bitflicker64 commented on code in PR #3326: URL: https://github.com/apache/hugegraph/pull/3326#discussion_r4282873122
########## .github/workflows/submit-dependencies.yml: ########## @@ -0,0 +1,400 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +name: Dependency baseline + +on: + push: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: dependency-baseline-${{ github.repository }}-master + cancel-in-progress: false + +jobs: + validate: + if: >- + (github.repository == 'apache/hugegraph' || github.repository == 'hugegraph/hugegraph') && + github.ref == 'refs/heads/master' && + (github.event_name == 'push' || github.event_name == 'workflow_dispatch') + runs-on: ubuntu-latest + timeout-minutes: 10 + env: + PYTHONDONTWRITEBYTECODE: '1' + steps: + - name: Checkout event commit + uses: actions/checkout@v7 + with: + ref: ${{ github.sha }} + persist-credentials: false + - name: Test CI policy and dependency inventory + run: | + python3 -m unittest discover -s .github/scripts -p 'test_ci_policy.py' + python3 -m unittest discover -s .github/scripts -p 'test_dependency_snapshot.py' + python3 -m unittest discover -s install-dist/scripts/dependency -p 'test_*.py' + + generate: + needs: validate + if: >- + ((github.repository == 'apache/hugegraph' && github.event.repository.fork == false) || + github.repository == 'hugegraph/hugegraph') && + github.ref == 'refs/heads/master' && + (github.event_name == 'push' || github.event_name == 'workflow_dispatch') + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: read + env: + PYTHONDONTWRITEBYTECODE: '1' + INPUT_TOKEN: '' + GITHUB_TOKEN: '' + GH_TOKEN: '' + outputs: + artifact_id: ${{ steps.snapshot.outputs.artifact-id }} + steps: + - name: Checkout event commit + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.sha }} + persist-credentials: false + - name: Set up project JDK + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + with: + java-version-file: .github/workflows/.java-version + distribution: 'temurin' + - name: Verify checkout and current master + env: + EXPECTED_SHA: ${{ github.sha }} + run: | + test "$(git rev-parse HEAD)" = "$EXPECTED_SHA" + test "$(git ls-remote origin refs/heads/master | cut -f1)" = "$EXPECTED_SHA" Review Comment: Important: A master commit that stops being the tip before its run finishes never gets a baseline, and the rerun guidance added at e821d8e cannot recover it. The open thread on this line raised this, and this head still has the same behaviour. Evidence: this check, line 100, the same pair in `inventory` (lines 144 and 157) and the writer's `Stale master before submission` check (line 392) all fail the run unless `refs/heads/master` equals `github.sha`. `workflow_dispatch` only runs on the current tip, and the concurrency group at line 28 keeps at most one pending run, so a superseded commit has no later run. Master already moves faster than one run, which needs two parallel full-reactor `mvn install` jobs and then `submit`: 449beb023, e4934c206 and a1045160c merged within 72 seconds of each other at 19:12-19:13Z on 2026-10-14, while `mvn install` alone took 3m37s in this head's `dependency-check` job. Under this workflow 449beb023 fails its post-generation check and e4934c206's pending run is replaced by a1045160c's, so neither gets a snapshot. `dependency-review` compares against the event's `pull_request.base.sha`, the master tip at push time, so any PR pushed while one of those commits was the tip fails with 0 base s napshots. The job at this head shows the same failure today: 0 base vs 1 head snapshots, failing on `[email protected]`. The new `docs/ci.md` lines 196-197 say rerunning the review alone cannot supply a skipped baseline, but they give no step that does. Requested change: either produce a baseline for every commit that is still reachable from master (replace the equality checks with an ancestry check such as `compare/{sha}...master` returning `ahead` or `identical`, and stop superseded runs from being dropped), or, if a non-tip submission could replace the default-branch graph and the tip check has to stay, extend lines 193-197 to say that the PR author must push again or update the branch so the event base moves to a master commit whose **Dependency baseline** run succeeded. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
