ci: snapshot-cached runtime checks — split clone shards, required try-runtime snapshots, integrity manifests#2874
Conversation
… serializing behind the SDK pair Co-authored-by: Cursor <cursoragent@cursor.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🛡️ AI Review — Skeptic (security review)VERDICT: SAFE BASELINE scrutiny — repository write access and substantial activity, no Gittensor association; additional scrutiny applied for commits authored by the related UnArbosFive account; split-stake-sdk-clone-shard → main. Static review covered the expanded snapshot-artifact implementation and workflow changes added since the prior review. Snapshot selection is constrained by repository identity, trusted branch, age, API digest, network genesis, manifest contract, file size, and content checksum; PR-triggered consumers cannot select an arbitrary source branch. The clone shard split preserves the required-check fan-in and test coverage. FindingsNo findings. ConclusionNo malicious behavior or security vulnerability was found in the current diff. 🔍 AI Review — Auditor (domain review)VERDICT: 👍 UNKNOWN Gittensor association; established, highly active contributor with repository write access. The snapshot helper contract tests pass, and both modified workflows parse successfully. The producer/consumer integrity checks, fail-closed cached mode, build split, matrix fan-in, and issuance shard preserve the intended coverage. The overlapping PR #2850 concerns bittensor-core e2e work and is not a duplicate. Findings
ConclusionThe implementation is sound and adequately tested. The one-time bootstrap requirement should be made explicit before merge. |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👍 |
unarbos
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| .github/scripts/snapshot-artifact.sh select \ | ||
| "try-runtime-snap-v${TRY_RUNTIME_VERSION}-${{ matrix.network.name }}" \ | ||
| "${{ github.event_name == 'workflow_dispatch' && inputs.snapshot_source_branch || github.event.repository.default_branch }}" \ | ||
| "${{ github.repository_id }}" \ | ||
| 72 "$GITHUB_OUTPUT" required |
There was a problem hiding this comment.
[MEDIUM] Document the required bootstrap label for this PR
The default branch cannot yet have artifacts under the new versioned names because the producer naming change is introduced by this PR. With no fresh-try-runtime-state label currently attached, all three PR try-runtime jobs will fail here before the post-merge producer dispatch can occur. Add the label to this PR and update the deploy note to state that this first PR must run against live state; after merge and the initial producer dispatch, subsequent PRs can remain fail-closed on cached snapshots.
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👍 |
3 participants
Summary
Two related speedups for Runtime Checks, which has been the long pole on every runtime-affecting PR.
1. Split the stake-sdk clone shard (fe6edda)
stake-sdkkeeps the two SDK-facing tests plus the metadata drift gate; a newissuanceshard takestest-net-tao-flow-emission-allocation+test-total-issuance-trackers(the ~6-min legitimate wait) along with the 30-minute timeout override. Removes ~10 min from the longest shard.2. Snapshot-cached try-runtime (348420a, ef43c28 — authored by @UnArbosFive on
codex/try-runtime-snapshot-cache-test, cherry-picked here onto current main; conflicts with #2867's workflow changes resolved)refresh-mainnet-snapshot.yml): snapshots pinned to a finalized block (--at), shipped with a sha256/spec-version manifest, versioned artifact names (try-runtime-snap-v0.10.1-<network>), 7-day retention,max-parallel: 1so refreshes cannot crowd PR jobs off the tryruntime runner pool.runtime-checks.yml): try-runtime jobs now require a fresh (<72h) digest-verified snapshot instead of silently falling back to a 30-40 min live scrape; live state is an explicit label/dispatch bypass. Build split intobuild-try-runtime(16-core, gates try-runtime) andbuild-node-release(8-core, gates clone shards) so neither waits on the other. MBM detection auto-adds--disable-mbm-checkswhile the runtime has no multi-block migrator..github/scripts/snapshot-artifact.shhelper (select/download/validate) with contract tests wired in as asnapshot-artifact-testsjob.Conflict resolutions of note: kept main's
create-snapshotarg-order fix semantics via UnArbosFive's superset version; merged thechangesfilter to keep both #2867'spython_sdk/sdk_driftoutputs and the newsnapshot_cioutput;sdk-checkskeeps thepython_sdktrigger and gains thetry_runtime_onlydispatch exclusion.Deploy note (important)
After this merges, dispatch
refresh-mainnet-snapshot.ymlon main once: the artifact names change and snapshots become required, so runtime PRs will fail try-runtime until the first green producer run publishes the v-named artifacts. Validated on the source branch: mainnet snapshot 27 min, testnet 3 min.Test plan
.github/scripts/test-snapshot-artifact.shpasses locally