Skip to content

fix(ci): preserve cleanup evidence on lock release #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Eli Pinkerton (wallstop) merged 2 commits into from
Jul 19, 2026
Merged

fix(ci): preserve cleanup evidence on lock release #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ea57047
fix(ci): preserve cleanup evidence on lock release
wallstop Jul 19, 2026
baaf8d3
fix(ci): make cleanup mapping precedence explicit
wallstop Jul 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions .github/workflows/build-tests-windows.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,7 +300,7 @@ jobs:

- name: Classify activation-owning cleanup proof
id: cleanup-proof
if: ${{ always() && steps.acquire-build-lock.outcome == 'success' }}
if: ${{ always() && (steps.acquire-build-lock.outcome == 'success' || steps.acquire-build-lock.outcome == 'failure' || steps.acquire-build-lock.outcome == 'cancelled') }}
shell: pwsh
env:
BUILD_1_OUTCOME: ${{ steps.build-1.outcome }}
Expand All @@ -310,6 +310,7 @@ jobs:
BUILD_3_OUTCOME: ${{ steps.build-3.outcome }}
BUILD_3_RESOURCE_SAFE: ${{ steps.build-3.outputs.resourceSafe }}
POST_ACQUIRE_HEAD_OUTCOME: ${{ steps.current-pr-head-after-acquire.outcome }}
QUARANTINE_RECOVERED: ${{ steps.acquire-build-lock.outputs['quarantine-recovered'] }}
run: ./scripts/classify-build-resource-proof.ps1

- name: Release organization Unity lock
Expand All @@ -322,9 +323,9 @@ jobs:
lock-repository: Ambiguous-Interactive/ambiguous-organization-build-lock
runner-id: ${{ runner.name }}
holder-id-suffix: ${{ github.job }}-${{ strategy.job-index }}
resource-cleanup-status: ${{ steps.cleanup-proof.outputs['resource-safe'] == 'true' && 'confirmed' || 'unknown' }}
resource-cleanup-status: ${{ (steps.cleanup-proof.outputs['resource-safe'] == 'true' && steps.cleanup-proof.outputs['resource-reason'] == 'cleanup-confirmed' && 'confirmed') || 'unknown' }}
resource-health: healthy
resource-reason: ${{ steps.cleanup-proof.outputs['resource-reason'] }}
resource-reason: ${{ (steps.cleanup-proof.outputs['resource-safe'] == 'true' && steps.cleanup-proof.outputs['resource-reason'] == 'cleanup-confirmed' && 'cleanup-confirmed') || (steps.cleanup-proof.outputs['resource-reason'] == 'return-missing-positive-evidence' && 'return-missing-positive-evidence') || 'cleanup-evidence-unknown' }}
env:
BUILD_LOCK_APP_ID: ${{ secrets.BUILD_LOCK_APP_ID }}
BUILD_LOCK_APP_PRIVATE_KEY: ${{ secrets.BUILD_LOCK_APP_PRIVATE_KEY }}
Expand All @@ -338,6 +339,7 @@ jobs:
BUILD_2_OUTCOME: ${{ steps.build-2.outcome }}
BUILD_3_OUTCOME: ${{ steps.build-3.outcome }}
CLEANUP_RESOURCE_SAFE: ${{ steps.cleanup-proof.outputs['resource-safe'] }}
CLEANUP_RESOURCE_REASON: ${{ steps.cleanup-proof.outputs['resource-reason'] }}
run: |
if ($env:LOCK_ACQUIRED -ne 'true') {
throw 'Windows canary did not acquire the lifecycle-aware organization lock.'
Expand All @@ -350,7 +352,8 @@ jobs:
if ($successfulBuilds -eq 0) {
throw 'No Windows build attempt succeeded; cleanup proof cannot be accepted.'
}
if ($env:CLEANUP_RESOURCE_SAFE -ne 'true') {
if ($env:CLEANUP_RESOURCE_SAFE -ne 'true' -or
$env:CLEANUP_RESOURCE_REASON -ne 'cleanup-confirmed') {
throw 'At least one Windows build attempt ended without activation-owning cleanup proof.'
}

