feat(stovepipe)!: key the record stage on the request id - #468
Merged
Conversation
This was referenced Jul 29, 2026
behinddwalls
force-pushed
the
preetam/stovepipe-record-request-id
branch
from
July 29, 2026 22:41
96413b8 to
c524a8a
Compare
behinddwalls
marked this pull request as ready for review
July 29, 2026 23:09
behinddwalls
force-pushed
the
preetam/stovepipe-record-request-id
branch
from
July 30, 2026 07:51
c524a8a to
1879181
Compare
mnoah1
approved these changes
Jul 30, 2026
behinddwalls
force-pushed
the
preetam/stovepipe-record-request-id
branch
from
July 30, 2026 18:20
1879181 to
4199281
Compare
github-merge-queue
Bot
removed this pull request from the merge queue because the pull requests in the stack were not ordered correctly in the queue
Jul 30, 2026
behinddwalls
force-pushed
the
preetam/stovepipe-record-request-id
branch
from
July 30, 2026 18:31
4199281 to
a228944
Compare
behinddwalls
force-pushed
the
preetam/stovepipe-record-request-id
branch
from
July 30, 2026 19:57
a228944 to
c9730e3
Compare
behinddwalls
force-pushed
the
preetam/stovepipe-record-request-id
branch
from
July 30, 2026 20:09
c9730e3 to
a8ad1d3
Compare
## Summary ### Why? `buildsignal` published the *build* id to `record`, but `record`'s unit of work is a Request: it writes whole-repo greenness for the Request's URI, advances the Queue's last-green bookmark, and fires Hooks. Keying its input on a build artifact forces every future reader to navigate Build→Request, and it bakes a one-build-per-Request assumption into the wire contract. The assumption is also the wrong one to encode. The concurrency knob gates how many *Requests* are in flight per Queue — same base, different head, one build each — so the fan-out axis is Queue→N Requests, not Request→N Builds. And if a Request ever did fan out, a build-keyed input would give `record` N messages with no way to tell "one build failed" from "one failed and three haven't reported yet". A request-keyed input lets `record` answer its own question. ### What? `Record.id` now carries the request id, and `publishRecord` uses it for the payload, the message id, and the partition key. The field name stays `id`, matching `ProcessRequest.id` and `BuildRequest.id`. Partitioning is unchanged — it was already request id — so the only wire change is what the payload means. No reverse index is needed to make this work: the previous commit projects the build's terminal status onto `Request.State`, so `record` reads the Request and never reaches a `Build`. That also leaves the "no reverse index from Request to its builds" property in `build.md` intact, for a better reason than before, and the derived-build-key alternative explicitly untriggered — its condition is a stage that must derive a build's key from a Request, which `record` no longer does. Marked `!` because the `record` topic's payload semantics change. Nothing consumes it yet — the `record` stage lands later — so there is no migration. ## Test Plan ✅ `bazel test //stovepipe/...` — new unit test pins that the record payload, message id, and partition key are all the request id. ✅ `bazel test //test/e2e/stovepipe/...` — the slow-build case now additionally asserts the request reaches `succeeded` and the queue's `in_flight_count` returns to 0. # Conflicts: # stovepipe/controller/buildsignal/buildsignal_test.go # Please enter the commit message for your changes. Lines starting # with '#' will be kept; you may remove them yourself if you want to. # An empty message aborts the commit. # # interactive rebase in progress; onto b1937b43 # Last command done (1 command done): # pick d3e6221a feat(stovepipe)!: key the record stage on the request id # No commands remaining. # You are currently rebasing branch 'preetam/stovepipe-record-request-id' on 'b1937b43'. # # Changes to be committed: # modified: doc/rfc/stovepipe/steps/build.md # modified: doc/rfc/stovepipe/steps/buildsignal.md # modified: doc/rfc/stovepipe/workflow.md # modified: stovepipe/controller/buildsignal/buildsignal.go # modified: stovepipe/controller/buildsignal/buildsignal_test.go # modified: stovepipe/core/messagequeue/proto/record.proto # modified: stovepipe/core/messagequeue/protopb/record.pb.go # modified: stovepipe/core/messagequeue/topics.go # modified: test/e2e/stovepipe/harness_test.go # modified: test/e2e/stovepipe/suite_test.go #
behinddwalls
force-pushed
the
preetam/stovepipe-record-request-id
branch
from
July 30, 2026 20:15
a8ad1d3 to
ac2c9f2
Compare
behinddwalls
added a commit
that referenced
this pull request
Jul 30, 2026
## Summary ### Why? PR #443 disabled this workflow outright (`if: false`) when the repo moved to GitHub's native stacked PRs. That was too blunt: native stacks and hand-rolled `arh` chains coexist here today. Stacks #470, #472 and #474 are native, while #460 → #461 → #462 → #463 → #476 is a plain chain whose every member reports `stack: null`. With the workflow off, merging any PR in a hand-rolled chain leaves the children still carrying their parent's commits — precisely the broken-diff problem this workflow was written to fix. GitHub owns the lifecycle of its own stacks: on a partial merge it rebases and retargets the surviving members itself, so the workflow must not touch those. It only needs to tell the two apart rather than give up on both. ### What? Re-enables the job and skips only the PRs GitHub actually owns, instead of switching the whole workflow off. A `detect_stack` helper resolves native-stack membership from `GET /repos/{owner}/{repo}/pulls/{n}`. It queries the REST API at run time rather than reading `github.event.pull_request.stack` off the webhook payload, so a PR added to a stack after the merge event was queued is still recognised. Membership survives merge — a merged member still reports its stack — which is what makes the lookup meaningful at this point in the lifecycle. The check is applied **per child PR**, not to the merged PR. GitHub only ever rebases a stack's own members; a PR that targets a member's head branch without joining the stack is invisible to that machinery. Skipping the whole chain whenever the merged PR happened to be a stack member would therefore strand such a PR with exactly the broken diff this workflow exists to prevent. `rebase_chain` always runs; each child that is a stack member is skipped and not recursed into, while its siblings rebase normally. Membership of the merged PR is logged for context and gates nothing. Presence is tested on the `stack` object itself rather than on `stack.number`. Probing a sub-field means a stack object arriving without that field reads as "standalone" and gets force-pushed — the unsafe direction to fail in. The number is used only for logging. An unreadable response still falls back to standalone, since the Stacks API 404s when the feature is not enabled for a repo, which is exactly when the rebase is wanted. `cleanup_orphaned_merged_branches` still runs on every merge, including those where every child turned out to be GitHub's to rebase. This workflow therefore remains the sole owner of head-branch deletion, and native-stack head branches are reaped here too, each on the first merge after GitHub has retargeted its successors off it. This depends on "Automatically delete head branches" being OFF, as the header has always documented — otherwise GitHub retargets children to `main` before the job runs and the non-native path silently no-ops on a green job. The setting has been turned off on the repo. ## Test Plan ✅ YAML parses; job `if` and step `env` verified after the edit. ✅ `bash -n` clean on the extracted `run:` block under bash 5.2, the version Actions runners use. Note for future edits: macOS `/bin/bash` 3.2 reports a spurious `syntax error near ';;'` on this script — it cannot parse the heredoc nested in `$( )`, so it blames a line far from the real construct. ✅ `actionlint` v1.7.7 — clean. ✅ `zizmor` v1.25.2 (`--no-online-audits`, the version CI pins) — no findings, 2 ignored and 5 suppressed, confirming the existing `.github/zizmor.yml` exceptions still cover the file. ✅ `yamlfmt` v0.16.0 `-lint` — clean. ✅ `detect_stack` exercised against live PRs in this repo: | PR | `.stack` | Result | | --- | --- | --- | | #467 | stack #470, position 4/6, merged | native → skipped | | #468 | stack #470, position 5/6, open | native → skipped | | #404 | stack #472 | native → skipped | | #457 | stack #475, size 1 | native → skipped | | #443 | `null` | standalone → rebased | | #460 | `null` | standalone → rebased | | #999999 | HTTP 404 | warns, treated as standalone, no `set -euo pipefail` abort | ✅ The sub-field trap verified directly: a synthetic `{"stack":{"id":51488,"position":4,"size":6}}` with no `number` reads as standalone under `.stack.number // empty`, and as in-a-stack under the expression shipped here. ✅ Observed reference case — the merge of #467 (position 4 of stack #470). GitHub retargeted #468 from `preetam/stovepipe-buildsignal-outcome` to `main` and left #469 on #468's branch, confirming both that GitHub handles its own members and that a merged member retains its `stack` object. The rebase itself can only be exercised post-merge. On the next merge of a hand-rolled chain (the runway series is the live case) watch for `=== Stack rebase complete ===` and a child retargeted with only its own commits; on a native-stack merge watch for each member child logging `skipped: belongs to native stack #N`, followed by the branch sweep. The first sweep will also reap `preetam/stovepipe-buildsignal-outcome`, which is currently orphaned — it merged after auto-delete was turned off and has no open dependents.
