Select compatible images from verified main artifacts - #73093
Draft
jason810496 wants to merge 4 commits into
Draft
Select compatible images from verified main artifacts#73093jason810496 wants to merge 4 commits into
jason810496 wants to merge 4 commits into
Conversation
Shared CI environments must fail when their locked dependencies cannot be installed, so consumers never reuse a silently re-resolved environment.
Application-only changes should not repeat dependency installation. Separate metadata inputs retain resolver checks while current wheels replace application files.
CI needs a stable compatibility and provenance contract before it can safely reuse an image produced by another workflow run.
A cross-run artifact download that degrades to a crawl instead of failing outright previously had no circuit breaker: nothing aborted it, and the consumer would just wait far longer than a fresh build would have taken. Measure the average transfer rate after the first 30 seconds and abandon the download in favor of building locally once it falls under 50 MB/s, the rate below which finishing the transfer is expected to cost more time than it saves.
This was referenced Sep 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 3/5 of the CI image reuse series.
Why
Image reuse must match the checkout and reject stale or untrusted artifacts.
How
Fingerprint build inputs, verify publisher provenance and archive digests, and pin immutable selections across retries. Abort and fall back to a full build when a selected image's download is measurably too slow — averaging under 50 MB/s over its first 30 seconds — instead of letting a degraded transfer run to completion.
Series impact (audit draft)
Sept 6–12, 2026 UTC PR census and CI timing:
The purpose is to avoid rebuilding the CI image when a PR doesn't change package dependencies — currently, even a PR that only touches the API server or the UI still triggers a full CI image rebuild on every push — and real hit rate and end-to-end PR latency remain unmeasured pending a pilot.
Was generative AI tooling used to co-author this PR?
Generated-by: Codex (GPT-6)