zooqueenandhanzo-dev
4802e6a021
ff-main asked only "is LOCAL an ancestor of REMOTE" and called every other answer DIVERGED -- so the forge simply being AHEAD of GitHub took the loud-failure path. That is the normal state after every native push, and the push-mirror is sync_on_commit with an 8h floor, so one commit can produce up to 48 false alarms ten minutes apart. The cost is not the noise. A job that is always red cannot report the one thing it exists to report, and this job exists to refuse to force-push a real divergence. The loud failure is only worth keeping if it is rare. Convergence, not invention: app, git, hanzo.ai, iam and now id already carry exactly this two-direction check. This repo held the stale copy. Exercised against real git ancestry -- equal and github-ahead unchanged, native-ahead DIVERGED(1) -> native-ahead(0), and true divergence still exits 1. One row moves; the alarm survives. Co-authored-by: Hanzo Dev <dev@hanzo.ai>
84 lines
4.2 KiB
YAML
84 lines
4.2 KiB
YAML
name: Sync from GitHub
|
|
# git.hanzo.ai is CANONICAL and builds natively; development also lands on
|
|
# github.com/hanzoai/python-sdk. Together with the push-mirror going the other way
|
|
# (native -> GitHub, sync_on_commit) this is the full bidirectional loop.
|
|
#
|
|
# The two compose rather than fight: a native commit reaches GitHub via the
|
|
# push-mirror, so this job then sees LOCAL == REMOTE and exits "in sync". A
|
|
# GitHub commit fast-forwards native here, and the resulting push-mirror is a
|
|
# no-op because GitHub already has it. No echo, no loop.
|
|
#
|
|
# ONE deterministic direction per job: an in-cluster PULL. The runner reaches
|
|
# both ends (GitHub outbound, this forge via the instance URL actions/checkout
|
|
# already uses), so the sync has no ingress dependency.
|
|
#
|
|
# Fast-forward ONLY. A divergence fails LOUDLY here rather than force-pushing
|
|
# either side and destroying whichever history lost the race.
|
|
on:
|
|
schedule:
|
|
- cron: '*/10 * * * *'
|
|
workflow_dispatch: {}
|
|
concurrency:
|
|
group: sync-from-github
|
|
cancel-in-progress: false
|
|
jobs:
|
|
ff-main:
|
|
runs-on: [hanzo-build-linux-amd64]
|
|
steps:
|
|
- name: Checkout main (full history for the ancestry check)
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: true
|
|
- name: Fast-forward main from github.com/hanzoai/python-sdk
|
|
env:
|
|
GH_PAT: ${{ secrets.GH_PAT }}
|
|
run: |
|
|
set -euo pipefail
|
|
git fetch --quiet "https://x-access-token:${GH_PAT}@github.com/hanzoai/python-sdk.git" main
|
|
LOCAL="$(git rev-parse HEAD)"
|
|
REMOTE="$(git rev-parse FETCH_HEAD)"
|
|
if [ "$LOCAL" = "$REMOTE" ]; then
|
|
echo "in sync at $LOCAL"
|
|
exit 0
|
|
fi
|
|
if git merge-base --is-ancestor "$LOCAL" "$REMOTE"; then
|
|
echo "fast-forwarding $LOCAL -> $REMOTE"
|
|
git push origin "$REMOTE:refs/heads/main"
|
|
# A push made with the workflow token does NOT trigger other workflows
|
|
# (loop prevention), so synced commits would never build. Dispatch it
|
|
# explicitly — a real fast-forward means real commits arrived.
|
|
#
|
|
# It dispatched `deploy.yml`, which this repo does not have and never
|
|
# had: these are libraries, they publish to PyPI and deploy nothing.
|
|
# The forge answered 404 every time, `|| echo ... (non-fatal)` ate it,
|
|
# and the job went green. So every commit synced from GitHub landed
|
|
# here having triggered NOTHING, and the gate this repo declares in
|
|
# hanzo.yml has no runs at all to show for it.
|
|
#
|
|
# Name the workflow that exists, and let a failed dispatch fail the
|
|
# job. A sync that lands commits but cannot start the gate is the
|
|
# exact false green this whole exercise is about.
|
|
curl -fsS --max-time 20 -X POST \
|
|
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
|
|
-H "Content-Type: application/json" \
|
|
"${{ github.server_url }}/v1/repos/${{ github.repository }}/actions/workflows/cicd.yml/dispatches" \
|
|
-d '{"ref":"main"}'
|
|
elif git merge-base --is-ancestor "$REMOTE" "$LOCAL"; then
|
|
# Native is AHEAD of GitHub -- the normal state between a native push
|
|
# and the push-mirror carrying it over, and NOT brief: the mirror is
|
|
# sync_on_commit with an 8h floor, so one commit can sit here for
|
|
# hours. It used to fall into the `else` below, which asked only "is
|
|
# LOCAL an ancestor of REMOTE" and called every other answer a
|
|
# divergence -- up to 48 false DIVERGED failures per commit, ten
|
|
# minutes apart. A job that is always red cannot report the one thing
|
|
# it exists to report. Nothing to pull; never push from here, that is
|
|
# the push-mirror's single direction.
|
|
echo "native is ahead at $LOCAL; GitHub at $REMOTE will follow via the push-mirror"
|
|
exit 0
|
|
else
|
|
echo "DIVERGED: native $LOCAL and GitHub $REMOTE share no ancestry line." >&2
|
|
echo "Resolve by hand; this job will not force-push either side." >&2
|
|
exit 1
|
|
fi
|