perf(cf06): parallelize deterministic oracle validation - #17
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan includes up to 3 reviews per rolling hour; 1 remains after this review. 📝 WalkthroughWalkthroughThe Oracle workflow replaces the adapter job, adds changed-profile validation with verified HL7 R4 context, pins action revisions, disables persisted checkout credentials, and adds an aggregation job that requires both validation jobs to succeed. ChangesOracle CI validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to This PR only reorganizes the existing validation workflow and adds a fail-closed aggregation job; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
PR Summary by QodoParallelize CF-06 oracle validation with a fail-closed proof gate
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
Greptile SummaryThe PR parallelizes CF-06 oracle validation into two independent suites and adds a fail-closed aggregation job.
Confidence Score: 4/5The PR appears safe to merge from a functional perspective, with only a non-blocking documentation mismatch concerning the renamed and parallelized job topology. Both validation jobs recreate their required state independently and the proof job rejects every non-success dependency result; the remaining issue is that CF-06 convergence documentation still specifies the removed single-job structure. Files Needing Attention: .github/workflows/cf06-oracle.yml and specs/006-cf-06-hl7-oracle-divergence/convergence.md
|
| Filename | Overview |
|---|---|
| .github/workflows/cf06-oracle.yml | Splits the serial oracle job into two self-contained parallel jobs and a fail-closed proof gate; implementation is coherent, but the documented workflow topology is now stale. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[Workflow trigger] --> B[oracle-self-smoke]
A --> C[oracle-changed-profile]
B --> D[oracle-proof]
C --> D
D -->|Both results are success| E[CF-06 validation passes]
D -->|Either result is non-success| F[CF-06 validation fails closed]
Reviews (1): Last reviewed commit: "perf(cf06): parallelize deterministic or..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| oracle-self-smoke: | ||
| name: oracle-self-smoke |
There was a problem hiding this comment.
Replacing the documented single oracle-adapter job with oracle-self-smoke, oracle-changed-profile, and oracle-proof leaves the CF-06 convergence document describing a nonexistent job and outdated final workflow structure, which can mislead maintainers validating the intended CI topology.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Code Review by Qodo
1. ubuntu-latest runner is mutable
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
|
|
||
| oracle-changed-profile: | ||
| name: oracle-changed-profile | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
1. ubuntu-latest runner is mutable 📘 Rule violation § Compliance
The newly added validation jobs select ubuntu-latest, allowing their runner environment to change without a repository change. This makes the production validation DAG dependent on a mutable infrastructure identifier.
Agent Prompt
## Issue description
The newly added jobs use the mutable `ubuntu-latest` runner label.
## Issue Context
Compliance rule 2717380 requires production infrastructure definitions to use immutable, fully specified image or artifact identifiers. Select a fixed runner image version or an immutable self-hosted runner image reference for both new jobs.
## Fix Focus Areas
- .github/workflows/cf06-oracle.yml[97-97]
- .github/workflows/cf06-oracle.yml[280-280]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 | ||
| with: | ||
| distribution: temurin | ||
| java-version: '17' |
There was a problem hiding this comment.
2. java-version is not exact 📘 Rule violation § Compliance
The new changed-profile job requests only Java major version 17, allowing different JDK patch and build versions to be installed over time. This leaves a package dependency in the production validation environment unpinned.
Agent Prompt
## Issue description
The new job configures `actions/setup-java` with the floating major version `17` rather than an exact JDK patch and build.
## Issue Context
Compliance rule 2717380 requires package versions in production infrastructure definitions to be fully specified. Configure the Temurin installation with an exact supported JDK version and build identifier.
## Fix Focus Areas
- .github/workflows/cf06-oracle.yml[102-105]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| oracle-self-smoke: | ||
| name: oracle-self-smoke |
There was a problem hiding this comment.
3. Workflow contract remains stale 🐞 Bug ⚙ Maintainability
The workflow renames oracle-adapter and splits its validation into three jobs, but the CF-06 convergence contract still says the final workflow contains only the oracle-adapter job. This leaves reviewers and operators with an incorrect description of the required validation checks.
Agent Prompt
## Issue description
Update the CF-06 convergence documentation so it describes the new parallel validation DAG rather than claiming the workflow contains only `oracle-adapter`.
## Issue Context
The workflow now consists of `oracle-self-smoke`, `oracle-changed-profile`, and the fail-closed `oracle-proof` aggregate job. Preserve the documentation's distinction between oracle-specific validation and general mainline CI.
## Fix Focus Areas
- specs/006-cf-06-hl7-oracle-divergence/convergence.md[51-51]
- .github/workflows/cf06-oracle.yml[13-14]
- .github/workflows/cf06-oracle.yml[95-96]
- .github/workflows/cf06-oracle.yml[274-289]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
CF-06 runtime-hardening post-merge closeoutStatus:
No post-merge No Rust semantics, Java oracle semantics, fixtures, corpus, Cargo dependencies, schemas, or HL7 pin changed. CF-12 is not started. Final classification: |
1 participant
Summary
Parallelize the existing CF-06 oracle validation workflow across two independent GitHub-hosted jobs while preserving every existing assertion and failure-path check. A final fail-closed enforcement job requires both validation suites to succeed.
Production DAG
oracle-self-smokeoracle-changed-profileoracle-proofalways()and fails unless both validation suites concludedsuccessSemantic boundary
No Rust, Java oracle, fixture, package-resolution, corpus, Cargo dependency, schema, or HL7 pin changes are included. Existing semantic assertions are copied unchanged into their corresponding suite. The production HL7 oracle identity remains release
6.10.2at source commitd06577dbc5c62c74a2a8823fbc4830a3024d5b0b.Supply-chain hardening
The touched workflow now pins
actions/checkout,actions/setup-java, anddtolnay/rust-toolchainto immutable commit SHAs matching the versions already proven by the H0 harness.H0 provenance
H0 experimental run
32067554329completed three successful exact-head attempts on1d15fe0aa0724f18f75ca56c06576983e0fce462. The replicated benchmark reduced wall time from the 5792-second serial baseline to 2998s, 2942s, and 2863s (48.239%–50.570% improvement under the measured hosted-runner conditions). This PR does not claim that production CI will reproduce that exact speedup; exact-head production workflow timing is still required.Validation status
.github/workflows/cf06-oracle.ymlThis PR must remain Draft. Do not merge without explicit founder authorization.
Summary by cubic
Parallelizes CF‑06 oracle validation by replacing the previous single serial workflow with two parallel jobs and a fail‑closed gate. Old behavior: one job ran all validations. New behavior:
oracle-self-smokeandoracle-changed-profilerun independently, andoracle-prooffails unless both succeed; all assertions and failure paths are unchanged.Review notes
.github/workflows/cf06-oracle.ymlchanged; no Rust/Java, fixture, package-resolution, corpus, schema, or HL7 pin changes. The HL7 oracle identity remains 6.10.2.oracle-proofjob that runsalways()and enforces success of both validation suites.actions/checkout,actions/setup-java, anddtolnay/rust-toolchainto immutable SHAs for supply‑chain hardening. H0 experiments observed ~48–51% faster wall time; production CI timing may vary.Written for commit 098f644. Summary will update on new commits.
Summary by CodeRabbit