Skip to content

ci: restore BytePort workflow syntax and attestations (pilot) - #318

Draft
KooshaPari wants to merge 99 commits into
mainfrom
codex/byteport-workflow-syntax-pilot
Draft

ci: restore BytePort workflow syntax and attestations (pilot)#318
KooshaPari wants to merge 99 commits into
mainfrom
codex/byteport-workflow-syntax-pilot

Conversation

@KooshaPari

Copy link
Copy Markdown
Owner

Scope

This branch restores the BytePort CI workflow files after newline/control-character corruption and resolves the embedded release-attestation conflict. It also preserves the existing pilot/placement commits already on this worktree.

Evidence

  • PyYAML parse sweep: all workflows parse in pilot, placement-readback, and pr172-rebase worktrees.
  • git diff --check: clean.
  • Control-character and merged-comment scan: clean for the repaired workflow set.

Remaining gate

actionlint was not runnable locally because the host has Go 1.24.3 while the current actionlint release requires Go 1.25; automatic toolchain acquisition did not yield a binary. Exact-head CI must provide the semantic GitHub Actions gate before merge.

@gemini-code-assist

Copy link
Copy Markdown

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

@KooshaPari

Copy link
Copy Markdown
Owner Author

Validation update:

  • PyYAML parsed every workflow in the pilot, placement-readback, and pr172-rebase worktrees (0 failures).
  • git diff --check is clean.
  • Focused Rust check passed on pilot: byteport-transport, byteport-dag, pheno-dag, byteport-cli (cargo check ... --lib -j 1).
  • Placement pheno-dag check passed (cargo check -p pheno-dag --lib -j 1).
  • Fixed pheno-dag's missing uuid serde feature (the prior check caught three derive errors).
  • Full all-target Tauri check remains open because the drive exhausted space; the isolated target was cleaned and reclaimed 1.4 GiB.
  • actionlint remains an environment gate: host Go is 1.24.3; current actionlint requires Go 1.25.

@KooshaPari

Copy link
Copy Markdown
Owner Author

CI remediation update:

  • Workflow hardening commit ci: pin workflow actions and tighten permissions is now on this branch: all action refs are full SHAs, npm lifecycle installs use --ignore-scripts, npx was replaced with locked local npm exec, and the invalid === expression was corrected.
  • Go lint remediation commit fix(byteport): satisfy errcheck and staticcheck gates resolves the 49 logged issues.
  • With Go 1.25.0 and GOTOOLCHAIN=local, go test ./... passed locally across backend packages.
  • Focused Rust checks and workflow parser checks remain green.
  • Remote checks are rerunning; default-branch Dependabot findings (50 total) remain outside this PR's changed scope.

@KooshaPari

Copy link
Copy Markdown
Owner Author

Audit run 30509379794 (head f2eeeaa34d6589b89019074241c97d6d22cbff4d) reached SonarCloud with the CPD exclusion argument intact (-Dsonar.cpd.exclusions=**/*_test.go). SonarScanner exited before analysis with: You are running CI analysis while Automatic Analysis is enabled. Please consider disabling one or the other. This is a SonarCloud project configuration conflict, not a source/CPD failure. We are leaving the CPD scope unchanged and require the project owner to disable Automatic Analysis before enabling CI analysis.

@KooshaPari

Copy link
Copy Markdown
Owner Author

SonarCloud gate evidence (2026-07-30): the failure is a real duplication gate, not a missing workflow check. Public check output reports 3.6% Duplication on New Code (PR #318; PR #319 reports 3.3%, threshold <=3%). SonarCloud public project settings show sonar.autoscan.enabled=true for KooshaPari_BytePort. The repository scanner config contains sonar.cpd.exclusions=**/*_test.go, but the Automatic Analysis project mode is independent of the CI scanner and is still measuring test fixtures; the PR analysis reports new duplicate blocks in backend/models/*_100_percent_test.go plus provider files. This is not being bypassed here. Remediation requiring project/org admin access: disable SonarCloud Automatic Analysis for KooshaPari_BytePort and keep the pinned CI SonarSource/sonarqube-scan-action as the sole analysis path, then rerun this PR head. Do not relax the quality-gate threshold or broaden exclusions. If Automatic Analysis must remain enabled, the alternative is a source refactor to reduce measured duplication below 3%, followed by a fresh analysis.

