Default test-infra-ref to "main" in reusable job workflows - #8472
Conversation
The reusable `*_job*` and `build_wheels_*` workflows default `test-infra-ref` to an empty string and pass it straight to `actions/checkout` as `ref:`. With an empty ref, checkout makes a "Determining the default branch" REST call per job to resolve the ref. Under a large CI fan-out (e.g. pytorch/executorch), those per-job calls exhaust the org-scoped GitHub App installation rate limit, and the `Checkout repository (pytorch/test-infra@)` step then fails with `API rate limit exceeded for installation` (meta-pytorch/pytorch-gha-infra#1375). `main` is already the branch an empty ref resolves to, so this changes no checkout behavior — it only lets checkout skip the default-branch lookup, removing that call from the quota-consuming path for every consumer that does not pin its own ref. Draft: mitigates the checkout failures; bounding the fan-out (concurrency on ciflow/ghstack runs) is the complementary fix and is tracked separately. Authored with assistance from Claude Code.
meta-cla
Bot
added
the
CLA Signed
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
atalman
left a comment
atalman
left a comment
There was a problem hiding this comment.
how this will affect release branches ?
I don't think it can't affect release branch in anyway. Leaving an empty ref here will use main branch anyway, but cost one more API call to GitHub |
Now that the reusable workflows carry an explicit `default: "main"` for test-infra-ref, the release-cutting script must switch that default to the release branch too — otherwise a cut release/x.y branch would still default to checking out test-infra@main. The existing sed only rewrites caller-style `test-infra-ref: main` and `@main` refs; the input default lives on a separate `default:` line. Add a scoped sed that rewrites `default: "main"` only within a `test-infra-ref:` input block (bounded by the next `type:`), so unrelated inputs such as greenlight-review.yml's `ref:` default are left untouched.
|
Good catch — addressed in 8315dbf. Two parts:
Simulated a |
The mobile_job call passed `test-infra-ref: ''`, which makes actions/checkout resolve the default branch via a REST call and, under CI fan-out, contributes to GitHub App installation rate-limit exhaustion (meta-pytorch/pytorch-gha-infra#1375). An explicit ref skips that lookup; `main` is the branch the empty ref already resolved to. This is the one call site that overrode pytorch/test-infra#8472's new `main` default with an explicit empty string.
Tag-triggered workflows key concurrency on `${{
github.event.pull_request.number || github.sha }}`. On a `ciflow/*` tag
push there is no PR number, so the group falls back to `github.sha` —
each re-push points at a new sha, gets its own group, and never cancels
the prior run. `cancel-in-progress` is dead for tag pushes.
On Aug 5 a burst of ciflow re-pushes fanned out to 46 shas / 117 runs,
buried the shared `macos-m1-stable` fleet, and drove `main` macOS
coverage to 0
([gha-infra#1391](meta-pytorch/pytorch-gha-infra#1391)).
## Fix
Fall back to `github.ref_name` (stable across re-pushes of the same tag)
and gate the sha term on `github.ref_type == 'branch'`, matching
`periodic.yml` in this repo and `pytorch/pytorch`'s `trunk.yml`:
```yaml
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref_name }}-${{ github.ref_type == 'branch' && github.sha }}-...
```
Applied to all 29 workflows carrying the old key (22 are tag-exposed;
the other 7 are fixed for uniformity). Also drops a stray `--` in the
nightly/test-backend group strings. `doc-build.yml` was already correct
(keys on `github.ref`) and is untouched.
## Also: apple.yml test-infra-ref
`apple.yml` passed `test-infra-ref: ''` to the `mobile_job` call,
forcing `actions/checkout` to resolve the default branch via a REST call
— a contributor to GitHub App installation rate-limit exhaustion
([gha-infra#1375](meta-pytorch/pytorch-gha-infra#1375)).
Set it to `main` (the branch the empty ref already resolved to). This is
the one executorch call site that overrode the new `main` default from
[pytorch/test-infra#8472](pytorch/test-infra#8472);
every other call site inherits that default.
## Review
`periodic.yml` (unchanged) is the template — verify `trunk.yml` matches
it; the other 28 are the identical one-line change. The `apple.yml` line
is independent.
---
Authored with assistance from Claude Code.
2 participants
The reusable
*_job*/build_wheels_*/_binary_uploadworkflows defaulttest-infra-refto""and pass it toactions/checkoutasref:. An emptyrefmakes checkout do a "Determining the default branch" REST call per job, which under large fan-out exhausts the org GitHub App installation rate limit — the cause of theCheckout repository (pytorch/test-infra@)failures in pytorch-gha-infra#1375.Default it to
"main"instead.mainis what an empty ref already resolves to, so no checkout behavior changes — checkout just skips the default-branch lookup, dropping that call from the quota path for consumers that don't pin their own ref.Mitigation, not a full fix: it doesn't bound the fan-out or the separate runner-registration quota (see #1375), and explicit
test-infra-ref: ''callers still override it. Draft for infra owners to confirm on CI.Authored with assistance from Claude Code.