server: preemption notices, asynchronous parks and exact concurrency (pin branch on b10869)

.github/actions/prebuilt-alert/action.yml

@@ -0,0 +1,119 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+name: Prebuilt failure alert
+description: Open, update or close a deduplicated issue tracking prebuilt pipeline health.
+
+inputs:
+  status:
+    description: 'failure or success'
+    required: true
+  key:
+    description: 'Dedup key; all alerts sharing it collapse onto one issue'
+    required: true
+  title:
+    description: 'Issue title'
+    required: true
+  details:
+    description: 'Markdown describing what broke'
+    required: false
+    default: ''
+  label:
+    description: 'Label applied to the issue'
+    required: false
+    default: 'prebuilt-failure'
+  token:
+    description: 'Token with issues:write'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Open, update or close the tracking issue
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        STATUS: ${{ inputs.status }}
+        KEY: ${{ inputs.key }}
+        TITLE: ${{ inputs.title }}
+        DETAILS: ${{ inputs.details }}
+        LABEL: ${{ inputs.label }}
+        RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        REPO: ${{ github.repository }}
+      run: |
+        # GitHub runs `shell: bash` with -e, which `set -uo pipefail` does not
+        # undo. Alerting must never fail the run it reports on, so turn it off
+        # explicitly; every gh call below is already individually tolerated.
+        set +e
+        set -uo pipefail
+
+        case "$STATUS" in
+          failure|success) ;;
+          *) echo "::warning::prebuilt-alert: unknown status '$STATUS'"; exit 0 ;;
+        esac
+
+        MARKER="<!-- prebuilt-alert:${KEY} -->"
+
+        # Scan open labelled issues rather than the search index, which lags by
+        # minutes and would double-open on back-to-back runs.
+        EXISTING=""
+        while read -r num; do
+          [ -n "$num" ] || continue
+          if gh issue view "$num" --repo "$REPO" --json body --jq .body 2>/dev/null | grep -qF "$MARKER"; then
+            EXISTING="$num"; break
+          fi
+        done < <(gh issue list --repo "$REPO" --label "$LABEL" --state open \
+                   --limit 100 --json number --jq '.[].number' 2>/dev/null || true)
+
+        if [ "$STATUS" = "success" ]; then
+          if [ -n "$EXISTING" ]; then
+            gh issue comment "$EXISTING" --repo "$REPO" \
+              --body "Recovered: [\`${GITHUB_WORKFLOW}\` run](${RUN_URL}) succeeded. Closing." >/dev/null 2>&1 || true
+            gh issue close "$EXISTING" --repo "$REPO" >/dev/null 2>&1 \
+              || echo "::warning::prebuilt-alert: could not close #${EXISTING}"
+            echo "closed #${EXISTING} ($KEY)"
+          fi
+          exit 0
+        fi
+
+        BODY="$(printf '%s\n\n%s\n\n**Run:** %s\n\n%s\n' \
+          "$MARKER" \
+          "\`${GITHUB_WORKFLOW}\` failed on \`${GITHUB_EVENT_NAME}\`." \
+          "$RUN_URL" \
+          "$DETAILS")"
+
+        # The run summary always works: no token, no permission, no repo
+        # setting. Issues can be disabled (they are on a fresh fork), and an
+        # alert nobody can read is the failure this whole pipeline keeps
+        # having, so write the details somewhere visible before trying.
+        {
+          echo "## ${TITLE}"
+          echo
+          echo "$DETAILS"
+        } >> "${GITHUB_STEP_SUMMARY:-/dev/null}"
+
+        if [ -n "$EXISTING" ]; then
+          # Comment rather than open a second issue, so an outage is one thread.
+          gh issue comment "$EXISTING" --repo "$REPO" --body "$BODY" >/dev/null 2>&1 \
+            || echo "::warning::prebuilt-alert: could not comment on #${EXISTING}"
+          echo "updated #${EXISTING} ($KEY)"
+        else
+          # gh refuses to create with a label that does not exist yet.
+          gh label create "$LABEL" --repo "$REPO" --color B60205 \
+            --description "Prebuilt release pipeline is failing" >/dev/null 2>&1 || true
+          NEW="$(gh issue create --repo "$REPO" --title "$TITLE" --label "$LABEL" \
+                   --body "$BODY" 2>&1 | tail -1)"
+          case "$NEW" in
+            https://*) echo "opened $NEW ($KEY)" ;;
+            *)
+              # The one case worth shouting about: a real failure went
+              # unreported. Name the usual cause so it is actionable.
+              if [ "$(gh api "repos/${REPO}" --jq .has_issues 2>/dev/null)" = "false" ]; then
+                echo "::error::prebuilt-alert: issues are disabled on ${REPO}, so ${KEY} cannot be tracked; see the run summary for details"
+              else
+                echo "::error::prebuilt-alert: could not open an issue for ${KEY} (${NEW}); the failure at ${RUN_URL} is unreported"
+              fi
+              ;;
+          esac
+        fi
+        exit 0

.github/workflows/bench.yml.disabled

@@ -162,7 +162,7 @@ jobs:
             tools/server/bench/*.log
 
       - name: Commit status
-        uses: Sibz/github-status-action@v1
+        uses: Sibz/github-status-action@faaa4d96fecf273bd762985e0e7f9f933c774918  # v1
         with:
           authToken: ${{secrets.GITHUB_TOKEN}}
           sha: ${{ inputs.sha || github.event.pull_request.head.sha || github.sha }}
@@ -172,7 +172,7 @@ jobs:
           state: 'success'
 
       - name: Upload benchmark images
-        uses: devicons/public-upload-to-imgur@v2.2.2
+        uses: devicons/public-upload-to-imgur@352cf5f2805c692539a96cfe49a09669e6fca88e  # v2.2.2
         continue-on-error: true # Important as it looks unstable: 503
         id: imgur_step
         with:
@@ -221,7 +221,7 @@ jobs:
           echo "IMAGE_3=${{ fromJSON(steps.imgur_step.outputs.imgur_urls)[3] }}" >> $GITHUB_ENV
 
       - name: Comment PR
-        uses: mshick/add-pr-comment@v2
+        uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc  # v2
         id: comment_pr
         if: ${{ github.event.pull_request != '' && matrix.pr_comment_enabled == 'true' }}
         with: