mirror of
https://github.com/deepseek-ai/deepseek-harness
synced 2026-08-15 21:04:50 +00:00
ci: address second review round — dependabot lane, drop dead restore, update topology note
- Route untrusted PRs (forks + Dependabot, same author test as e2e.yml) back to the hosted enterprise pool via a runs-on expression: Dependabot PRs are same-repo, so the previous head.repo guard admitted dependency-supplied code onto the persistent self-hosted VM. A single job with pool selection keeps all-checks-passed free of skips. - Drop the pnpm-store cache restore from this lane: on self-hosted the hosted-path cache actually HIT (Linux key) and spent ~52 s pulling 181 MB into a path pnpm never reads; the persistent local store already serves warm installs in seconds. - Update the larger-hosted-runners Agent Note (en/zh + i18n pairing record) so the decision record describes the shipped topology: coverage on the in-house vm-backup pool for trusted PRs, hosted Ubuntu 24.04 32-core retained for untrusted PRs.
This commit is contained in:
Chinesezjc
@@ -2,5 +2,5 @@
|
||||
# side as of the last confirmed-consistent state. Both languages carry equal authority;
|
||||
# after editing either side, bring the other along and re-record with:
|
||||
# pnpm run verify-translation-pairing --write
|
||||
2026-07-22-evidence-based-larger-hosted-runners.md: aaeab4ed9ae9687598f9f1d4a862120405697672
|
||||
2026-07-22-evidence-based-larger-hosted-runners.zh.md: 72b69c85908990a9f35b60f4c0a2ce213f9c8134
|
||||
2026-07-22-evidence-based-larger-hosted-runners.md: c3e6344ae61669da4810090e558589875ca7536e
|
||||
2026-07-22-evidence-based-larger-hosted-runners.zh.md: e5b322673b7a1eb004eb15b3784d21f500e83719
|
||||
|
||||
@@ -12,7 +12,7 @@ Larger runners make it possible to pay setup once and parallelize inside the rep
|
||||
|
||||
## Decision
|
||||
|
||||
The enterprise keeps repo-restricted x64 larger-runner pools for Ubuntu and Windows. Ordinary pull requests name three 32-core pools directly: Ubuntu 24.04 for exhaustive coverage, Ubuntu latest for the remaining primary Node 24 inventory, and Windows 2025 for blocking Windows contracts. Public IPs are disabled, and workflow concurrency remains bounded because an autoscaling ceiling neither allocates idle machines nor makes repository work scale without limit.
|
||||
The enterprise keeps repo-restricted x64 larger-runner pools for Ubuntu and Windows. Ordinary pull requests name two 32-core hosted pools directly: Ubuntu latest for the remaining primary Node 24 inventory and Windows 2025 for blocking Windows contracts. Exhaustive coverage moved off the metered Ubuntu 24.04 32-core pool onto the in-house self-hosted pool (`vm-backup` label: a 64-core VM running four always-on systemd-managed runner instances plus four registered spares) for trusted same-repo PRs; untrusted PRs — forks and Dependabot — keep coverage on the hosted Ubuntu 24.04 32-core pool so dependency-supplied code never reaches the persistent VM. Public IPs are disabled, and workflow concurrency remains bounded because an autoscaling ceiling neither allocates idle machines nor makes repository work scale without limit.
|
||||
|
||||
The required primary path depends on those enterprise pools. Standard GitHub-hosted jobs retain the Node 22.19, Node 26, and Python SDK compatibility contracts, while the [portable recovery boundary](2026-07-23-portable-required-pull-request-ci.md) and [serial reference](2026-07-21-serial-cross-platform-ci-reference.md) keep complete standard-runner evidence available on `master`. `suite=larger-runner-benchmark` compares isolated critical lanes across provisioned sizes, and `suite=consolidated-runner-benchmark` compares whole aggregates. Each benchmark reports its observed processor and memory capacity before running repository work.
