Move log backfill off the public API Gateway endpoint - #8595
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
meta-cla
Bot
added
the
CLA Signed
izaitsevfb
left a comment
izaitsevfb
left a comment
There was a problem hiding this comment.
lgtm, but let's make sure that the manual setup is done
| error | ||
| ); | ||
| return false; | ||
| } |
There was a problem hiding this comment.
let's not forget about the manual setup, as otherwise the failures would be silent
🟡 Confirm the uploader's invoke grant is in place before this deploys — without it every Dr.CI backfill fails and nothing downstream sees it. (ai-generated section)
The uploader is reachable only through an IAM-authenticated invoke, and the grant for the principal behind the HUD's OUR_AWS_ACCESS_KEY_ID is documented as one-time manual AWS setup rather than something the deploy performs. If it is not in place when this ships, the invoke throws on every call; the new catch logs the error and returns false, and the sole caller of backfillMissingLog ignores that value — so Dr.CI finishes normally and log backfill just stops.
Reviewed by codex gpt-5.6-sol at xhigh effort, against 5099e87.
2 participants
Stack from ghstack (oldest at bottom):
Impact:
backfillMissingLog, which Dr.CI calls when a failed job has no logRisk: medium -- changes a live Dr.CI path
What
backfillMissingLognow invokes thegha-log-uploaderlambda directly insteadof POSTing a synthetic
action: "backfill"event atjqogootqqe.execute-api.us-east-1.amazonaws.com. AddsPOST /api/log-uploader/backfillfor callers outside HUD, authenticated with ashared secret in
LOG_UPLOADER_BOT_KEY, matching theDRCI_BOT_KEYandFLAKY_TEST_BOT_KEYroutes.