8 commits

Author	SHA1	Message	Date
qwen-code-dev-bot	f3642d4e45	fix(ci): sweep stale pool residue before sdk-java checkouts (#13506) (#13507) ... A main-push SDK Java run failed its 'ubuntu-latest / Java 21' leg in the Checkout step before any test ran (run 37423974280). The leg runs on the shared self-hosted ECS pool, whose reused workspace accumulates residue from earlier jobs: ci.yml's incident history records review/autofix leftovers (.qwen, .qwen.root-orig, review worktrees and branches) failing actions/checkout's clean, and a runner-user-owned tree failing every later git call with 'detected dubious ownership' (#12648). sdk-java.yml's pool-routed jobs carried only the bare ownership restore, without the two countermeasures ci.yml grew for exactly these failures. Port both, byte-identical to the pinned ci.yml copies, to the three pool-routed jobs (test, flyway-migrations, daemon-e2e): the safe.directory trust joins the restore step, and the stale-.qwen sweep (with its quarantine ladder and review worktree/branch cleanup) runs between restore and checkout, gated to self-hosted so the hosted macOS/Windows legs stay untouched. The sdk-java workflow suite pins the restore -> sweep -> checkout order in all three jobs and pins both step bodies byte-identical to ci.yml's, so the copies cannot drift; mutation-probed by stashing the workflow change (all 9 new pins red) and restoring it (green). The size baseline records the copied recipe's growth in the same commit, per the ratchet. Co-authored-by: 易良 <1204183885@qq.com>	2026-10-06 14:36:05 +00:00
易良	d697f98553	fix(ci): raise serve-ab handshake budget, report dead CodeQL nightlies, route trusted PR lanes to ECS (#13270) ... * fix(ci): raise serve-ab handshake budget, report dead CodeQL nightlies, route trusted PR lanes to ECS - serve-ab-drive: pass --initialize-timeout-ms 60000 like the other serve harnesses; the 10s default expired under pool contention and the daemon killed its own ACP child (#13266). - codeql.yml: a report_failure job files or comments on one scope/ci-cd issue when a scheduled scan leg fails or is cancelled by its timeout, which the main-CI notifier never saw (#13249). - tui-parity parity/noflicker, sdk-java flyway-migrations and assign-pr-owner assign use the trusted-PR ECS routing with the ownership restore; tui-parity also gets the self-hosted Node, disk-floor and hosted-only cache split (#13245). * fix(ci): scope the no-flicker report dir per runner on the ECS pool accept-noflicker.sh defaults OUT to a fixed /tmp path; hosted runners are single-tenant, but one ECS host runs many jobs at once.	2026-10-03 13:48:26 +00:00
Shaojin Wen	d5c22d336b	ci(sdk-java): guard Flyway version uniqueness and watch red main runs (#12965) ... * ci(sdk-java): guard Flyway version uniqueness and watch red main runs Two in-flight PRs each added a V16 managed-agent-server migration and merged 23 minutes apart; each branch was green in isolation, and Flyway refused to boot the merged result, leaving main red for two hours while three more merges stacked on it (#12940). A new flyway-migrations job runs scripts/check-flyway-migrations.js on every SDK Java pull request and push: a filename scan of the two migration locations that share one version sequence, failing in seconds and naming both files when two claim one version. Versions compare the way Flyway compares them — numerically per segment — so V016 collides with V16, and a location rename that would empty the guard fails instead of passing vacuously. The main-CI failure watcher now watches the SDK Java workflow, whose path-filtered push run on main is the only signal for a merge result neither PR could fail, and the failure-signature helper reads Surefire's per-test error lines, so a red Java lane files one deduped issue naming the failing tests instead of a per-commit stub. Refs #12940 * ci(sdk-java): harden the Flyway guard and dedupe its main-red issues Review on #12965: - compare versions across every module of one invocation — Flyway resolves classpath:db/migration across jars, so a version claimed in two modules collides exactly like two files in one module - fail when the SQL location yields no migration even if the Java location still does, so renaming one location away can no longer pass vacuously - escape %/CR/LF in module names and file paths before emitting ::error:: (the runner parses workflow commands from stderr too, and the job scans contributor-controlled filenames on pull_request) - match the migration suffix case-insensitively, as Flyway does - keep the fully qualified Surefire id as the dedupe identity so same-named tests in different packages no longer merge into one issue; the cosmetic package strip moves to shortenForTitle - give the guard's ::error:: line a stable flyway:<module>:<version> identity, so a standing red dedupes to one issue instead of one per stacked merge, and render the failed jobs in the test-keyed body - pin the workflow_run watch entry to sdk-java.yml's name key Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci(sdk-java): fix the Flyway dedupe on runner-rendered logs and close review findings The Actions runner consumes ::error:: workflow commands and writes ##[error] into the downloadable job log, so the dedupe pattern anchored on ^::error:: never matched production input and every merge stacked on a standing red would have opened a fresh autofix issue. The anchor now accepts both forms, the guard's two non-collision failure modes (moved migration location, missing module directory) get their own stable module+mode identity, and the synthesized flyway id is written to be read since it doubles as the issue title and body bullet. The issue body's "- Failed jobs:" block is now machine-owned like "## Also failing": stripped and re-emitted from the current run on every merge instead of freezing the lanes recorded at filing time, with the empty-list case pinned against a dangling heading. The guard itself now reports a multi-module collision once after all modules are scanned, naming every claimant (a second line would file a second issue), never prints a clean summary for a claimant, and only requires the SQL location of a module that owns a db/migration* directory — which lets the workflow invocation cover runtime-broker, the module that shares the classpath:db/migration namespace without carrying migrations today. escapeWorkflowCommand moves to scripts/release-script-utils.js (the byte-identical copy would have drifted from the tested original), and the filename-forgery tests gain a runner-decoding oracle and a capability probe so the Windows lane skips instead of failing on filenames Win32 cannot hold. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci(sdk-java): close the guard's blind spots and validate its dedupe captures Review and sandboxed verification on #12965 found the moved-location probe keying on the two exact directory names: a rename outside the migration* family (db/migration -> db/changelog) passed silently with the whole sequence inside it, a renamed Java location printed "all versions unique" from a scan that skipped it, and a Java-only module red-lit as "moved" with its real collision never named. The probe is now derived from the LOCATIONS table: a versioned-migration file anywhere under a source root but outside the configured location fails with the files named, the sibling check is per location and fires only when the location directory itself is gone, and a repeated module argument no longer fabricates a collision of a file with itself. The invocation now names qwencode too — managed-agent-server depends on it at compile scope, the same namespace premise that admitted runtime-broker — and the .size-baseline entry is re-recorded at the file's current size. On the consumer side, both Flyway patterns feed their captures through a module-shape validation before they become a dedupe identity, so a filename-borne forgery rendered by the runner's annotation decode can no longer inject a second identity into the issue this files, and the guard's run-level diagnosis is ordered ahead of first-seen test ids so a mass failure in another lane cannot crowd it past the search and body caps. A closure pin keeps the spawned guard importable in the dependency-free helper lane. Refs #12940 * ci(sdk-java): close the Windows-drive forgery and split the stray-file message The drive-prefix alternative in the module validator re-opened the forgery it closed: backslash and colon are ordinary characters in a POSIX filename, so a migration name could supply a `C:\evil` prefix and pass the path-shape check. No lane that runs this consumer ever produces a backslashed module — the producer and analyze jobs are ubuntu-latest and the suite runs only on the Linux lint_and_static lane — so the branch is dropped, backslashes are rejected outright, and the fixtures hand the guard a slash-bearing argument (a no-op on POSIX) instead of teaching the consumer a shape only a forgery can produce. The unsafe-character half of the validator is now pinned for whitespace, backticks and backslashes across both call sites. A populated location with a migration-shaped stray elsewhere under the source root no longer prints "found no migration under": the guard names the stray as the cause, and the consumer's config identity learns the new phrase, so the standing red still files one issue. The dep-free closure pin now walks the guard's relative-import closure instead of a hardcoded depth-one list, so a new hop carrying an npm import cannot slip through. Refs #12940 * ci(sdk-java): re-record the sdk-java.yml size baseline after merging main The rebase onto 51b80dadbc folded #12945's Hosted latency steps into the workflow; the file is 22735 bytes now, and the ratchet requires the number in the same PR. * ci(sdk-java): anchor the flyway dedupe identity to runner-emitted lines Sandboxed verification found the module-shape validator closing the filename