fix(ci): bazel-remote-gates → shared-cache-backed (unbreak all PR gates)#227
Merged
Conversation
The GF exchange stopped granting executor tokens to this repo's PR refs (and the consumer registry now records substrate_mode=shared-cache-backed, latch remote_processes=0), so the gates lane's hard executor requirement has structurally redded every PR since ~07-10 while main stayed green. Request cache-write on trusted main pushes, cache-read on PR refs, strip the executor attachment for mode/endpoint agreement, and skip cache uploads under read-only tokens.
Owner
Author
|
The cache-read mint fix is confirmed: token exchange and attachment passed on this PR. The next red is deterministic local-execution fallout, not the token policy: Tectonic inherited read-only |
…he); align cv e2e with TeX-source scrub
The executor image shipped /bin/chromium; the local lane has no browser. Install playwright's chromium (with system deps) when no system browser exists, cache it, and pass the resolved path through --test_env instead of hardcoding the executor path in .bazelrc.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Restores a truthful, green gates lane for every PR. Three coupled fixes (each alone leaves gates red somewhere):
ci.yml,bazel-cache-backed.sh): the GF exchange denies executor tokens offrefs/heads/main, and this repo's GF consumer-registry entry issubstrate_mode: shared-cache-backed(latchremote_processes: 0) — so the lane now requestscache-writeon trusted main pushes,cache-readon PR refs (proven live on this PR:token minted: mode=cache-read), stripsBAZEL_REMOTE_EXECUTOR*, and skips cache uploads under read-only tokens.MODULE.bazel+ lock): 0.1.0's tectonic actions hard-fail in the local sandbox (Read-only file system, os error 30) — they only ever passed on GF executors. 0.2.1 (released + registry-promoted today: rules_tectonic v0.2.1, bazel-registry feat(pulse): add client identity stubs #100) stages an action-private writable cache/HOME.e2e/cv.spec.ts): main has carried 2 genuinely failing assertions since 81655ce scrubbed the private spear-resumes "View TeX Source" link; the specs now assert the link stays scrubbed (count 0).Unblocks #216, #217, #224, #225, #226. Merge on genuine green only.