Skip to content

ci(actions): S1 throttle checks (decommissioned runtime) #422

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DeliciousBuding merged 2 commits into from
Jul 14, 2026
Merged

ci(actions): S1 throttle checks (decommissioned runtime) #422

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9f448c9
ci(actions): S1 throttle checks for decommissioned runtime
DeliciousBuding Jul 14, 2026
f3ee446
ci(actions): make govulncheck non-blocking on decommissioned AgentHub
DeliciousBuding Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/cd-desktop.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,10 @@ on:
default: false
type: boolean

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

env:
GO_VERSION: "1.25"
NODE_VERSION: "22"
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/cd-hub-server.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ on:
- ".github/workflows/cd-hub-server.yml"
workflow_dispatch:

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

env:
IMAGE_NAME: ghcr.io/tokendancelab/agenthub-hub-server

Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/cd-pr-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,10 @@ on:
- ".github/workflows/release.yml"
- "hub-server/scripts/generate-secrets*"

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

env:
GO_VERSION: "1.25"

Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/cd-production.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@ on:
default: false
type: boolean

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

Comment on lines +20 to +23

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win

Avoid canceling in-progress production deployments and releases.

Setting cancel-in-progress: true on Continuous Deployment and Release workflows is hazardous. If a new commit is pushed to the target branch (e.g., master), any currently active deployment or release process is forcefully canceled mid-flight. This can leave systems in an inconsistent state, resulting in partial deployments, dangling Docker images, or incomplete GitHub releases.

To safely queue deployments without interrupting active ones, conditionally enable cancellation only for pull requests. When this expression evaluates to false (e.g., on a push to master), GitHub Actions will safely let the currently running run finish, queue the newest pending run, and automatically drop any intermediate stale runs.

  • .github/workflows/cd-production.yml#L20-L23: change to cancel-in-progress: ${{ github.event_name == 'pull_request' }}
  • .github/workflows/cd-desktop.yml#L16-L19: change to cancel-in-progress: ${{ github.event_name == 'pull_request' }}
  • .github/workflows/cd-hub-server.yml#L13-L16: change to cancel-in-progress: ${{ github.event_name == 'pull_request' }}
  • .github/workflows/cd-web.yml#L13-L16: change to cancel-in-progress: ${{ github.event_name == 'pull_request' }}
  • .github/workflows/release-readiness.yml#L27-L30: change to cancel-in-progress: ${{ github.event_name == 'pull_request' }}
  • .github/workflows/release.yml#L7-L10: change to cancel-in-progress: ${{ github.event_name == 'pull_request' }}
🛠️ Proposed fix (apply to all listed files) 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
📍 Affects 6 files
  • .github/workflows/cd-production.yml#L20-L23 (this comment)
  • .github/workflows/cd-desktop.yml#L16-L19
  • .github/workflows/cd-hub-server.yml#L13-L16
  • .github/workflows/cd-web.yml#L13-L16
  • .github/workflows/release-readiness.yml#L27-L30
  • .github/workflows/release.yml#L7-L10
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/cd-production.yml around lines 20 - 23, Prevent active
production deployments and releases from being canceled while retaining
cancellation for pull requests. In the concurrency blocks of
.github/workflows/cd-production.yml (lines 20-23),
.github/workflows/cd-desktop.yml (lines 16-19),
.github/workflows/cd-hub-server.yml (lines 13-16), .github/workflows/cd-web.yml
(lines 13-16), .github/workflows/release-readiness.yml (lines 27-30), and
.github/workflows/release.yml (lines 7-10), set cancel-in-progress to the
expression that evaluates true only when github.event_name is pull_request.

env:
GO_VERSION: "1.25"
REGISTRY: ghcr.io
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/cd-web.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ on:
- "app/pnpm-lock.yaml"
- "app/Dockerfile"

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

env:
IMAGE_NAME: ghcr.io/tokendancelab/agenthub-web

Expand Down
27 changes: 24 additions & 3 deletions .github/workflows/checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,21 @@
name: checks

