Repository navigation
chore(ci): stop the rust crate version checks from timing out - #127240
Conversation
The check-version-bump job ran step-security/changed-files on a depth-1 checkout. That action fetches more history before it can diff, and on this repository the fetch often outran the job's 5-minute timeout, which GitHub reports as cancelled. The job now reads the PR's changed files from the GitHub API through the vendored paths-filter action, and checks out only the four paths it reads. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
😎 Merged successfully - details. |
🤖 CI report
|
HostHog preview —
|
|
Risk: No findings This delta applies the already-reviewed pattern from publish-replay-anonymizer-crate.yml to two more release-check workflows (build-deltalite.yml, build-hogql-parser-rs.yml): a sparse non-cone checkout of just the paths the job reads, and the vendored .github/actions/paths-filter action reading changed files from the GitHub API instead of fetching git history. I traced every changed line and found no new security issue: the version-comparison and publish gates are unchanged, publish still requires a manual dispatch on master in PostHog/posthog, and the action's boolean outputs ('true'/'false') match the bash comparisons that consumed the old *_any_changed outputs. Sentinel reviewed |
…checks The hogql-parser-rs and deltalite version checks ran step-security/changed-files on a full-history blob:none checkout. That checkout took most of the job's 5-minute timeout, and some hogql-parser-rs runs hit the timeout inside it. Both jobs now use the vendored paths-filter action, which reads the PR's changed files from the GitHub API, and check out only the paths they read. This matches the replay-anonymizer version check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
robbie-c
changed the title
![stamphog[bot]](https://avatars.githubusercontent.com/in/3000332?s=60&v=4){kind=small}
There was a problem hiding this comment.
Not approved — this change needs a human reviewer.
Re-adding the stamphog label gives the same result unless the changed files change.
stamphog won't auto-review this pull request because two gates refused it. The deny-list gate flagged all three changed files (build-deltalite.yml, build-hogql-parser-rs.yml and publish-replay-anonymizer-crate.yml) as CI workflow paths, which stamphog approves only for authors on team-devex. The tier gate also classified the change as T2-never, so size was not the problem: at 57 lines across 3 files it was within the ceiling.
Please ask a human reviewer to look at it, ideally someone from team-devex, since the changes are all in .github/workflows. Splitting the pull request would not help, because each file would still match the CI workflow deny-list.
Gate mechanics and policy version
| Gate | Result | |
|---|---|---|
| prerequisites | ✓ | all clear |
| deny-list | ✗ | matches: ci_workflows (stamphog approves these paths only for authors on team-devex) |
| size | ✓ | 57L, 3F substantive — within ceiling |
| tier | ✗ | classified as T2-never: T2-never (57L, 3F, single-area, chore) |
| stamphog 2.6.1 | .stamphog/policy.yml @ unknown · reviewed head 58518ba |
Problem
posthog-replay-anonymizer,hogql-parser-rsanddeltalite.step-security/changed-filesinside a 5-minute job timeout.Changes
.github/actions/paths-filteraction.step-security/changed-fileswas a temporary replacement fortj-actions/changed-filesafter that action was compromised (chore: Reinstatechanged-filessteps #30000).publishjob do not change.How did you test this code?
bin/hogli lint:workflowsand actionlint 1.7.12, the version CI pins, pass.hogli ci:planshows the same steps run in each scenario as before.paths-filterbundle, run locally against the API, gave these outputs in about one second each:crate=truecrate=falseparser=true,workflow=falseparser=false,workflow=falsedeltalite=true,workflow=falsedeltalite=false,workflow=truepost-reminder-section.mjswork there.Test rationale: No new test. These workflows have no test suite, and the checks above cover both outcomes of each filter.
Release status
Docs update
🤖 Agent context
Autonomy: Human-driven (agent-assisted)
Agent: Claude Code, Claude Opus 5.5 (
claude-opus-5-5)Skills:
/authoring-ci-workflows,/writing-pr-descriptions,/asd-ste100More context for AI agents
hogql-parser-rsanddeltalite.paths-filteroverstep-security/changed-files. feat(ci): vendor paths-filter with include-exclude matching #67952 vendored the action, and chore(ci): migrate remaining paths-filter call sites to the vendored action #69171 moved every call site to it as the single implementation. chore(ci): refactor dockerfile lint job to use shared path filter #64263 already replaced onestep-security/changed-filesuse with the shared filter./authoring-ci-workflowsnames the vendored action for change detection in sparse jobs.GITHUB_TOKENand not a dedicated App token, because each check makes one light call per run.build-wheelscheckout, in a different hunk. chore(ci): narrow the hogql npm version check checkout #127010 narrows the checkout of thehogql-parser-npmversion check, but keepsstep-security/changed-filesand full history.publishjob still usesstep-security/changed-fileson master pushes.hogql-parserandhogql-parser-npmversion checks use the same full-history pattern.dorny/paths-filterfrom every workflow, but fivedesktop-*workflows use it again.🤖 Generated with Claude Code