Diagnostic Triage observation #95
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Diagnostic Triage observation | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| workflow_run: | |
| workflows: [CI] | |
| types: [completed] | |
| permissions: {} | |
| concurrency: | |
| group: diagnostic-triage-observe-${{ github.event.workflow_run.id || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| diagnostics: | |
| if: github.event_name != 'workflow_run' | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Check out triggering revision | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| - name: Run pinned repository diagnostics | |
| id: diagnostics | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| report="$RUNNER_TEMP/diagnostic-triage-report.json" | |
| set +e | |
| nix develop --command diagnostic-triage ci > "$report" | |
| status=$? | |
| set -e | |
| if test "$status" -ne 0 && test "$status" -ne 1; then | |
| echo "Diagnostic Triage operational exit: $status" >&2 | |
| exit "$status" | |
| fi | |
| verdict="$(jq -er ' | |
| if .schema_version == "diagnostic-triage.session-report/v1" | |
| then .verdict | |
| else error("unexpected report schema") | |
| end | |
| ' "$report")" | |
| case "$status:$verdict" in | |
| 0:PASS|1:POLICY_FAIL) ;; | |
| *) | |
| echo "exit/verdict mismatch: $status/$verdict" >&2 | |
| exit 2 | |
| ;; | |
| esac | |
| printf 'exit_code=%s\nverdict=%s\n' "$status" "$verdict" >> "$GITHUB_OUTPUT" | |
| - name: Run the offline GitHub Actions Observer | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| input="tests/fixtures/diagnostic-triage/github-actions-success.json" | |
| nix develop --command diagnostic-triage observe \ | |
| --source github-actions \ | |
| --input "$input" \ | |
| > "$RUNNER_TEMP/diagnostic-triage-observer.jsonl" | |
| jq -s -e ' | |
| .[0].kind == "manifest" | |
| and .[-1].kind == "completion" | |
| and .[-1].status == "COMPLETE" | |
| ' "$RUNNER_TEMP/diagnostic-triage-observer.jsonl" >/dev/null | |
| - name: Record diagnostic summary | |
| run: | | |
| { | |
| echo "### Diagnostic Triage" | |
| echo "- Verdict: \`${{ steps.diagnostics.outputs.verdict }}\`" | |
| echo "- Exit code: \`${{ steps.diagnostics.outputs.exit_code }}\`" | |
| echo "- Enforcement: observe-only" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: Upload bounded diagnostic evidence | |
| if: always() && github.event_name != 'pull_request' | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: diagnostic-triage-diagnostics-${{ github.sha }} | |
| path: | | |
| ${{ runner.temp }}/diagnostic-triage-report.json | |
| ${{ runner.temp }}/diagnostic-triage-observer.jsonl | |
| if-no-files-found: warn | |
| retention-days: 7 | |
| # workflow_run may originate from untrusted pull-request code. Execute only | |
| # the observer implementation on the trusted default branch: | |
| # https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#workflow_run | |
| completed-run: | |
| if: github.event_name == 'workflow_run' | |
| permissions: | |
| actions: read | |
| contents: read | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Check out trusted observer revision | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| ref: ${{ github.event.repository.default_branch }} | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| - name: Fetch completed CI run | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| OBSERVED_RUN_ID: ${{ github.event.workflow_run.id }} | |
| run: | | |
| set -euo pipefail | |
| workspace="$RUNNER_TEMP/diagnostic-triage-observer-workspace" | |
| mkdir -p "$workspace" | |
| input="$workspace/github-actions-run.json" | |
| set +o pipefail | |
| gh api \ | |
| -H "Accept: application/vnd.github+json" \ | |
| -H "X-GitHub-Api-Version: 2022-11-28" \ | |
| "repos/$GITHUB_REPOSITORY/actions/runs/$OBSERVED_RUN_ID" \ | |
| | head -c 16777217 > "$input" | |
| pipeline_status=("${PIPESTATUS[@]}") | |
| set -o pipefail | |
| api_status="${pipeline_status[0]}" | |
| byte_count="$(stat -c %s "$input")" | |
| if test "$byte_count" -gt 16777216; then | |
| echo "Completed-run input exceeds the 16 MiB observer limit" >&2 | |
| exit 2 | |
| fi | |
| if test "$api_status" -ne 0; then | |
| echo "GitHub Actions REST request failed: $api_status" >&2 | |
| exit "$api_status" | |
| fi | |
| jq -e \ | |
| --argjson observed_run_id "$OBSERVED_RUN_ID" \ | |
| '.status == "completed" and .id == $observed_run_id' \ | |
| "$input" >/dev/null | |
| # LLM contract: completed run DISCOVERED -> NORMALIZED -> REPORTED; | |
| # missing, oversized, or malformed source evidence terminates FAILED. | |
| - name: Observe the completed run offline | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| workspace="$RUNNER_TEMP/diagnostic-triage-observer-workspace" | |
| nix develop --command diagnostic-triage \ | |
| --repository "$workspace" \ | |
| observe \ | |
| --source github-actions \ | |
| --input github-actions-run.json \ | |
| > "$RUNNER_TEMP/diagnostic-triage-observer.jsonl" | |
| jq -s -e ' | |
| .[0].kind == "manifest" | |
| and .[-1].kind == "completion" | |
| and .[-1].status == "COMPLETE" | |
| ' "$RUNNER_TEMP/diagnostic-triage-observer.jsonl" >/dev/null | |
| - name: Record completed-run summary | |
| env: | |
| OBSERVED_RUN_ID: ${{ github.event.workflow_run.id }} | |
| run: | | |
| { | |
| echo "### Diagnostic Triage" | |
| echo "- Completed CI run: \`$OBSERVED_RUN_ID\`" | |
| echo "- Source: explicit GitHub Actions REST input" | |
| echo "- Enforcement: observe-only" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: Upload bounded completed-run evidence | |
| if: always() | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: diagnostic-triage-observe-${{ github.event.workflow_run.id }} | |
| path: | | |
| ${{ runner.temp }}/diagnostic-triage-observer.jsonl | |
| ${{ runner.temp }}/diagnostic-triage-observer-workspace/github-actions-run.json | |
| if-no-files-found: warn | |
| retention-days: 7 |