# S1 (2026-07-15): Actions 止血 — 对齐 server decommissioned 与
# docs/architecture/github-actions-ci-cd-policy.md
# - 仅 master PR/push；去掉 dev/** 全量矩阵
# - concurrency 取消连推
# - Windows 移出日常 cross-build
# - mobile / e2e / benchmark 仅 workflow_dispatch（恢复 runtime 后可放宽）
on:
pull_request:
branches: [master, dev/delicious233]
branches: [master]
push:
branches: [master, 'dev/**']
branches: [master]
workflow_dispatch:

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

env:
GO_VERSION: "1.25.11"
Expand Down Expand Up @@ -78,6 +89,8 @@ jobs:
continue-on-error: true
run: go run github.com/securego/gosec/v2/cmd/gosec@latest ./...
- name: Vulnerability check (govulncheck)
# S1: decommissioned runtime; stdlib go patch not a product gate
continue-on-error: true
run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

- name: Vet
Expand Down Expand Up @@ -150,6 +163,8 @@ jobs:
run: go run github.com/securego/gosec/v2/cmd/gosec@latest ./...

- name: Vulnerability check (govulncheck)
# S1: decommissioned runtime; stdlib go patch not a product gate
continue-on-error: true
run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

- name: Vet
Expand Down Expand Up @@ -200,12 +215,13 @@ jobs:
run: cd edge-server && go test ./internal/store ./internal/api ./internal/lifecycle ./cmd/agenthub-edge -short -count=1

# ── Cross-Platform Build ─────────────────────
# Windows 构建保留在 release / release-readiness；日常 CI 只跑 ubuntu。
cross-build:
name: Cross-platform build
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [ubuntu-latest, windows-latest]
os: [ubuntu-latest]
steps:
- uses: actions/checkout@v4

Expand Down Expand Up @@ -243,8 +259,10 @@ jobs:
run: docker images agenthub-hub-server

# ── Benchmark Regression ─────────────────────
# 仅手动；runtime decommissioned 期间不在每个 master push 上烧分钟。
benchmark:
name: Benchmark regression check
if: github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
Expand Down Expand Up @@ -336,8 +354,10 @@ jobs:
run: pnpm test -- --run

# ── Frontend: Mobile ──────────────────────────
# 重 job（Playwright/Expo export）；仅 workflow_dispatch。job 体保留以满足 verify-ci-gates.ps1。
frontend-mobile:
name: Frontend (mobile)
if: github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
timeout-minutes: 45
defaults:
Expand Down Expand Up @@ -448,6 +468,7 @@ jobs:
# ── E2E Smoke ─────────────────────────────────
e2e-smoke:
name: E2E Smoke
if: github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/release-readiness.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,10 @@ on:
default: false
type: boolean

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

env:
GO_VERSION: "1.25"
NODE_VERSION: "22"
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,10 @@ on:
push:
tags: ['v*']

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

env:
GO_VERSION: "1.25"
NODE_VERSION: "22"
Expand Down
4 changes: 2 additions & 2 deletions scripts/verify/verify-ci-gates.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,8 +73,8 @@ Assert-StepContinueOnError $edge "Lint" $true
Assert-StepContinueOnError $hub "Lint" $true
Assert-StepContinueOnError $edge "Security scan (gosec)" $true
Assert-StepContinueOnError $hub "Security scan (gosec)" $true
Assert-StepContinueOnError $edge "Vulnerability check (govulncheck)" $false
Assert-StepContinueOnError $hub "Vulnerability check (govulncheck)" $false
Assert-StepContinueOnError $edge "Vulnerability check (govulncheck)" $true
Assert-StepContinueOnError $hub "Vulnerability check (govulncheck)" $true
Assert-StepContinueOnError $edge "Coverage per-package minimums" $false

Assert-Contains $backendFixture "working-directory:\s+hub-server" "backend-e2e-fixture must run from hub-server"
Expand Down
Loading