|
|
@@ -49,8 +49,8 @@ jobs:
|
|
|
# build-backed consumer tail. The consumer job owns the only Linux build so
|
|
|
# all three jobs enter runner allocation independently.
|
|
|
#
|
|
|
- # FAILOVER: each Linux enterprise job resolves its pool through the
|
|
|
- # DSH_CI_FAILOVER repository variable. Unset (normal), the expressions
|
|
|
+ # FAILOVER (Linux): each Linux enterprise job resolves its pool through the
|
|
|
+ # DSH_CI_FAILOVER_LINUX repository variable. Unset (normal), the expressions
|
|
|
# pick the hosted enterprise pools below. Setting the variable to
|
|
|
# 'selfhosted' (repo Settings → Actions → Variables; writer-manageable
|
|
|
# repository state — not PR-editable, no merge required) retargets all
|
|
|
@@ -58,11 +58,12 @@ jobs:
|
|
|
# vm-backup pool and re-running the failed jobs is the entire switch —
|
|
|
# see .agents/notes/implemented/process/2026-07-26-ci-failover-runbook.md. The
|
|
|
# in-house pool's readiness is re-proven on every master push by the
|
|
|
- # serial-linux-selfhosted standby lane below.
|
|
|
+ # serial-linux-selfhosted standby lane below. The Windows failover switch is
|
|
|
+ # the separate DSH_CI_FAILOVER_WINDOWS variable on the windows-native job below.
|
|
|
node-24:
|
|
|
if: github.event_name == 'pull_request'
|
|
|
runs-on: >-
|
|
|
- ${{ vars.DSH_CI_FAILOVER == 'selfhosted'
|
|
|
+ ${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted'
|
|
|
&& github.event.pull_request.user.login != 'dependabot[bot]'
|
|
|
&& fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
|
|
|
|| 'dsh-ubuntu-24-04-16core' }}
|
|
|
@@ -96,7 +97,7 @@ jobs:
|
|
|
# compression and upload on the paid latency-critical path. Skipped
|
|
|
# under failover — see the coverage lane's identical rationale.
|
|
|
- uses: actions/cache/restore@v4
|
|
|
- if: vars.DSH_CI_FAILOVER != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
|
|
|
+ if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
|
|
|
with:
|
|
|
path: ${{ steps.pnpm-store.outputs.path }}
|
|
|
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
|
|
@@ -114,7 +115,7 @@ jobs:
|
|
|
node-24-coverage:
|
|
|
if: github.event_name == 'pull_request'
|
|
|
runs-on: >-
|
|
|
- ${{ vars.DSH_CI_FAILOVER == 'selfhosted'
|
|
|
+ ${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted'
|
|
|
&& github.event.pull_request.user.login != 'dependabot[bot]'
|
|
|
&& fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
|
|
|
|| 'dsh-ubuntu-24-04-16core' }}
|
|
|
@@ -124,7 +125,7 @@ jobs:
|
|
|
# shares one 64-core VM across six always-on runner instances, so each
|
|
|
# instance may use eight while keeping the worst case at 8 × 6 = 48
|
|
|
# workers; process-bound suites remain isolated in forks.
|
|
|
- DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '6' }}
|
|
|
+ DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '6' }}
|
|
|
DSH_GATE_CONCURRENCY: '3'
|
|
|
steps:
|
|
|
- uses: actions/checkout@v6
|
|
|
@@ -151,7 +152,7 @@ jobs:
