ci: add dependency-aware impact routing and release-oriented Pages (#216) - #218
Conversation
|
Implementation for #216 is complete at exact HEAD Exact-head routing evidence:
Contract evidence:
No merge, tag creation, Release publication, repository dispatch, or manual public Pages candidate deployment was performed. Post-merge evidence belongs to Integration: verify the ordinary merge push has Security/Foundation as expected and creates no Pages run/artifact, then return to #213 for the separate explicit Human-approved manual candidate Pages gate. |
miso-develop
left a comment
miso-develop
left a comment
There was a problem hiding this comment.
Review disposition: REWORK_REQUIRED
Reviewed exact PR head c64b5ff836bf7ce4ca6c89f740dc4fdd777cb3e4 against Issue #216, parent #215, and the revised v1.0.0 release sequence in #213.
One blocking deterministic-routing finding identified.
Blocking finding — Issue117 routing does not treat the canonical classifier itself as a snapshot build-semantics dependency
.github/workflows/issue117-screen-snapshot.yml now delegates its contract/build decision to:
scripts/ci_change_impact.py
However, that exact classifier path is absent from the Issue117 workflow-level pull_request.paths trigger.
In addition, scripts/ci_change_impact.py is in SHARED_EXACT, but it is not in SNAPSHOT_BUILD_EXACT or SNAPSHOT_BUILD_PREFIXES. Therefore:
classify_paths(["scripts/ci_change_impact.py"])sets Shared/Web/Firmware/Pages impact, but does not set snapshot_build=true.
This creates a future false-skip boundary:
- a PR changes only
scripts/ci_change_impact.py; - that change can alter the exact logic used by Issue117 to decide whether diagnostics firmware should build;
- the Issue117 workflow does not start at all because its workflow-level path filter does not include the classifier;
- even if invoked independently, the classifier currently does not classify its own change as
snapshot_build; - Foundation/Security can still be green without the diagnostics-ON ESP-IDF profile being exercised.
The current exact-head Issue117 #200 run does not expose this hole because this PR also changes .github/workflows/issue117-screen-snapshot.yml, which is in both the workflow trigger and SNAPSHOT_BUILD_EXACT, so both snapshot jobs ran.
This conflicts with #216's explicit Issue117 contract that diagnostics ESP-IDF build must run for:
- workflow build-semantics changes;
- other true diagnostics-firmware build dependencies.
The canonical classifier is now directly part of Issue117 workflow build/routing semantics and must not be able to change without exercising that boundary.
Required completion condition:
- make
scripts/ci_change_impact.pyitself trigger the Issue117 workflow; - classify a change to that file as
snapshot_contract=trueandsnapshot_build=true; - add focused regression coverage proving classifier-only change exercises the diagnostics-build path;
- preferably pin the workflow trigger dependency mechanically in
tests/ci_change_impact_test.pyso this cannot silently regress.
No broad change to the snapshot dependency set is required for this finding.
Other reviewed areas
The rest of #216 is consistent with the current contract.
Foundation routing
- Foundation still triggers on every PR and main push.
- Always-run
classifyjob uses complete-history checkout and repository-owned Git/Python classification. - PR uses base SHA -> head SHA; push uses before -> after.
- rename/copy handling includes both old and new paths; delete paths are retained.
- malformed/all-zero/unavailable/empty diff state fails safe to
uncertain=trueand all-heavy. - unknown paths fail safe to Shared/all-heavy.
- heavy jobs are conditioned only after classification:
- Web/Windows on
web=true; - Firmware on
firmware=true.
- Web/Windows on
- this workflow/classifier PR correctly exercised all heavy jobs.
Required Security invariant
- Security workflow still runs on every PR and main push without workflow path filtering.
- exact required job/check context remains
security:scan. - no job-level conditional skip was added to
security:scan. - full security/release/supply-chain suite remains.
- CI routing/Pages regression suite is now executed inside the required Security job.
