* ci: split fast and deep static checks Fast PRs run typecheck, lint, and format before provider admission. Knip, duplication, architecture guards, and Python stay on the full tier. Shared-boundary fallbacks keep the Linux x64 baseline, and Turbo jobs export remote-cache credentials when they are configured. Co-authored-by: morluto <morluto@users.noreply.github.com> * ci: keep pull requests from writing the remote cache Trusted default-branch runs still receive TURBO_TOKEN. Pull requests get an empty token and remote read-only mode. Knip saves a per-commit cache key so the next trusted full run can refresh the restored snapshot. Co-authored-by: morluto <morluto@users.noreply.github.com> * ci: forward the release cache token and upload deep static reports Release qualification now passes TURBO_TOKEN into the called workflow. Labeled pull requests still do not. The deep static job records its task context and uploads duplication reports after a failed gate. Co-authored-by: morluto <morluto@users.noreply.github.com> * style: format the turbo cache policy test Co-authored-by: morluto <morluto@users.noreply.github.com> * ci: keep fast checks exclusive and trusted cache writes explicit Declare the static artifact name and context script so typecheck matches the implementations. Lock check:ci:fast around dist, and publish the remote cache only for release qualification or default-branch push, schedule, and dispatch. Co-authored-by: morluto <morluto@users.noreply.github.com> * ci: record static task graphs without nesting the artifacts lock Keep check:ci:fast locked, and point graph recording at the unlocked check:ci:fast:tasks script so check:pr and check:test can record hashes while they already hold that lock. Co-authored-by: morluto <morluto@users.noreply.github.com> * ci: keep unauthenticated Turbo runs on the local cache Open pull requests do not receive TURBO_TOKEN, so a remote read mode cannot authenticate. Those runs now use the local cache. Trusted runs still publish. Co-authored-by: morluto <morluto@users.noreply.github.com> * test(ida): treat unchanged invalid requests as nonretryable Main already stopped marking invalid_request retryable. The pull request merge runs that projector, while the IDA lookup tests still expected retryable true. Match the merged behavior. Co-authored-by: morluto <morluto@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: morluto <morluto@users.noreply.github.com>
69 lines
2.1 KiB
TypeScript
69 lines
2.1 KiB
TypeScript
import type { NormalizedWorkflowRun } from "./workflow-run.mjs";
|
|
import type { StaticTaskContext } from "./static-task-context.mjs";
|
|
export type { StaticTaskContext } from "./static-task-context.mjs";
|
|
|
|
export interface StaticDiagnostic {
|
|
readonly kind: "lint" | "jscpd";
|
|
readonly path?: string;
|
|
readonly paths?: readonly string[];
|
|
readonly code?: string;
|
|
readonly message?: string;
|
|
readonly severity?: string;
|
|
}
|
|
|
|
export function classifyFailure(input: {
|
|
repository: string;
|
|
defaultBranch: string;
|
|
run: Record<string, unknown> & NormalizedWorkflowRun;
|
|
job: Record<string, unknown>;
|
|
diagnostics: readonly StaticDiagnostic[];
|
|
context: StaticTaskContext;
|
|
mainRun: Record<string, unknown> & NormalizedWorkflowRun;
|
|
mainJob: Record<string, unknown>;
|
|
mainDiagnostics: readonly StaticDiagnostic[];
|
|
mainContext: StaticTaskContext;
|
|
executionSourcesVerified: boolean;
|
|
ancestry: { status: string; mergeBaseSha: string | null };
|
|
blobs: Readonly<Record<string, boolean>>;
|
|
}): {
|
|
classification: "matching-main-diagnostics" | "unknown";
|
|
reason: string;
|
|
};
|
|
|
|
export function diagnosticPaths(item: StaticDiagnostic): readonly string[];
|
|
export function isFailedConclusion(
|
|
value: unknown,
|
|
): value is "failure" | "timed_out";
|
|
export function isEligibleMainRun(
|
|
run: Record<string, unknown>,
|
|
defaultBranch: string,
|
|
repository: string,
|
|
): boolean;
|
|
export function pullRequestBaseSha(
|
|
run: Record<string, unknown>,
|
|
repository: string,
|
|
): string | null;
|
|
export function safeSha(value: unknown): string | null;
|
|
export function validRepoPath(value: unknown): value is string;
|
|
export function selectStaticCheckArtifact(
|
|
page: unknown,
|
|
run: { id?: string | number; head_sha?: string },
|
|
runAttempt: number,
|
|
name?: string,
|
|
): unknown | null;
|
|
|
|
export function readStaticCheckArtifact(options: {
|
|
repository: string;
|
|
artifactId: number | string;
|
|
token: string;
|
|
fetchImpl?: typeof fetch;
|
|
}): Promise<{
|
|
context: StaticTaskContext;
|
|
diagnostics: readonly StaticDiagnostic[];
|
|
}>;
|
|
|
|
export function parseStaticArchive(archivePath: string): Promise<{
|
|
context: StaticTaskContext;
|
|
diagnostics: readonly StaticDiagnostic[];
|
|
}>;
|