Repository navigation
ci: route bench validation to Eagle - #7
Conversation
|
@codex review |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates the existing bench validation workflow to run on the disposable File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/bench-init.yml" line_range="14" />
<code_context>
jobs:
validate:
- runs-on: ubuntu-24.04
+ runs-on: eagle-linux-ubuntu24
timeout-minutes: 10
steps:
</code_context>
<issue_to_address>
**Pull requests reach Eagle runners**
When a pull request changes `.github/workflows/bench-init.yml`, gitHub runs the pull-request version of this workflow on Eagle, so a contributor can replace the validation steps with arbitrary commands that access the runner’s network or transient credentials. The job’s `contents: read` permission does not restrict host access.
Run untrusted pull-request workflows only on an Eagle pool isolated from credentials and internal network access, or keep this validation on GitHub-hosted runners.
</issue_to_address>
### Comment 2
<location path=".github/workflows/bench-init.yml" line_range="14" />
<code_context>
jobs:
validate:
- runs-on: ubuntu-24.04
+ runs-on: eagle-linux-ubuntu24
timeout-minutes: 10
steps:
</code_context>
<issue_to_address>
**Validation remains queued**
When the Eagle pool has no online runner registered with the exact `eagle-linux-ubuntu24` label, gitHub cannot assign `validate` to a runner, so the required validation check never completes and blocks the pull request.
Set `runs-on` to a label registered with an online runner.
</issue_to_address>Sourcery assessment
Approval pending. 2 findings to address first.
Blocking findings: .github/workflows/bench-init.yml:14, .github/workflows/bench-init.yml:14
| jobs: | ||
| validate: | ||
| runs-on: ubuntu-24.04 | ||
| runs-on: eagle-linux-ubuntu24 |
There was a problem hiding this comment.
🟠 High · Pull requests reach Eagle runners
When a pull request changes .github/workflows/bench-init.yml, gitHub runs the pull-request version of this workflow on Eagle, so a contributor can replace the validation steps with arbitrary commands that access the runner’s network or transient credentials. The job’s contents: read permission does not restrict host access.
Run untrusted pull-request workflows only on an Eagle pool isolated from credentials and internal network access, or keep this validation on GitHub-hosted runners.
Prompt for AI agents
In `.github/workflows/bench-init.yml` at line 14:
**Pull requests reach Eagle runners**
When a pull request changes `.github/workflows/bench-init.yml`, gitHub runs the pull-request version of this workflow on Eagle, so a contributor can replace the validation steps with arbitrary commands that access the runner’s network or transient credentials. The job’s `contents: read` permission does not restrict host access.
Run untrusted pull-request workflows only on an Eagle pool isolated from credentials and internal network access, or keep this validation on GitHub-hosted runners.| jobs: | ||
| validate: | ||
| runs-on: ubuntu-24.04 | ||
| runs-on: eagle-linux-ubuntu24 |
There was a problem hiding this comment.
🟠 High · Validation remains queued
When the Eagle pool has no online runner registered with the exact eagle-linux-ubuntu24 label, gitHub cannot assign validate to a runner, so the required validation check never completes and blocks the pull request.
Set runs-on to a label registered with an online runner.
Prompt for AI agents
In `.github/workflows/bench-init.yml` at line 14:
**Validation remains queued**
When the Eagle pool has no online runner registered with the exact `eagle-linux-ubuntu24` label, gitHub cannot assign `validate` to a runner, so the required validation check never completes and blocks the pull request.
Set `runs-on` to a label registered with an online runner.
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
GitHub-hosted execution is blocked by the account billing cap. Route the existing bench configuration validation job to the disposable Eagle Linux pool using
eagle-linux-ubuntu24. The pinned checker, test command, triggers and permissions are unchanged.Validation: the existing immutable configuration checker passes locally, actionlint passes with the Eagle label declaration, and git diff checks pass. This change launches no bench or shared service.
Fleet governance and runtime validation: opensoft/openBenches#208 (
specs/030-eagle-fleet-routing/). Actual execution on Eagle is required before landing.Summary by Sourcery
Route bench configuration validation through the Eagle Linux runner pool to avoid GitHub-hosted execution limits.
Enhancements:
CI: