Skip to content

QVAC-24073 feat[bc]: adopt fabric b10297 consumers and replace no_mmap with load_mode #5018

QVAC-24073 feat[bc]: adopt fabric b10297 consumers and replace no_mmap with load_mode

QVAC-24073 feat[bc]: adopt fabric b10297 consumers and replace no_mmap with load_mode #5018

Workflow file for this run

name: Merge Guard
on:
pull_request_target:
types:
- opened
- synchronize
- reopened
- labeled
- ready_for_review
branches:
- main
workflow_dispatch:
permissions:
contents: read
pull-requests: read
packages: read
concurrency:
# Cancel a superseded in-flight run when a newer event (e.g. a prebuild
# label) arrives for the same PR. This gate only READS prebuild statuses (it
# no longer builds anything), so cancelling an older run is free and closes a
# race: a run started before the label uses a static freshness threshold and
# could otherwise trust a pre-label "skipped = success" while the newer
# labeled build is still running. Killing the older run leaves only the newer
# run, which waits for the real build.
group: pr-gate-merge-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
jobs:
fork-approval:
permissions:
statuses: write
uses: ./.github/workflows/reusable-fork-approval.yml
authorize:
needs: [fork-approval]
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
statuses: read
outputs:
allowed: ${{ steps.auth.outputs.allowed }}
steps:
- name: Checkout authorize-pr (default branch)
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
ref: ${{ github.event.repository.default_branch }}
sparse-checkout: .github/actions/authorize-pr
sparse-checkout-cone-mode: false
persist-credentials: false
- name: Authorize
id: auth
uses: ./.github/actions/authorize-pr
with:
github-token: ${{ github.token }}
changes:
if: github.event_name == 'pull_request_target'
runs-on: ubuntu-latest
outputs:
packages: ${{ steps.pkglist.outputs.packages }}
packages-with-path: ${{ steps.pkglist.outputs.packages-with-path }}
any: ${{ steps.filter.outputs.pkg-any }}
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
fetch-depth: 0
persist-credentials: false
- uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # 4.0.1
id: filter
with:
token: ${{ secrets.GITHUB_TOKEN }}
filters: |
pkg-any:
- "packages/**"
- ".github/workflows/prebuilds-*.yml"
asr-ggml:
- "packages/asr-ggml/**"
- ".github/workflows/prebuilds-asr-ggml.yml"
bci-whispercpp:
- "packages/bci-whispercpp/**"
- ".github/workflows/prebuilds-bci-whispercpp.yml"
classification-ggml:
- "packages/classification-ggml/**"
- ".github/workflows/prebuilds-classification-ggml.yml"
decoder-audio:
- "packages/decoder-audio/**"
diffusion-cpp:
- "packages/diffusion-cpp/**"
- ".github/workflows/prebuilds-diffusion-cpp.yml"
embed-llamacpp:
- "packages/embed-llamacpp/**"
- ".github/workflows/prebuilds-embed-llamacpp.yml"
# Pure-JS/TS package (no prebuilds). Listed so its lint, typecheck,
# declaration and generated-artifact checks run under sanity-checks
# and reach the required qvac-merge-guard status.
infer-base:
- "packages/infer-base/**"
llm-llamacpp:
- "packages/llm-llamacpp/**"
- ".github/workflows/prebuilds-llm-llamacpp.yml"
model-fit:
- "packages/model-fit/**"
- ".github/workflows/prebuilds-model-fit.yml"
ocr-ggml:
- "packages/ocr-ggml/**"
- ".github/workflows/prebuilds-ocr-ggml.yml"
translation-nmtcpp:
- "packages/translation-nmtcpp/**"
- ".github/workflows/prebuilds-translation-nmtcpp.yml"
tts-ggml:
- "packages/tts-ggml/**"
- ".github/workflows/prebuilds-tts-ggml.yml"
fabric:
- "packages/fabric/**"
- ".github/workflows/prebuilds-fabric.yml"
vla:
- "packages/vla-ggml/**"
- ".github/workflows/prebuilds-vla.yml"
# Package dir names mostly match the filter/job key (packages/<key>),
# except vla (packages/vla-ggml) - mapped explicitly here so
# sanity-checks' workdir is always correct. Two outputs: a flat name
# list (intersected with PREBUILD_KEYS in verify-prebuilds) and a
# name+path list (for the sanity-checks matrix's workdir).
- name: Build package lists
id: pkglist
env:
CHANGES: ${{ steps.filter.outputs.changes }}
run: |
CHANGED=$(echo "$CHANGES" | jq -c 'map(select(. != "pkg-any"))')
echo "packages=${CHANGED}" >> "$GITHUB_OUTPUT"
echo "packages-with-path=$(echo "$CHANGED" | jq -c '
map({package: ., path: (if . == "vla" then "packages/vla-ggml" else "packages/" + . end)})
')" >> "$GITHUB_OUTPUT"
sanity-checks:
# Runs per-package (matches how ./.github/actions/sanity-checks is
# already invoked from every on-pr-<pkg>.yml - workdir is a package
# path, there is no root package.json in this monorepo).
# Gate on the concrete package list: a non-addon packages/** change leaves
# packages=[], which would make this matrix zero-run and result='' downstream.
if: needs.authorize.outputs.allowed == 'true' && needs.changes.outputs.packages != '[]' && needs.changes.outputs.packages != ''