Production-equivalent local Web smoke
- real Vite build with repository production base
/m5authenticator/; - real Provisioner/Firmware/Help route HTML and CSP;
- normal Firmware Flash surface enabled;
- synthetic non-secret same-origin target/manifests/firmware parts emitted only under dedicated smoke modes;
- production-smoke output is separate from normal
dist; - normal Pages production build does not enable the fixture plugin;
- Chrome verifies route initialization, CSP, same-origin target/manifests, and every synthetic firmware part;
- existing QR/Argon2 production-bundle coverage remains.
Pages cadence / manual candidate
- ordinary
mainpush trigger is removed. - automatic tag path remains
v*.*.*. - manual candidate requires:
refs/heads/main;- explicit acknowledgement;
- exact 40-character candidate SHA;
- fresh
origin/main; - workflow source SHA == fresh current main;
- candidate SHA == fresh current main.
- manual candidate forces
exact_release=falseand records mutable/pre-release identity in the summary. - tag/manual path retains release validation, pinned ESP-IDF identity, isolated firmware build, image/package validation, same-origin firmware assets, production Web build, one-day Pages staging artifact, deploy, and exact artifact-ID deletion.
- no Pages/OIDC authority is added to Authorized Release.
Release/security boundary
.github/workflows/release-authorized.ymlis byte-for-byte unchanged from exact base/current main (blobd126d260b05c56556cb2e83017ee21086a362490).- canonical Product/Firmware version remains
1.0.0 / 1.0.0 / 1.0.0. - Protocol / Storage / Vault remain
2 / 2 / 1. production_release_allowedremains true.v1.0.0tag is absent.- GitHub Release
v1.0.0is absent. - no Product/Protocol/Storage/Vault runtime behavior or release authority is changed.
Exact-head evidence
- Security #948: SUCCESS.
- Foundation #945: SUCCESS:
- classify: SUCCESS;
- Web: SUCCESS;
- Windows Chrome: SUCCESS;
- Firmware: SUCCESS;
- production-equivalent Web/Flash/Help smoke: SUCCESS;
- isolated ESP-IDF/package validation: SUCCESS.
- Issue117 Screen Snapshot #200: SUCCESS:
- classifier: SUCCESS;
- snapshot contract: SUCCESS;
- diagnostics ESP-IDF profile: SUCCESS.
- no Pages workflow is created for this PR.
Staleness/collision
- handoff HEAD matches current PR HEAD.
- PR is open, non-draft, mergeable.
- current
mainremains exact PR base49de696f3a75a1afa100606bce2b072ec5148c98. - PR #218 is the only open PR at final Review check.
#216 must not advance to Integration until the Issue117 classifier-dependency hole above is corrected and re-reviewed on a new exact HEAD.
No manual public Pages candidate, protected tag creation, or Release publication belongs in this rework.
|
Rework for the blocking Review finding is complete at exact HEAD Resolved boundary:
Exact-head verification:
The rework is limited to the Review finding; no Pages candidate deployment, tag creation, Release publication, or merge was performed. |
miso-develop
left a comment
miso-develop
left a comment
There was a problem hiding this comment.
Review disposition: READY_FOR_INTEGRATION
Re-reviewed exact PR head ee1b38d004265d7b325e2e0cd53e20a81d98d82f against Issue #216, parent #215, and the release sequencing in #213.
No blocking finding remains.
Resolution of prior Review finding
The Issue117 classifier-dependency false-skip boundary is closed.
.github/workflows/issue117-screen-snapshot.ymlnow explicitly includes:
scripts/ci_change_impact.py
in itspull_request.pathstrigger.scripts/ci_change_impact.pynow includes its own path inSNAPSHOT_BUILD_EXACT.- Therefore a classifier-only change sets:
snapshot_contract=true;snapshot_build=true;- Shared/Web/Firmware routing as expected.
- Focused unit coverage asserts exactly that classifier-only behavior.
- Workflow contract coverage mechanically asserts that the classifier path remains present in the Issue117 trigger.
This means future changes to the canonical routing logic itself cannot silently bypass the diagnostics-ON ESP-IDF profile.
Exact-head runtime evidence
Foundation #946:
- classify job: SUCCESS;
- exact impact output:
- web=true;
- firmware=true;
- pages=true;
- security_release_shared=true;
- snapshot_contract=true;
- snapshot_build=true;
- uncertain=false;
- complete changed-path set includes all ten effective PR files;
- Linux Web: SUCCESS;
- Windows Chrome: SUCCESS;
- Firmware: SUCCESS;
- production-equivalent Provisioner/Firmware/Help Chrome smoke: SUCCESS;
- isolated ESP-IDF build/package validation: SUCCESS.
Security #949:
- exact required check context
security:scan: SUCCESS; - CI impact/workflow regression suite: 15 tests passed;
- full existing security/release/supply-chain suite remains green;
- repository scan: SUCCESS.
Issue117 Screen Snapshot #201:
- classify snapshot impact: SUCCESS;
- exact classifier output includes
snapshot_contract=trueandsnapshot_build=true; - snapshot contract: SUCCESS;
- test-only diagnostics ESP-IDF profile: SUCCESS;
- dependency lock unchanged.
Remaining #216 contract
Previously-reviewed areas remain acceptable and unchanged by the rework:
- Foundation still triggers on every PR and main push.
- Heavy Web/Windows/Firmware jobs are conditional only after deterministic classification.
- unknown/unclassified paths and diff uncertainty fail safe to all-heavy.
- PR base->head and push before->after diff semantics remain.
- rename/delete handling remains complete.
security:scanremains unconditional and unfiltered on PR/main push.- Pages no longer deploys on ordinary main pushes.
- SemVer tag-triggered Pages deployment remains.
- manual Pages candidate remains explicit, mutable/pre-release, and fail-closed to exact current main through:
- main ref requirement;
- explicit acknowledgement;
- exact 40-character candidate SHA;
- fresh origin/main fetch;
- workflow source SHA == current main;
- candidate SHA == current main.
- manual candidate forces
exact_release=false. - Pages retains production firmware/package/Web build, one-day staging artifact retention, deployment, and exact artifact-ID deletion.
- production-equivalent local Web smoke uses real production base/CSP/routes and same-origin synthetic non-secret firmware fixtures isolated to smoke build modes.
- Authorized Release workflow remains outside this optimization boundary and unchanged.
- no Pages/OIDC authority was added to Authorized Release.
Release/security boundary
Current exact base/main remains 49de696f3a75a1afa100606bce2b072ec5148c98.
The PR preserves:
- Product/Firmware version =
1.0.0; - Protocol = 2;
- Storage Schema = 2;
- Vault Format = 1;
production_release_allowed=true;- release authorization/provenance/attestation boundaries;
- legacy Release tombstone retirement;
- ESP-IDF identity;
- Product/Vault/crypto/Recovery/Lock behavior.
v1.0.0 tag remains absent.
GitHub Release v1.0.0 remains absent.
Staleness / collision
- handoff HEAD matches current PR HEAD;
- PR is open, non-draft, mergeable;
- current main remains exact PR base;
- rework delta from prior reviewed HEAD is limited to:
.github/workflows/issue117-screen-snapshot.yml;scripts/ci_change_impact.py;tests/ci_change_impact_test.py;
- PR #218 remains the only open PR at final Review check.
Integration boundary
#216 is ready for Integration.
After merge, Integration must still perform the required post-merge evidence on the exact merged main SHA:
- canonical Product/Firmware remains
1.0.0; security:scansucceeds;- Foundation routing for the shared workflow merge behaves as expected;
- ordinary main merge push creates no Pages workflow run;
- ordinary main merge push creates no Pages staging artifact;
- Authorized Release and tombstone contracts remain unchanged;
v1.0.0tag remains absent.
Only after that should control return to #213 for the separate explicit Human-approved manual public Pages candidate gate.
No manual Pages candidate, tag creation, or Release publication is authorized as part of merging #216.
READY_TO_MERGEHEAD: Integration reconstruction:
STATE: READY_TO_MERGE |
INTEGRATEDPR: #218 Pre-merge Integration evidence:
Required post-merge evidence on exact merged main:
STATE: INTEGRATED |
1 participant
Closes #216
Parent: #215
Release preparation parent: #213
Scope
security:scanunconditional and add routing regression coverage under that required contextmainpushesdocs/CI.mdFresh bootstrap evidence
Baseline current main:
49de696f3a75a1afa100606bce2b072ec5148c981.0.0 / 1.0.0 / 1.0.02 / 2 / 1production_release_allowed: truesecurity:scanfrom GitHub Actions integration15368v1.0.0tag: absentv1.0.0GitHub Release: absentImpact classifier
scripts/ci_change_impact.pyowns deterministic PR/push diff acquisition and routing.It:
GITHUB_OUTPUT;Output categories are:
webfirmwarepagessecurity_release_sharedsnapshot_contractsnapshot_buildprocess_docs_onlyuncertainThe focused regression matrix covers docs/process-only, Web-only, Firmware-only, shared release/CI, unknown paths, all-zero push base, unavailable diff, rename/delete behavior, and snapshot contract/build boundaries.
Foundation and Security
Foundation still triggers on every PR and main push.
The lightweight
classifyjob always runs. Heavy jobs are conditional:This PR changes routing workflows/classifier and therefore classified Shared on exact HEAD. All Web, Windows, and Firmware jobs ran.
Security remains unfiltered on every PR and main push:
security:scan;Production-equivalent local Web smoke
Web/Shared changes run a real Vite production-style build with:
/m5authenticator/;The synthetic fixture plugin is enabled only for
qr-smoke/production-smokemodes and is not emitted by the normal Pages production build.Existing QR/Argon2 production-bundle coverage remains.
Pages cadence
.github/workflows/pages.ymlno longer has an ordinarymainpush trigger.Automatic deployment remains:
v*.*.*Manual candidate deployment remains:
workflow_dispatch;candidate_sha;refs/heads/main;origin/main;GITHUB_SHA == current main;candidate_sha == current main;exact_release=false;Tag/manual paths preserve release validation, immutable ESP-IDF identity, isolated firmware build, package/image validation, same-origin firmware assets, production Web build, one Pages staging artifact with
retention-days: 1, and exact artifact-ID deletion after deploy.Issue117 split
Issue117 now has:
snapshot contractjob;test-only screen snapshot profilebuild job.Snapshot docs,
AGENTS.md, Windows scripts, host helper, and snapshot contract tests do not require the ESP-IDF diagnostics build. True firmware/profile/CMake/sdkconfig/device/time/session/vault-runtime/image/workflow-build inputs still do.Because this PR changes the workflow itself, exact-head classification intentionally exercised both jobs.
Authorized Release boundary
.github/workflows/release-authorized.ymlis byte-for-byte unchanged from current main (blobd126d260b05c56556cb2e83017ee21086a362490).No Pages/OIDC deployment authority was added to it. Existing raw/verified artifact handoffs, checksums, attest-before-publish, one-day retention, exact-ID cleanup, publisher permissions, and legacy Release tombstone boundary remain intact.
Exact-head verification
HEAD:
c64b5ff836bf7ce4ca6c89f740dc4fdd777cb3e4security:scan;uncertain=false;mainremains exact base49de696f3a75a1afa100606bce2b072ec5148c98;security:scanfrom GitHub Actions integration15368;v1.0.0tag remains absent;v1.0.0remains absent.Safety boundaries
release-authorized.ymlPost-merge Integration boundary
Integration must verify on the exact merged
mainSHA:1.0.0;security:scansucceeds;v1.0.0tag remains absent.After that, return to #213. The manual public Pages candidate is a separate Human Gate and must not be run merely as part of integrating this PR.