38 commits

Author	SHA1	Message	Date
qwen-code-dev-bot	cfd95f6abb	fix(ci): scope the sdk-java host lock to the cache write-back (#15128) ... * fix(ci): scope the sdk-java host lock to the cache write-back (#15117) Run 39627609266's fast-tier job arrived at 17:38, stayed head of the sdk-java host-lock queue, and failed at 19:15 without starting Maven. The MariaDB integration lane held the same lock across its install and full MySQL clean verify; under pool contention that hold ran from 15:54 to 18:57 (run 39628985638), past the fast tier's 90-minute budget. Both MariaDB Maven runs already resolve from a job-local repository, so they touch no host-shared state. Seed that repository before the lock, run both Maven commands unlocked, and take the host lock only for the cache write-back, the sole remaining host-shared mutation. Drop fd 9 on the write-back children so a cancelled job's survivor cannot retain the lock. Raise the lane ceiling to 300 minutes for the ~3-hour verify plus one lock wait and setup, and pin the new order and fd closes. Fixes #15117 * test(ci): exempt the OpenTUI parity suites from the no-AK gate (#15117) The main merge brought three interactive suites from #14964. The no-AK gate requires every runnable integration test to be selected or explicitly exempted, so the Test job fails until they are listed. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen Autofix <qwen-code-assistant@users.noreply.github.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: jinjing.zzj <jinjing.zzj@alibaba-inc.com> Co-authored-by: 易良 <1204183885@qq.com>	2026-10-22 21:44:45 +08:00
qwen-code-dev-bot	06e59666df	fix(ci): skip the duplicate prepare build in the daemon E2E lane (#14884) ... * fix(ci): skip the duplicate prepare build in the daemon E2E lane (#14870) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): pin the daemon E2E prepare-skip premises (Refs #14870) * test(ci): keep the daemon E2E step commands pinned (Refs #14870) * test(ci): pin the daemon E2E step and its install warning (#14870) --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: Qwen Autofix <autofix@qwen-code.dev> Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com>	2026-10-22 12:19:59 +00:00
jinye	288e4c481d	perf(ci): Optimize MySQL integration verification (#15200) ... Close Spring contexts before fixture database cleanup, run integration classes in isolated reusable forks, and remove redundant fixture validation and duplicate load-test execution. Document bounded local validation and preserve full CI gates. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-22 12:03:13 +00:00
易良	0b3c2f816a	feat(ci): restore a MariaDB leg for the non-Hosted IT family (#15003) ... * fix(ci): align Java integration database and lock lifetime * test(ci): re-pin the sdk-java lock and MySQL probe after the single-step merge The merge commit staged the conflict resolution before these two re-pins were written, so they land as a follow-up in the same push: - `keeps the host lock out of every Maven child` counted three lock-bearing steps; #14903 collapsed the MariaDB lane's two Maven steps into one, so the count is now two (test job + mysql-integration). - The MySQL startup probe took the step's first `mvn` line, which is now the `-DskipTests install` staging command; select the `-Pmysql-integration` command instead so the probe still exercises the consumer. Verified: vitest sdk-java-workflow.test.js 96 passed; prettier --check clean. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-conflict/jmvgz448zlp * fix(ci): skip the MySQL binlog, drop the unused database, correct the reaper bound Three independent corrections to the mysql-integration lane this PR reworks. 1. MySQL 8 enables the binary log by default (MariaDB 10.11 did not in the configuration this lane replaced), and the datadir is an uncapped tmpfs. Nothing in packages/managed-agent-server/src or packages/sdk-java reads a binlog (0 hits for binlog|log_bin|GTID|SHOW MASTER STATUS), and the container is disposable with no replica, so `--skip-log-bin` is appended after the image name beside --innodb-use-native-aio=0. Without it the ~67 MiB hex-encoded LONGBLOB query this lane already raises max_allowed_packet for is serialized a second time into host RAM. 2. `--env MYSQL_DATABASE='runtime_broker_test'` had no consumer: the lane's only connection is -Dmysql.url=.../managed_agent_test?createDatabaseIfNotExist=true. The declaration invited a cleanup that drops createDatabaseIfNotExist and dies at first connect with Unknown database. Dropping it lets the JDBC URL own the schema and shrinks the diff. 3. The cleanup comment and removal-failure warning said the host reaper reclaims a stranded container "after a 24h age gate" / "up to a day". The real bound is ~48h: qwen-docker-cleanup.sh:31 gates on a strict `now - created_at > 86400` (exactly 24h is SKIPPED) and qwen-docker-cleanup.timer fires once a day, so a container created just after a fire is skipped at the next one and reaped at the one after. Test pins updated in the same change: the start-step assertion, the exact docker-run trace literal, and the cleanup warning literal. All three were mutant-verified red (drop --skip-log-bin / re-add MYSQL_DATABASE / restore "after 24h") and restored byte-identical. Only this PR's own copy of the reaper wording is corrected; the two pre-existing copies (sdk-java.yml's event-transport-multi-node job and release-managed-agent-reference.yml) are untouched to keep this diff scoped. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmvhb9cysmc * feat(ci): restore a MariaDB leg for the non-Hosted IT family #14936 moved the mysql-integration lane onto MySQL 8.4 and removed the last real MariaDB server, leaving the published MariaDB-only V12 repair (RTRIM, error 1901) and the schema catalog's MariaDB branches without a falsifier. Both engines now run the same non-Hosted *IT family as two matrix legs of one job: the container image, its startup arguments, its client, and its readiness signal come from the leg, and the container name carries the engine so two legs on one pool host cannot collide. --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-22 11:24:34 +00:00
易良	54a56f30ce	fix(ci): write back only the MariaDB lane's Maven delta and size its ceiling (#15000) (#15064) ... * fix(ci): bound the MariaDB lane's cache write-back and size its ceiling (#15000) Run 39563394993's mysql-integration job was cancelled at the 200-minute ceiling: 54 minutes queued for the host lock, 75 minutes of Maven work, then a 60-minute unbounded tar of the host-shared ~/.m2. The cache is an optimization, so skip it after five minutes; the ceiling now covers the 90-minute wait, the measured Maven pass, the bounded write-back and setup headroom. * fix(ci): write back only the MariaDB lane's Maven delta by hardlink The bounded tar pipeline extracted straight into the host-shared ~/.m2, so a timeout mid-member left a truncated artifact that --skip-old-files never repaired and the next seed hardlinked into its job. Its 300 s cap was also below the measured 26-61 minute whole-tree cost, so it would have tripped on every run. Publish only the files Maven fetched in this job (nlink == 1 after the hardlink seed) with per-file cp -ln, keeping the two in-house excludes. Each link is atomic and never replaces a host file, so the 300 s backstop can only leave artifacts missing. Distinguish the timeout from other failures, and fold the backstop into the derived ceiling floor instead of a second hardcoded one. * ci: record sdk-java.yml's real size in the workflow ratchet This PR grows .github/workflows/sdk-java.yml from 113473 to 114180 bytes: the MariaDB lane's timeout ceiling moves 200 -> 280 with the arithmetic that justifies it, and the Maven write-back is rewritten to publish only this job's own downloads (nlink == 1) under a 300 s backstop instead of taring the whole tree. The growth is the change, so record it rather than move the step out. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-conflict/jmvj37bcsp8 --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-22 14:48:11 +08:00
qwen-code-dev-bot	438bcb2a8f	fix(ci): let the fast Java tier overtake waiting full-tier lock tickets (#15035) ... * fix(ci): serve the fast Java tier before full-tier lock holds (#15032) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): keep a parked lock head's ticket alive under fast priority A head blocked in `flock --wait` could not touch its ticket, so once a hold outlasted the 1800s mtime arm another waiter reaped a live head and the next ticket, whatever its class, parked in the kernel too. With two classes that lets normal tickets take kernel positions ahead of fast tickets that arrive later during a long hold. A keepalive now refreshes the parked head's ticket at the waiters' two-second cadence; it closes the lock fd and uses `touch -c`, so it can neither hold the lock nor recreate a removed ticket. The ordering and promotion cases used a stub whose `--wait` returned every 200 ms, so they exercised a head that loops, which production never does. They now park `--wait` until release and assert the reachable paths: a fast ticket overtaking a normal ticket that is still waiting, and a promoted waiting normal ticket preceding a later fast ticket. The comments and design docs no longer claim a fast job waits at most the hold already running (a parked head still goes first) or cite #14962/#15032 as fast-behind-full evidence; they state what priority removes and that a single hold longer than the budget is outside it. --------- Co-authored-by: Qwen Autofix <qwen-code-assistant@users.noreply.github.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: wenshao <shaojin.wensj@alibaba-inc.com>	2026-10-22 03:54:27 +00:00
