root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Address PR review feedback (#1453)

Browse Source 
- boot-smoke: shutdown verdict now requires SIGTERM actually delivered and a
  clean exit (code 0 or SIGTERM); EADDRINUSE port race retries with a fresh
  port (3 attempts)
- test-changed: rename shouldForceFullSuite -> isSharedInfraChange (it routes
  to gate mode, not full); run the changed-mode gate under the isolation guard
- workflows: least-privilege permissions (contents: read) on pr-checks and
  full-suite
This commit is contained in:
gsxdsm
2026-06-05 13:58:34 -07:00
parent 20153a3ef3
commit 5aa6cad168
6 changed files with 106 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.github/workflows/full-suite.yml vendored
View File

@@ -20,6 +20,11 @@ concurrency:
group: full-suite-${{ github.sha }}
cancel-in-progress: false
# Least-privilege token: jobs only read the repo (checkout + cache) and upload
# workflow artifacts (timings), which needs no extra permission scope.
permissions:
contents: read
# FN-4863: Opt JavaScript actions into Node 24 ahead of GitHub's forced cutover on 2026-06-02.
env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

4
.github/workflows/pr-checks.yml vendored
View File

@@ -21,6 +21,10 @@ concurrency:
group: pr-checks-${{ github.ref }}
cancel-in-progress: true
# Least-privilege token: every job here only reads the repo (checkout + cache).
permissions:
contents: read
# FN-4863: Opt JavaScript actions into Node 24 ahead of GitHub's forced cutover on 2026-06-02.
env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

8
packages/cli/src/__tests__/root-test-command.test.ts
View File

@@ -3,7 +3,7 @@ import {
decideExecutionPlan,
normalizeForwardedArgs,
resolveAffectedPackages,
shouldForceFullSuite,
isSharedInfraChange,
} from "../../../../scripts/test-changed.mjs";
import { computeSplitPlan, parseShardArgs, planShardAssignments, selectShardPackages } from "../../../../scripts/ci-test-shard.mjs";
@@ -52,9 +52,9 @@ describe("root test command changed-only planning", () => {
});
it("marks root workflow/config changes as shared-infra (gate-mode) triggers", () => {
expect(shouldForceFullSuite([".github/workflows/pr-checks.yml"])).toBe(true);
expect(shouldForceFullSuite(["package.json"])).toBe(true);
expect(shouldForceFullSuite(["packages/core/src/store.ts"])).toBe(false);
expect(isSharedInfraChange([".github/workflows/pr-checks.yml"])).toBe(true);
expect(isSharedInfraChange(["package.json"])).toBe(true);
expect(isSharedInfraChange(["packages/core/src/store.ts"])).toBe(false);
});
it("strips forwarded silent flags so package vitest scripts do not receive duplicates", () => {

