up

Author: metascroy

.github/workflows/_ci-run-decision.yml

@@ -34,9 +34,11 @@ jobs:
     outputs:
       is-full-run: ${{ steps.compute.outputs.is-full-run }}
     steps:
-      # Full history needed to compute commit depth via `git rev-list --count`.
-      # The depth-based sample (every 4th commit) needs the SHA to be reachable
-      # from the repo root.
+      # Full history needed to compute commit depth via
+      # `git rev-list --first-parent --count`. The --first-parent flag
+      # follows only the linear main-branch history through merge
+      # commits, so the count maps 1:1 to pushes on main regardless of
+      # how many commits were in any merged PR.
       - name: Checkout
         uses: actions/checkout@v4
         with:
@@ -65,17 +67,21 @@ jobs:
               ;;
           esac
 
-          # Depth-based 25% sample on push: every 4th commit (depth from
-          # the repo root, mod 4 == 0). Hard guarantees:
-          #   - Exactly 25% sample rate (no statistical variance).
+          # Depth-based 25% sample on push: every 4th commit on the
+          # linear main-branch history (depth %% 4 == 0). --first-parent
+          # is required — plain `git rev-list --count` would walk all
+          # merge parents, so the count would jump by (1 + PR_size) at
+          # each merge commit and the sample rate would be unpredictable.
+          # Hard guarantees with --first-parent:
+          #   - Exactly 25% of pushes on main are sampled.
           #   - At most 3 non-sampled commits between any two samples.
           # Re-runs of the same commit always have the same outcome.
           if [ "$IS_FULL" = "false" ] && [ "$EVENT_NAME" = "push" ]; then
-            DEPTH=$(git rev-list --count "$SHA")
+            DEPTH=$(git rev-list --first-parent --count "$SHA")
             if [ $((DEPTH % 4)) -eq 0 ]; then
               IS_FULL=true
             fi
-            echo "Depth:       $DEPTH (depth %% 4 = $((DEPTH % 4)))"
+            echo "Depth:       $DEPTH (first-parent; depth %% 4 = $((DEPTH % 4)))"
           fi
 
           echo "Event:       $EVENT_NAME"

.github/workflows/promote-to-viable-strict.yml

@@ -30,6 +30,9 @@ on:
 
 permissions:
   contents: write
+  # Needed to delete the failed `viable-strict-gate` run that the
+  # original push triggered — see the "Delete failed gate runs" step.
+  actions: write
 
 concurrency:
   # One in-flight promotion at a time; safer than racing tag pushes.
@@ -96,3 +99,41 @@ jobs:
           git push origin "$TAG"
 
           echo "::notice::Pushed $TAG. Watch the tag-triggered workflow runs (pull / trunk / viable-strict-gate); once they pass, the next update-viablestrict cron (every 30 min) will advance viable/strict."
+
+      # Defense-in-depth: the push that originally landed this commit
+      # triggered a `viable-strict-gate` run that failed (because the
+      # commit wasn't sampled). The tag push above triggers a NEW run
+      # of the gate workflow that will succeed. Standard PyTorch viable/
+      # strict resolves multiple runs by taking the latest conclusion,
+      # so this is usually fine — but to remove ambiguity (and keep the
+      # commit's HUD row clean), explicitly delete any prior failed/
+      # cancelled gate runs on this SHA.
+      - name: Delete failed viable-strict-gate runs on this SHA
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SHA: ${{ inputs.sha }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          # List all viable-strict-gate runs for the SHA, filter to
+          # those that completed unsuccessfully, and delete each one.
+          # Failures here are non-fatal: the tag push above is the
+          # primary mechanism; this cleanup is best-effort.
+          RUNS=$(gh api "repos/$REPO/actions/runs?head_sha=$SHA&per_page=100" \
+                   --jq '.workflow_runs[]
+                          | select(.name == "viable-strict-gate")
+                          | select(.conclusion == "failure" or .conclusion == "cancelled" or .conclusion == "timed_out")
+                          | .id' 2>/dev/null || true)
+
+          if [ -z "$RUNS" ]; then
+            echo "No prior failed viable-strict-gate runs to clean up."
+            exit 0
+          fi
+
+          while IFS= read -r RUN_ID; do
+            [ -z "$RUN_ID" ] && continue
+            echo "Deleting failed viable-strict-gate run $RUN_ID"
+            gh api -X DELETE "repos/$REPO/actions/runs/$RUN_ID" || \
+              echo "::warning::Failed to delete run $RUN_ID; continuing anyway."
+          done <<< "$RUNS"

.github/workflows/pull.yml

@@ -15,8 +15,10 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # Emits PR diff file list; non-PR events emit '*' so the per-job
-  # `if:` short-circuits via `event_name != 'pull_request'`.
+  # Emits PR diff file list; non-PR events emit '*' (every contains()
+  # check returns true). Gated jobs combine this with run-decision's
+  # is-full-run output: on push, jobs run only if a path matches OR
+  # the commit is a sampled full-run.
   changed-files:
     name: Get changed files
     uses: ./.github/workflows/_get-changed-files.yml

.github/workflows/trunk.yml

@@ -19,8 +19,10 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # Emits PR diff file list; non-PR events emit '*' so the per-job
-  # `if:` short-circuits via `event_name != 'pull_request'`.
+  # Emits PR diff file list; non-PR events emit '*' (every contains()
+  # check returns true). Gated jobs combine this with run-decision's
+  # is-full-run output: on push, jobs run only if a path matches OR
+  # the commit is a sampled full-run.
   changed-files:
     name: Get changed files
     uses: ./.github/workflows/_get-changed-files.yml