Repository navigation
Harden GitHub Actions and fix preview database caching - #23
Merged
Merged
Conversation
Add secret-free TypeScript checks for fork PRs while retaining AWS-backed integration tests for same-repository PRs and manual runs. Require successful master CI for the exact commit before publishing containers. Scope release write permissions to asset uploads, disable Actions caching, and pass image outputs through environment variables. Document CI behavior and correct the yarn loglevel option.
Restore only the two newest ledger snapshots and make integration jobs read-only consumers of the S3 cache. Serialize cache writers, upload retained snapshots before pruning obsolete ones, and mirror volatile files. Require a successful restore and clean shutdown before saving. Handle S3 listing errors explicitly and add cache regression tests.
johnalotoski
force-pushed
the
jl/gha-update-and-cache-fix
branch
from
November 13, 2026 00:01
084415c to
d071f10
Compare
There was a problem hiding this comment.
🔵 Needs a closer look
Destructive pruning of the shared S3 cache requires live validation of bucket layout and restore compatibility, plus confirmation of deletion permissions and stopped legacy writers, which filesystem fixtures cannot establish.
No open issues 🎉
What changed in this PR
This PR hardens GitHub Actions and reduces preview database cache growth by separating integration-test readers from a single cache writer.
Changes:
- Adds selective database restores, guarded saves, stale-snapshot pruning, and local regression tests.
- Adds secret-free fork checks, tighter permissions, disabled Actions caching, and exact-commit master CI checks before container publication.
- Bounds synchronization waits and retries, improves shutdown handling, and documents workflow security and cache behavior.
| File | Description |
|---|---|
| CONTRIBUTING.md | Documents workflow trust boundaries, cache behavior, and local tests. |
| .github/workflows/scripts/test-preview-cache.py | Adds fixture-based cache and synchronization regression tests. |
| .github/workflows/scripts/preview-node-sync.sh | Adds explicit socket configuration, startup timeout, and bounded query retries. |
| .github/workflows/scripts/preview-db-save.sh | Guards uploads and prunes obsolete ledger and volatile data. |
| .github/workflows/scripts/preview-db-restore.sh | Restores the two newest ledger snapshots with transfer retries. |
| .github/workflows/scripts/preview-db-common.sh | Shares cache listing, snapshot filtering, and argument validation helpers. |
| .github/workflows/release-upload.yaml | Narrows permissions and token scope; disables Actions caching. |
| .github/workflows/network-synchronization.yaml | Serializes cache writers and requires successful restore and shutdown before saving. |
| .github/workflows/continuous-integration.yaml | Adds fork checks and makes integration jobs cache consumers only. |
| .github/workflows/container-image.yaml | Gates publication on exact-commit master CI and passes manifest inputs through environment variables. |
| .ai/skills/gha/SKILL.md | Updates guidance on workflow trust, injection prevention, credentials, and cache isolation. |
Review effort: Balanced
johnalotoski
marked this pull request as ready for review
November 13, 2026 00:37
Pass the node socket explicitly to cardano-cli and surface query errors instead of silently retrying until the job times out. Detect stopped containers, bound startup and query retries, and reserve time for shutdown and cache upload. Validate the sync target while preserving an explicit zero. Add sync-loop regression tests and update testing documentation.
johnalotoski
force-pushed
the
jl/gha-update-and-cache-fix
branch
from
November 13, 2026 00:45
d071f10 to
ab95177
Compare
Wait for valid progress instead of exiting when a successful tip query omits it. Bound retries by the synchronization deadline and preserve zero-target behavior. Add regression coverage for missing and invalid progress, recovery, and timeout handling.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Preview database restores had grown to 52 GB because S3 retained obsolete
ledger snapshots and volatile files. Network Synchronization also retried
failing tip queries silently until the six-hour job timeout.
This PR:
snapshots after uploading fresh state.
writers, requiring successful restore and clean shutdown before saving.
and query retries, with visible errors.
tests for same-repository PRs and manual runs.
successful master CI for the exact commit before publishing containers.
Validation: 17 local regression tests, ShellCheck, and actionlint passed
(with the older linter's unsupported cache-mode diagnostic excluded).
The first successful updated synchronization run cleans up accumulated
cache objects. Avoid overlapping it with older workflows that still write
to the same S3 prefix.