Expand Down
6 changes: 4 additions & 2 deletions scripts/classify-build-resource-proof.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,11 @@ foreach ($attempt in 1..3) {
}

if ($attemptedBuilds -eq 0) {
if ($env:POST_ACQUIRE_HEAD_OUTCOME -in @('failure', 'cancelled')) {
if ($env:POST_ACQUIRE_HEAD_OUTCOME -in @('failure', 'cancelled') -and
$env:QUARANTINE_RECOVERED -eq 'false') {
# The exact-head guard runs after lock admission and before the first
# activation-owning action, so rejection here cannot leave a Unity seat.
# activation-owning action. Rejection is confirmed safe only when
# admission did not inherit an existing same-runner quarantine.
$resourceSafe = 'true'
$resourceReason = 'cleanup-confirmed'
}
Expand Down
17 changes: 11 additions & 6 deletions scripts/test-windows-resource-proof.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,12 +70,16 @@ $allowedResourceReasons = @(
'return-missing-positive-evidence'
)
$classificationCases = @(
@{ Name = 'no attempt'; Outcomes = @('skipped', 'skipped', 'skipped'); Proofs = @('', '', ''); Guard = 'skipped'; ExpectedSafe = 'false'; ExpectedReason = 'cleanup-evidence-unknown' },
@{ Name = 'stale after admission'; Outcomes = @('skipped', 'skipped', 'skipped'); Proofs = @('', '', ''); Guard = 'failure'; ExpectedSafe = 'true'; ExpectedReason = 'cleanup-confirmed' },
@{ Name = 'confirmed success'; Outcomes = @('success', 'skipped', 'skipped'); Proofs = @('true', '', ''); Guard = 'success'; ExpectedSafe = 'true'; ExpectedReason = 'cleanup-confirmed' },
@{ Name = 'confirmed failed builds'; Outcomes = @('failure', 'failure', 'skipped'); Proofs = @('true', 'true', ''); Guard = 'success'; ExpectedSafe = 'true'; ExpectedReason = 'cleanup-confirmed' },
@{ Name = 'failed return'; Outcomes = @('failure', 'skipped', 'skipped'); Proofs = @('false', '', ''); Guard = 'success'; ExpectedSafe = 'false'; ExpectedReason = 'return-missing-positive-evidence' },
@{ Name = 'cancel after safe attempt'; Outcomes = @('failure', 'cancelled', 'skipped'); Proofs = @('true', '', ''); Guard = 'success'; ExpectedSafe = 'false'; ExpectedReason = 'return-missing-positive-evidence' }
@{ Name = 'no attempt'; Outcomes = @('skipped', 'skipped', 'skipped'); Proofs = @('', '', ''); Guard = 'skipped'; Recovery = 'false'; ExpectedSafe = 'false'; ExpectedReason = 'cleanup-evidence-unknown' },
@{ Name = 'stale after admission'; Outcomes = @('skipped', 'skipped', 'skipped'); Proofs = @('', '', ''); Guard = 'failure'; Recovery = 'false'; ExpectedSafe = 'true'; ExpectedReason = 'cleanup-confirmed' },
@{ Name = 'stale after quarantine recovery'; Outcomes = @('skipped', 'skipped', 'skipped'); Proofs = @('', '', ''); Guard = 'failure'; Recovery = 'true'; ExpectedSafe = 'false'; ExpectedReason = 'cleanup-evidence-unknown' },
@{ Name = 'stale with missing recovery evidence'; Outcomes = @('skipped', 'skipped', 'skipped'); Proofs = @('', '', ''); Guard = 'failure'; Recovery = ''; ExpectedSafe = 'false'; ExpectedReason = 'cleanup-evidence-unknown' },
@{ Name = 'cancelled head check after admission'; Outcomes = @('skipped', 'skipped', 'skipped'); Proofs = @('', '', ''); Guard = 'cancelled'; Recovery = 'false'; ExpectedSafe = 'true'; ExpectedReason = 'cleanup-confirmed' },
@{ Name = 'cancelled head check after quarantine recovery'; Outcomes = @('skipped', 'skipped', 'skipped'); Proofs = @('', '', ''); Guard = 'cancelled'; Recovery = 'true'; ExpectedSafe = 'false'; ExpectedReason = 'cleanup-evidence-unknown' },
@{ Name = 'confirmed success'; Outcomes = @('success', 'skipped', 'skipped'); Proofs = @('true', '', ''); Guard = 'success'; Recovery = 'false'; ExpectedSafe = 'true'; ExpectedReason = 'cleanup-confirmed' },
@{ Name = 'confirmed failed builds'; Outcomes = @('failure', 'failure', 'skipped'); Proofs = @('true', 'true', ''); Guard = 'success'; Recovery = 'false'; ExpectedSafe = 'true'; ExpectedReason = 'cleanup-confirmed' },
@{ Name = 'failed return'; Outcomes = @('failure', 'skipped', 'skipped'); Proofs = @('false', '', ''); Guard = 'success'; Recovery = 'false'; ExpectedSafe = 'false'; ExpectedReason = 'return-missing-positive-evidence' },
