ci: triage every checkout, and surface the signature that hid three timeouts - #6767
Merged
Conversation
Triage of all 32 `actions/checkout` steps, and the result is mostly a negative: **there is almost nothing left to filter.** `filter: blob:none` only matters alongside `fetch-depth: 0`. Most steps here do not set it, so a filter would be a no-op. Of the ones that do, nearly all genuinely need the objects -- desktop, integration-smoke, online-tests, release and the coverage compile-checks all build, and trufflehog and gitleaks scan history by design, where a filtered clone is a loss rather than a win. So #6756 already fixed the whole population that qualifies: check-trailer, detect CodeQL scope, attestation-verify. The class was three, not twenty-seven. What remains is that those three were each found only by reading a job log after something ELSE looked broken -- an overrun reports `cancelled`, which GitHub also uses for a superseded run, so nobody investigates. This adds a report-only check for the signature (`fetch-depth: 0` + a short timeout + no filter) so the next one surfaces on its own. Deliberately report-only. `gate-coverage-scripts` carries that exact shape on purpose -- it reads nearly every tracked file at HEAD -- so a gating check would nag a documented, reasoned exception. It names the pattern; a human still decides whether a filter is right for that job.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #6757
The result is mostly a negative, and that is the finding
All 32
actions/checkoutsteps across 20 workflows were enumerated and classified by what the job actually reads. The 27 not already fixed were re-derived independently rather than taken from #6756's summary.There is almost nothing left to filter.
filter: blob:noneonly does anything alongsidefetch-depth: 0. Most steps here never set it, so a filter would be a no-op — including several that looked like obvious candidates (yaml-validate,docs-lint,llm-freshness,pii-scan, bothsecurity.ymlcargo jobs).Of the steps that do set
fetch-depth: 0, nearly all genuinely need the objects:desktop,integration-server-smoke,online-tests×2,release/test,gate-coverage-compile-checkssecret-scan(trufflehog),gitleakssecurity.yml's ownWHY(#6609)says soFor those a blob-filtered clone is a loss, not a win — it fetches blobs lazily and they need all of them.
So #6756 already fixed the entire qualifying population:
check-trailer,detect CodeQL scope,attestation-verify. The class was three, not twenty-seven.What actually needed building
The three were each found only by reading a job log after something else looked broken. That is the durable problem: an overrun reports
cancelled, and GitHub uses that same status for a superseded run, so a real timeout reads as "an older run got replaced" and nobody investigates.scripts/check-checkout-filter-risk.pysurfaces the signature —fetch-depth: 0+ a shorttimeout-minutes+ nofilter:— so the next instance announces itself instead of waiting to be noticed sideways.Deliberately report-only, not gating
One job carries that exact shape on purpose:
gate-coverage-scriptsreads nearly every tracked file at HEAD viacheck-conflict-markers.py, soblob:nonebuys it little. A gating check would nag a documented, reasoned exception until someone silenced it — and a silenced check is worse than none.So the script names the pattern and states plainly that not every flag wants a filter; a human still applies the same "what does this job read" judgement the triage did. It runs inside
yaml-validate, which already walks the workflow directory.Against current
mainit reports exactly one flag,gate-coverage-scripts— the known exception, correctly identified.