+=("${name}@${ver}") ;; |
| 56 | + quarantined_awaiting_release) stuck+=("${name}@${ver}") ;; |
| 57 | + unknown) unknown+=("${name}@${ver}") ;; |
| 58 | + quarantined) |
| 59 | + quarantined+=("${name}@${ver}") |
| 60 | + until=$(printf '%s' "$entry" | jq -r '.status.quarantine_until // empty') |
| 61 | + # RFC-3339 UTC sorts lexically == chronologically. |
| 62 | + if [ -n "$until" ] && { [ -z "$latest_until" ] || [ "$until" \> "$latest_until" ]; }; then |
| 63 | + latest_until="$until" |
| 64 | + fi |
| 65 | + ;; |
| 66 | + esac |
| 67 | + done < <(awk ' |
| 68 | + /^\[\[package\]\]/ { name=""; ver=""; src=0 } |
| 69 | + /^name = / { gsub(/[",]/,""); name=$3 } |
| 70 | + /^version = / { gsub(/[",]/,""); ver=$3 } |
| 71 | + /^source = "registry/ { src=1 } |
| 72 | + /^$/ { if (name && ver && src) print name, ver; name=""; ver=""; src=0 } |
| 73 | + END { if (name && ver && src) print name, ver } |
| 74 | + ' Cargo.lock) |
| 75 | +
|
| 76 | + list() { printf '%s\n' "$@" | sed 's/^/- `/; s/$/`/'; } |
| 77 | +
|
| 78 | + # Dominant diagnosis. `rejected` and `stuck` are the "a retry will not |
| 79 | + # help" cases and take precedence over a plain quarantine window. |
| 80 | + if [ ${#rejected[@]} -gt 0 ]; then |
| 81 | + { echo "verdict=rejected"; echo "body<<HORT_EOF" |
| 82 | + echo "### 🔴 Blocked: dependency scanned & REJECTED by hort" |
| 83 | + echo "" |
| 84 | + echo "A retry will **not** help — this is the supply-chain gate working. Investigate / replace:" |
| 85 | + echo ""; list "${rejected[@]}" |
| 86 | + echo "HORT_EOF"; } >> "$GITHUB_OUTPUT" |
| 87 | + elif [ ${#stuck[@]} -gt 0 ]; then |
| 88 | + { echo "verdict=stuck"; echo "body<<HORT_EOF" |
| 89 | + echo "### 🟠 Stuck: past the quarantine window with no release authority (ADR 0007)" |
| 90 | + echo "" |
| 91 | + echo "These cleared the quarantine *time* window but no release authority fired, so **a timed retry will not release them.** They need an operator **curator waive** or **admin override**:" |
| 92 | + echo ""; list "${stuck[@]}" |
| 93 | + echo "HORT_EOF"; } >> "$GITHUB_OUTPUT" |
| 94 | + elif [ ${#quarantined[@]} -gt 0 ]; then |
| 95 | + { echo "verdict=quarantined"; echo "until=${latest_until:-unknown}"; echo "body<<HORT_EOF" |
| 96 | + echo "### ⏳ Blocked by quarantine (retryable)" |
| 97 | + echo "" |
| 98 | + echo "**Not a code failure** — the gate could not source ${#quarantined[@]} dependency(ies) still inside hort's quarantine window. Re-run the gate after they clear." |
| 99 | + echo "" |
| 100 | + echo "**Earliest retry:** \`${latest_until:-the quarantine window}\`" |
| 101 | + echo ""; list "${quarantined[@]}" |
| 102 | + echo "" |
| 103 | + echo "_Prefetch on the feature branch normally warms these before the merge build, so this should be rare._" |
| 104 | + echo "HORT_EOF"; } >> "$GITHUB_OUTPUT" |
| 105 | + elif [ ${#unknown[@]} -gt 0 ]; then |
| 106 | + { echo "verdict=unknown"; echo "body<<HORT_EOF" |
| 107 | + echo "### ❔ Dependencies not yet ingested by hort" |
| 108 | + echo "" |
| 109 | + echo "Not in hort yet (prefetch may not have run or cascaded); they will ingest + quarantine on first fetch:" |
| 110 | + echo ""; list "${unknown[@]}" |
| 111 | + echo "HORT_EOF"; } >> "$GITHUB_OUTPUT" |
| 112 | + else |
| 113 | + echo "verdict=none" >> "$GITHUB_OUTPUT" |
| 114 | + echo "No pinned dependency is quarantined / rejected / stuck in hort — the resolve failure is unrelated to quarantine (network, lockfile drift, or a genuinely missing crate). Gate stays red; see the job log." |
| 115 | + fi |
| 116 | +
|
| 117 | + - name: Comment the diagnosis |
| 118 | + if: ${{ inputs.active == 'true' && steps.classify.outputs.verdict != '' && steps.classify.outputs.verdict != 'none' && github.event_name == 'pull_request' }} |
| 119 | + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 |
| 120 | + env: |
| 121 | + BODY: ${{ steps.classify.outputs.body }} |
| 122 | + with: |
| 123 | + script: | |
| 124 | + await github.rest.issues.createComment({ |
| 125 | + owner: context.repo.owner, |
| 126 | + repo: context.repo.repo, |
| 127 | + issue_number: context.payload.pull_request.number, |
| 128 | + body: process.env.BODY, |
| 129 | + }); |
0 commit comments