易良	a4562edb67	fix(ci): align Java integration database and lock lifetime (#14936) ... * fix(ci): align Java integration database and lock lifetime * test(ci): re-pin the sdk-java lock and MySQL probe after the single-step merge The merge commit staged the conflict resolution before these two re-pins were written, so they land as a follow-up in the same push: - `keeps the host lock out of every Maven child` counted three lock-bearing steps; #14903 collapsed the MariaDB lane's two Maven steps into one, so the count is now two (test job + mysql-integration). - The MySQL startup probe took the step's first `mvn` line, which is now the `-DskipTests install` staging command; select the `-Pmysql-integration` command instead so the probe still exercises the consumer. Verified: vitest sdk-java-workflow.test.js 96 passed; prettier --check clean. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-conflict/jmvgz448zlp * fix(ci): skip the MySQL binlog, drop the unused database, correct the reaper bound Three independent corrections to the mysql-integration lane this PR reworks. 1. MySQL 8 enables the binary log by default (MariaDB 10.11 did not in the configuration this lane replaced), and the datadir is an uncapped tmpfs. Nothing in packages/managed-agent-server/src or packages/sdk-java reads a binlog (0 hits for binlog|log_bin|GTID|SHOW MASTER STATUS), and the container is disposable with no replica, so `--skip-log-bin` is appended after the image name beside --innodb-use-native-aio=0. Without it the ~67 MiB hex-encoded LONGBLOB query this lane already raises max_allowed_packet for is serialized a second time into host RAM. 2. `--env MYSQL_DATABASE='runtime_broker_test'` had no consumer: the lane's only connection is -Dmysql.url=.../managed_agent_test?createDatabaseIfNotExist=true. The declaration invited a cleanup that drops createDatabaseIfNotExist and dies at first connect with Unknown database. Dropping it lets the JDBC URL own the schema and shrinks the diff. 3. The cleanup comment and removal-failure warning said the host reaper reclaims a stranded container "after a 24h age gate" / "up to a day". The real bound is ~48h: qwen-docker-cleanup.sh:31 gates on a strict `now - created_at > 86400` (exactly 24h is SKIPPED) and qwen-docker-cleanup.timer fires once a day, so a container created just after a fire is skipped at the next one and reaped at the one after. Test pins updated in the same change: the start-step assertion, the exact docker-run trace literal, and the cleanup warning literal. All three were mutant-verified red (drop --skip-log-bin / re-add MYSQL_DATABASE / restore "after 24h") and restored byte-identical. Only this PR's own copy of the reaper wording is corrected; the two pre-existing copies (sdk-java.yml's event-transport-multi-node job and release-managed-agent-reference.yml) are untouched to keep this diff scoped. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmvhb9cysmc --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-21 14:39:26 +00:00
易良	976425cdb9	fix(ci): queue the sdk-java host lock first-come-first-serve (#14743) (#14912) ... * fix(ci): queue the sdk-java host lock first-come-first-serve (#14743) flock(2) does not order its wakeups, so under continuous arrivals one waiter can lose every release and die at the wait budget — repeatedly burning 40, then 60, then 90 minutes per starved lane across at least three hosts. Replace the inline flock --wait at all three acquisition sites with a ticketed queue: every acquirer takes the next sequence number atomically, only the head of line retries the lock, dead owners are reaped, and the lock still releases at the step boundary. The pinned infrastructure-signature error text is preserved. The .size-baseline records the workflow's new size (smaller than main's, but main itself already exceeds its recorded baseline). * fix(ci): block the queue head instead of polling the lock The first live run starved its full 5400 s budget as queue ticket 1: the head polled flock --nonblock while main and older branches still run blocking flock --wait, so every release went to a legacy waiter's kernel wakeup. The head now blocks in five-second slices, re-entering the same wake race on even terms; tickets still order every run that uses this helper. * fix(ci): serve the fast tier before full-tier holds The queue bounded the wait by position but a fast-tier PR job still queued behind every full-tier hold ahead of it. Give the fast tier its own class: the head is the first sorted ticket and fast tickets sort first, so a PR job waits at most the hold already running. A normal ticket ages into the fast class after 20 minutes, so continuous PR traffic cannot starve the full tier. * refactor(ci): keep the lock queue plain FIFO. Drops the priority/aging classes: a single first-come-first-serve line is simpler to review and reason about. The head still blocks in five-second slices so it re-enters the kernel wake race on even terms with legacy waiters, and dead owners are still reaped. The tradeoff is explicit: a fast-tier job waits its turn behind full-tier holds instead of jumping them. * fix(ci): stop leaking the host-lock ticket and reap stale orphans Three bounded defects in the fair-lock helper, all confirmed by executing it rather than by reading alone: - The EXIT/TERM/INT traps quoted `${ticket}`, a `local` that is already out of scope once the sourcing step's shell exits, so every trap ran `rm -f ''` and each successful acquisition left its head ticket behind. Drop the traps and leave the queue at acquisition instead: a holder needs no place in line once the kernel holds the lock, and SIGKILL runs no trap. - The ticket was published after `exec 8>&-` released the counter lock, so a later arrival could take seq+1, see an empty queue, name itself head and win the lock out of arrival order. Publish inside the critical section. - Orphan liveness was decided solely by `kill -0`, so a ticket whose PID had been recycled to a live process was never aged out and, being head, made an idle lock unreachable for every job on the host. Age a ticket out on mtime alone above 1800s; a live waiter re-touches every ~7s. Measured on a free lock with a live-PID, 2h-old orphan head ticket: base burns its full 6023ms budget and exits 1 with the orphan intact; this commit acquires in 19ms and reaps it. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmvhb9cysmc * style(ci): keep only the load-bearing why in the lock helper comments Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmvhb9cysmc * fix(ci): keep the lock queue head in one blocking wait The head re-entered the kernel wait queue every five seconds, so a release reached waiters that stayed blocked first; the head could lose every release and starve to its budget. Run 39472038337 still burned the full 5400 s as queue ticket 2. Wait once for the remaining budget and log the remaining time at most once a minute. A resumed release tag can predate the helper, so both acquisition sites fall back to the bare lock instead of dying before Maven and wedging the release. Pin the emitted ::error:: annotation prefix rather than a file substring a comment can satisfy, and observe the real acquisition order in the stub. * fix(ci): name the blocking ticket in the sdk-java lock timeout The timeout line reported only the dying waiter's own ticket, so a deep queue and a wedged one produced the same message and neither could be acted on from the log. Name the head of line, which separates a real sibling hold from an orphan ticket. Bring both design docs back to the shipped mechanism: two acquisition sites, the flock'd counter with no aging path, the 1800 s mtime arm and the ticket removed at acquisition, plus the operator recovery command. Refresh the stale .size-baseline entry for sdk-java.yml. * test(ci): wait for the first ticket instead of a fixed sleep The FIFO case started the second acquirer 800 ms after the first and relied on that being enough for A to take sequence 1. On a loaded runner it is not, and B wins sequence 1, so the case fails on timing rather than behavior. Poll for A's published ticket instead. * fix(ci): print the lock wait line before blocking The wait line was emitted only after `flock` returned, so a head parked behind a sibling hold printed nothing for its whole budget: run 39528681869's step sat in flock for 40 minutes and was cancelled with an empty log, which is the opposite of the attribution this change exists to add. Probe with --nonblock, print the ticket line, then block. The observability bullet in both design docs now states what the code does. --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: Shaojin Wen <szujobs@gmail.com>	2026-10-21 12:21:44 +08:00
qwen-code-dev-bot	b05be4cd23	fix(ci): hold the MariaDB lane's sdk-java lock once per job (#14896) (#14903) ... * fix(ci): hold the MariaDB lane's sdk-java lock once per job (#14896) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): pin the merged MariaDB step's order and SpotBugs witness The single-step merge dropped guarantees that the two-step layout got for free from step boundaries, and one witness became satisfiable by prose: - spotbugs-gate matched `verify` anywhere in the step body, and the merged step's own comments explain the incident with the word 'verify' twice. A later narrowing to `clean test` would stay green. Match `clean verify` on command lines only. - seed-before-write-back was a step-order invariant; both strings now live in one body with presence assertions only, and the write-back's warning arm swallows the ordering failure. Pin seed < install < verify < write-back. - `working-directory:` applied to the whole step and could not be misplaced; its `cd` replacement is positional inside the body. Pin it between the two Maven runs. - Drop the finder arm that matched the deleted `working-directory:` property: no step in either inspected job carries it any more. --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: 易良 <1204183885@qq.com> Co-authored-by: Shaojin Wen <szujobs@gmail.com>	2026-10-21 00:53:44 +08:00
qwen-code-dev-bot	623cb40cf5	fix(ci): skip prepare's duplicate build in the daemon E2E install (#14861) (#14873) ... The daemon E2E job's install ran prepare, which built and bundled the tree, then the job's next two steps built and bundled it again. The fast-tier lane failed inside that install-path prepare build. Set QWEN_SKIP_PREPARE so the install stays an install, matching the e2e build job. Co-authored-by: Qwen Autofix <autofix@qwen-code.dev>	2026-10-20 20:41:31 +08:00
qwen-code-dev-bot	848111433b	fix(ci): retry transient pnpm installs in the SDK Java workflow (#14845) (#14851) ... * fix(ci): retry transient pnpm installs in the SDK Java workflow (#14845) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): correct the retry's failure class and exercise the loop The install step's prepare re-enters the workspace build, so an absorbed failure here can be a build failure; the warning no longer routes it at the #11726 network-transient counter, and the recorded cost counts each attempt's rebuild. The meta-test now runs the loop under a stubbed corepack to prove the retry, the absorbed warning and the exit status. --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: yiliang114 <1204183885@qq.com>	2026-10-20 17:16:06 +08:00
qwen-code-dev-bot	66807cae3f	fix(ci): wait 90 minutes for the sdk-java host lock (#14787) (#14801) ... Run 39229303984's fast-tier Java 21 job exhausted the 60-minute flock budget behind sibling Maven holds on the shared ECS host and failed before Maven started, so no test result was reported. The lock is shared by every Maven lane on the host, so an acquisition must cover a queue of holds, not one: raise each wait to 90 minutes and give the two affected ceilings room for a full wait plus their Maven work and setup. The workflow meta-test pins the new wait and derives both ceilings from it, so a future re-size cannot leave a job ceiling below the wait. Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com>	2026-10-20 01:21:24 +00:00
易良	f8b3031f73	fix(ci): repair Java gates and report failures on PRs (#14522) ... * fix(ci): surface Java failures on PRs and manual main runs * fix(ci): address review findings on PR failure reporting - Gate the PR failure comment on infra_only like the issue path: an infrastructure-only death is rerun once, not reported, and the comment has no correction path once the retry goes green. - Tolerate a missing or truncated run-jobs.json in the comment command so an API failure degrades to naming no job instead of failing analyze and losing both the PR comment and the issue. - Drop the leftover 'main-branch ... on main' wording from the per-commit issue body now that merged-PR failures reach it. * fix(managed-agent): keep daemon recovery waits re-driven and deflake hosted tests The daemon refuses a lifecycle phase with hosted_lifecycle_recovery_required while it settles a previous prompt. The coordinator classified that refusal as a hook refusal and published the operation RECOVERY_BLOCKED, which the lifecycle store then refused on every later attempt even after the daemon recovered. Treat it like the other self-clearing waits: budget-exempt, with the daemon's own code once past the budget, still re-driven by the recovery scan. Deflake the gate's remaining timing-sensitive spots: give the Hosted close the dispatch backoff's own window, allocate fault-gate ports below the ephemeral range, widen the action renewal lease, and size the SSE stall test off a 1200ms idle budget so a loaded runner can still answer inside it. The E2E freeze loop now waits up to 5s for InnoDB transactions to drain. * fix(ci): resolve fork approval runs in the Java failure reporter An approval run records the base repository as head_repository even when the PR head lives in a fork, so the owner:branch listing filter found nothing and fork approval failures produced no comment, no issue and no diagnostic. Resolve by exact head SHA instead, fail soft with a warning when the listing errors or nothing resolves, exclude closed-unmerged PRs, gate the infrastructure rerun to destinations that file, and publish the issue url before the route edit can abort the step. * fix(ci): preserve PR failure reports across issue and runner errors * test(sdk-java): wait for the re-registered attachment's heartbeat The close-by-id success arm asserted a new heartbeat inside a fixed 60ms window while the heartbeat interval is 10ms. A loaded runner delayed the periodic task past that window and failed the assertion on main, though the attachment was still beating. Poll for the next beat with the same 5s bound the other heartbeat waits use. * docs(managed-agent): name the recovery wait in the public contract and pin the wrapped refusal The contract's failure_code description enumerates the codes a recovery_blocked lifecycle operation reports; the daemon-recovery wait this change published added a third code without touching that text or the contract version. Name hosted_lifecycle_recovery_required in both the public and WebShell descriptions and bump the contract to 1.63.0 with a version note; regenerate the WebShell types. The recovery-refusal test threw the refusal directly, but the SDK wraps it in MutationOutcomeUnknownException once the non-idempotent detach may have been delivered — the wrapped shape is why daemonRefusalCode walks the cause chain. Parameterize the test over the wrapped shape so a regression that stops unwrapping fails it. * fix(ci): cover SDK lock holds and refresh InnoDB freeze probes * test(managed): allow writer grant latency in failover fixtures * fix(managed-agent): name the refusing store route and pair writer grants with store heads The Hosted failover lane failed with the store's shared writer-conflict text and no way to tell which operation with which grant was refused (review #14522's discriminator: a grant the wake never re-acquired vs a grant the store already judged superseded). ManagedSessionStoreHttpError now carries the refusing store route in its own field (public messages pass through unchanged). On a 409 the writer annotation captures, sanitized (boot id, never a token), the grant the writer presented and the store-head generation/revision/committed/state verdict probed at the same instant — reaching it from a commit retry and from the renewal path that otherwise swallows the refusal silently. The daemon's recovery print and turn-failed print render status, stable remote code, route and that pairing. Also log the sanitized acquiredWriterGeneration and the restore-head match pair on acquire/restore, so a healthy takeover proves from both sides that the previous boot's writer stayed fenced. * test(managed): establish journal ownership before broker outage * test(cli): wait for startup and saved-plan recovery before asserting * test(sdk-java): wait for heartbeats instead of fixed windows * test(managed-agent): isolate automation fault fixtures and await deadlock recovery * test(ci): pin the awaitility fail-fast guard, not its exact prefix `HostedTeamLeadMySqlIT`'s waiting helper now configures `ignoreExceptionsInstanceOf(CannotAcquireLockException)` before chaining `failFast`, so the class no longer contains the literal `await().failFast("The case's @Timeout interrupted it"` and the hosted-process-ci guard failed on the merged head. The invariant is that every wait goes through the helper that fails on the `@Timeout` interrupt; the single-`await()` assertion still pins that. Match the failFast guard itself so configuring awaitility first stays legal. * fix(ci): record the current workflow size in .size-baseline The ratchet is meant to turn workflow growth into one reviewed line, but main-ci-failure-issue.yml landed at 23219 bytes against a recorded 20935, so the 2284-byte remainder rode inside the 4096-byte allowance unrecorded and the grow-by-adding-a-step path stayed invisible. Record the byte size the file actually has at this head. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmvdoiklbf5 * fix(managed-agent): normalize boolean literals in schema checks * test(managed-agent): isolate destructive schema validation * fix(ci): release cancelled fast PR gate concurrency * fix(ci): release PR gate when tier selection is cancelled * chore(web-shell): regenerate managed agent API types The merge of origin/main brought a new `hosted_lifecycle_recovery_required` clause into the Managed Agent OpenAPI description, but the committed `managed-agent-api.ts` was resolved by hand instead of regenerated, so `managed-agent-api.test.ts` drifted from its generator and failed the required Test lane. Regenerated with `node scripts/generate-managed-agent-api.mjs`; the only change is the aligned description line. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmveoyarfh8 * fix(managed-agent): restore the daemon recovery wait in failure_code docs The e62a4c7 main merge kept main's failure_code descriptions and dropped hosted_lifecycle_recovery_required from both. Regenerating the WebShell types from that contract then removed the clause there too, although the coordinator still publishes this code for recovery_blocked lifecycle operations. Restore it in the contract and the generated types. * fix(ci): merge paginated jobs pages before the comment helper reads them gh api --paginate prints one JSON document per page, while the PR-comment helper parses the jobs listing with a single JSON.parse. A failed run wider than one page made the parse throw and rendered a summary naming no failed job — the links that make the report actionable. Slurp-merge the pages at the fetch, which also turns a parked error body into the same empty-list degradation the per-commit body already handles. Bump the recorded byte size for the prose comment. * style(managed-agent): fix the OpenAPI version indent so prettier passes The v1.68 bump in this PR left info.version indented four spaces, so Lint & Static failed on `node scripts/lint.js --prettier`: [warn] packages/managed-agent-server/src/main/resources/openapi/managed-agent-public-api.openapi.json Formatting only; no contract change. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-conflict/jmvesvre3hg --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-19 08:04:12 +00:00
Shaojin Wen	948caad58f	ci(sdk-java): run the EventTransport gate lanes on the ECS pool (#14472) ... * ci(sdk-java): run the EventTransport gate lanes on the ECS pool The broker and multi-node EventTransport lanes were pinned to hosted runners because the RocketMQ cluster bound fixed ports. Their trusted runs now route like the MariaDB lane, behind the same trust clause and MAINTAINER_ECS_RUNNER_DISABLED kill-switch, and are made safe on a shared, reused pool host: - A new step picks free ports for the NameServer, broker and proxy (with the broker's listenPort - 2 and + 1 companions free too) and exports them; rocketmq-lite-broker.sh already reads them from the environment, and the gates take the proxy endpoint from the same variable. - Both lanes install and verify against a job-local Maven repository seeded from the host-shared ~/.m2, so the fixed SDK coordinates never round-trip through it, and set up Maven on the pool. - The multi-node lane's MySQL moves from a service container to a job-owned container with native AIO off and a tmpfs datadir (#14416), removed on every outcome. Node comes from the pool's own install, libfaketime is installed only when the host lacks it, and the unnecessary `corepack enable` is dropped. - Both lanes gain the pool's pre-checkout hygiene steps, and their job ceilings absorb the setup stretch a loaded host adds. hosted-harness-mysql stays hosted: it delegates a cgroup v2 root at a fixed /sys/fs/cgroup path through sudo, and its failover E2Es spawn native mysqld from the hosted image's MySQL server packages. The routing matrix, per-job ports (the chooser runs for real), the MySQL container contract, job-local Maven repos and pool hygiene are pinned in the workflow meta-tests. * ci(sdk-java): move the RocketMQ port chooser to a script and record the size Lint & Static failed the workflow-size ratchet: sdk-java.yml grew 21571 bytes over its recorded 74834. The duplicated inline port chooser moves to .github/scripts/choose-rocketmq-ports.mjs, which both lanes run and the broker lane's test still executes for real. The remaining growth is real. Every pool job in this file carries the ownership heal, the stale .qwen sweep (pinned byte-identical to ci.yml) and the .git recreation. These run before checkout, so they cannot live in a repository script, and the two newly pooled lanes need one copy each. The job-owned MySQL container and its cleanup make up most of the rest. Record 93793 bytes.	2026-10-18 00:15:56 +08:00
易良	1ab68e951e	feat(ci): gate Managed Agent changes on a full SDK Java run before merge (#14397) ... * feat(ci): gate Managed Agent changes on a full SDK Java run before merge Changes to the Java modules or the harness they drive now run a fast SDK Java subset on every push and the full suite on the first approval of the current head. An always-reporting `Managed Agent gate` check can be made required: a touched PR reports it only from a full run. Refs #14392, #14381 * fix(ci): route the Managed Agent gate's own jobs off the hosted queue The scope and gate jobs report the would-be required check; on the first run they sat in a hosted queue holding 123 runs. Trusted runs now take the ECS pool with the shared pre-checkout hygiene, forks stay hosted. * fix(ci): register managed-agent-gate.yml in the PR-stage CI budget ledger managed-agent-gate.yml triggers on pull_request and merge_group, so it is PR-stage and needs an entry in .github/workflows/.ci-budget. That ledger is a fail-closed whitelist: a missing entry makes check-ci-budget.mjs error out and short-circuits the remaining Lint & Static steps, so no linter ran. Recorded exactly as measured (3 jobs, 15 declared timeout-minutes, 1 job without a fixed timeout) so no slack is left against the ratchet. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmvb6htxaa7 * fix(ci): run the full Managed Agent unit suite in the fast tier The fast tier skipped mysql-integration, the only lane that runs the module's ~4,200-test H2 suite in full, so a PR push got no unit feedback until the review-triggered full run. In the fast tier the Java 21 leg now runs the whole module suite instead of its Runtime Broker subset, after the same workspace install mysql-integration uses: part of the suite loads the built Core and CLI JavaScript. * fix(ci): harden Managed Agent gate tier selection and cancellation reporting (#14397) * fix(ci): gate the Managed Agent full tier on a maintainer approval The full tier was reachable by any approved review, including the deferred APPROVE that qwen-triage-finalize.yml posts once a PR's checks land green. That workflow now watches this gate, so its own fast tier could buy the most expensive run in the repository with no human involved. tier=full now also requires the reviewer's author_association to be OWNER, MEMBER or COLLABORATOR, and fails closed when it is absent. The concurrency group embedded the event name, so a push could never cancel the approval run it superseded: that run kept going for about 125 minutes and then reported a head that branch protection no longer reads. The group is now keyed on the pull request, with cancel-in-progress still true only for pull_request, so approvals keep queueing behind each other instead of displacing a pending full run. The design docs also described a Maven cache composite that is not in the tree, called the untouched-PR cost hosted-only when trusted runs take the ECS pool, and carried a touched-push figure from before the fast tier took on the full module suite. Non-goals now record that this gate supersedes the separate compile gate proposed in #14385, and that the Java SDK checkstyle step stays pinned to the Java 11 leg, so only the full tier runs it. * docs(ci): stop citing the Maven cache save the merge from main removed Merging main brought in #14396, which suppresses setup-java's post-job Maven cache save on self-hosted runners by making the cache input conditional on runner.environment. That was the measured cause behind two claims this branch carries, and both went stale the moment it landed. The design doc's Cost section said removing the 14 to 37 minute save was planned work with no implementation in the tree. It is now merged, so the 330 machine minute full run is a figure measured before the saving went away and should come in lower; it is stated that way, without a re-measured number this branch does not have. The daemon-e2e budget comment and its test justified the fast tier's 90 minutes entirely by that save. The value stays: the leg's own sizing puts stretched setup at about 44 minutes against a 45 ceiling, and the fast tier now runs it on every touched PR push rather than nightly only, so it meets that tail far more often. The comment now says that instead of citing a save that no longer happens. * fix(ci): diff a review event against its merge commit's first parent A pull_request_review run checks out the same test merge commit as a pull_request run (run 38997396688: "Merge 7d918f7 into 2746553"), so HEAD^1 is already the base. The payload's base sha can lag main and pull main's own Managed Agent changes into an untouched PR's diff, starting needless full runs. * fix(ci): keep comment reviews out of the gate's pull request group A concurrency group keeps one pending run, and a newcomer cancels it whatever cancel-in-progress says. With every event of a PR in one group, a comment review arriving while an approval run waits behind the fast tier cancelled that approval run, and the head's required check stayed expected until someone approved again. Reviews that are not approvals now run in a group of their own. --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com>	2026-10-17 21:17:23 +08:00
易良	880717242e	fix(ci): start the reference distribution MySQL without native AIO (#14429) ... * fix(ci): start the reference MySQL without native AIO on the pool The ECS pool shares fs.aio-nr across every job on a host. A mysql:8.4 service container reserves AIO contexts during init and dies with io_setup() EAGAIN once the budget is exhausted, before any step runs. A service container cannot take a command, so start it explicitly with native AIO disabled and own its readiness and teardown. * test(ci): pin the reference MySQL container contract Extend the routing meta-test to assert the service block stays gone, the port export reaches GITHUB_ENV, and teardown runs unconditionally; update the Maven bootstrap test for the new job-scoped container name. Make teardown best-effort so a transient docker rm cannot redden the release build; the host reaper collects the leftover. * docs(ci): correct the teardown comment to match the host reaper The host cleanup service (qwen-docker-cleanup.sh) has no state-based container prune: reap_stale filters by label/name and force-removes anything older than 86400s regardless of state. The comment claimed it only reaps exited/dead containers, which is wrong; the 24h age gate is the real reason a cancelled job would strand a running mysqld.	2026-10-17 13:03:44 +08:00
易良	b194ac7245	fix(ci): keep the setup-java Maven cache on hosted runners (#14396) ... * fix(ci): keep the setup-java Maven cache on hosted runners An ECS host keeps ~/.m2 between jobs, so setup-java's post-job save tars the whole shared repository (14-37 minutes per job) and then loses the cache reservation to a parallel job, discarding the archive. * fix(ci): bootstrap ~/.m2/repository on fresh ECS hosts before the write-back * test(ci): widen the setup-java cache guard to every workflow (#14396) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-17 11:35:29 +08:00
易良	3bddf6e0bb	feat(ci): route the release lane's hosted stragglers onto ECS runners (#14336) ... * feat(ci): route the release lane's hosted stragglers onto ECS runners The 2026-10-15 v0.25.2 releases validated in minutes and then queued up to 64 minutes on the GitHub-hosted pool behind PR automation (FIFO, no priority). publish stayed hosted on purpose — it carries release credentials — and the shared self-hosted pool is dual-labelled onto PR CI instances, so it could not simply move back either. quality joins the pool its five checks already use, effective on merge. publish and collect move behind a new opt-in variable ECS_RELEASE_HOST_RUNNER_ENABLED onto a new release-only label ecs-qwen-release-host: unset, everything dispatches exactly as before; set, publish only reaches machines that never run PR code. publish gains the disk-floor gate, collect clears stale prebuilds fail-closed, and the meta-tests pin the new routing and credential isolation. * ci(managed-agent): fold reference version resolution into the build job The separate prepare job ran for seconds but waited 25-30 minutes for a GitHub-hosted runner before build could queue again, so each PR dry run spent close to an hour in two serial queues. The root package.json path is dropped because the packager only reads version and engines.node from it, while most unrelated PRs touch it. * test(ci): pin collect's release-host routing and stale-prebuild wipe Address the review suggestions on the collect job: nothing parsed audio-capture-prebuilds.yml, so its opt-in routing expression and the fail-closed wipe were the one behaviour in this change no test pinned. Also note in the YAML that run steps resolve against the job's working-directory while action inputs stay workspace-relative — the indirection the rm -rf and find steps depend on. * ci(managed-agent): run trusted reference dry runs on the ECS pool Trusted pull-request dry runs of the reference distribution now use the persistent pool instead of waiting on the saturated hosted queue. The job gains the pool's pre-checkout hygiene, a random MySQL host port on tmpfs, a random server port, and a job-local Maven repository so the fixed qwencode-sdk and server coordinates built from PR code never reach the host-shared ~/.m2. Dispatch builds feed the published release and stay on hosted VMs. Published release notes are anchored at the previous reference release instead of whichever tag family the API picks.	2026-10-16 23:13:26 +08:00
jinye	28415ddff3	refactor(managed-agent): Consolidate server and broker sources (#14277) ... * refactor(managed-agent): Consolidate server and broker sources Move the combined Java application beside sdk-java and remove the standalone Runtime Broker artifact. Update build, development, packaging and CI references while preserving Java package identities, runtime protocols and schema resources. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * docs(managed-agent): Preserve historical evidence and verification guidance Restore commit-pinned H3 probe inputs and align the Java verification environment contract with the consolidated server layout. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): Run hosted Broker tests under Bash Keep Maven property arguments intact on Windows and stop before Broker tests when the SDK install fails. Exercise both successful and failed SDK installation in the workflow regression tests. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): Quote the hosted Broker shell value Follow the repository yamllint single-quote rule without changing the parsed workflow configuration. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-16 00:28:58 +00:00
易良	5d40c8153c	fix(ci): gate Desktop and Java SDK releases on checks of the release commit (#14259) ... * fix(ci): gate desktop releases on checks of the release commit Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): gate Java SDK releases on the complete Java suite Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): update sdk-java MAVEN_ARGS count after checkstyle step addition Commit 404845a (#14242) added a 'Run Managed Agent Server Checkstyle' step to the test job in sdk-java.yml, bringing the MAVEN_ARGS count from 6 to 7, but did not update the corresponding test expectation. * fix(ci): run desktop shell checks in parallel with the build The relocated desktop_shell job serialized up to 45 minutes ahead of the 120-minute build on every release and daily dry run, re-running cargo test and test-release.js that build already runs ungated on all five matrix entries against the same pinned revision. Keep the job, but gate only publish and sync-oss on it; build needs prepare alone, so the shell lane runs in parallel and nothing publishes unchecked. Also: sdk-java.yml's cancel-in-progress expression named a trigger #14205 removed, so it was permanently false — make that literal. The desktop qwen_code_ref input descriptions now say the ref must contain the desktop crate, since a pre-desktop ref hard-fails the gate instead of passing vacuously. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): restore the runs-on dropped from the desktop build job Commit 6989b9c replaced the build job's `runs-on: '${{ matrix.os }}'` with the comment explaining the parallel shell lane, so the key never came back. actionlint fails the Lint & Static gate on it, and GitHub rejects the file outright — the push-event Desktop Release run ends "failed because of a workflow file issue" with zero jobs, which would break every desktop release and dry run, not just CI. Restore the line. The build job's 34 steps and its five-entry `os` matrix are unchanged, so this returns the job to the shape main has. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>	2026-10-15 19:42:08 +08:00
易良	b99787e474	docs: remind to update workflow meta-tests when changing CI workflows (#14239) ... * docs: remind to update workflow meta-tests when changing CI workflows #14205 moved Java and Desktop checks off pull_request/push triggers but forgot three scripts/tests/*.test.js files that pin those workflows' trigger shapes. The resulting red main CI run was fixed by #14227. Add a step to the general workflow so the next workflow change updates all parsing meta-tests, not just the obvious ones. * docs: preserve workflow validation guidance after renumbering Correct the self-audit reference so fixes rerun build, typecheck, and tests, and keep the workflow lookup command on one line for Prettier. * test(ci): update Java Maven step count for server Checkstyle Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-15 06:27:55 +00:00
易良	c1b012539b	fix(ci): repair daily failure reporting and contract guards (#14238) ... Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-15 05:07:50 +00:00
易良	70407feeb9	ci: run Java and Desktop checks daily or on demand (#14205) ... * ci: run Java and Desktop checks weekly or on demand Move Java compatibility and integration checks out of PR and push events. Group Desktop Shell checks with the existing packaging dry run, replace daily packaging with weekly validation, and retain manual dispatch. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci: report weekly Java and Desktop failures as issues Include both weekly suites in the existing main failure analyzer and reuse its issue deduplication and autofix routing. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci: run Java and Desktop checks daily Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci: format failure reporting workflow list Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci: preserve lightweight guards after daily suite migration Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci: align lint permission assertion and Java concurrency Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-14 16:15:03 +00:00
jinye	3a9bbd7216	feat(sdk-java): add private CSI Session and native SQL authority (#13996) ... * feat(sdk-java): connect original CSI sessions to native SQL authority * fix(sdk-java): preserve private execution and outcome boundaries * codex: address PR review feedback (#13996) * codex: address PR review feedback (#13996) * codex: address PR review feedback (#13996) * test(managed-agent): align lifecycle capability fixtures * fix(sdk-java): refuse private CSI wake claims before mutation * ci(sdk-java): record native producer workflow size	2026-10-14 08:23:43 +00:00
jinye	1f39a80bf0	feat(managed-agent): consolidate persistence into a 32-table baseline (#14069) ... * feat(managed-agent): consolidate persistence into a 32-table baseline Preserve journal, idempotency, runtime, physical storage and recovery boundaries in a shared fresh-database schema. Add fixed snapshots, typed operations, scoped resource collection and atomic automation projections with MySQL fault and load coverage. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): restore schema CI and channel claim fencing Avoid nested snapshot connection borrowing while preserving committed read-lease expiry and retirement checks. Carry reserved channel reconciliation identities into private journal commands and retain UNKNOWN no-resend behavior. Update canonical-schema fixtures, migration discovery and application packaging. Preserve the 32-table fresh-database boundary and record local versus pending CI acceptance in both languages. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): refuse system catalogs before schema initialization Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): restore fresh-schema E2E and MariaDB validation Port the real-stack runner and its audits to canonical tables, retain stream and approval scopes, and register fresh Linux storage before Harness admission. Validate MariaDB CHECK enforcement and InnoDB without relying on MySQL-only metadata or negative-test syntax. Add regression coverage and document current platform and acceptance boundaries. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): normalize boolean CASE catalog literals Accept MariaDB's numeric representation of bare SQL boolean literals while retaining structural CHECK validation, quoted values and enforcement guards. Add alias and tamper regression coverage and synchronize the bilingual verification evidence. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): raise managed schema MariaDB packet budget Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): support MariaDB load-test query plans Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): Restore native storage fixtures and const read witnesses Preserve measured row counts while bounding MariaDB optimization-stage page reads, and register Linux Hosted test storage through the production guard before tool admission. Keep recovery registration across restarts and resolve physical owners through aliases. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(managed-agent): Await snapshot publication in retraction checks Keep the strict terminal snapshot watermark assertion while allowing after-commit publication to finish under the concurrent materializer. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>	2026-10-14 00:58:38 +00:00
易良	aceb7f1223	fix(ci): recover reused runner checkouts and Java lock waits (#14017) ... * fix(ci): recover reused runner checkouts and Java lock waits Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): refresh Git metadata across Linux validation lanes Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): refresh checkout metadata for triage jobs Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-13 06:12:21 +00:00
qwen-code-dev-bot	06a837d768	fix(ci): double the sdk-java MariaDB lane's per-host lock budget (#13989) (#13991) ... The mysql-integration job acquires the per-host sdk-java-tests.lock once per Maven step with a 20-minute budget sized on one quiet pool window (run 37743332082: 1193 s of waits). Main run 38258395829 exhausted it: the Managed Agent verify step starved a full 1200 s behind cross-run pool traffic and failed before Maven started. Raise each acquisition to flock --wait 2400 (two full sibling holds) and the job ceiling to 140 minutes (three 40-minute waits plus the ~14 minutes of measured Maven work, plus margin). Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>	2026-10-12 16:16:29 +00:00
qwen-code-dev-bot	78a1d33afb	fix(ci): route the sdk-java MariaDB lane to the ECS pool (#13623) (#13627) ... * fix(ci): route the sdk-java MariaDB lane to the ECS pool (#13623) Three consecutive main runs (37636399508, 37653932541, 37654231285) lost their GitHub-hosted ubuntu lanes to runner-queue starvation: every failed job recorded zero steps and no assigned runner, and every job that got a runner passed — including this lane itself, W1c migrations and all, once a hosted runner freed up. The workflow's established answer is trusted-lane ECS routing (#13245, #13270); the MariaDB job was the last pool-safe lane still pinned to the hosted queue. Move its trusted runs (push, workflow_dispatch, same-repo and OWNER/MEMBER/COLLABORATOR PRs) to ecs-qwen and make the shared host safe: the mandated restore/sweep pre-checkout hygiene (pinned byte-identical to ci.yml), the test job's self-hosted Maven setup, the per-host sdk-java-tests.lock around every Maven run, and a random host port for the MariaDB service — a fixed 3306:3306 collides between jobs on one host. Timeout 15 → 25: the hosted lane measured ~12 minutes; the pool adds the lock wait. Hosted process fault gates stays hosted: it apt-installs mysql-server system-wide and runs a 130-minute profile, both hostile to a shared pool without a maintainer's call. * fix(ci): harden the pool-routed sdk-java MariaDB lane (#13623) - Raise mysql-integration timeout-minutes to 45 so one full 20-minute lock wait plus the ~12 minutes of measured Maven work fits the ceiling (25 cancelled the lane on its head run). - Resolve the Managed Agent install and verify steps from one job-local Maven repository under runner.temp, seeded from the shared cache inside the lock, so the fixed 0.1.0-alpha release coordinates cannot cross runs through the host-shared ~/.m2. - Record the deliberate merge-ref checkout stance at the job and pin it. - Strengthen the workflow pins: per-Maven-step lock path coverage, a timeout/lock-wait relation, byte-identical Set up Maven bootstrap across pool jobs, per-job job-local MAVEN_ARGS counts, the -Dmysql.url consumer lines, and a character-identical runs-on tie to the flyway lane. * fix(ci): recapture the pool lane's Maven cache and re-anchor MAVEN_ARGS pins (#13623) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): recapture third-party com/alibaba artifacts and size the pool lane's lock budget (#13623) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): keep the pool lane's MariaDB datadir on tmpfs (#13623) mariadb:10.11.18 declares VOLUME /var/lib/mysql, and the runner tears service containers down with `docker rm --force` (no -v), so every pool-routed mysql-integration run stranded one anonymous volume (~150 MB) on the shared ECS hosts, which nothing reaps. Mount the datadir on tmpfs instead: no anonymous volume is created and the storage dies with the container, cancelled runs included. --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: 易良 <1204183885@qq.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com> Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com> Co-authored-by: qwen-code[bot] <qwen-code[bot]@users.noreply.github.com>	2026-10-11 15:39:58 +00:00
Shaojin Wen	ba8615f4c4	ci(sdk-java): stop the API contract version from regressing or stalling (#13804) (#13808) ... The public Managed Agent contract's info.version is allocated by hand on every contract-changing pull request, and nothing checked it: on 2026-10-09 four such pull requests were in flight with 1.34.0 claimed twice while main was already at 1.35.0, and the stall had reached main once before — #13163 changed the document with no version movement. A duplicate Flyway version refuses to boot within minutes, but a regressed or stalled contract version breaks nothing at runtime; it silently misinforms every consumer that keys capability detection on it. On every pull request the Flyway lane now also compares the merge result's document with the base branch's head copy — fetched at depth one, since the default checkout is one commit deep — and fails when a changed document declares an equal or lower version, compared numerically per segment so 1.9.0 ranks below 1.37.0, naming whether the number stalled or regressed; a pull request arriving at the base ref's own bytes owes no bump. Each refusal arm has a test that fails when its guard is removed, and any path echoed into an ::error:: line is bound to the same byte alphabet check-flyway-migrations.js applies, so a hostile name cannot forge a second error line into a decoded log. After every push to main that changes the document, and every 30 minutes, a new workflow re-checks each open pull request's changed paths and document through the API — no pull request code is fetched, checked out or run — and sets the 'API contract version uniqueness (latest main)' status, the #13770 shape for the version number instead of the migrations: failure when the declared version no longer advances past main's, success otherwise, naming the other open pull requests claiming the same version, and error when a file list or head document could not be read in full. A head that already carries the status is re-evaluated even after it stops changing the document, so a stale failure clears. Both scripts ran live before this commit: the pull-request check over four merge shapes (stall, regression, advance, untouched) against a depth-one clone and filtered base fetch, and the re-check as a dry run against the open queue, whose six contract-changing pull requests it correctly read as stalled or regressed against main at 1.38.0. Fixes #13804	2026-10-10 05:43:18 +00:00
Shaojin Wen	34843cb9e8	ci(sdk-java): re-check open PRs for Flyway version collisions as main moves (#13770) ... The Flyway uniqueness guard checks a pull request merged with the main of the moment it ran. Nothing re-ran it when main later gained a migration, so a PR that went green before another PR took its version stayed green and turned main red once it merged; it also cannot see several open PRs claiming one version. A new workflow runs after every push to main that changes a migration and every 30 minutes. It checks out main, reads each open PR's changed paths from the GraphQL API (no PR code is fetched), and sets the 'Flyway migration version uniqueness (latest main)' commit status on each PR head that adds a migration: failure when a version it adds is taken in the merge result, success otherwise naming the other open PRs that claim the same version, and error when the file list could not be read in full. A head whose status would not change is not written again, and a head that already carries the status is always re-evaluated so a stale failure clears. The naming rules move into a shared module used by both scripts; the guard's behaviour is unchanged and its workflow also triggers on that module. Fixes #13742 Co-authored-by: probe <probe@local> Co-authored-by: 易良 <1204183885@qq.com>	2026-10-09 14:56:44 +00:00
qwen-code-dev-bot	f3642d4e45	fix(ci): sweep stale pool residue before sdk-java checkouts (#13506) (#13507) ... A main-push SDK Java run failed its 'ubuntu-latest / Java 21' leg in the Checkout step before any test ran (run 37423974280). The leg runs on the shared self-hosted ECS pool, whose reused workspace accumulates residue from earlier jobs: ci.yml's incident history records review/autofix leftovers (.qwen, .qwen.root-orig, review worktrees and branches) failing actions/checkout's clean, and a runner-user-owned tree failing every later git call with 'detected dubious ownership' (#12648). sdk-java.yml's pool-routed jobs carried only the bare ownership restore, without the two countermeasures ci.yml grew for exactly these failures. Port both, byte-identical to the pinned ci.yml copies, to the three pool-routed jobs (test, flyway-migrations, daemon-e2e): the safe.directory trust joins the restore step, and the stale-.qwen sweep (with its quarantine ladder and review worktree/branch cleanup) runs between restore and checkout, gated to self-hosted so the hosted macOS/Windows legs stay untouched. The sdk-java workflow suite pins the restore -> sweep -> checkout order in all three jobs and pins both step bodies byte-identical to ci.yml's, so the copies cannot drift; mutation-probed by stashing the workflow change (all 9 new pins red) and restoring it (green). The size baseline records the copied recipe's growth in the same commit, per the ratchet. Co-authored-by: 易良 <1204183885@qq.com>	2026-10-06 14:36:05 +00:00
易良	d697f98553	fix(ci): raise serve-ab handshake budget, report dead CodeQL nightlies, route trusted PR lanes to ECS (#13270) ... * fix(ci): raise serve-ab handshake budget, report dead CodeQL nightlies, route trusted PR lanes to ECS - serve-ab-drive: pass --initialize-timeout-ms 60000 like the other serve harnesses; the 10s default expired under pool contention and the daemon killed its own ACP child (#13266). - codeql.yml: a report_failure job files or comments on one scope/ci-cd issue when a scheduled scan leg fails or is cancelled by its timeout, which the main-CI notifier never saw (#13249). - tui-parity parity/noflicker, sdk-java flyway-migrations and assign-pr-owner assign use the trusted-PR ECS routing with the ownership restore; tui-parity also gets the self-hosted Node, disk-floor and hosted-only cache split (#13245). * fix(ci): scope the no-flicker report dir per runner on the ECS pool accept-noflicker.sh defaults OUT to a fixed /tmp path; hosted runners are single-tenant, but one ECS host runs many jobs at once.	2026-10-03 13:48:26 +00:00
Shaojin Wen	d5c22d336b	ci(sdk-java): guard Flyway version uniqueness and watch red main runs (#12965) ... * ci(sdk-java): guard Flyway version uniqueness and watch red main runs Two in-flight PRs each added a V16 managed-agent-server migration and merged 23 minutes apart; each branch was green in isolation, and Flyway refused to boot the merged result, leaving main red for two hours while three more merges stacked on it (#12940). A new flyway-migrations job runs scripts/check-flyway-migrations.js on every SDK Java pull request and push: a filename scan of the two migration locations that share one version sequence, failing in seconds and naming both files when two claim one version. Versions compare the way Flyway compares them — numerically per segment — so V016 collides with V16, and a location rename that would empty the guard fails instead of passing vacuously. The main-CI failure watcher now watches the SDK Java workflow, whose path-filtered push run on main is the only signal for a merge result neither PR could fail, and the failure-signature helper reads Surefire's per-test error lines, so a red Java lane files one deduped issue naming the failing tests instead of a per-commit stub. Refs #12940 * ci(sdk-java): harden the Flyway guard and dedupe its main-red issues Review on #12965: - compare versions across every module of one invocation — Flyway resolves classpath:db/migration across jars, so a version claimed in two modules collides exactly like two files in one module - fail when the SQL location yields no migration even if the Java location still does, so renaming one location away can no longer pass vacuously - escape %/CR/LF in module names and file paths before emitting ::error:: (the runner parses workflow commands from stderr too, and the job scans contributor-controlled filenames on pull_request) - match the migration suffix case-insensitively, as Flyway does - keep the fully qualified Surefire id as the dedupe identity so same-named tests in different packages no longer merge into one issue; the cosmetic package strip moves to shortenForTitle - give the guard's ::error:: line a stable flyway:<module>:<version> identity, so a standing red dedupes to one issue instead of one per stacked merge, and render the failed jobs in the test-keyed body - pin the workflow_run watch entry to sdk-java.yml's name key Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci(sdk-java): fix the Flyway dedupe on runner-rendered logs and close review findings The Actions runner consumes ::error:: workflow commands and writes ##[error] into the downloadable job log, so the dedupe pattern anchored on ^::error:: never matched production input and every merge stacked on a standing red would have opened a fresh autofix issue. The anchor now accepts both forms, the guard's two non-collision failure modes (moved migration location, missing module directory) get their own stable module+mode identity, and the synthesized flyway id is written to be read since it doubles as the issue title and body bullet. The issue body's "- Failed jobs:" block is now machine-owned like "## Also failing": stripped and re-emitted from the current run on every merge instead of freezing the lanes recorded at filing time, with the empty-list case pinned against a dangling heading. The guard itself now reports a multi-module collision once after all modules are scanned, naming every claimant (a second line would file a second issue), never prints a clean summary for a claimant, and only requires the SQL location of a module that owns a db/migration* directory — which lets the workflow invocation cover runtime-broker, the module that shares the classpath:db/migration namespace without carrying migrations today. escapeWorkflowCommand moves to scripts/release-script-utils.js (the byte-identical copy would have drifted from the tested original), and the filename-forgery tests gain a runner-decoding oracle and a capability probe so the Windows lane skips instead of failing on filenames Win32 cannot hold. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci(sdk-java): close the guard's blind spots and validate its dedupe captures Review and sandboxed verification on #12965 found the moved-location probe keying on the two exact directory names: a rename outside the migration* family (db/migration -> db/changelog) passed silently with the whole sequence inside it, a renamed Java location printed "all versions unique" from a scan that skipped it, and a Java-only module red-lit as "moved" with its real collision never named. The probe is now derived from the LOCATIONS table: a versioned-migration file anywhere under a source root but outside the configured location fails with the files named, the sibling check is per location and fires only when the location directory itself is gone, and a repeated module argument no longer fabricates a collision of a file with itself. The invocation now names qwencode too — managed-agent-server depends on it at compile scope, the same namespace premise that admitted runtime-broker — and the .size-baseline entry is re-recorded at the file's current size. On the consumer side, both Flyway patterns feed their captures through a module-shape validation before they become a dedupe identity, so a filename-borne forgery rendered by the runner's annotation decode can no longer inject a second identity into the issue this files, and the guard's run-level diagnosis is ordered ahead of first-seen test ids so a mass failure in another lane cannot crowd it past the search and body caps. A closure pin keeps the spawned guard importable in the dependency-free helper lane. Refs #12940 * ci(sdk-java): close the Windows-drive forgery and split the stray-file message The drive-prefix alternative in the module validator re-opened the forgery it closed: backslash and colon are ordinary characters in a POSIX filename, so a migration name could supply a `C:\evil` prefix and pass the path-shape check. No lane that runs this consumer ever produces a backslashed module — the producer and analyze jobs are ubuntu-latest and the suite runs only on the Linux lint_and_static lane — so the branch is dropped, backslashes are rejected outright, and the fixtures hand the guard a slash-bearing argument (a no-op on POSIX) instead of teaching the consumer a shape only a forgery can produce. The unsafe-character half of the validator is now pinned for whitespace, backticks and backslashes across both call sites. A populated location with a migration-shaped stray elsewhere under the source root no longer prints "found no migration under": the guard names the stray as the cause, and the consumer's config identity learns the new phrase, so the standing red still files one issue. The dep-free closure pin now walks the guard's relative-import closure instead of a hardcoded depth-one list, so a new hop carrying an npm import cannot slip through. Refs #12940 * ci(sdk-java): re-record the sdk-java.yml size baseline after merging main The rebase onto 51b80dadbc folded #12945's Hosted latency steps into the workflow; the file is 22735 bytes now, and the ratchet requires the number in the same PR. * ci(sdk-java): anchor the flyway dedupe identity to runner-emitted lines Sandboxed verification found the module-shape validator closing the filename door but not the directory one: the guard prints file paths, so a LF inside a directory component leaves the forged text after a real `/` — slash-bearing and past the shape. The runner timestamps every line it writes, and a decoded annotation continuation carries none, so both flyway arms now accept their line only when it came from the runner itself. The shape validation stays as the second layer for every other channel, and its inline fixtures are timestamped so they still reach it. The Surefire arm's matching exposure is pre-existing — the vitest and pytest patterns share it — and is left to a follow-up. Refs #12940 * ci(sdk-java): close the forgery family at the guard's emission sites The third Critical in the family, and the round that ends it. The guard interpolates contributor-controlled path bytes into ::error:: command data, and the runner percent-decodes that data where the consumer parses — so percent-escaping control bytes was never enough: a directory name carries the LF, the slash and every pattern byte the decoded continuation needs. No charset rule over the consumer's module shape can close that — the forged module is shape-indistinguishable — and double-escaping regresses the genuine LF arm into the suppression arm. What closes every measured arm is bounding the emitted alphabet at the four emission sites: nothing outside a migration path's real characters reaches the command data, so no decode pass can restore pattern text from it. The suppression arm needs no newline at all and no runner behaviour: spaces on the timestamped line run the duplicate-version arm's lazy module capture all the way to the payload, the shape rejects it, and an unconditional continue used to discard the line's genuine config identity with it — the duplicate storm this change exists to end, from the opposite direction. The flyway arm now falls through to the config arm when its capture is rejected. The stray-file test's path assertion is separator-agnostic, per the round-6 review's note that the suite must pass on the Windows lane. Refs #12940 * ci(sdk-java): re-record the sdk-java.yml size baseline after merging main The merge folded #13083's workflow growth into the file (23,524 bytes now); the ratchet asks for the number in the same PR. --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-02 06:49:12 +00:00
jinye	bb8afc3356	feat(java): Add managed runtime state foundation (#12301) ... * feat(java): add managed runtime state foundation Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(java): strengthen runtime broker state coverage Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * build(java): Require JDK 25 for runtime broker Set the new runtime broker module's release target to Java 25 and run its CI checks only on Java 25 across Linux, macOS, and Windows. Preserve the existing SDK compatibility matrix and align the bilingual documentation. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * build(java): Use JDK 21 for runtime broker Set the new runtime broker module's compilation and runtime baseline to Java 21. Reuse the existing Java 21 matrix across Linux, macOS, and Windows while preserving the SDK's Java 11 compatibility coverage. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>	2026-09-21 07:09:40 +00:00
易良	38fae41ddc	fix(release): stop one flaky test from failing a stable release (#10842) ... * test: wait for state instead of fixed timing in three flaky tests Release run 33633468180 failed with all three workspace test shards red, each for an unrelated reason, and all three are timing assumptions that only hold on an idle machine. The message list pagination test polled a fixed budget of 32 animation frames before asserting a load had fired. A frame count does not stretch when the host is loaded and the queued effect lands late, so poll against a wall-clock deadline instead. The scroll-restore test in the same file asserted the restored offset exactly one frame after the load resolved, and now waits for the restore to land. The hook process test read the descendant's pid file the moment the hook returned, but the hook is killed by its own 300ms timeout, which can fire before the descendant has started far enough to write that file. Poll for it the way every other pid read in that file already does. The session PR refresh teardown removed its temp tree with a plain recursive delete. dispose() stops the next tick but does not await the sweep already in flight, so a sweep can still be writing under the tree while teardown walks it, and the delete fails with ENOTEMPTY when a file lands between the readdir and the rmdir. Retry so cleanup waits the writer out. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * fix(release): retry a flaky workspace test instead of failing the release A stable release ran its workspace tests with no retry at all, while nightly and preview retried twice. With ~30k tests behind that gate, any single flaky one reddened the release outright: six consecutive stable runs failed on one test each while build, typecheck, lint, scripts and both integration suites stayed green, and the same test passed on the next attempt. Retry every release schedule, behind a repository variable so the count can be retuned or switched off without a PR. A real break still fails all three attempts; what this stops is a contended runner deciding whether a release ships. Widen the timing bounds the process-tree hook tests impose on themselves. Every test in that file spawns real `node --import=tsx/esm` processes and then waits on a hard wall-clock deadline — 5s for startup, 3-4s for reaping. Process startup is not something a smarter wait can speed up, so on a shared runner those deadlines report host load rather than hook behaviour. Size them for the busiest host; a genuine hang still fails, only later, and the passing path is unchanged at 24s for the file. Assert the recall scan latency against the fastest of its samples rather than the median. Three release shards land on one machine, so a wall-clock median moves with the neighbours' load: it measured 131ms against a 50ms ceiling on a run whose every other gate passed. The fastest sample is the one least contaminated by contention and the closest available estimate of the intrinsic cost, and the shared lane gets a ceiling only a real regression can cross. The printed table now carries best, median and worst so the detail survives. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * fix(acp): keep a failing late-drain recovery from ending the process The mid-turn drain recovery is fired and forgotten with a bare `void`. Its own comment says it "bounds the wait and swallows a late rejection", but it only swallows a rejection of the drain promise: anything that throws after that race escapes as an unhandled rejection, and Node ends the process on one. The debug logger is among the things that can throw there, so a logging failure could take a session down — from a path whose entire purpose is best-effort recovery. This is also what made a release shard red while reporting no failing test. The throw lands on a later tick, so on a loaded host it arrives after the test that installed it has finished: Vitest attributes it to no test, counts it as an error, and exits non-zero with every one of the 8147 tests passed. A test retry cannot help, because nothing failed. Swallow silently rather than log, since the logger is itself one of the things that can throw here. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * fix(release): let the surviving-hook test's descendant outlive the deadline The previous commit polled for the descendant's pid file after the hook returned. That could not help the case it targeted: the hook's 300ms timeout has the supervisor SIGTERM then SIGKILL the whole process group, and the descendant is in that group, so by the time executeHook resolves the file either already exists or never will. On a host where node takes longer than 300ms to start, the poll only moved the same failure 30s later. Raise the hook deadline instead, so the descendant is alive to write its pid before the group is reaped; the poll stays as a harmless guard against filesystem visibility. Give the release retry an honest off switch. `vars.X || '2'` could not disable the retry safely: an empty variable falls back to the default, and '0' passes --retry=0, which outranks a workspace's own config-level retry — the very thing the comment said to avoid. 'off' now omits the flag, and the contract test pins it alongside the stale schedule wording it replaces. Say what the shared-lane latency bound actually checks. A 3x ceiling still read as a budget check while letting a 2.5x regression through. Make it an order-of-magnitude guard and label it as such; the budget itself is asserted off shared runners. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * fix(deps): update vulnerable production packages Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * chore(vscode-ide-companion): regenerate NOTICES.txt for bumped deps The dependency bump in this PR (fast-uri 3.1.5->3.1.7, qs 6.15.2->6.16.0, side-channel 1.1.0->1.1.1) left NOTICES.txt stale, failing the CI notices freshness gate. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-conflict/jmtkdz88hdi * test(release): align widened waits with per-test budgets and lane-aware deadlines - hook-runner.process.test.ts: raise the 'reaps an active %s hook tree on parent %s' (15s) and 'lets %s write output and finish' (10s) per-test budgets to 90s, matching every sibling — the widened 30s/15s inner waits can never complete inside the stale budgets on oversubscribed ECS runners. - recall-scan-latency.test.ts: the row tuple gained a 'best' column, so the strict bound silently asserted best-of-5; assert the median off shared runners and keep the loose best-of-5 bound on shared ECS lanes. - MessageList.dom.test.tsx: make FLUSH_DEADLINE_MS lane-aware (10s on ecs-qwen- runners, 4s elsewhere) so it stays inside vitest's 5s default testTimeout off the ECS lanes that grant 60s. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmtklu5f5dz * docs(test): correct two comments that now describe the opposite of the code The retry test's retained comment still said the stable path must omit the flag rather than zero it. That was true before this PR and is false after it: every schedule now retries by default, and only the operator sentinel omits the flag. The pinning test three lines down asserts exactly that, so the comment told the next reader the opposite of what the file checks — and a future edit justified by it would revert the fix. The process-test header claimed every test spawns `node --import=tsx/esm`. Four of eleven blocks do; four spawn plain node over `node:` builtins and three spawn nothing. The header carries the deadline-sizing rationale, so the claim invites applying a seconds-scale tsx startup model to processes that pay tens of milliseconds. Say which fixtures pay it, and that the budgets are generous rather than tight for the rest. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * test(ci): give the autofix workflow suite headroom over host contention `upserts deferred findings into a per-PR issue that survives the merge` scans the whole rendered workflow repeatedly and measures ~14s idle against the suite's 30s default. On a contended release runner it exhausted that budget in two consecutive Release runs, failing Quality Checks (Scripts) as the only red file out of 76. Claude-Session: https://claude.ai/code/session_01MCE9CXnMVrX4fUxHpQoUr8 * test(cli): pin the late drain recovery guard against unhandled rejections The `.catch(() => {})` on `#recoverLateDrain` had no committed regression test: removing it kept the drain suite green while anything thrown after the drain race — the debug logger among them — escaped as an unhandled rejection. The new test drives a real prompt through a mid-turn drain timeout, faults the module-graph logger exactly on the recovery's debug line, and asserts zero escaped rejections. Mutation-verified: deleting the guard turns it red. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(core): size the surviving-hook timeout fixture for loaded startup 'enforces a surviving hook timeout after the parent exits' configured its fixture deadline at 300ms, but the supervisor's clock starts at hook spawn, so on loaded hosts the group was killed before the hook wrote its ready/pid files; the driver's busy-wait then never broke and the test burned its 90s vitest budget instead of exercising the reap assertions. Use HOOK_GROUP_TIMEOUT_MS, the way the byte-similar group test was converted. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): isolate Maven config per SDK Java job Concurrent self-hosted runner instances share HOME, so deleting or updating ~/.m2/toolchains.xml races with Maven startup in neighboring jobs. Point setup-java at the per-runner temp directory and make every Maven invocation consume those job-local settings and toolchains files. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(serve): wait for the shared session/list waiter before cutting a connection The release gate went red on this test for the first time on run 33701581941: `session/list scan alive when one connection is destroyed` failed with `-32603` instead of the empty session list, twice in a row. `PersistedSessionListCache` aborts an in-flight scan the moment its waiter count reaches zero, and a request only becomes a waiter once it reaches `lookup()`. The test posted both requests, waited for the loader, and then deleted the first connection — which proves the *first* request attached but says nothing about the second. On a loaded runner the second can still be resolving params when the DELETE lands, so the count drops to zero, the shared scan is aborted, its promise rejects, and the second request answers out of that rejection as an internal error. Watch `lookup()` for the single-flight join so the DELETE can never land before the second waiter is attached. The waiter count is bumped synchronously inside `lookup()`, so observing the `single_flight` status is exactly the "second waiter attached" edge the test needs — and it holds whichever of the two requests wins the race to start the scan. The cache's own unit test already covers the invariant deterministically ("cancels one waiter without aborting the shared load"), so this is a test-side race only; no production behavior changes. Claude-Session: https://claude.ai/code/session_012797rgiteWJxLT9TLkKq8G * test(serve): skip an interface that vanished mid-suite instead of failing on it `isOwnInterfaceAddress` re-reads `networkInterfaces()` on every call, while the suite snapshots the host's addresses once at collection. A shared CI host adds and drops veth interfaces continuously, so an address captured at collection can be gone minutes later when a case asserts on it — the function then correctly answers false and the case fails on a host that changed rather than on the lost normalisation it exists to guard. That is what reddened Workspace Tests (2/3) of release run 33676423730: `strips an RFC 6874 zone identifier before matching` and `matches an own address case-insensitively` — the two cases that run last here — failed `expected false to be true`, while the bare and bracketed cases that run before them passed on the same addresses. Intersect the collection snapshot with a fresh read per case. The fresh read comes from `node:os`, not from the function under test, so no case can confirm itself, and the vacuity guard stays: the loopback never churns, so the intersection never runs empty. Claude-Session: https://claude.ai/code/session_012797rgiteWJxLT9TLkKq8G --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: yiliang114 <jinjing.zzj@gmail.com> Co-authored-by: yiliang114 <yiliang114@users.noreply.github.com>	2026-09-03 03:39:37 +00:00
易良	3aa1b14624	ci: stabilize tests under shared ECS host contention (#10552) ... * ci: tolerate shared runner scheduling delays Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): inherit ECS contention budgets Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(cli): extend PTY request budget on ECS Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(cli): synchronize ACP archive race Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): isolate visuals publisher fixture modules Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): cover hostile parent package scopes Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(sdk-java): isolate finite SSE fixture connections Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(cli): make timer-range deadline deterministic Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(sdk-java): tolerate shared CI scheduling delays Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(sdk-java): preserve timeout contract on CI Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(sdk-java): include request submission in timeout bound Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci: extend no-AK shared runner timeout Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): guard no-AK integration budget Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci(sdk-java): serialize ECS test execution Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(sdk-java): relax stalled-response setup on CI Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): align no-AK timeout contract Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci: extend Serve A/B shared runner budget Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci: scope extended ceilings to ECS routing The extended job ceilings (test 60->90, integration_no_ak 30->60) were unconditional even though runs-on falls back to GitHub-hosted ubuntu-latest for fork PRs from untrusted authors and when MAINTAINER_ECS_RUNNER_DISABLED=true. Derive each ceiling from the runner classify_pr selected so hosted paths keep the pre-contention bound and a genuine hang there does not burn the extra 30 minutes. The lane contract now evaluates the real timeout expression for both routings instead of pinning a bare number, matching the substitute-then-evaluate technique ci-runner-routing.test.mjs uses on runs-on. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): address closeout review feedback Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-08-30 14:38:54 +00:00
Shaojin Wen	06cc41ee3f	ci: route trusted-author fork PRs and no-checkout jobs to the ECS pool (#8502) ... * ci: route trusted-author fork PRs and no-checkout jobs to the ECS pool Fork PRs whose author has write access (OWNER/MEMBER/COLLABORATOR association) now run Linux CI on the self-hosted ECS pool instead of the saturated GitHub-hosted quota, and bot workflows that check out no code move to ECS unconditionally. Everything stays gated on the MAINTAINER_ECS_RUNNER_DISABLED kill-switch. * ci: address review — real write-permission routing, watchdog independence, timeouts Route the triage agent on the collaborator-permission API result computed by authorize instead of the coarse author_association, which admits org members and read-only collaborators; the two permission-gate jobs revert to the same-repo guard. Keep the fleet watchdog and the CI-failure reporter hosted so they stay independent of the pool they watch. Add missing timeouts, wipe serve-ab's reused workspace, and pin the routing logic with drift and negative-case tests. --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-08-04 03:48:24 +00:00
易良	fddcda86ed	ci: reduce SDK Java runner queueing (#8441) ... * ci: cancel stale SDK Java pull request runs * fix(ci): preserve SDK Java push scheduling * ci: route trusted SDK Java jobs to ECS * ci: simplify SDK Java runner routing * fix(ci): provision Maven on ECS Java jobs * fix(ci): clean SDK daemon ECS test state * fix(ci): satisfy SDK Java lint	2026-08-03 16:21:05 +00:00