@{ Name = 'cancel after safe attempt'; Outcomes = @('failure', 'cancelled', 'skipped'); Proofs = @('true', '', ''); Guard = 'success'; Recovery = 'false'; ExpectedSafe = 'false'; ExpectedReason = 'return-missing-positive-evidence' }
)
foreach ($case in $classificationCases) {
$outputPath = Join-Path ([System.IO.Path]::GetTempPath()) ("resource-proof-{0}.txt" -f [guid]::NewGuid())
Expand All @@ -86,6 +90,7 @@ foreach ($case in $classificationCases) {
[Environment]::SetEnvironmentVariable("BUILD_${attempt}_RESOURCE_SAFE", $case.Proofs[$attempt - 1])
}
$env:POST_ACQUIRE_HEAD_OUTCOME = $case.Guard
$env:QUARANTINE_RECOVERED = $case.Recovery
& $classifier
$actual = @{}
foreach ($line in Get-Content -LiteralPath $outputPath) {
Expand Down
21 changes: 17 additions & 4 deletions scripts/verify-resource-cleanup-contract.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -365,10 +365,12 @@ if (
)
failures.push('RC014: FIFO admission must revalidate the exact PR head before activation');
if (
cleanupProof?.if !== "${{ always() && steps.acquire-build-lock.outcome == 'success' }}" ||
cleanupProof?.if !== expectedReleaseCondition ||
cleanupProof?.run !== './scripts/classify-build-resource-proof.ps1' ||
cleanupProof?.env?.POST_ACQUIRE_HEAD_OUTCOME !==
'${{ steps.current-pr-head-after-acquire.outcome }}' ||
cleanupProof?.env?.QUARANTINE_RECOVERED !==
"${{ steps.acquire-build-lock.outputs['quarantine-recovered'] }}" ||
[1, 2, 3].some(
(attempt) =>
cleanupProof?.env?.[`BUILD_${attempt}_OUTCOME`] !==
Expand All @@ -377,15 +379,26 @@ if (
`\${{ steps.build-${attempt}.outputs.resourceSafe }}`,
)
)
failures.push('RC014: cleanup classifier must inspect every attempted build under always()');
failures.push(
'RC014: cleanup classifier must run for every release-eligible acquire outcome and inspect every attempted build',
);
if (
windowsVerify?.if !== '${{ always() }}' ||
windowsVerify?.env?.LOCK_ACQUIRED !== '${{ steps.acquire-build-lock.outputs.acquired }}' ||
windowsVerify?.env?.CLEANUP_RESOURCE_SAFE !==
"${{ steps.cleanup-proof.outputs['resource-safe'] }}" ||
windowsVerify?.env?.CLEANUP_RESOURCE_REASON !==
"${{ steps.cleanup-proof.outputs['resource-reason'] }}" ||
!windowsVerify?.run?.includes("if ($env:LOCK_ACQUIRED -ne 'true')")
)
failures.push(
'RC014: Windows canary must fail after release when lock ownership was not acquired',
);
if (
!windowsVerify?.run?.includes("$env:CLEANUP_RESOURCE_SAFE -ne 'true' -or") ||
!windowsVerify?.run?.includes("$env:CLEANUP_RESOURCE_REASON -ne 'cleanup-confirmed'")
)
failures.push('RC014: Windows canary must require the exact confirmed cleanup proof tuple');
const expectedRunnerId = '${{ runner.name }}';
const expectedHolderSuffix = '${{ github.job }}-${{ strategy.job-index }}';
if (
Expand All @@ -403,10 +416,10 @@ if (
`Ambiguous-Interactive/ambiguous-organization-build-lock/.github/actions/release-build-lock@${buildLockSha}` ||
windowsRelease?.if !== expectedReleaseCondition ||
windowsRelease?.with?.['resource-cleanup-status'] !==
"${{ steps.cleanup-proof.outputs['resource-safe'] == 'true' && 'confirmed' || 'unknown' }}" ||
"${{ (steps.cleanup-proof.outputs['resource-safe'] == 'true' && steps.cleanup-proof.outputs['resource-reason'] == 'cleanup-confirmed' && 'confirmed') || 'unknown' }}" ||
windowsRelease?.with?.['resource-health'] !== 'healthy' ||
windowsRelease?.with?.['resource-reason'] !==
"${{ steps.cleanup-proof.outputs['resource-reason'] }}" ||
"${{ (steps.cleanup-proof.outputs['resource-safe'] == 'true' && steps.cleanup-proof.outputs['resource-reason'] == 'cleanup-confirmed' && 'cleanup-confirmed') || (steps.cleanup-proof.outputs['resource-reason'] == 'return-missing-positive-evidence' && 'return-missing-positive-evidence') || 'cleanup-evidence-unknown' }}" ||
Object.hasOwn(windowsRelease?.with || {}, 'resource-safe')
)
failures.push('RC014: Windows release must report typed schema-5 cleanup evidence');
Expand Down
Loading