From ddab2bbeded1386ad8a781d8ad84f299bf4ac0bc Mon Sep 17 00:00:00 2001 From: Jinwoo-H Date: Thu, 3 Sep 2026 06:35:31 -0400 Subject: [PATCH] fix(cloud): run pre-checkout steps from the repo root and reach the lease tests from cloud/ defaults.run.working-directory: cloud does not exist before actions/checkout, so the eight guard/gate steps that run first (and the two checkout-free jobs, clock-skew and requeue) failed to start. Pin those steps to '.'. The pretest lease-action paths are ../.github from cloud/, and the two bare pnpm setups read cloud/package.json instead of the root's pnpm 12. Cloud Verify now also triggers on the lease action. --- .../workflows/cloud-deploy-relay-production-capacity-job.yml | 2 ++ .github/workflows/cloud-deploy-relay-production-capacity.yml | 1 + .../workflows/cloud-deploy-relay-production-same-cap-job.yml | 1 + .github/workflows/cloud-monitor-relay-clock-skew.yml | 1 + .github/workflows/cloud-operate-relay-asia-admission.yml | 2 ++ .github/workflows/cloud-operate-relay-production-rehome-job.yml | 1 + .github/workflows/cloud-prove-relay-asia-staging.yml | 2 ++ .github/workflows/cloud-recover-relay-staging-c4-image.yml | 1 + .github/workflows/cloud-requeue-relay-staging-c4-recovery.yml | 1 + .github/workflows/cloud-verify.yml | 2 ++ cloud/package.json | 2 +- 11 files changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cloud-deploy-relay-production-capacity-job.yml b/.github/workflows/cloud-deploy-relay-production-capacity-job.yml index eeea3d11a49..a98f910ada4 100644 --- a/.github/workflows/cloud-deploy-relay-production-capacity-job.yml +++ b/.github/workflows/cloud-deploy-relay-production-capacity-job.yml @@ -66,6 +66,7 @@ jobs: SOURCE_WAVE_RUN_ID: ${{ inputs.source-wave-run-id }} steps: - name: Require exact reusable-workflow invocation + working-directory: . run: | [[ "${DEPLOY_MODE}" =~ ^(verify|apply|rollback)$ ]] if test "${EVIDENCE_MODE}" = continuation; then @@ -86,6 +87,7 @@ jobs: fi - name: Require production workflow configuration + working-directory: . env: DEPLOY_WORKLOAD_IDENTITY_PROVIDER: ${{ vars.PRODUCTION_GCP_RELAY_DEPLOY_WORKLOAD_IDENTITY_PROVIDER }} DEPLOY_SERVICE_ACCOUNT: ${{ vars.PRODUCTION_GCP_RELAY_DEPLOY_SERVICE_ACCOUNT }} diff --git a/.github/workflows/cloud-deploy-relay-production-capacity.yml b/.github/workflows/cloud-deploy-relay-production-capacity.yml index 830abe8f7cd..98985eebd6a 100644 --- a/.github/workflows/cloud-deploy-relay-production-capacity.yml +++ b/.github/workflows/cloud-deploy-relay-production-capacity.yml @@ -119,6 +119,7 @@ jobs: WAVE_CELL_IDS: ${{ inputs.wave-cell-ids }} steps: - name: Require production workflow configuration + working-directory: . env: DEPLOY_WORKLOAD_IDENTITY_PROVIDER: ${{ vars.PRODUCTION_GCP_RELAY_DEPLOY_WORKLOAD_IDENTITY_PROVIDER }} DEPLOY_SERVICE_ACCOUNT: ${{ vars.PRODUCTION_GCP_RELAY_DEPLOY_SERVICE_ACCOUNT }} diff --git a/.github/workflows/cloud-deploy-relay-production-same-cap-job.yml b/.github/workflows/cloud-deploy-relay-production-same-cap-job.yml index 2821bc26660..a8d8c68fafd 100644 --- a/.github/workflows/cloud-deploy-relay-production-same-cap-job.yml +++ b/.github/workflows/cloud-deploy-relay-production-same-cap-job.yml @@ -55,6 +55,7 @@ jobs: OUTPUT_DIRECTORY: ${{ github.workspace }}/relay-monitor-evidence steps: - name: Require exact reusable-workflow configuration + working-directory: . env: DEPLOY_WIF: ${{ vars.PRODUCTION_GCP_RELAY_DEPLOY_WORKLOAD_IDENTITY_PROVIDER }} DEPLOY_SERVICE_ACCOUNT: ${{ vars.PRODUCTION_GCP_RELAY_DEPLOY_SERVICE_ACCOUNT }} diff --git a/.github/workflows/cloud-monitor-relay-clock-skew.yml b/.github/workflows/cloud-monitor-relay-clock-skew.yml index 86156807bf0..9d4de846519 100644 --- a/.github/workflows/cloud-monitor-relay-clock-skew.yml +++ b/.github/workflows/cloud-monitor-relay-clock-skew.yml @@ -24,6 +24,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Measure Date-header skew for every relay cell + working-directory: . run: | set -u # Date headers carry whole seconds; compare floored seconds on both diff --git a/.github/workflows/cloud-operate-relay-asia-admission.yml b/.github/workflows/cloud-operate-relay-asia-admission.yml index 2196c06dc5c..7abae2f8646 100644 --- a/.github/workflows/cloud-operate-relay-asia-admission.yml +++ b/.github/workflows/cloud-operate-relay-asia-admission.yml @@ -172,6 +172,8 @@ jobs: node-version: 24 - uses: pnpm/action-setup@v4 + with: + package_json_file: cloud/package.json if: ${{ inputs.environment == 'production' && inputs.mode == 'promote' && inputs.cell-ids == 'production-gce-c27' }} - name: Install exact C27 canary dependencies diff --git a/.github/workflows/cloud-operate-relay-production-rehome-job.yml b/.github/workflows/cloud-operate-relay-production-rehome-job.yml index 058ee2e54cf..1ceadcece12 100644 --- a/.github/workflows/cloud-operate-relay-production-rehome-job.yml +++ b/.github/workflows/cloud-operate-relay-production-rehome-job.yml @@ -58,6 +58,7 @@ jobs: OUTPUT_DIRECTORY: ${{ github.workspace }}/relay-monitor-evidence steps: - name: Require exact reusable-workflow configuration + working-directory: . env: DEPLOY_WIF: ${{ vars.PRODUCTION_GCP_RELAY_DEPLOY_WORKLOAD_IDENTITY_PROVIDER }} DEPLOY_SERVICE_ACCOUNT: ${{ vars.PRODUCTION_GCP_RELAY_DEPLOY_SERVICE_ACCOUNT }} diff --git a/.github/workflows/cloud-prove-relay-asia-staging.yml b/.github/workflows/cloud-prove-relay-asia-staging.yml index 9275dedc536..9a66e967b57 100644 --- a/.github/workflows/cloud-prove-relay-asia-staging.yml +++ b/.github/workflows/cloud-prove-relay-asia-staging.yml @@ -85,6 +85,8 @@ jobs: node-version: 24 - uses: pnpm/action-setup@v4 + with: + package_json_file: cloud/package.json - name: Require the exact staging director image before promotion env: diff --git a/.github/workflows/cloud-recover-relay-staging-c4-image.yml b/.github/workflows/cloud-recover-relay-staging-c4-image.yml index dc6d4eaaebe..42cbaf0e374 100644 --- a/.github/workflows/cloud-recover-relay-staging-c4-image.yml +++ b/.github/workflows/cloud-recover-relay-staging-c4-image.yml @@ -29,6 +29,7 @@ jobs: recover: ${{ steps.trigger.outputs.recover }} steps: - name: Bind recovery to the exact failed C4 job + working-directory: . id: trigger env: CONFIRMATION: ${{ inputs.confirmation }} diff --git a/.github/workflows/cloud-requeue-relay-staging-c4-recovery.yml b/.github/workflows/cloud-requeue-relay-staging-c4-recovery.yml index d137c0b1fdc..d92086a620a 100644 --- a/.github/workflows/cloud-requeue-relay-staging-c4-recovery.yml +++ b/.github/workflows/cloud-requeue-relay-staging-c4-recovery.yml @@ -24,6 +24,7 @@ jobs: timeout-minutes: 5 steps: - name: Requeue only a cancelled protected recovery job + working-directory: . env: GH_TOKEN: ${{ github.token }} SOURCE_RUN_ID: ${{ github.event.workflow_run.id }} diff --git a/.github/workflows/cloud-verify.yml b/.github/workflows/cloud-verify.yml index 7e76f4ef230..0600bcbb182 100644 --- a/.github/workflows/cloud-verify.yml +++ b/.github/workflows/cloud-verify.yml @@ -5,11 +5,13 @@ on: paths: - cloud/** - .github/workflows/cloud-*.yml + - .github/actions/cloud-sql-rollout-lease/** push: branches: [main] paths: - cloud/** - .github/workflows/cloud-*.yml + - .github/actions/cloud-sql-rollout-lease/** permissions: contents: read diff --git a/cloud/package.json b/cloud/package.json index 4666eb73440..c75d027d3d2 100644 --- a/cloud/package.json +++ b/cloud/package.json @@ -20,7 +20,7 @@ "load:relay:model": "node dev/scripts/run-relay-load-model.mjs", "load:relay:recovery-gate": "node dev/scripts/run-relay-recovery-wave-gate.mjs", "ops:relay": "pnpm --filter @orca-cloud/relay-ops dev", - "pretest": "node --test dev/scripts/capture-terraform-plan-baseline.test.mjs dev/scripts/operate-relay-asia-admission.test.mjs dev/scripts/prepare-relay-asia-director-cells.test.mjs dev/scripts/prepare-relay-asia-topology-input.test.mjs dev/scripts/production-cloud-sql-rollout-lock.test.mjs dev/scripts/read-relay-serving-regional-placement-version.test.mjs dev/scripts/relay-asia-admission-workflow.test.mjs dev/scripts/relay-asia-rollout-evidence.test.mjs dev/scripts/relay-asia-topology-workflow.test.mjs dev/scripts/relay-cloud-sql-connection-budget.test.mjs dev/scripts/relay-load-reader-evidence.test.mjs dev/scripts/relay-staging-deploy-identity.test.mjs dev/scripts/sanitize-relay-asia-admission-result.test.mjs dev/scripts/terraform-root-partition.test.mjs dev/scripts/validate-relay-asia-topology-plan.test.mjs .github/actions/cloud-sql-rollout-lease/action-contract.test.mjs .github/actions/cloud-sql-rollout-lease/storage-lease.test.mjs", + "pretest": "node --test dev/scripts/capture-terraform-plan-baseline.test.mjs dev/scripts/operate-relay-asia-admission.test.mjs dev/scripts/prepare-relay-asia-director-cells.test.mjs dev/scripts/prepare-relay-asia-topology-input.test.mjs dev/scripts/production-cloud-sql-rollout-lock.test.mjs dev/scripts/read-relay-serving-regional-placement-version.test.mjs dev/scripts/relay-asia-admission-workflow.test.mjs dev/scripts/relay-asia-rollout-evidence.test.mjs dev/scripts/relay-asia-topology-workflow.test.mjs dev/scripts/relay-cloud-sql-connection-budget.test.mjs dev/scripts/relay-load-reader-evidence.test.mjs dev/scripts/relay-staging-deploy-identity.test.mjs dev/scripts/sanitize-relay-asia-admission-result.test.mjs dev/scripts/terraform-root-partition.test.mjs dev/scripts/validate-relay-asia-topology-plan.test.mjs ../.github/actions/cloud-sql-rollout-lease/action-contract.test.mjs ../.github/actions/cloud-sql-rollout-lease/storage-lease.test.mjs", "test": "pnpm -r test && node --test dev/scripts/classify-relay-production-capacity-director.test.mjs dev/scripts/classify-relay-staging-bootstrap.test.mjs dev/scripts/deploy-relay-blue-green.test.mjs dev/scripts/deploy-relay-gce-candidate.test.mjs dev/scripts/deploy-relay-gce-multi-target.test.mjs dev/scripts/github-smoke-token.test.mjs dev/scripts/infra.test.mjs dev/scripts/operate-relay-regional-rehome.test.mjs dev/scripts/power-staging-relay.test.mjs dev/scripts/prepare-relay-capacity-canary.test.mjs dev/scripts/prepare-relay-production-capacity-canary.test.mjs dev/scripts/probe-relay-legacy-admission.test.mjs dev/scripts/probe-relay-rehome-trust.test.mjs dev/scripts/production-cell-image-digest-consistency.test.mjs dev/scripts/read-relay-production-capacity-identity.test.mjs dev/scripts/relay-admission-selector.test.mjs dev/scripts/relay-gce-terraform-fence.test.mjs dev/scripts/relay-load-connection-failure.test.mjs dev/scripts/relay-load-control-peer.test.mjs dev/scripts/relay-load-director-capacity-gate.test.mjs dev/scripts/relay-load-model.test.mjs dev/scripts/relay-load-phase-barrier.test.mjs dev/scripts/relay-load-placement-boundary.test.mjs dev/scripts/relay-load-profile.test.mjs dev/scripts/relay-load-rebind-boundary.test.mjs dev/scripts/relay-load-region-behavior.test.mjs dev/scripts/relay-load-request-unit-boundary.test.mjs dev/scripts/relay-load-run-lifecycle.test.mjs dev/scripts/relay-monitor-evidence.test.mjs dev/scripts/relay-production-capacity-wave.test.mjs dev/scripts/relay-production-capacity-workflow.test.mjs dev/scripts/relay-production-identity-boundaries.test.mjs dev/scripts/relay-production-same-cap-wave.test.mjs dev/scripts/relay-public-workflow-contract.test.mjs dev/scripts/relay-recovery-wave-gate.test.mjs dev/scripts/relay-region-observation-evidence.test.mjs dev/scripts/relay-regional-rehome-workflow.test.mjs dev/scripts/relay-rehome-aggregate-evidence.test.mjs dev/scripts/relay-repository.test.mjs dev/scripts/relay-staging-c4-refresh-workflow.test.mjs dev/scripts/relay-staging-capacity-identity.test.mjs dev/scripts/staging-relay-apply-guard.test.mjs dev/scripts/validate-relay-capacity-plan.test.mjs dev/scripts/verify-relay-capacity-transition.test.mjs dev/scripts/verify-relay-legacy-bootstrap.test.mjs dev/scripts/workload-identity-attribute-conditions.test.mjs", "typecheck": "pnpm -r typecheck" },