behinddwalls
added a commit
that referenced
this pull request
Jul 30, 2026
## Summary ### Why? PR #443 disabled this workflow outright (`if: false`) when the repo moved to GitHub's native stacked PRs. That was too blunt: native stacks and hand-rolled `arh` chains coexist here today. Stacks #470, #472 and #474 are native, while #460 → #461 → #462 → #463 → #476 is a plain chain whose every member reports `stack: null`. With the workflow off, merging any PR in a hand-rolled chain leaves the children still carrying their parent's commits — precisely the broken-diff problem this workflow was written to fix. GitHub owns the lifecycle of its own stacks: on a partial merge it rebases and retargets the surviving members itself, so the workflow must not touch those. It only needs to tell the two apart rather than give up on both. ### What? Re-enables the job and skips only the PRs GitHub actually owns, instead of switching the whole workflow off. A `detect_stack` helper resolves native-stack membership from `GET /repos/{owner}/{repo}/pulls/{n}`. It queries the REST API at run time rather than reading `github.event.pull_request.stack` off the webhook payload, so a PR added to a stack after the merge event was queued is still recognised. Membership survives merge — a merged member still reports its stack — which is what makes the lookup meaningful at this point in the lifecycle. The check is applied **per child PR**, not to the merged PR. GitHub only ever rebases a stack's own members; a PR that targets a member's head branch without joining the stack is invisible to that machinery. Skipping the whole chain whenever the merged PR happened to be a stack member would therefore strand such a PR with exactly the broken diff this workflow exists to prevent. `rebase_chain` always runs; each child that is a stack member is skipped and not recursed into, while its siblings rebase normally. Membership of the merged PR is logged for context and gates nothing. Presence is tested on the `stack` object itself rather than on `stack.number`. Probing a sub-field means a stack object arriving without that field reads as "standalone" and gets force-pushed — the unsafe direction to fail in. The number is used only for logging. An unreadable response still falls back to standalone, since the Stacks API 404s when the feature is not enabled for a repo, which is exactly when the rebase is wanted. `cleanup_orphaned_merged_branches` still runs on every merge, including those where every child turned out to be GitHub's to rebase. This workflow therefore remains the sole owner of head-branch deletion, and native-stack head branches are reaped here too, each on the first merge after GitHub has retargeted its successors off it. This depends on "Automatically delete head branches" being OFF, as the header has always documented — otherwise GitHub retargets children to `main` before the job runs and the non-native path silently no-ops on a green job. The setting has been turned off on the repo. ## Test Plan ✅ YAML parses; job `if` and step `env` verified after the edit. ✅ `bash -n` clean on the extracted `run:` block under bash 5.2, the version Actions runners use. Note for future edits: macOS `/bin/bash` 3.2 reports a spurious `syntax error near ';;'` on this script — it cannot parse the heredoc nested in `$( )`, so it blames a line far from the real construct. ✅ `actionlint` v1.7.7 — clean. ✅ `zizmor` v1.25.2 (`--no-online-audits`, the version CI pins) — no findings, 2 ignored and 5 suppressed, confirming the existing `.github/zizmor.yml` exceptions still cover the file. ✅ `yamlfmt` v0.16.0 `-lint` — clean. ✅ `detect_stack` exercised against live PRs in this repo: | PR | `.stack` | Result | | --- | --- | --- | | #467 | stack #470, position 4/6, merged | native → skipped | | #468 | stack #470, position 5/6, open | native → skipped | | #404 | stack #472 | native → skipped | | #457 | stack #475, size 1 | native → skipped | | #443 | `null` | standalone → rebased | | #460 | `null` | standalone → rebased | | #999999 | HTTP 404 | warns, treated as standalone, no `set -euo pipefail` abort | ✅ The sub-field trap verified directly: a synthetic `{"stack":{"id":51488,"position":4,"size":6}}` with no `number` reads as standalone under `.stack.number // empty`, and as in-a-stack under the expression shipped here. ✅ Observed reference case — the merge of #467 (position 4 of stack #470). GitHub retargeted #468 from `preetam/stovepipe-buildsignal-outcome` to `main` and left #469 on #468's branch, confirming both that GitHub handles its own members and that a merged member retains its `stack` object. The rebase itself can only be exercised post-merge. On the next merge of a hand-rolled chain (the runway series is the live case) watch for `=== Stack rebase complete ===` and a child retargeted with only its own commits; on a native-stack merge watch for each member child logging `skipped: belongs to native stack #N`, followed by the branch sweep. The first sweep will also reap `preetam/stovepipe-buildsignal-outcome`, which is currently orphaned — it merged after auto-delete was turned off and has no open dependents.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why?
buildsignalpublished the build id torecord, butrecord's unit of work is a Request: it writes whole-repo greenness for the Request's URI, advances the Queue's last-green bookmark, and fires Hooks. Keying its input on a build artifact forces every future reader to navigate Build→Request, and it bakes a one-build-per-Request assumption into the wire contract.The assumption is also the wrong one to encode. The concurrency knob gates how many Requests are in flight per Queue — same base, different head, one build each — so the fan-out axis is Queue→N Requests, not Request→N Builds. And if a Request ever did fan out, a build-keyed input would give
recordN messages with no way to tell "one build failed" from "one failed and three haven't reported yet". A request-keyed input letsrecordanswer its own question.What?
Record.idnow carries the request id, andpublishRecorduses it for the payload, the message id, and the partition key. The field name staysid, matchingProcessRequest.idandBuildRequest.id. Partitioning is unchanged — it was already request id — so the only wire change is what the payload means.No reverse index is needed to make this work: the previous commit projects the build's terminal status onto
Request.State, sorecordreads the Request and never reaches aBuild. That also leaves the "no reverse index from Request to its builds" property inbuild.mdintact, for a better reason than before, and the derived-build-key alternative explicitly untriggered — its condition is a stage that must derive a build's key from a Request, whichrecordno longer does.Marked
!because therecordtopic's payload semantics change. Nothing consumes it yet — therecordstage lands later — so there is no migration.Test Plan
✅
bazel test //stovepipe/...— new unit test pins that the record payload, message id, and partition key are all the request id.✅
bazel test //test/e2e/stovepipe/...— the slow-build case now additionally asserts the request reachessucceededand the queue'sin_flight_countreturns to 0.Conflicts:
stovepipe/controller/buildsignal/buildsignal_test.go
Please enter the commit message for your changes. Lines starting
with '#' will be kept; you may remove them yourself if you want to.
An empty message aborts the commit.
interactive rebase in progress; onto b1937b43
Last command done (1 command done):
pick d3e6221a feat(stovepipe)!: key the record stage on the request id
No commands remaining.
You are currently rebasing branch 'preetam/stovepipe-record-request-id' on 'b1937b43'.
Changes to be committed:
modified: doc/rfc/stovepipe/steps/build.md
modified: doc/rfc/stovepipe/steps/buildsignal.md
modified: doc/rfc/stovepipe/workflow.md
modified: stovepipe/controller/buildsignal/buildsignal.go
modified: stovepipe/controller/buildsignal/buildsignal_test.go
modified: stovepipe/core/messagequeue/proto/record.proto
modified: stovepipe/core/messagequeue/protopb/record.pb.go
modified: stovepipe/core/messagequeue/topics.go
modified: test/e2e/stovepipe/harness_test.go
modified: test/e2e/stovepipe/suite_test.go
Stack