needs: [authorize, changes, fork-approval]
strategy:
fail-fast: false
matrix:
include: ${{ fromJSON(needs.changes.outputs.packages-with-path || '[]') }}
runs-on: ubuntu-latest
name: sanity-checks (${{ matrix.package }})
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
fetch-depth: 0
persist-credentials: false
- name: Run Sanity checks
uses: ./.github/actions/sanity-checks
with:
secret-token: ${{ secrets.GITHUB_TOKEN }}
pat-token: ${{ secrets.GITHUB_TOKEN }}
run-integration: ${{ needs.authorize.outputs.allowed == 'true' }}
workdir: ${{ matrix.path }}
# Verifies prebuilds without triggering them. Each prebuild-bearing
# on-pr-<pkg>.yml posts a qvac/prebuild-<pkg> commit status on the PR head SHA
# and stamps its own run URL into the status target_url. A status is trusted
# only when the run that produced it is the on-pr-<pkg> workflow AND was
# triggered at/after this PR event (run.created_at >= pull_request.updated_at).
# That binds the status to a run from the current-or-newer event, so a
# superseded pre-label run's "skipped = success" cannot pass the gate just
# because its timestamp happens to post-date the label. The producing run is
# read by the id embedded in the status, so this never depends on the Actions
# API having listed the newest run for the SHA (no listing-lag window).
verify-prebuilds:
needs: [authorize, changes, fork-approval]
if: needs.authorize.outputs.allowed == 'true'
runs-on: ubuntu-latest
timeout-minutes: 180
permissions:
contents: read
statuses: read
actions: read
steps:
# Trusted base-branch checkout of only the prebuild-status scripts (never
# PR head code), so verification logic is a single, unit-tested source.
- name: Checkout prebuild-status scripts (default branch)
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
ref: ${{ github.event.repository.default_branch }}
sparse-checkout: .github/scripts/prebuild-status
sparse-checkout-cone-mode: false
persist-credentials: false
- name: Verify addon prebuild statuses on the PR head
env:
GH_TOKEN: ${{ github.token }}
REPO: ${{ github.repository }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
CHANGED_PACKAGES: ${{ needs.changes.outputs.packages || '[]' }}
# Freshness threshold: the moment this PR event fired. The run that
# produced a trusted prebuild status must have been triggered at/after
# this (run.created_at >= PR_UPDATED_AT), which rejects statuses from
# runs of an earlier event (e.g. the pre-label opened/synchronize run).
PR_UPDATED_AT: ${{ github.event.pull_request.updated_at }}
run: node .github/scripts/prebuild-status/verify.mjs
# Calls pr-checks-sdk-pod.yml via its workflow_call trigger. No sdk-pod-any
# pre-filter: the called workflow self-detects SDK pod changes and is a fast
# no-op when none changed, so this stays graceful for addon-only / non-SDK PRs.
sdk-pod-checks:
needs: [authorize, fork-approval]
if: needs.authorize.outputs.allowed == 'true'
permissions:
contents: read
packages: read
uses: ./.github/workflows/pr-checks-sdk-pod.yml
qvac-merge-guard:
needs:
[
fork-approval,
authorize,
changes,
sanity-checks,
verify-prebuilds,
sdk-pod-checks,
]
if: |
always() && !cancelled() &&
(needs.changes.result == 'success' || needs.changes.result == 'skipped')
permissions:
contents: read
packages: read
uses: ./.github/workflows/public-pr.yml
with:
# A skipped gated job maps to success ONLY when the PR was actually
# authorized. Without this, an unapproved fork (fork-approval failed,
# authorize skipped, or authorize returned allowed=false) would skip
# sanity-checks / verify-prebuilds / sdk-pod-checks and their
# skipped=success would green the required check. Require the full
# authorization chain up front so those skips fail closed instead.
sanity-checks-status: ${{ needs.fork-approval.result == 'success' && needs.authorize.result == 'success' && needs.authorize.outputs.allowed == 'true' && (needs.sanity-checks.result == 'success' || needs.sanity-checks.result == 'skipped') }}
build-status: ${{ needs.fork-approval.result == 'success' && needs.authorize.result == 'success' && needs.authorize.outputs.allowed == 'true' && (needs.verify-prebuilds.result == 'success' || needs.verify-prebuilds.result == 'skipped') }}
general-checks-status: ${{ needs.fork-approval.result == 'success' && needs.authorize.result == 'success' && needs.authorize.outputs.allowed == 'true' && (needs.sdk-pod-checks.result == 'success' || needs.sdk-pod-checks.result == 'skipped') }}