Skip to content

perf(cf06): parallelize deterministic oracle validation #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheHalfMoon merged 1 commit into from
Aug 18, 2026
Merged

perf(cf06): parallelize deterministic oracle validation #17

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 44 additions & 4 deletions .github/workflows/cf06-oracle.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,15 +10,18 @@ permissions:
contents: read

jobs:
oracle-adapter:
oracle-self-smoke:
name: oracle-self-smoke
Comment on lines +13 to +14

@greptile-apps greptile-apps Bot Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Workflow topology documentation is stale

Replacing the documented single oracle-adapter job with oracle-self-smoke, oracle-changed-profile, and oracle-proof leaves the CF-06 convergence document describing a nonexistent job and outdated final workflow structure, which can mislead maintainers validating the intended CI topology.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Comment on lines +13 to +14

@qodo-code-review qodo-code-review Bot Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

3. Workflow contract remains stale 🐞 Bug ⚙ Maintainability

The workflow renames oracle-adapter and splits its validation into three jobs, but the CF-06
convergence contract still says the final workflow contains only the oracle-adapter job. This
leaves reviewers and operators with an incorrect description of the required validation checks.
Agent Prompt 
## Issue description
Update the CF-06 convergence documentation so it describes the new parallel validation DAG rather than claiming the workflow contains only `oracle-adapter`.

## Issue Context
The workflow now consists of `oracle-self-smoke`, `oracle-changed-profile`, and the fail-closed `oracle-proof` aggregate job. Preserve the documentation's distinction between oracle-specific validation and general mainline CI.

## Fix Focus Areas
- specs/006-cf-06-hl7-oracle-divergence/convergence.md[51-51]
- .github/workflows/cf06-oracle.yml[13-14]
- .github/workflows/cf06-oracle.yml[95-96]
- .github/workflows/cf06-oracle.yml[274-289]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v5.7.0
- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 / Node 24
with:
persist-credentials: false
- uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
distribution: temurin
java-version: '17'
- uses: dtolnay/rust-toolchain@1.97.1
- uses: dtolnay/rust-toolchain@032958afbdc797a9164d3bc0b56325c1308924a5 # 1.97.1
- name: Build pinned HL7 oracle adapter
run: mvn -B -ntp -f tools/hl7-oracle/pom.xml package
- name: Resolve pinned real R4 oracle context
Expand Down Expand Up @@ -88,6 +91,26 @@ jobs:
assert report['structural_diff']['changes'] == []
assert report['resources'] == []
PY

oracle-changed-profile:
name: oracle-changed-profile
runs-on: ubuntu-latest

@qodo-code-review qodo-code-review Bot Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. ubuntu-latest runner is mutable 📘 Rule violation § Compliance

The newly added validation jobs select ubuntu-latest, allowing their runner environment to change
without a repository change. This makes the production validation DAG dependent on a mutable
infrastructure identifier.
Agent Prompt 
## Issue description
The newly added jobs use the mutable `ubuntu-latest` runner label.

## Issue Context
Compliance rule 2717380 requires production infrastructure definitions to use immutable, fully specified image or artifact identifiers. Select a fixed runner image version or an immutable self-hosted runner image reference for both new jobs.

## Fix Focus Areas
- .github/workflows/cf06-oracle.yml[97-97]
- .github/workflows/cf06-oracle.yml[280-280]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

steps:
- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 / Node 24
with:
persist-credentials: false
- uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
distribution: temurin
java-version: '17'
Comment on lines +102 to +105

@qodo-code-review qodo-code-review Bot Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

2. java-version is not exact 📘 Rule violation § Compliance

The new changed-profile job requests only Java major version 17, allowing different JDK patch and
build versions to be installed over time. This leaves a package dependency in the production
validation environment unpinned.
Agent Prompt 
## Issue description
The new job configures `actions/setup-java` with the floating major version `17` rather than an exact JDK patch and build.

## Issue Context
Compliance rule 2717380 requires package versions in production infrastructure definitions to be fully specified. Configure the Temurin installation with an exact supported JDK version and build identifier.

## Fix Focus Areas
- .github/workflows/cf06-oracle.yml[102-105]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

- uses: dtolnay/rust-toolchain@032958afbdc797a9164d3bc0b56325c1308924a5 # 1.97.1
- name: Build pinned HL7 oracle adapter
run: mvn -B -ntp -f tools/hl7-oracle/pom.xml package
- name: Resolve pinned real R4 oracle context
run: |
rm -rf /tmp/commandf-oracle-smoke
cargo run --locked --quiet -p commandf -- pkg resolve hl7.fhir.r4.core@4.0.1 --cache /tmp/commandf-oracle-smoke/cache --lock /tmp/commandf-oracle-smoke/commandf.lock
cargo run --locked --quiet -p commandf -- pkg verify --cache /tmp/commandf-oracle-smoke/cache --lock /tmp/commandf-oracle-smoke/commandf.lock
- name: Build deterministic changed-profile oracle fixtures
run: |
ARCHIVE="$(python - <<'PY'
Expand Down Expand Up @@ -247,3 +270,20 @@ jobs:
fields = {change.get('field') for change in report['structural_diff']['changes']}
assert {'min', 'type', 'binding', 'mustSupport'} <= fields
PY

oracle-proof:
name: oracle-proof
if: always()
needs:
- oracle-self-smoke
- oracle-changed-profile
runs-on: ubuntu-latest
steps:
- name: Enforce all CF-06 oracle validation suites
env:
SELF_SMOKE_RESULT: ${{ needs.oracle-self-smoke.result }}
CHANGED_PROFILE_RESULT: ${{ needs.oracle-changed-profile.result }}
run: |
set -euo pipefail
test "$SELF_SMOKE_RESULT" = success
test "$CHANGED_PROFILE_RESULT" = success
Loading