|
||||
|
||||
|
||||
@@ -12,7 +12,7 @@ Status: implemented
|
||||
|
||||
## 决策
|
||||
|
||||
企业保留仅限本仓库使用的 Ubuntu 和 Windows x64 大型运行器池。普通拉取请求直接指定 3 个 32 核运行器池：Ubuntu 24.04 用于完整覆盖率，Ubuntu latest 用于其余主 Node 24 清单，Windows 2025 用于阻塞性 Windows 契约。公网 IP 已禁用；工作流并发仍设有边界，因为自动扩缩容上限既不会分配闲置机器，也不意味着仓库工作可以无限扩展。
|
||||
企业保留仅限本仓库使用的 Ubuntu 和 Windows x64 大型运行器池。普通拉取请求直接指定 2 个 32 核托管运行器池：Ubuntu latest 用于其余主 Node 24 清单，Windows 2025 用于阻塞性 Windows 契约。完整覆盖率已从计费的 Ubuntu 24.04 32 核池迁移至公司自有的自托管池（`vm-backup` 标签：一台 64 核虚拟机，运行 4 个常驻的 systemd 管理运行器实例，另有 4 个已注册备用位），仅面向可信的同仓库拉取请求；不可信的拉取请求——fork 与 Dependabot——的覆盖率仍在托管的 Ubuntu 24.04 32 核池上运行，确保依赖方提供的代码永远不会进入持久化虚拟机。公网 IP 已禁用；工作流并发仍设有边界，因为自动扩缩容上限既不会分配闲置机器，也不意味着仓库工作可以无限扩展。
|
||||
|
||||
必需主路径依赖这些企业级运行器池。GitHub 标准托管作业保留 Node 22.19、Node 26 和 Python SDK 兼容性契约，而[可移植恢复边界](2026-07-23-portable-required-pull-request-ci.md)与[串行参考流程](2026-07-21-serial-cross-platform-ci-reference.md)则在 `master` 上持续提供完整的标准运行器证据。`suite=larger-runner-benchmark` 比较已预配规格上相互独立的关键通道，`suite=consolidated-runner-benchmark` 则比较完整聚合流程。每项基准测试都会先报告实测的处理器和内存容量，再运行仓库工作。
|
||||
|
||||
|
||||
39
.github/workflows/ci.yml
vendored
39
.github/workflows/ci.yml
vendored
@@ -76,15 +76,19 @@ jobs:
|
||||
compression-level: 0
|
||||
|
||||
node-24-coverage:
|
||||
# Same-repo PRs only: this lane runs on an in-house self-hosted runner,
|
||||
# so fork-originated code must never land here. The repo is currently
|
||||
# private with forking disabled; this guard keeps that invariant explicit
|
||||
# if either setting ever changes.
|
||||
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
|
||||
# Runs on the in-house pool (self-hosted, 64-core) instead of the metered
|
||||
# enterprise pool. The pool holds 4 always-on instances plus 4 registered
|
||||
# spares; the runner service is systemd-managed and self-healing.
|
||||
runs-on: [self-hosted, linux, x64, vm-backup]
|
||||
if: github.event_name == 'pull_request'
|
||||
# Trusted same-repo PRs run on the in-house pool (self-hosted, 64-core;
|
||||
# 4 always-on systemd-managed instances plus 4 registered spares) instead
|
||||
# of the metered enterprise pool. Untrusted PRs — forks and Dependabot
|
||||
# (same-repo but dependency-supplied code; same author test as e2e.yml) —
|
||||
# stay on the hosted enterprise pool so no untrusted code reaches the
|
||||
# persistent self-hosted VM. Selecting the pool via runs-on keeps this a
|
||||
# single job, so the all-checks-passed aggregate never sees a skip.
|
||||
runs-on: >-
|
||||
${{ (github.event.pull_request.head.repo.full_name != github.repository
|
||||
|| github.event.pull_request.user.login == 'dependabot[bot]')
|
||||
&& 'dsh-enterprise-ubuntu-24-04-32core-test'
|
||||
|| fromJSON('["self-hosted", "linux", "x64", "vm-backup"]') }}
|
||||
name: node 24 / coverage
|
||||
env:
|
||||
DSH_COVERAGE_MAX_WORKERS: '24'
|
||||
@@ -94,17 +98,12 @@ jobs:
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- uses: actions/cache/restore@v4
|
||||
with:
|
||||
# Path must stay byte-identical to the save-side path in the master
|
||||
# lane: actions/cache hashes the literal path into the cache version,
|
||||
# so any variation (e.g. ~) would never match the saved cache. On
|
||||
# self-hosted this restore simply misses and the persistent local
|
||||
# pnpm store covers warm installs instead.
|
||||
path: /home/runner/.local/share/pnpm/store/v11
|
||||
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-
|
||||
# No pnpm-store cache restore in this lane: on the self-hosted pool
|
||||
# pnpm's persistent store lives outside /home/runner, so restoring the
|
||||
# hosted cache here downloads ~180 MB into a path pnpm never reads
|
||||
# (measured: 52 s restore, then a 2.8 s install straight from the
|
||||
# persistent store). The rare hosted (untrusted-PR) run just does a
|
||||
# cold install.
|
||||
|
||||
- uses: actions/setup-node@v6
|
||||
with:
|
||||
|
||||
Reference in New Issue
Block a user