|
|
|
# already serves warm installs, while restoring the hosted archive
|
|
|
# would spend ~52 s pulling ~180 MB into that populated store.
|
|
|
- uses: actions/cache/restore@v4
|
|
|
- if: vars.DSH_CI_FAILOVER != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
|
|
|
+ if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
|
|
|
with:
|
|
|
path: ${{ steps.pnpm-store.outputs.path }}
|
|
|
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
|
|
@@ -177,7 +178,7 @@ jobs:
|
|
|
node-24-consumers:
|
|
|
if: github.event_name == 'pull_request'
|
|
|
runs-on: >-
|
|
|
- ${{ vars.DSH_CI_FAILOVER == 'selfhosted'
|
|
|
+ ${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted'
|
|
|
&& github.event.pull_request.user.login != 'dependabot[bot]'
|
|
|
&& fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
|
|
|
|| 'dsh-ubuntu-24-04-16core' }}
|
|
|
@@ -188,7 +189,7 @@ jobs:
|
|
|
DSH_OXLINT_THREADS: '8'
|
|
|
DSH_PUBLINT_CONCURRENCY: '8'
|
|
|
# Failover halves snapshot concurrency for the shared 64-core VM.
|
|
|
- DSH_SNAPSHOT_MAX_CONCURRENCY: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '12' || '32' }}
|
|
|
+ DSH_SNAPSHOT_MAX_CONCURRENCY: ${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '12' || '32' }}
|
|
|
steps:
|
|
|
- uses: actions/checkout@v6
|
|
|
with:
|
|
|
@@ -212,7 +213,7 @@ jobs:
|
|
|
|
|
|
# Skipped under failover — see the coverage lane's identical rationale.
|
|
|
- uses: actions/cache/restore@v4
|
|
|
- if: vars.DSH_CI_FAILOVER != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
|
|
|
+ if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
|
|
|
with:
|
|
|
path: ${{ steps.pnpm-store.outputs.path }}
|
|
|
key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
|
|
@@ -222,7 +223,7 @@ jobs:
|
|
|
# Pull requests restore the cache normally produced by serial-linux on
|
|
|
# master; they do not pay compression and upload on the required path.
|
|
|
- uses: actions/cache/restore@v4
|
|
|
- if: vars.DSH_CI_FAILOVER != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
|
|
|
+ if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
|
|
|
with:
|
|
|
path: ~/.cache/ms-playwright
|
|
|
key: ${{ runner.os }}-playwright-${{ hashFiles('pnpm-lock.yaml') }}
|
|
|
@@ -243,13 +244,13 @@ jobs:
|
|
|
exit "$sandbox_status"
|
|
|
|
|
|
- name: Install Playwright Chromium and hosted dependencies
|
|
|
- if: vars.DSH_CI_FAILOVER != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
|
|
|
+ if: vars.DSH_CI_FAILOVER_LINUX != 'selfhosted' || github.event.pull_request.user.login == 'dependabot[bot]'
|
|
|
run: pnpm --filter @deepseek-ai/dsh-web-frontend exec playwright install --with-deps chromium
|
|
|
|
|
|
# The persistent VM image owns Playwright's Linux system packages; do
|
|
|
# not mutate the shared host with apt on every failover run.
|
|
|
- name: Install Playwright Chromium on the failover VM
|
|
|
- if: vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]'
|
|
|
+ if: vars.DSH_CI_FAILOVER_LINUX == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]'
|
|
|
run: pnpm --filter @deepseek-ai/dsh-web-frontend exec playwright install chromium
|
|
|
|
|
|
- name: Run compatibility, snapshot, and artifact gates
|
|
|
@@ -437,13 +438,16 @@ jobs:
|
|
|
# its own unmasked conclusion but is deliberately absent from
|
|
|
# all-checks-passed.needs, so it never delays or changes that required
|
|
|
# verdict. Under normal operation it runs on the hosted larger runner; under
|
|
|
- # failover (DSH_CI_FAILOVER=selfhosted) it retargets onto the in-house
|
|
|
- # self-hosted Windows pool. Dependabot PRs are excluded from the self-hosted
|
|
|
- # pool and stay queued for the hosted runner — see the failover runbook.
|
|
|
+ # Windows failover (DSH_CI_FAILOVER_WINDOWS=selfhosted) it retargets onto the
|
|
|
+ # in-house self-hosted Windows pool. Dependabot PRs are excluded from the
|
|
|
+ # self-hosted pool and stay queued for the hosted runner — see the failover
|
|
|
+ # runbook. This Windows switch is independent of the Linux
|
|
|
+ # DSH_CI_FAILOVER_LINUX variable that retargets the three required Linux jobs
|
|
|
+ # and the all-checks-passed verdict above.
|
|
|
windows-native:
|
|
|
if: github.event_name == 'pull_request'
|
|
|
runs-on: >-
|
|
|
- ${{ vars.DSH_CI_FAILOVER == 'selfhosted'
|
|
|
+ ${{ vars.DSH_CI_FAILOVER_WINDOWS == 'selfhosted'
|
|
|
&& github.event.pull_request.user.login != 'dependabot[bot]'
|
|
|
&& fromJSON('["self-hosted", "dsh-win-ci", "windows"]')
|
|
|
|| 'dsh-windows-2025-16core' }}
|
|
|
@@ -558,7 +562,7 @@ jobs:
|
|
|
# re-runs the complete unsharded aggregate on the persistent 64-core VM,
|
|
|
# continuously proving that environment can take over a required lane if
|
|
|
# the hosted pools degrade (the switch is then setting the writer-manageable
|
|
|
- # DSH_CI_FAILOVER variable — see the failover runbook, no merge required).
|
|
|
+ # DSH_CI_FAILOVER_LINUX variable — see the failover runbook, no merge required).
|
|
|
# Push-triggered, so this lane always executes the base branch's own
|
|
|
# workflow definition. (Under failover, pull_request jobs do reach these
|
|
|
# runners with the PR merge ref's workflow — the boundary there is
|
|
|
@@ -644,11 +648,11 @@ jobs:
|
|
|
# move re-runs the complete unsharded Windows gate inventory on the persistent
|
|
|
# VM, continuously proving that environment can take over the required
|
|
|
# `windows` lane if the hosted pool degrades (the switch is setting the
|
|
|
- # writer-manageable DSH_CI_FAILOVER variable — see the failover runbook, no
|
|
|
- # merge required). Push-triggered, so this lane always executes the base
|
|
|
- # branch's own workflow definition. Non-blocking for pull requests; absent
|
|
|
- # from all-checks-passed.needs by design — the required `windows` job owns
|
|
|
- # the PR verdict. No cache steps because the VM's persistent pnpm store
|
|
|
+ # writer-manageable DSH_CI_FAILOVER_WINDOWS variable — see the failover
|
|
|
+ # runbook, no merge required). Push-triggered, so this lane always executes
|
|
|
+ # the base branch's own workflow definition. Non-blocking for pull requests;
|
|
|
+ # absent from all-checks-passed.needs by design — the required `windows` job
|
|
|
+ # owns the PR verdict. No cache steps because the VM's persistent pnpm store
|
|
|
# and tool caches make them redundant (and saving here would poison the
|
|
|
# hosted cache namespace with self-hosted paths).
|
|
|
serial-windows:
|
|
|
@@ -911,11 +915,13 @@ jobs:
|
|
|
all-checks-passed:
|
|
|
name: all checks passed
|
|
|
# This bookkeeping-only verdict must not depend on custom-pool
|
|
|
- # provisioning — and under failover it follows the same selector as the
|
|
|
- # worker jobs it aggregates, so a standard-hosted outage cannot strand
|
|
|
- # the branch-protection verdict either.
|
|
|
+ # provisioning — and under Linux failover it follows the same selector as
|
|
|
+ # the worker jobs it aggregates, so a standard-hosted outage cannot strand
|
|
|
+ # the branch-protection verdict either. It retargets with the Linux switch
|
|
|
+ # (DSH_CI_FAILOVER_LINUX), not the Windows one, because it aggregates the
|
|
|
+ # required Linux workers and runs on the vm-backup pool.
|
|
|
runs-on: >-
|
|
|
- ${{ vars.DSH_CI_FAILOVER == 'selfhosted'
|
|
|
+ ${{ vars.DSH_CI_FAILOVER_LINUX == 'selfhosted'
|
|
|
&& github.event.pull_request.user.login != 'dependabot[bot]'
|
|
|
&& fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
|
|
|
|| 'ubuntu-latest' }}
|
Chinesezjc