fix(pipeline): stop CI/tooling config URLs from minting infra Route nodes#1048
Open
DeusData wants to merge 1 commit into
Open
fix(pipeline): stop CI/tooling config URLs from minting infra Route nodes#1048DeusData wants to merge 1 commit into
DeusData wants to merge 1 commit into
Conversation
…odes URLs in .pre-commit-config.yaml, .github/workflows and similar CI configs are repository/action/registry references for the development toolchain, never endpoints the indexed service exposes. They matched is_infra_file (.yaml) and passed the #521 value guards, so each minted a __route__infra__<url> Route node; the route matcher's root-service heuristic then attached every handler of an ambiguous '/' route to each junk URL - 6-7 junk HANDLES targets per handler on plain pallets/flask, with tie-break-dependent winners feeding HANDLES churn between builds. Deny by file identity (well-known CI/tooling basenames plus .github/, .gitlab/, .circleci/ trees) in cbm_pipeline_extract_infra_routes, not by URL shape: deployment configs (Cloud Scheduler push endpoints, compose) keep minting their genuine endpoints, guarded by an inverse test. Closes #999 Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #999
Bug
On a plain
pallets/flaskcheckout,repo:URLs from.pre-commit-config.yamlmatchedis_infra_file(.yaml) and slipped past the #521 value-level guards (they're clean single-token URLs under a non-denied key), so each minted a__route__infra__https://github.com/...Route node. The route matcher's root-service heuristic (handler_path == "/") then bridged every handler of the ambiguous__route__ANY__/route onto each junk URL — 6–7 junk HANDLES targets per handler, with tie-break-dependent winners contributing to the HANDLES churn measured between identical builds.Fix
CI/tooling configs describe the development toolchain — their URLs are repository/action/registry references, never endpoints the service exposes.
cbm_pipeline_extract_infra_routesnow denies by file identity (newis_ci_tooling_config): well-known basenames (.pre-commit-config.yaml,.gitlab-ci.yml,.travis.yml,azure-pipelines.yml,appveyor.yml,bitbucket-pipelines.yml,.readthedocs.*,codecov.yml,.goreleaser.*,.golangci.*) plus anything under.github/,.gitlab/,.circleci/. Both pipeline paths route through this single choke point.Deliberately not URL-shape-based: deployment configs (Cloud Scheduler push endpoints, compose) keep minting their genuine endpoints.
The issue's second ask (deterministic tie-break when several handlers tie for one route) is the wider HANDLES-nondeterminism item tracked in #998 and stays open there — this PR removes the junk-target class.
Reproduce-first
contract_edge_no_infra_routes_from_ci_configs_issue999— flask-style app + the reporter's pre-commit config + a workflow file: RED on main (github.com=2junk routes), GREEN with the fix.contract_edge_infra_routes_from_deploy_configs_still_minted— inverse guard: a Cloud-Scheduler-stylepush_endpointstill mints its infra Route (proves the deny is file-scoped, not a blanket kill).Verification
Full local suite 6000 passed, 1 skipped, zero regressions; lint-ci clean.