58
scripts/__tests__/test-changed.test.mjs
View File

@@ -10,7 +10,7 @@ import assert from "node:assert/strict";
import {
buildPackageDirByName,
buildReverseDependencyMap,
shouldForceFullSuite,
isSharedInfraChange,
resolveAffectedPackages,
decideExecutionPlan,
computePackageHash,
@@ -101,72 +101,72 @@ function hashWithFakeGit(pkgDir, blobSha) {
}
// ---------------------------------------------------------------------------
// shouldForceFullSuite
// isSharedInfraChange
// ---------------------------------------------------------------------------
test("shouldForceFullSuite: returns false for pure package changes", () => {
test("isSharedInfraChange: returns false for pure package changes", () => {
assert.equal(
shouldForceFullSuite(["packages/engine/src/foo.ts", "packages/core/src/bar.ts"]),
isSharedInfraChange(["packages/engine/src/foo.ts", "packages/core/src/bar.ts"]),
false,
);
});
test("shouldForceFullSuite: returns true when pnpm-lock.yaml changed", () => {
assert.equal(shouldForceFullSuite(["pnpm-lock.yaml"]), true);
test("isSharedInfraChange: returns true when pnpm-lock.yaml changed", () => {
assert.equal(isSharedInfraChange(["pnpm-lock.yaml"]), true);
});
test("shouldForceFullSuite: returns true when scripts/test-changed.mjs changed", () => {
assert.equal(shouldForceFullSuite(["scripts/test-changed.mjs"]), true);
test("isSharedInfraChange: returns true when scripts/test-changed.mjs changed", () => {
assert.equal(isSharedInfraChange(["scripts/test-changed.mjs"]), true);
});
test("shouldForceFullSuite: returns true when scripts/check-test-isolation.mjs changed", () => {
assert.equal(shouldForceFullSuite(["scripts/check-test-isolation.mjs"]), true);
test("isSharedInfraChange: returns true when scripts/check-test-isolation.mjs changed", () => {
assert.equal(isSharedInfraChange(["scripts/check-test-isolation.mjs"]), true);
});
test("shouldForceFullSuite: returns true when a GitHub workflow changed", () => {
assert.equal(shouldForceFullSuite([".github/workflows/pr-checks.yml"]), true);
test("isSharedInfraChange: returns true when a GitHub workflow changed", () => {
assert.equal(isSharedInfraChange([".github/workflows/pr-checks.yml"]), true);
});
test("shouldForceFullSuite: returns false for .changeset/*.md summary files", () => {
assert.equal(shouldForceFullSuite([".changeset/fn-5157-test-changed-allowlist.md"]), false);
test("isSharedInfraChange: returns false for .changeset/*.md summary files", () => {
assert.equal(isSharedInfraChange([".changeset/fn-5157-test-changed-allowlist.md"]), false);
});
test("shouldForceFullSuite: still returns true for .changeset/config.json", () => {
assert.equal(shouldForceFullSuite([".changeset/config.json"]), true);
test("isSharedInfraChange: still returns true for .changeset/config.json", () => {
assert.equal(isSharedInfraChange([".changeset/config.json"]), true);
});
test("shouldForceFullSuite: returns false for allowlisted root markdown files", () => {
test("isSharedInfraChange: returns false for allowlisted root markdown files", () => {
for (const file of ["AGENTS.md", "README.md", "CHANGELOG.md", "CONTRIBUTING.md", "SECURITY.md"]) {
assert.equal(shouldForceFullSuite([file]), false, `${file} should stay on changed-only mode`);
assert.equal(isSharedInfraChange([file]), false, `${file} should stay on changed-only mode`);
}
});
test("shouldForceFullSuite: returns false for .fusion artifacts", () => {
assert.equal(shouldForceFullSuite([".fusion/memory/MEMORY.md"]), false);
assert.equal(shouldForceFullSuite([".fusion/tasks/FN-5157/PROMPT.md"]), false);
test("isSharedInfraChange: returns false for .fusion artifacts", () => {
assert.equal(isSharedInfraChange([".fusion/memory/MEMORY.md"]), false);
assert.equal(isSharedInfraChange([".fusion/tasks/FN-5157/PROMPT.md"]), false);
});
test("shouldForceFullSuite: still returns true for root config edges", () => {
test("isSharedInfraChange: still returns true for root config edges", () => {
for (const file of ["tsconfig.json", ".npmrc", "Dockerfile"]) {
assert.equal(shouldForceFullSuite([file]), true, `${file} should still force the full suite`);
assert.equal(isSharedInfraChange([file]), true, `${file} should still force the full suite`);
}
});
test("shouldForceFullSuite: mixed diff with only allowlisted root paths returns false", () => {
test("isSharedInfraChange: mixed diff with only allowlisted root paths returns false", () => {
assert.equal(
shouldForceFullSuite(["AGENTS.md", ".changeset/foo.md", ".fusion/tasks/FN-5154/task.json"]),
isSharedInfraChange(["AGENTS.md", ".changeset/foo.md", ".fusion/tasks/FN-5154/task.json"]),
false,
);
});
test("shouldForceFullSuite: mixed diff with allowlisted root path plus explicit trigger returns true", () => {
assert.equal(shouldForceFullSuite(["AGENTS.md", "pnpm-lock.yaml"]), true);
test("isSharedInfraChange: mixed diff with allowlisted root path plus explicit trigger returns true", () => {
assert.equal(isSharedInfraChange(["AGENTS.md", "pnpm-lock.yaml"]), true);
});
test("shouldForceFullSuite: FN-5157 reproduction keeps FN-5154 diff in changed-only mode", () => {
test("isSharedInfraChange: FN-5157 reproduction keeps FN-5154 diff in changed-only mode", () => {
// FN-5157: AGENTS.md + changeset summaries previously tripped the root catch-all and forced a full suite for the FN-5154 diff.
assert.equal(
shouldForceFullSuite([
isSharedInfraChange([
"AGENTS.md",
".changeset/FN-5136-quick-entry-submit-lock.md",
".changeset/FN-5141-soft-delete-terminology.md",

72
scripts/boot-smoke.mjs
View File

@@ -40,6 +40,9 @@ const cliBin = path.join(repoRoot, "packages/cli/bin.mjs");
const HEALTH_TIMEOUT_MS = 60_000;
const SHUTDOWN_TIMEOUT_MS = 15_000;
// Ephemeral-port TOCTOU: retry the whole boot with a fresh port when the
// child loses the bind race (EADDRINUSE).
const BOOT_ATTEMPTS = 3;
function parsePortList(raw) {
return String(raw ?? "")
@@ -110,6 +113,36 @@ async function main() {
console.log("boot-smoke: `fn --help` OK");
// 2. Real server boot on an ephemeral port with an isolated HOME.
// The ephemeral-port probe is inherently TOCTOU (probe closes before the
// server binds), so an EADDRINUSE loss on a busy machine retries with a
// fresh port instead of failing the gate.
let cleanup = () => {};
process.on("exit", () => cleanup());
// Node does NOT fire 'exit' on signals by default. A cancelled CI job
// (timeout, manual cancel, runner eviction) sends SIGTERM — without these
// handlers the serve child would be orphaned.
for (const sig of ["SIGTERM", "SIGINT"]) {
process.on(sig, () => {
cleanup();
process.exit(sig === "SIGINT" ? 130 : 143);
});
}
for (let attempt = 1; attempt <= BOOT_ATTEMPTS; attempt++) {
const result = await bootAndVerify(attempt, (fn) => (cleanup = fn));
if (result === "retry-port") continue;
console.log("boot-smoke: PASS");
return;
}
fail(`could not bind a server port after ${BOOT_ATTEMPTS} attempts (EADDRINUSE each time)`);
}
/**
* One boot attempt: spawn, poll health, verify SIGTERM shutdown.
* Returns "retry-port" when the child lost the ephemeral-port race
* (EADDRINUSE); calls fail() (which exits) on any real failure.
*/
async function bootAndVerify(attempt, registerCleanup) {
const port = await getEphemeralPort();
const isolatedHome = mkdtempSync(path.join(tmpdir(), "fusion-boot-smoke-"));
let stderrBuf = "";
@@ -132,7 +165,7 @@ async function main() {
child.stderr.on("data", (d) => (stderrBuf += d));
child.stdout.on("data", (d) => (stderrBuf += d));
const cleanup = () => {
registerCleanup(() => {
// 'exit' handlers cannot await: escalate straight to SIGKILL so a child
// that ignores SIGTERM is never orphaned holding the port/tmpdir. The
// graceful SIGTERM path below runs before this on the success path.
@@ -142,17 +175,7 @@ async function main() {
// ESRCH: child already reaped between the check and the kill — fine.
}
rmSync(isolatedHome, { recursive: true, force: true });
};
process.on("exit", cleanup);
// Node does NOT fire 'exit' on signals by default. A cancelled CI job
// (timeout, manual cancel, runner eviction) sends SIGTERM — without these
// handlers the serve child would be orphaned.
for (const sig of ["SIGTERM", "SIGINT"]) {
process.on(sig, () => {
cleanup();
process.exit(sig === "SIGINT" ? 130 : 143);
});
}
});
const exitedEarly = new Promise((resolve) => {
child.once("exit", (code, signal) => resolve({ code, signal }));
@@ -166,16 +189,25 @@ async function main() {
}),
]);
} catch (err) {
if (/EADDRINUSE/.test(stderrBuf) && attempt < BOOT_ATTEMPTS) {
console.log(`boot-smoke: port :${port} lost to another process (EADDRINUSE), retrying with a fresh port (attempt ${attempt}/${BOOT_ATTEMPTS})`);
await exitedEarly; // child is already dead or dying; wait so cleanup is race-free
rmSync(isolatedHome, { recursive: true, force: true });
return "retry-port";
}
fail(err.message, stderrBuf);
}
console.log(`boot-smoke: GET /api/health 200 on :${port}`);
// 3. Clean shutdown of OUR child only.
// 3. Clean shutdown of OUR child only. The verdict requires BOTH that
// SIGTERM was actually delivered (a server that died between the health
// check and here is a failure, not a pass) AND that the exit was clean
// (SIGTERM or exit code 0) — a crash after serving is a broken boot path.
let sigtermSent = false;
try {
child.kill("SIGTERM");
sigtermSent = child.kill("SIGTERM");
} catch {
// ESRCH: server exited between the health check and the kill — the
// exitedEarly promise below already carries its exit code.
// ESRCH: server already exited — sigtermSent stays false and fails below.
}
const { code, signal } = await Promise.race([
exitedEarly,
@@ -183,12 +215,18 @@ async function main() {
setTimeout(() => resolve({ code: null, signal: "timeout" }), SHUTDOWN_TIMEOUT_MS),
),
]);
if (!sigtermSent) {
fail(`server exited on its own after the health check (${code ?? `signal ${signal}`}) — SIGTERM shutdown could not be verified`, stderrBuf);
}
if (signal === "timeout") {
child.kill("SIGKILL");
fail("server did not shut down within 15s of SIGTERM", stderrBuf);
}
if (signal !== "SIGTERM" && code !== 0) {
fail(`server exited uncleanly on SIGTERM (${code ?? `signal ${signal}`})`, stderrBuf);
}
console.log(`boot-smoke: clean shutdown (${code ?? signal})`);
console.log("boot-smoke: PASS");
return "ok";
}
main().catch((err) => fail(err.message ?? String(err)));

14
scripts/test-changed.mjs
View File

@@ -113,7 +113,7 @@ const HASH_VERSION_PREFIX = "v2";
* alone would miss those, so we fold the tree in globally — the simplest
* provably-correct choice (mirrors the tsconfig.base.json treatment).
*
* NOTE: this list intentionally overlaps `shouldForceFullSuite`'s
* NOTE: this list intentionally overlaps `isSharedInfraChange`'s
* `fullSuitePaths` (which decides full-suite mode, a different axis than cache
* busting). When adding a new shared root config input, consider both lists.
*/
@@ -428,12 +428,13 @@ function isTestIrrelevantRootPath(file) {
return ["README", "CHANGELOG.md", "LICENSE", "LICENSE.md"].includes(file);
}
export function shouldForceFullSuite(changedFiles) {
export function isSharedInfraChange(changedFiles) {
// NOTE: overlaps SHARED_HASH_INPUT_PATHS by intent (different axis: this list
// signals shared-infra changes; that one busts every package's cache hash).
// When adding a new shared root config input, consider both lists.
//
// HISTORY: this signal used to escalate `pnpm test` to an implicit full
// HISTORY: previously named `shouldForceFullSuite` — this signal used to
// escalate `pnpm test` to an implicit full
// recursive run — which was the local OOM path (two concurrent heavy
// packages, 6GB dashboard heaps). Since the merge-gate redesign
// (docs/plans/2026-06-04-001-refactor-fast-trusted-test-gate-plan.md) it
@@ -1026,7 +1027,7 @@ export function decideExecutionPlan({
if (!comparisonBase) return { mode: "gate", reason: "missing-comparison-base" };
if (!changedFiles) return { mode: "gate", reason: "diff-failed" };
if (changedFiles.length === 0) return { mode: "gate", reason: "no-changes" };
if (shouldForceFullSuite(changedFiles)) return { mode: "gate", reason: "shared-infra-changed" };
if (isSharedInfraChange(changedFiles)) return { mode: "gate", reason: "shared-infra-changed" };
const affectedPackages = resolveAffectedPackages(changedFiles, packageNameByDir);
if (!affectedPackages || affectedPackages.length === 0) return { mode: "gate", reason: "no-affected-package" };
@@ -1234,7 +1235,10 @@ export function main(argv = process.argv.slice(2)) {
// affected expansion preserves changed-code coverage. Overlap (engine in the
// affected set re-runs the engine-core files) is accepted by design.
console.log("[test-changed] running merge-gate suite (pnpm test:gate) before affected packages.");
run("pnpm", ["test:gate"], { env: isolatedHomeEnv });
// Run the gate under the same isolation guard as the affected set — a gate
// suite leak must trip the checker, not silently become the "before" state
// of the later run.
runMaybeIsolated("pnpm", ["test:gate"], { env: isolatedHomeEnv });
const filterArgs = activePackages.flatMap((pkg) => ["--filter", pkg]);
console.log(`[test-changed] running tests for changed packages: ${activePackages.join(", ")}`);