Repository navigation
Conversation
v0.0.38 extends the agent's shutdown window (TimeoutStopSec=30s, --shutdown-grace 20s) so buffered logs and the summary reach the collector before the runner VM is destroyed. Without it short jobs lose their sensor output silently, and both jobs running the sensor finish in about two minutes — `syntax` and `types` are exactly the case the fix describes. The bundled agent goes 0.0.43 -> 0.0.45. Still pinned by commit SHA, which fixes the agent version along with the action: the explicit `cicd-sensor-version` input this seemed to call for would add nothing. Also corrects the bug-report template, which suggested a 0.9.0 health payload as the version placeholder. That directory was missed by the documentation audit before the 1.0.0 tag — the sweep covered .md files and comments under backend/app, not .github.
Four changes, one job: make the tooling see what actually ships. Renamed backend/requirements.lock to requirements-lock.txt. GitHub's dependency graph was reading requirements.txt and not the lock, so Dependabot alerts covered 21 floor-pinned packages while the image installs 73 exact ones. This was measured, not suspected: fastapi and ansible-core appear in the repository SBOM, anyio and attrs — which exist only in the lock — do not, and none of the 25 Python entries carried a version at all, because >= pins have none to record. `requirements*.txt` is the pattern the graph recognises, so the rename is the cheap experiment. Whether the filename was the actual cause becomes visible in the SBOM once this lands; if the transitive packages still do not appear, the answer is submitting them from CI through the dependency submission API. The file was moved, not regenerated — every pin and hash is byte-identical, and the image still builds under --require-hashes. Added .github/dependabot.yml for GitHub Actions. Pinning actions by SHA is correct and also means none of them can move on their own; the 1.0.0 release warned that six still target the Node 20 runtime. Monthly and grouped into a single pull request, because a bot a solo maintainer starts ignoring is worse than no bot. pip is excluded on purpose, with the reason in the file. Put cicd-sensor in the two jobs that lacked it. `syntax` is cheap to cover. `publish` holds DOCKERHUB_TOKEN and contents:write and produces the image users pull, so the job most worth watching was the one not watched — which contradicted the commit that introduced the sensor, since that one said it was for jobs holding release secrets. Coverage there is partial by nature: the sensor observes the runner, not the buildkit containers the image is built inside. It also adds a third-party step to the release path, which is a real cost accepted knowingly.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits. Nothing here changes how the application behaves — it changes what
the tooling around it can see.
The measurable one
backend/requirements.lockbecomesbackend/requirements-lock.txt.GitHub's dependency graph was reading
requirements.txtand not the lock, soDependabot alerts covered 21 floor-pinned packages while the image installs 73
exact ones. Measured before changing anything:
fastapiandansible-coreappear in the repository SBOM;
anyioandattrs, which exist only in the lock,do not. None of the 25 Python entries carried a version at all —
>=pins havenone to record.
requirements*.txtis the pattern the graph recognises, which makes the rename acheap experiment with a visible outcome. The graph analyses the default branch,
so merging this is what runs the test. The SBOM currently reports 25 pypi
packages; if the rename is the answer it should climb toward the lock's 73, and
anyioshould be among them. If it does not, the fallback is submittingdependencies from CI through the dependency submission API, and that will be a
separate change.
The file was moved, not regenerated: every pin and hash is byte-identical, and
the image still builds under
--require-hashes.The rest
.github/dependabot.ymlfor GitHub Actions. Every action is SHA-pinned,which is correct and also means none can move on its own — the 1.0.0 release
warned that six still target the Node 20 runtime. Monthly, grouped into one
PR. pip is excluded on purpose, with the reason written in the file.
syntax, andpublishinrelease.yml. The latter holdsDOCKERHUB_TOKENandcontents: writeandbuilds the image users pull, so the job most worth watching was the unwatched
one; that also contradicted the commit which introduced the sensor "for jobs
that install third-party deps or hold release secrets". Coverage there is
partial: the sensor observes the runner, not the buildkit containers. It also
adds a third-party step to the release path — a real cost, accepted knowingly.
log loss on short jobs;
syntaxandtypesboth finish in about two minutes.0.9.0health payload.Verification
844 tests, coverage 82.35% against a floor of 82, mypy clean, both workflows
parse, and the image rebuilds from the renamed lock with the same 73 packages.