door but not the directory one: the guard prints file paths, so a LF inside a directory component leaves the forged text after a real `/` — slash-bearing and past the shape. The runner timestamps every line it writes, and a decoded annotation continuation carries none, so both flyway arms now accept their line only when it came from the runner itself. The shape validation stays as the second layer for every other channel, and its inline fixtures are timestamped so they still reach it. The Surefire arm's matching exposure is pre-existing — the vitest and pytest patterns share it — and is left to a follow-up. Refs #12940 * ci(sdk-java): close the forgery family at the guard's emission sites The third Critical in the family, and the round that ends it. The guard interpolates contributor-controlled path bytes into ::error:: command data, and the runner percent-decodes that data where the consumer parses — so percent-escaping control bytes was never enough: a directory name carries the LF, the slash and every pattern byte the decoded continuation needs. No charset rule over the consumer's module shape can close that — the forged module is shape-indistinguishable — and double-escaping regresses the genuine LF arm into the suppression arm. What closes every measured arm is bounding the emitted alphabet at the four emission sites: nothing outside a migration path's real characters reaches the command data, so no decode pass can restore pattern text from it. The suppression arm needs no newline at all and no runner behaviour: spaces on the timestamped line run the duplicate-version arm's lazy module capture all the way to the payload, the shape rejects it, and an unconditional continue used to discard the line's genuine config identity with it — the duplicate storm this change exists to end, from the opposite direction. The flyway arm now falls through to the config arm when its capture is rejected. The stray-file test's path assertion is separator-agnostic, per the round-6 review's note that the suite must pass on the Windows lane. Refs #12940 * ci(sdk-java): re-record the sdk-java.yml size baseline after merging main The merge folded #13083's workflow growth into the file (23,524 bytes now); the ratchet asks for the number in the same PR. --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-02 06:49:12 +00:00
jinye	bb8afc3356	feat(java): Add managed runtime state foundation (#12301) ... * feat(java): add managed runtime state foundation Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(java): strengthen runtime broker state coverage Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * build(java): Require JDK 25 for runtime broker Set the new runtime broker module's release target to Java 25 and run its CI checks only on Java 25 across Linux, macOS, and Windows. Preserve the existing SDK compatibility matrix and align the bilingual documentation. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * build(java): Use JDK 21 for runtime broker Set the new runtime broker module's compilation and runtime baseline to Java 21. Reuse the existing Java 21 matrix across Linux, macOS, and Windows while preserving the SDK's Java 11 compatibility coverage. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>	2026-09-21 07:09:40 +00:00
易良	38fae41ddc	fix(release): stop one flaky test from failing a stable release (#10842) ... * test: wait for state instead of fixed timing in three flaky tests Release run 33633468180 failed with all three workspace test shards red, each for an unrelated reason, and all three are timing assumptions that only hold on an idle machine. The message list pagination test polled a fixed budget of 32 animation frames before asserting a load had fired. A frame count does not stretch when the host is loaded and the queued effect lands late, so poll against a wall-clock deadline instead. The scroll-restore test in the same file asserted the restored offset exactly one frame after the load resolved, and now waits for the restore to land. The hook process test read the descendant's pid file the moment the hook returned, but the hook is killed by its own 300ms timeout, which can fire before the descendant has started far enough to write that file. Poll for it the way every other pid read in that file already does. The session PR refresh teardown removed its temp tree with a plain recursive delete. dispose() stops the next tick but does not await the sweep already in flight, so a sweep can still be writing under the tree while teardown walks it, and the delete fails with ENOTEMPTY when a file lands between the readdir and the rmdir. Retry so cleanup waits the writer out. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * fix(release): retry a flaky workspace test instead of failing the release A stable release ran its workspace tests with no retry at all, while nightly and preview retried twice. With ~30k tests behind that gate, any single flaky one reddened the release outright: six consecutive stable runs failed on one test each while build, typecheck, lint, scripts and both integration suites stayed green, and the same test passed on the next attempt. Retry every release schedule, behind a repository variable so the count can be retuned or switched off without a PR. A real break still fails all three attempts; what this stops is a contended runner deciding whether a release ships. Widen the timing bounds the process-tree hook tests impose on themselves. Every test in that file spawns real `node --import=tsx/esm` processes and then waits on a hard wall-clock deadline — 5s for startup, 3-4s for reaping. Process startup is not something a smarter wait can speed up, so on a shared runner those deadlines report host load rather than hook behaviour. Size them for the busiest host; a genuine hang still fails, only later, and the passing path is unchanged at 24s for the file. Assert the recall scan latency against the fastest of its samples rather than the median. Three release shards land on one machine, so a wall-clock median moves with the neighbours' load: it measured 131ms against a 50ms ceiling on a run whose every other gate passed. The fastest sample is the one least contaminated by contention and the closest available estimate of the intrinsic cost, and the shared lane gets a ceiling only a real regression can cross. The printed table now carries best, median and worst so the detail survives. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * fix(acp): keep a failing late-drain recovery from ending the process The mid-turn drain recovery is fired and forgotten with a bare `void`. Its own comment says it "bounds the wait and swallows a late rejection", but it only swallows a rejection of the drain promise: anything that throws after that race escapes as an unhandled rejection, and Node ends the process on one. The debug logger is among the things that can throw there, so a logging failure could take a session down — from a path whose entire purpose is best-effort recovery. This is also what made a release shard red while reporting no failing test. The throw lands on a later tick, so on a loaded host it arrives after the test that installed it has finished: Vitest attributes it to no test, counts it as an error, and exits non-zero with every one of the 8147 tests passed. A test retry cannot help, because nothing failed. Swallow silently rather than log, since the logger is itself one of the things that can throw here. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * fix(release): let the surviving-hook test's descendant outlive the deadline The previous commit polled for the descendant's pid file after the hook returned. That could not help the case it targeted: the hook's 300ms timeout has the supervisor SIGTERM then SIGKILL the whole process group, and the descendant is in that group, so by the time executeHook resolves the file either already exists or never will. On a host where node takes longer than 300ms to start, the poll only moved the same failure 30s later. Raise the hook deadline instead, so the descendant is alive to write its pid before the group is reaped; the poll stays as a harmless guard against filesystem visibility. Give the release retry an honest off switch. `vars.X || '2'` could not disable the retry safely: an empty variable falls back to the default, and '0' passes --retry=0, which outranks a workspace's own config-level retry — the very thing the comment said to avoid. 'off' now omits the flag, and the contract test pins it alongside the stale schedule wording it replaces. Say what the shared-lane latency bound actually checks. A 3x ceiling still read as a budget check while letting a 2.5x regression through. Make it an order-of-magnitude guard and label it as such; the budget itself is asserted off shared runners. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * fix(deps): update vulnerable production packages Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * chore(vscode-ide-companion): regenerate NOTICES.txt for bumped deps The dependency bump in this PR (fast-uri 3.1.5->3.1.7, qs 6.15.2->6.16.0, side-channel 1.1.0->1.1.1) left NOTICES.txt stale, failing the CI notices freshness gate. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-conflict/jmtkdz88hdi * test(release): align widened waits with per-test budgets and lane-aware deadlines - hook-runner.process.test.ts: raise the 'reaps an active %s hook tree on parent %s' (15s) and 'lets %s write output and finish' (10s) per-test budgets to 90s, matching every sibling — the widened 30s/15s inner waits can never complete inside the stale budgets on oversubscribed ECS runners. - recall-scan-latency.test.ts: the row tuple gained a 'best' column, so the strict bound silently asserted best-of-5; assert the median off shared runners and keep the loose best-of-5 bound on shared ECS lanes. - MessageList.dom.test.tsx: make FLUSH_DEADLINE_MS lane-aware (10s on ecs-qwen- runners, 4s elsewhere) so it stays inside vitest's 5s default testTimeout off the ECS lanes that grant 60s. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmtklu5f5dz * docs(test): correct two comments that now describe the opposite of the code The retry test's retained comment still said the stable path must omit the flag rather than zero it. That was true before this PR and is false after it: every schedule now retries by default, and only the operator sentinel omits the flag. The pinning test three lines down asserts exactly that, so the comment told the next reader the opposite of what the file checks — and a future edit justified by it would revert the fix. The process-test header claimed every test spawns `node --import=tsx/esm`. Four of eleven blocks do; four spawn plain node over `node:` builtins and three spawn nothing. The header carries the deadline-sizing rationale, so the claim invites applying a seconds-scale tsx startup model to processes that pay tens of milliseconds. Say which fixtures pay it, and that the budgets are generous rather than tight for the rest. Claude-Session: https://claude.ai/code/session_01AWWgJEqafyAT1Mc75T8N7h * test(ci): give the autofix workflow suite headroom over host contention `upserts deferred findings into a per-PR issue that survives the merge` scans the whole rendered workflow repeatedly and measures ~14s idle against the suite's 30s default. On a contended release runner it exhausted that budget in two consecutive Release runs, failing Quality Checks (Scripts) as the only red file out of 76. Claude-Session: https://claude.ai/code/session_01MCE9CXnMVrX4fUxHpQoUr8 * test(cli): pin the late drain recovery guard against unhandled rejections The `.catch(() => {})` on `#recoverLateDrain` had no committed regression test: removing it kept the drain suite green while anything thrown after the drain race — the debug logger among them — escaped as an unhandled rejection. The new test drives a real prompt through a mid-turn drain timeout, faults the module-graph logger exactly on the recovery's debug line, and asserts zero escaped rejections. Mutation-verified: deleting the guard turns it red. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(core): size the surviving-hook timeout fixture for loaded startup 'enforces a surviving hook timeout after the parent exits' configured its fixture deadline at 300ms, but the supervisor's clock starts at hook spawn, so on loaded hosts the group was killed before the hook wrote its ready/pid files; the driver's busy-wait then never broke and the test burned its 90s vitest budget instead of exercising the reap assertions. Use HOOK_GROUP_TIMEOUT_MS, the way the byte-similar group test was converted. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): isolate Maven config per SDK Java job Concurrent self-hosted runner instances share HOME, so deleting or updating ~/.m2/toolchains.xml races with Maven startup in neighboring jobs. Point setup-java at the per-runner temp directory and make every Maven invocation consume those job-local settings and toolchains files. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(serve): wait for the shared session/list waiter before cutting a connection The release gate went red on this test for the first time on run 33701581941: `session/list scan alive when one connection is destroyed` failed with `-32603` instead of the empty session list, twice in a row. `PersistedSessionListCache` aborts an in-flight scan the moment its waiter count reaches zero, and a request only becomes a waiter once it reaches `lookup()`. The test posted both requests, waited for the loader, and then deleted the first connection — which proves the *first* request attached but says nothing about the second. On a loaded runner the second can still be resolving params when the DELETE lands, so the count drops to zero, the shared scan is aborted, its promise rejects, and the second request answers out of that rejection as an internal error. Watch `lookup()` for the single-flight join so the DELETE can never land before the second waiter is attached. The waiter count is bumped synchronously inside `lookup()`, so observing the `single_flight` status is exactly the "second waiter attached" edge the test needs — and it holds whichever of the two requests wins the race to start the scan. The cache's own unit test already covers the invariant deterministically ("cancels one waiter without aborting the shared load"), so this is a test-side race only; no production behavior changes. Claude-Session: https://claude.ai/code/session_012797rgiteWJxLT9TLkKq8G * test(serve): skip an interface that vanished mid-suite instead of failing on it `isOwnInterfaceAddress` re-reads `networkInterfaces()` on every call, while the suite snapshots the host's addresses once at collection. A shared CI host adds and drops veth interfaces continuously, so an address captured at collection can be gone minutes later when a case asserts on it — the