CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-20 11:52:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: free-lane flake ledger — retry ON in CI, flaky-passes recorded and uploaded

Browse Source 
The runner's attribution-gated flaky-retry pass (cap 5, truncation veto)
was OFF in the required lane and its FLAKY-PASS evidence was console-only —
so a single timing flake red the merge gate while repeat offenders stayed
unenumerable. free-tests.yml now sets GSTACK_FREE_RETRY_FLAKY=1 and points
GSTACK_FLAKE_LEDGER at runner.temp; every flaky-pass appends a JSONL entry
(SINGLE writer: the parent runner — no concurrent-append hazard by
construction; fail-open with a loud warning so a broken ledger can never
red the lane) and the artifact uploads UNCONDITIONALLY — a flaky-pass run
is green, which is exactly when the evidence matters. Wiring pinned by
free-tests-workflow-wiring; ledger behavior unit-tested incl. the fail-open
path. Matches 2026 industry practice (retry for data, quarantine out of
merge-blocking but never out of logging) with the repo's own receipts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-31 04:50:31 +00:00
co-authored by Claude Fable 5
parent 2dabc02447
commit 7f36eacbd2
4 changed files with 142 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/free-tests-workflow-wiring.test.ts
+11
View File
@@ -54,6 +54,17 @@ describe('free-tests workflow wiring', () => {
}
});
test('flake telemetry stays wired: retry flag, single-writer ledger, unconditional artifact', () => {
// WS1: a timing flake must not red the required lane, but every
// flaky-pass must be recorded and uploaded — a green run is exactly when
// the evidence matters. Removing any of these silently returns flakes to
// either merge-blocking (flag off) or invisibility (ledger/artifact off).
expect(source).toMatch(/GSTACK_FREE_RETRY_FLAKY:\s*"1"/);
expect(source).toMatch(/GSTACK_FLAKE_LEDGER:\s*\$\{\{ runner\.temp \}\}\/flake-ledger\.jsonl/);
expect(source).toContain('name: flake-ledger');
expect(source).toMatch(/name: Upload flake ledger\s*\n\s*if: always\(\)/);
});
test('least-privilege token: contents read-only, credentials not persisted', () => {
// The job executes PR-controlled code (install lifecycle scripts + the
// suite itself). A default-grant GITHUB_TOKEN persisted into .git/config