revert(ci): switch back to namespace runners#819
Conversation
📝 WalkthroughWalkthroughThis PR migrates the aube CI infrastructure from GitHub-hosted runners to Namespace-hosted custom runners. All workflows switch to ChangesNamespace CI Runner Migration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Greptile SummaryThis PR reverts #814 by switching all CI and release jobs back to Namespace runner profiles, restoring
Confidence Score: 4/5Safe to merge; all changes are runner/cache wiring and documentation with no production logic affected. The revert is straightforward and runner label changes are consistent across all workflows. One updated comment in release.yml mis-describes the macOS runner in use, and the new SVG asset is missing a trailing newline flagged by the PR's own git diff --check validation step. Neither affects CI correctness. release.yml — the rustup step comment describes macos-latest-large (Rosetta) but the runner is macos-latest (native ARM64). assets/namespace-logo.svg — missing trailing newline. Important Files Changed
Reviews (1): Last reviewed commit: "revert(ci): switch back to namespace run..." | Re-trigger Greptile |
| # GH macos-latest-large defaults to an x86_64-apple-darwin | ||
| # host rustc (Rosetta) — `--target=aarch64-apple-darwin` | ||
| # from pgo.bash then triggers a cross-compile that needs the | ||
| # arm64 std lib explicitly installed. Idempotent on namespace | ||
| # runners where the target is already present. |
There was a problem hiding this comment.
macos-latest-large (x86_64/Rosetta) behavior, but the actual runner for this matrix row is macos-latest, which is GitHub's native Apple Silicon runner. On macos-latest, aarch64-apple-darwin is already the native target — not a cross-compile — so the Rosetta/std-lib explanation doesn't apply. The previous comment was accurate for the runner in use.
| # GH macos-latest-large defaults to an x86_64-apple-darwin | |
| # host rustc (Rosetta) — `--target=aarch64-apple-darwin` | |
| # from pgo.bash then triggers a cross-compile that needs the | |
| # arm64 std lib explicitly installed. Idempotent on namespace | |
| # runners where the target is already present. | |
| # GitHub-hosted macos-latest is Apple Silicon, so | |
| # aarch64-apple-darwin is the native target. rustup target add | |
| # is idempotent and ensures the component is present even if a | |
| # prior toolchain upgrade dropped it. |
| <path d="M120.148 122.806V110.969H80.4884V122.806H120.148Z" fill="white"></path> | ||
| </svg> No newline at end of file |
There was a problem hiding this comment.
git diff --check — one of the two validation methods listed in the PR description.
| <path d="M120.148 122.806V110.969H80.4884V122.806H120.148Z" fill="white"></path> | |
| </svg> | |
| <path d="M120.148 122.806V110.969H80.4884V122.806H120.148Z" fill="white"></path> | |
| </svg> |
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yml (1)
36-52:⚠️ Potential issue | 🟠 Major | 🏗️ Heavy liftLock Linux
pull_requestcache writes like Windows to prevent Rust cache poisoning
buildandtest-linuxrun onnamespace-profile-endev-linux-amd64;overrides.cache-tag=aube-rust-linuxand usenamespacelabs/nscloud-cache-action@...withcache: rustonpull_request, but they do not setnscloud-cache-exp-do-not-commit(or any other read-only mode). Namespace requires this label to be explicitly configured; without it, the job can write through to the mounted/shared cache volume.- Your
windowsjob already prevents this by gating cache writes withsave-if: ${{ github.ref == 'refs/heads/main' }}—the Linux path should get the same protection (e.g., addnscloud-cache-exp-do-not-committoruns-onfor PRs/untrusted branches, or scope PR runs to a separateoverrides.cache-tag).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 36 - 52, The Linux PR runs using the namespacelabs/nscloud-cache-action with cache: rust can write to the shared cache (cache poisoning) because it lacks the nscloud-cache-exp-do-not-commit label or a conditional save like the Windows job's save-if; update the Linux jobs (e.g., the matrix entry that uses runner "namespace-profile-endev-linux-amd64;overrides.cache-tag=aube-rust-linux" and the jobs named build/test-linux that call namespacelabs/nscloud-cache-action) to prevent writes on pull_request by either adding nscloud-cache-exp-do-not-commit to runs-on for PR/untrusted branches or by gating cache writes with a conditional (mirror the Windows approach, e.g., use save-if: ${{ github.ref == 'refs/heads/main' }} or equivalent) so PR runs become read-only and cannot write to the mounted/shared cache.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 267-275: The README contains a duplicate "## CI" heading; change
the second "## CI" (the block showing Namespace logo and thank-you) to a
distinct heading such as "## CI Infrastructure" or move that block under an
existing "## Acknowledgments" or "## Contributors" section so anchors aren't
duplicated; update the heading text for that block (the second "## CI") and any
links/anchors that reference it to the new name to resolve the MD024
duplicate-heading lint error.
---
Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 36-52: The Linux PR runs using the
namespacelabs/nscloud-cache-action with cache: rust can write to the shared
cache (cache poisoning) because it lacks the nscloud-cache-exp-do-not-commit
label or a conditional save like the Windows job's save-if; update the Linux
jobs (e.g., the matrix entry that uses runner
"namespace-profile-endev-linux-amd64;overrides.cache-tag=aube-rust-linux" and
the jobs named build/test-linux that call namespacelabs/nscloud-cache-action) to
prevent writes on pull_request by either adding nscloud-cache-exp-do-not-commit
to runs-on for PR/untrusted branches or by gating cache writes with a
conditional (mirror the Windows approach, e.g., use save-if: ${{ github.ref ==
'refs/heads/main' }} or equivalent) so PR runs become read-only and cannot write
to the mounted/shared cache.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: a1715794-7adc-464d-a15d-70bd74ccf4c8
⛔ Files ignored due to path filters (1)
assets/namespace-logo.svgis excluded by!**/*.svg
📒 Files selected for processing (11)
.github/actionlint.yaml.github/workflows/bench-pr.yml.github/workflows/bench-refresh.yml.github/workflows/ci.yml.github/workflows/copr-publish.yml.github/workflows/docs.yml.github/workflows/publish-homebrew.yml.github/workflows/release-plz.yml.github/workflows/release.ymlREADME.mdbenchmarks/pgo.bash
| ## CI | ||
|
|
||
| <p> | ||
| <a href="https://namespace.so"> | ||
| <img src="assets/namespace-logo.svg" alt="Namespace" width="64"> | ||
| </a> | ||
| </p> | ||
|
|
||
| Thanks to [Namespace](https://namespace.so) for providing CI for aube. |
There was a problem hiding this comment.
Duplicate heading: Two "## CI" sections in the same document.
The README already has a "## CI" section at line 163 that documents the aube ci command. This new section at line 267 introduces a second "## CI" heading for acknowledging Namespace's CI infrastructure support.
Duplicate headings create ambiguous anchor links and confuse readers. Consider renaming this section to distinguish it from the existing one.
📝 Suggested alternatives
Option 1: Rename to a more specific heading:
-## CI
+## CI InfrastructureOption 2: Move this content into an "Acknowledgments" or "Thanks" section alongside the existing "Contributors" section at line 287.
Option 3: Use a subsection under a broader "Community" or "Support" heading.
As per coding guidelines, markdownlint-cli2 flags this as MD024 (no-duplicate-heading).
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)
[warning] 267-267: Multiple headings with the same content
(MD024, no-duplicate-heading)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 267 - 275, The README contains a duplicate "## CI"
heading; change the second "## CI" (the block showing Namespace logo and
thank-you) to a distinct heading such as "## CI Infrastructure" or move that
block under an existing "## Acknowledgments" or "## Contributors" section so
anchors aren't duplicated; update the heading text for that block (the second
"## CI") and any links/anchors that reference it to the new name to resolve the
MD024 duplicate-heading lint error.
Summary
namespace-profile-endev-linux-arm64-largeValidation
Note
Medium Risk
Touches release PGO/BOLT matrices and all primary CI paths; misconfigured runner labels or cache tags could break builds or slow releases, but application/runtime code is unchanged.
Overview
This PR reverts the GitHub-hosted runner migration and moves most CI, bench, docs, release, and packaging workflows back onto Namespace profiles (
namespace-profile-endev-linux-amd64, macOS arm64, and-largevariants for heavy PGO/bench work).Runner and cache wiring: Jobs that previously used
ubuntu-latest/macos-latestfor build, test, benches, docs, COPR, Homebrew, and release-plz now target Namespace labels again. BATS shards stay on GitHub-hosted Linux/macOS so jail/sandbox tests still match real OS behavior. Windows build/test remains onwindows-latestwithSwatinem/rust-cache.Rust caching:
Swatinem/rust-cacheis replaced bynamespacelabs/nscloud-cache-action(cache: rust) on Namespace Linux/macOS jobs, with shared cache tags (aube-rust-linux/aube-rust-linux-arm64) via profile;overrides.cache-tag=...so regular CI and-largebench/PGO jobs reuse the same target dirs where arch allows.release-plz-prdrops rust caching entirely in this diff.Release/PGO: Native aarch64 Linux GNU PGO+BOLT runs on
namespace-profile-endev-linux-arm64-largeagain; amd64 PGO uses-largeNamespace runners. Comments inrelease.ymlandbenchmarks/pgo.bashdocument why BOLT uses instrumentation (Namespaceperf_event_paranoid, no sysctl) instead of perf/LBR.Repo hygiene: Adds
.github/actionlint.yamlfor allowed self-hosted labels,assets/namespace-logo.svg, and a README CI credit section for Namespace.Reviewed by Cursor Bugbot for commit 3af950d. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
Chores
Documentation