function then correctly answers false and the case fails on a host that changed rather than on the lost normalisation it exists to guard. That is what reddened Workspace Tests (2/3) of release run 33676423730: `strips an RFC 6874 zone identifier before matching` and `matches an own address case-insensitively` — the two cases that run last here — failed `expected false to be true`, while the bare and bracketed cases that run before them passed on the same addresses. Intersect the collection snapshot with a fresh read per case. The fresh read comes from `node:os`, not from the function under test, so no case can confirm itself, and the vacuity guard stays: the loopback never churns, so the intersection never runs empty. Claude-Session: https://claude.ai/code/session_012797rgiteWJxLT9TLkKq8G --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: yiliang114 <jinjing.zzj@gmail.com> Co-authored-by: yiliang114 <yiliang114@users.noreply.github.com>	2026-09-03 03:39:37 +00:00
易良	3aa1b14624	ci: stabilize tests under shared ECS host contention (#10552) ... * ci: tolerate shared runner scheduling delays Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): inherit ECS contention budgets Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(cli): extend PTY request budget on ECS Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(cli): synchronize ACP archive race Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): isolate visuals publisher fixture modules Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): cover hostile parent package scopes Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(sdk-java): isolate finite SSE fixture connections Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(cli): make timer-range deadline deterministic Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(sdk-java): tolerate shared CI scheduling delays Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(sdk-java): preserve timeout contract on CI Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(sdk-java): include request submission in timeout bound Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci: extend no-AK shared runner timeout Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): guard no-AK integration budget Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci(sdk-java): serialize ECS test execution Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(sdk-java): relax stalled-response setup on CI Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): align no-AK timeout contract Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci: extend Serve A/B shared runner budget Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci: scope extended ceilings to ECS routing The extended job ceilings (test 60->90, integration_no_ak 30->60) were unconditional even though runs-on falls back to GitHub-hosted ubuntu-latest for fork PRs from untrusted authors and when MAINTAINER_ECS_RUNNER_DISABLED=true. Derive each ceiling from the runner classify_pr selected so hosted paths keep the pre-contention bound and a genuine hang there does not burn the extra 30 minutes. The lane contract now evaluates the real timeout expression for both routings instead of pinning a bare number, matching the substitute-then-evaluate technique ci-runner-routing.test.mjs uses on runs-on. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): address closeout review feedback Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-08-30 14:38:54 +00:00
Shaojin Wen	06cc41ee3f	ci: route trusted-author fork PRs and no-checkout jobs to the ECS pool (#8502) ... * ci: route trusted-author fork PRs and no-checkout jobs to the ECS pool Fork PRs whose author has write access (OWNER/MEMBER/COLLABORATOR association) now run Linux CI on the self-hosted ECS pool instead of the saturated GitHub-hosted quota, and bot workflows that check out no code move to ECS unconditionally. Everything stays gated on the MAINTAINER_ECS_RUNNER_DISABLED kill-switch. * ci: address review — real write-permission routing, watchdog independence, timeouts Route the triage agent on the collaborator-permission API result computed by authorize instead of the coarse author_association, which admits org members and read-only collaborators; the two permission-gate jobs revert to the same-repo guard. Keep the fleet watchdog and the CI-failure reporter hosted so they stay independent of the pool they watch. Add missing timeouts, wipe serve-ab's reused workspace, and pin the routing logic with drift and negative-case tests. --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-08-04 03:48:24 +00:00
易良	fddcda86ed	ci: reduce SDK Java runner queueing (#8441) ... * ci: cancel stale SDK Java pull request runs * fix(ci): preserve SDK Java push scheduling * ci: route trusted SDK Java jobs to ECS * ci: simplify SDK Java runner routing * fix(ci): provision Maven on ECS Java jobs * fix(ci): clean SDK daemon ECS test state * fix(ci): satisfy SDK Java lint	2026-08-03 16:21:05 +00:00