Repository navigation
test(wfctl): reuse immutable fixture builds per invocation - #1033
Merged
Merged
Conversation
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reuse identical immutable wfctl test-fixture builds within a single test invocation. Every consumer receives its own exclusive copy; source/toolchain/environment changes, unsupported native inputs, and mutable/generated builds retain the uncached path. Existing cancellation, timeout, error, and teardown contracts remain intact.
The linked-version test checks the real CLI's stderr version and empty stdout separately, preserving diagnostics and the uncached linker build. It now lives in a test-only integration package, with the original child working directory and environment retained. Recursive
go test ./...still executes it.Scope
Task 13,
fix/wfctl-fixture-build-reuse, of the private thirteen-task/thirteen-PR CI-recovery plan. This PR contains exactly seven test files after the explicitly approved integration-test relocation. No application behavior, workflow policy, scanner recipe, dependencies, credentials, skip conditions, or timeout changes. Other plan phases remain separate and incomplete.The latest commit,
7cc10fba, is empty: its source tree is byte-identical to the independently reviewed625225b0. It requests one fresh managed-quality scan identity after the previous Go quality job was canceled without acquiring a runner or executing a step. It is not a test fix or a waiver of any check. No further identity/event retry loop is planned.Verification
7cc10fba: fresh fullgo test -v -race ./... -count=1exit 0; 152 tested root packages, wfctl 453.402s and integration 26.498s, unchanged default 600s; 6 real fixture builds/7 hits/0 bypasses. Existing 52 skips disclosed. Existing native compiler/module caches reused, invocation fixture cache new.7cc10fba: fresh full race exit 0; 152 tested root packages, wfctl 425.045s and integration 25.004s, unchanged default 600s; 5 real fixture builds/8 hits/0 bypasses. Existing 57 skips disclosed. All 15 literal native gates have the expected exits, including root/policytool vet and changed-line lint, policytool tests and trusted scan exit 0. Temporary storage is native Linux tmpfs within the unchanged 6 GiB container limit; existing compiler cache reused, invocation fixtures new. Source is preserved, container exit is 0 without OOM, and the owned container is removed. Earlier failed receipts remain recorded, not passing evidence.7cc10fbanative security scan: approved comparison exit 0; strict comparison exit 1. Scanner/reporter still exit 1, with exactly two previously approved fixture metadata analysis errors, 14 extracted modules/12 without failure diagnostics, and 61 unchanged finding results. The initial comparison launcher omittedgo run; its failed invocation is retained, and only the invocation was corrected against the original unchanged scan receipts. The scanner was not repeated. Hosted comparison is separately required; this is not a clean-security claim.Existing Baseline Boundaries
The unchanged local policy harness still reproduces its recorded missing
EVENT_NAMEfixture bootstrap failure; the pinned external repaired harness passes with event variables unset. This is not permission to ignore other policy or test failures.Exact native and hosted security results must retain the recorded findings and narrowly permitted analysis-error signatures. No global clean-security claim or source-credential exception transfer. Hosted PR checks and immediate successor-main verification remain mandatory.
The pre-relocation head timed out in the hosted Go 1.26.5 race/coverage suite despite passing native Go 1.27.1 runs; that failed receipt is retained. The actual relocated
625225b0subsequently passed the hosted race/coverage suite at wfctl 580.503s, then 503.366s after the same-head reopening, under the unchanged 600s deadline. The reopened CI has all 11 ordinary jobs successful and only the precisely recorded bootstrap-harness failure. Managed quality still never executed at that head. Fresh hosted checks and an actually executed quality scan at7cc10fba, followed by successor-main verification, remain mandatory; no failed-test merge, deadline increase, or test omission is requested.