feat(storage): extend read hedging to mid-stream chunk reads #11855
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| statuses: write | |
| name: "gha: macOS & Windows" | |
| # Build on pull requests and pushes to `main`. The PR builds will be | |
| # non-blocking for now, but that is configured elsewhere. | |
| on: # zizmor: ignore[dangerous-triggers] | |
| # Start these builds on pushes (think "after the merge") too. Normally there | |
| # are no `ci-gha**` branches in our repository. The contributors to the repo | |
| # can create such branches when testing or troubleshooting builds. In such | |
| # branches we can disable builds (to speed up the testing) or add new ones, | |
| # without impacting the rest of the team. | |
| push: | |
| branches: [ 'ci-gha**', 'main' ] | |
| # Start the build in the context of the target branch. This is considered | |
| # "safe", as the workflow files are already committed. These types of builds | |
| # have access to the secrets in the build, which we need to use the remote | |
| # caches (Bazel and sccache). | |
| pull_request_target: | |
| types: | |
| - opened | |
| - synchronize | |
| - reopened | |
| # Allow trusted maintainers to trigger this workflow on external PRs by | |
| # commenting `/gharun`. | |
| issue_comment: | |
| types: [ created ] | |
| schedule: | |
| - cron: '0 5 * * 1,2,3,4,5' | |
| # Cancel in-progress runs of the workflow if somebody adds a new commit to the | |
| # PR or branch, or if a maintainer posts a new `/gharun` command. | |
| # Concurrency is defined at the job level so that issue comments without `/gharun` | |
| # (which are skipped in pre-flight) do not cancel in-progress builds. | |
| jobs: | |
| pre-flight: | |
| # Save the `ref` of the pull request, so downstream jobs know what to checkout. | |
| if: >- | |
| github.event_name != 'issue_comment' || | |
| (github.event.issue.pull_request != null && contains(github.event.comment.body, '/gharun')) | |
| concurrency: | |
| group: ${{ github.workflow }}-pre-flight-${{ github.event.pull_request.number || github.event.issue.number || github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| environment: >- | |
| ${{ | |
| (github.event_name != 'pull_request_target' && 'internal') || | |
| (github.event.pull_request.head.repo.full_name == github.repository && 'internal') | |
| }} | |
| name: Save PR ref | |
| runs-on: ubuntu-latest | |
| outputs: | |
| checkout-sha: ${{ steps.save-pull-request.outputs.sha }} | |
| is-trusted: ${{ steps.verify-permissions.outputs.is_trusted }} | |
| steps: | |
| - name: Verify permissions | |
| id: verify-permissions | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| REF: ${{ github.ref }} | |
| PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }} | |
| USER_TO_CHECK: >- | |
| ${{ | |
| (github.event_name == 'pull_request_target' && github.event.pull_request.user.login) || | |
| (github.event_name == 'issue_comment' && (github.event.comment.user.login || github.actor)) || | |
| github.actor | |
| }} | |
| run: | | |
| set -euo pipefail | |
| if [[ "${EVENT_NAME}" == "issue_comment" ]]; then | |
| permission=$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${USER_TO_CHECK}/permission" --jq '.permission') | |
| echo "Commenter: ${USER_TO_CHECK}, permission: ${permission}" | |
| case "${permission}" in | |
| admin|write|maintain) | |
| echo "Commenter '${USER_TO_CHECK}' is trusted." | |
| echo "is_trusted=true" >> "${GITHUB_OUTPUT}" | |
| ;; | |
| *) | |
| echo "::error::User '${USER_TO_CHECK}' is not trusted (permission: '${permission}'). Only collaborators can trigger runs with /gharun." | |
| exit 1 | |
| ;; | |
| esac | |
| elif [[ "${EVENT_NAME}" == "pull_request_target" ]]; then | |
| permission=$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${USER_TO_CHECK}/permission" --jq '.permission') | |
| echo "Author: ${USER_TO_CHECK}, permission: ${permission}" | |
| case "${permission}" in | |
| admin|write|maintain) | |
| echo "Author '${USER_TO_CHECK}' is trusted." | |
| echo "is_trusted=true" >> "${GITHUB_OUTPUT}" | |
| ;; | |
| *) | |
| echo "Author '${USER_TO_CHECK}' is untrusted (permission: '${permission}'). A maintainer must comment '/gharun' on the PR to trigger builds for this commit." | |
| echo "is_trusted=false" >> "${GITHUB_OUTPUT}" | |
| ;; | |
| esac | |
| elif [[ "${EVENT_NAME}" == "push" && "${REF}" == refs/heads/ci-gha* ]]; then | |
| permission=$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${USER_TO_CHECK}/permission" --jq '.permission') | |
| echo "Pusher: ${USER_TO_CHECK}, permission: ${permission}" | |
| case "${permission}" in | |
| admin|write|maintain) | |
| echo "User '${USER_TO_CHECK}' is trusted." | |
| echo "is_trusted=true" >> "${GITHUB_OUTPUT}" | |
| ;; | |
| *) | |
| echo "::error::User '${USER_TO_CHECK}' is not trusted (permission: '${permission}')." | |
| exit 1 | |
| ;; | |
| esac | |
| else | |
| echo "is_trusted=true" >> "${GITHUB_OUTPUT}" | |
| fi | |
| - name: Save Pull Request | |
| id: save-pull-request | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| PR_NUMBER: ${{ github.event.issue.number }} | |
| FALLBACK_SHA: ${{ github.ref }} | |
| IS_TRUSTED: ${{ steps.verify-permissions.outputs.is_trusted }} | |
| run: | | |
| if [[ "${EVENT_NAME}" == "issue_comment" ]]; then | |
| sha=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq '.head.sha') | |
| elif [[ "${EVENT_NAME}" == "pull_request_target" ]]; then | |
| sha="${PR_HEAD_SHA}" | |
| else | |
| sha="${FALLBACK_SHA}" | |
| fi | |
| echo "Resolved checkout SHA: ${sha}" | |
| echo "sha=${sha}" >> "${GITHUB_OUTPUT}" | |
| if [[ "${EVENT_NAME}" == "issue_comment" && "${IS_TRUSTED}" == "true" && -n "${sha}" ]]; then | |
| echo "Setting pending commit status for ${sha}..." | |
| gh api "repos/${GITHUB_REPOSITORY}/statuses/${sha}" \ | |
| -f state="pending" \ | |
| -f context="gha: macOS & Windows" \ | |
| -f description="macOS and Windows builds in progress via /gharun..." \ | |
| -f target_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" || true | |
| fi | |
| # Run other jobs once the `pre-flight` job passes. When the `pre-flight` | |
| # job requires approval, these blocks all the other jobs. The jobs are defined | |
| # in separate files to keep the size of this file under control. Note how | |
| # the additional jobs inherit any secrets needed to use the remote caches and | |
| # receive what version to checkout as an input. | |
| macos-bazel: | |
| if: needs.pre-flight.outputs.is-trusted == 'true' | |
| name: macOS-Bazel | |
| needs: [pre-flight] | |
| concurrency: | |
| group: ${{ github.workflow }}-macos-bazel-${{ github.event.pull_request.number || github.event.issue.number || github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| uses: ./.github/workflows/macos-bazel.yml # zizmor: ignore[secrets-inherit] | |
| with: | |
| checkout-ref: ${{ needs.pre-flight.outputs.checkout-sha }} | |
| bazel-cache-mode: 'READ_WRITE' | |
| execute-integration-tests: true | |
| secrets: inherit # zizmor: ignore[secrets-inherit] | |
| windows-bazel: | |
| # Disabled | |
| if: false | |
| name: Windows-Bazel | |
| needs: [pre-flight] | |
| concurrency: | |
| group: ${{ github.workflow }}-windows-bazel-${{ github.event.pull_request.number || github.event.issue.number || github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| uses: ./.github/workflows/windows-bazel.yml # zizmor: ignore[secrets-inherit] | |
| with: | |
| checkout-ref: ${{ needs.pre-flight.outputs.checkout-sha }} | |
| bazel-cache-mode: 'READ_WRITE' | |
| execute-integration-tests: true | |
| secrets: inherit # zizmor: ignore[secrets-inherit] | |
| macos-cmake: | |
| # Disabled | |
| if: false | |
| name: macOS-CMake | |
| needs: [pre-flight] | |
| concurrency: | |
| group: ${{ github.workflow }}-macos-cmake-${{ github.event.pull_request.number || github.event.issue.number || github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| uses: ./.github/workflows/macos-cmake.yml # zizmor: ignore[secrets-inherit] | |
| with: | |
| checkout-ref: ${{ needs.pre-flight.outputs.checkout-sha }} | |
| # Build the full matrix only on push events to the default branch, or | |
| # when PR gets the has a `gha:full-build` label, or when it had the | |
| # label already and it gets a new commit. | |
| full-matrix: |- | |
| ${{ | |
| github.event_name == 'schedule' || | |
| github.event_name == 'push' || | |
| contains(github.event.pull_request.labels.*.name, 'gha:full-build') || | |
| contains(github.event.issue.labels.*.name, 'gha:full-build') | |
| }} | |
| sccache-mode: 'READ_WRITE' | |
| vcpkg-cache-mode: 'readwrite' | |
| execute-integration-tests: true | |
| secrets: inherit # zizmor: ignore[secrets-inherit] | |
| windows-cmake: | |
| if: needs.pre-flight.outputs.is-trusted == 'true' | |
| name: Windows-CMake | |
| needs: [pre-flight] | |
| concurrency: | |
| group: ${{ github.workflow }}-windows-cmake-${{ github.event.pull_request.number || github.event.issue.number || github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| uses: ./.github/workflows/windows-cmake.yml # zizmor: ignore[secrets-inherit] | |
| with: | |
| checkout-ref: ${{ needs.pre-flight.outputs.checkout-sha }} | |
| # Build the full matrix only on push events to the default branch, or | |
| # when PR gets the has a `gha:full-build` label, or when it had the | |
| # label already and it gets a new commit. | |
| full-matrix: |- | |
| ${{ | |
| github.event_name == 'schedule' || | |
| github.event_name == 'push' || | |
| contains(github.event.pull_request.labels.*.name, 'gha:full-build') || | |
| contains(github.event.issue.labels.*.name, 'gha:full-build') | |
| }} | |
| sccache-mode: 'READ_WRITE' | |
| vcpkg-cache-mode: 'readwrite' | |
| execute-integration-tests: true | |
| secrets: inherit # zizmor: ignore[secrets-inherit] | |
| report-status: | |
| name: Report GHA Status | |
| needs: [pre-flight, macos-bazel, windows-cmake] | |
| if: >- | |
| always() && | |
| needs.pre-flight.result == 'success' && | |
| needs.pre-flight.outputs.is-trusted == 'true' && | |
| (github.event_name == 'issue_comment' || github.event_name == 'pull_request_target') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Publish commit status | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_SHA: ${{ needs.pre-flight.outputs.checkout-sha }} | |
| MACOS_BAZEL_RESULT: ${{ needs.macos-bazel.result }} | |
| WINDOWS_CMAKE_RESULT: ${{ needs.windows-cmake.result }} | |
| run: | | |
| if [[ "${MACOS_BAZEL_RESULT}" == "success" && "${WINDOWS_CMAKE_RESULT}" == "success" ]]; then | |
| state="success" | |
| desc="macOS and Windows builds passed" | |
| elif [[ "${MACOS_BAZEL_RESULT}" == "failure" || "${WINDOWS_CMAKE_RESULT}" == "failure" ]]; then | |
| state="failure" | |
| desc="macOS and Windows builds failed" | |
| elif [[ "${MACOS_BAZEL_RESULT}" == "cancelled" || "${WINDOWS_CMAKE_RESULT}" == "cancelled" ]]; then | |
| state="error" | |
| desc="macOS and Windows builds cancelled" | |
| else | |
| state="success" | |
| desc="macOS and Windows builds completed" | |
| fi | |
| echo "Setting commit status on ${PR_SHA} to ${state}: ${desc}" | |
| gh api "repos/${GITHUB_REPOSITORY}/statuses/${PR_SHA}" \ | |
| -f state="${state}" \ | |
| -f context="gha: macOS & Windows" \ | |
| -f description="${desc}" \ | |
| -f target_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" |