@github-actions

Copy link
Copy Markdown

Legacy Tooling Scan Report

Severity Count
Critical 0
High 0
Medium 0
Low 0

No violations detected.

This is a WARN-mode scan. Fix before strict enforcement begins.

@github-actions

Copy link
Copy Markdown

📊 Tier-2 Coverage Gate Results

Tier Threshold Status
Rust lib (byteport-transport) ≥71% ✅ Pass
Go framework (backend) ≥70% ❌ Fail
Service/E2E (frontend/web) ≥60% ❌ Fail

@github-actions

Copy link
Copy Markdown

📊 Tier-2 Coverage Gate Results

Tier Threshold Status
Rust lib (byteport-transport) ≥71% ✅ Pass
Go framework (backend) ≥70% ❌ Fail
Frontend unit (frontend/web) ≥60% ✅ Pass

@github-actions

Copy link
Copy Markdown

Legacy Tooling Scan Report

Severity Count
Critical 0
High 0
Medium 0
Low 0

No violations detected.

This is a WARN-mode scan. Fix before strict enforcement begins.

@github-actions

github-actions Bot commented Aug 1, 2026

Copy link
Copy Markdown

Legacy Tooling Scan Report

Severity Count
Critical 0
High 0
Medium 0
Low 0

No violations detected.

This is a WARN-mode scan. Fix before strict enforcement begins.

@github-actions

github-actions Bot commented Aug 1, 2026

Copy link
Copy Markdown

📊 Tier-2 Coverage Gate Results

Tier Threshold Status
Rust lib (byteport-transport) ≥71% ✅ Pass
Go framework (backend) ≥70% ❌ Fail
Frontend unit (frontend/web) ≥60% ✅ Pass

@github-actions

github-actions Bot commented Aug 2, 2026

Copy link
Copy Markdown

📊 Tier-2 Coverage Gate Results

Tier Threshold Status
Rust lib (byteport-transport) ≥71% ❌ Fail
Go framework (backend) ≥70% ❌ Fail
Frontend unit (frontend/web) ≥60% ❌ Fail

@github-actions

github-actions Bot commented Aug 2, 2026

Copy link
Copy Markdown

Legacy Tooling Scan Report

Severity Count
Critical 0
High 0
Medium 0
Low 0

No violations detected.

This is a WARN-mode scan. Fix before strict enforcement begins.

@github-actions

github-actions Bot commented Aug 2, 2026

Copy link
Copy Markdown

📊 Tier-2 Coverage Gate Results

Tier Threshold Status
Rust lib (byteport-transport) ≥71% ✅ Pass
Go framework (backend) ≥70% ❌ Fail
Frontend unit (frontend/web) ≥60% ❌ Fail

@github-actions

github-actions Bot commented Aug 2, 2026

Copy link
Copy Markdown

📊 Tier-2 Coverage Gate Results

Tier Threshold Status
Rust lib (byteport-transport) ≥71% ❌ Fail
Go framework (backend) ≥70% ❌ Fail
Frontend unit (frontend/web) ≥60% ❌ Fail

@github-actions

github-actions Bot commented Aug 2, 2026

Copy link
Copy Markdown

Legacy Tooling Scan Report

Severity Count
Critical 0
High 0
Medium 0
Low 0

No violations detected.

This is a WARN-mode scan. Fix before strict enforcement begins.

@github-actions

github-actions Bot commented Aug 2, 2026

Copy link
Copy Markdown

📊 Tier-2 Coverage Gate Results

Tier Threshold Status
Rust lib (byteport-transport) ≥71% ✅ Pass
Go framework (backend) ≥70% ✅ Pass
Frontend unit (frontend/web) ≥60% ✅ Pass

@sonarqubecloud

sonarqubecloud Bot commented Aug 2, 2026

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants