testsAndMisc/docs/superpowers/evidence/ci-mirror-scoped-push-gate-2026-08-23.json
Krzysztof kuhy Rudnicki 8ab15446fd Make the push gate check the push, and make its pytest stage real
`git push` took ~130s because ci-mirror re-ran `pre-commit --all-files`
plus every lib/tests suite on every push, regardless of what changed.

The larger problem found while measuring it: ci_mirror.sh invoked
pytest_changed_packages.py with no arguments, and that script returns 0
on empty argv because it is normally a pre-commit hook fed staged paths.
The pre-push python stage has therefore been running ZERO tests and
reporting success. Behind it sat a genuinely failing test, fixed in
ff3ea99a. The stage is now passed the changed paths and actually runs.

Scope, keeping the guarantee that a red push cannot reach GitHub:

  * pre-commit runs over the push range, read from PRE_COMMIT_FROM_REF /
    PRE_COMMIT_TO_REF, which the pre-push hook already resolves from the
    refs git hands it -- the remote's real shas, so unlike origin/main
    they cannot go stale and silently empty the range.
  * an unknown range, or a change to the gate's own machinery, forces a
    full sweep, so a new rule cannot land while checking only its own diff.
  * only the lib/tests suites whose tree the push touched are run; a
    change to scripts/lib/ or to a suite's lib_test_core.sh fans out to
    all of them.
  * pre-commit and pytest run concurrently. The jailed shell gate stays
    serial: concurrent jails produce false failures.
  * an unchanged tree short-circuits on a recorded tree hash.

This also restores intent that was already in the config:
session-autopsy-hook-mutations is `files:`-scoped to two files precisely
because it costs 50s, and --all-files was overriding that on every push.

Measured, against a ~130s baseline:
  docs-only push          7.6s
  python push            25.3s   (includes a 22s stage that never ran)
  one shell suite        43.6s   (37s of it is the fixes/lib suite)
  all-suites widening      52s
  re-push, unchanged     0.005s

Proved it still gates: a deliberately broken python assertion and a
deliberately broken shell assertion were each refused with exit 1, and
the green-tree cache is not written on failure. Both probes reverted.

Split into ci_mirror_range.sh and ci_mirror_shell.sh for the 250-line
cap; both are sourced-only, so they follow the repo's convention of
`# shellcheck shell=bash` with no shebang and no exec bit.

CI_GREEN_SKIP=1: main is red only from 04cc5fa2, the deliberate shell
probe above, which is already reverted here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
2026-08-23 15:12:23 +02:00

48 lines
3.3 KiB
JSON

{
"intent": "Cut the pre-push gate from ~130s to seconds by checking the push range instead of the whole tree, and make the pytest stage actually run -- it had been silently executing zero tests on every push.",
"scope": [
"meta/scripts/ci_mirror.sh",
"meta/scripts/ci_mirror_range.sh (new)",
"meta/scripts/ci_mirror_shell.sh (new, split for the 250-line cap)",
"Non-goal: weakening any check. The guarantee that a red push cannot reach GitHub is preserved."
],
"changes": [
"FIX: ci_mirror.sh invoked pytest_changed_packages.py with no arguments; that script returns 0 on empty argv, so the pre-push python stage ran zero tests and reported success. It is now passed the changed paths and genuinely runs.",
"Scope pre-commit to the push range via PRE_COMMIT_FROM_REF/PRE_COMMIT_TO_REF, which the pre-push hook already resolves from the refs git supplies. Repo-wide hooks (file-length-cap --all, no-binaries, check-python-location) are always_run in the config and still sweep the tree.",
"Force a full sweep when the range is unknown or when the gate's own machinery changed (.pre-commit-config.yaml, meta/scripts/, requirements.txt, .githooks/).",
"Run only the lib/tests suites whose tree the push touched; a change under scripts/lib/ or a suite's lib_test_core.sh/lib_test_path.sh fans out to all suites.",
"Run pre-commit and pytest concurrently; keep the shell/jail gate serial to avoid the CPU-contention false failures documented in the handoff.",
"Short-circuit on a tree hash matching the last green run, recorded in .ci-mirror-venv/ (already gitignored, so invisible to git status and jail fingerprints)."
],
"verification": [
{
"command": "PRE_COMMIT_FROM_REF/TO_REF set; time bash meta/scripts/ci_mirror.sh",
"result": "pass",
"evidence": "docs-only push 7.6s; python push 25.3s (now including a 22s pytest stage that never previously ran); single shell suite 43.6s; all-suites widening 52s; unchanged-tree re-push 0.005s. Baseline was ~130s."
},
{
"command": "Deliberately broke a python assertion, committed, ran the gate",
"result": "pass",
"evidence": "Gate exit 1, reported the failing test, and did NOT write the green-tree cache. Reverted."
},
{
"command": "Deliberately broke _t_eq in utils/lib/tests/test_study_doc_lookup.sh at a pinned range",
"result": "pass",
"evidence": "Suite failed bare (exit 1) first; gate then exit 1 with 'lib/tests suite failed: .../utils/lib/tests/run_all.sh'. Reverted."
},
{
"command": "shellcheck -x and shfmt -l on all three scripts; check_file_length.sh --all",
"result": "pass",
"evidence": "shellcheck clean, shfmt clean, all files within the 250-line cap (232/78/119)."
}
],
"risks": [
"Scoping means a hook no longer re-checks files outside the push range. Mitigated by the gate-widening rule and by keeping repo-wide hooks always_run.",
"The green-tree cache could mask a gate change; mitigated because the cache key is the whole-repo tree hash, so any gate edit invalidates it."
],
"rollback": [
"git revert the commit; ci_mirror.sh returns to --all-files on every push (~130s) and the pytest stage returns to silently running nothing.",
"Delete .ci-mirror-venv/.last-green-tree if a stale cache is ever suspected."
]
}