From 55fa5598c7b3696459f1f3e623f6025cf7ea906e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20=C5=A0tetiar?= Date: Wed, 22 Jul 2026 19:48:50 +0200 Subject: [PATCH] ci: cram: gate arming builds on component selection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit An automatic CRAM job waits for a manual build only when that build is non-optional and not allowed to fail. Leaving the manual build default in place would skip the downstream job initially and could run it after a failed build. Override rules on the six builds consumed by automatic CRAM jobs. Make a build blocking exactly when its board's automatic job is armed, using the same changes anchors and label policy. Keep variable and skip stand-down paths manual and non-blocking. GitLab gives a manual job selected through rules the real default of allow_failure: false. Scope the explicit non-blocking fallback to merge request pipelines so non-arming MRs do not block, while push, web, API, and branch pipelines retain their existing implicit blocking form. Preserve schedule, designated-branch, and release-tag behavior. Leave the x86_64 and extender builds unchanged. Assisted-by: codex:gpt-5.6-sol References: CI-9 Signed-off-by: Petr Štetiar --- .gitlab-ci.yml | 120 +++++++++++++++++++++++++++++++++++ .gitlab/tests/cram/README.md | 34 ++++++++++ 2 files changed, 154 insertions(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 22502f32fe..ff61ab9832 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -136,24 +136,144 @@ stages: build test mxl_x86_osp_tb341_v2 mxl_wlan_hostap_ng_wav700 prpl cellular security thread: extends: .build test config + rules: + - if: '$CI_PIPELINE_SOURCE == "schedule"' + when: never + - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH' + - if: '$CI_COMMIT_TAG =~ /^prplware-v[0-9]+\.[0-9]+\.[0-9]+.*$/' + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CRAM_COMPONENTS != null' + when: manual + allow_failure: true + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::skip($|,)/' + when: manual + allow_failure: true + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::(full|prplmesh|lcm|prplos)($|,)/' + when: manual + allow_failure: false + - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' + changes: *cram_changes_mxl25641_hdk_6 + when: manual + allow_failure: false + - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' + when: manual + allow_failure: true + - when: manual build test mvebu prpl security: extends: .build test config + rules: + - if: '$CI_PIPELINE_SOURCE == "schedule"' + when: never + - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH' + - if: '$CI_COMMIT_TAG =~ /^prplware-v[0-9]+\.[0-9]+\.[0-9]+.*$/' + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CRAM_COMPONENTS != null' + when: manual + allow_failure: true + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::skip($|,)/' + when: manual + allow_failure: true + - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' + changes: *cram_changes_turris_omnia + when: manual + allow_failure: false + - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' + when: manual + allow_failure: true + - when: manual build test x86_64 prpl security: extends: .build test config build test ipq807x prpl security: extends: .build test config + rules: + - if: '$CI_PIPELINE_SOURCE == "schedule"' + when: never + - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH' + - if: '$CI_COMMIT_TAG =~ /^prplware-v[0-9]+\.[0-9]+\.[0-9]+.*$/' + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CRAM_COMPONENTS != null' + when: manual + allow_failure: true + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::skip($|,)/' + when: manual + allow_failure: true + - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' + changes: *cram_changes_prpl_haze + when: manual + allow_failure: false + - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' + when: manual + allow_failure: true + - when: manual build test mtk_filogic prpl security: extends: .build test config + rules: + - if: '$CI_PIPELINE_SOURCE == "schedule"' + when: never + - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH' + - if: '$CI_COMMIT_TAG =~ /^prplware-v[0-9]+\.[0-9]+\.[0-9]+.*$/' + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CRAM_COMPONENTS != null' + when: manual + allow_failure: true + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::skip($|,)/' + when: manual + allow_failure: true + - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' + changes: *cram_changes_arcadyan_mozart + when: manual + allow_failure: false + - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' + when: manual + allow_failure: true + - when: manual build test airoha_an7581 prpl security: extends: .build test config + rules: + - if: '$CI_PIPELINE_SOURCE == "schedule"' + when: never + - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH' + - if: '$CI_COMMIT_TAG =~ /^prplware-v[0-9]+\.[0-9]+\.[0-9]+.*$/' + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CRAM_COMPONENTS != null' + when: manual + allow_failure: true + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::skip($|,)/' + when: manual + allow_failure: true + - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' + changes: *cram_changes_nokia_valyrian + when: manual + allow_failure: false + - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' + when: manual + allow_failure: true + - when: manual build test qca_ipq95xx prpl cellular security thread: extends: .build test config + rules: + - if: '$CI_PIPELINE_SOURCE == "schedule"' + when: never + - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH' + - if: '$CI_COMMIT_TAG =~ /^prplware-v[0-9]+\.[0-9]+\.[0-9]+.*$/' + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CRAM_COMPONENTS != null' + when: manual + allow_failure: true + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::skip($|,)/' + when: manual + allow_failure: true + - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::(full|prplmesh|lcm|prplos)($|,)/' + when: manual + allow_failure: false + - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' + changes: *cram_changes_wnc_freedom + when: manual + allow_failure: false + - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' + when: manual + allow_failure: true + - when: manual build test qca_ipq95xx extender_minimal cellular security thread: extends: .build test config diff --git a/.gitlab/tests/cram/README.md b/.gitlab/tests/cram/README.md index b41c96b865..332fcab2f5 100644 --- a/.gitlab/tests/cram/README.md +++ b/.gitlab/tests/cram/README.md @@ -157,6 +157,31 @@ it reserves no hardware. The `lint cram component manifest` job and the four named component jobs also remain manual and non-gating. Play a named component job directly when an explicit bucket is more useful than the computed result. +### Build consent and job states + +Automatic selection never starts a build. Playing a board's manual build is +the consent action; after a successful build, an armed `[auto]` job starts +without another click. Cross-cutting changes arm only Freedom and OSPv2, while +a board-specific change can arm its owning non-priority board. + +The dependency on the manual build affects the state GitLab displays: + +- `created` means `[auto]` is armed and waiting for a required, blocking build. +- `manual` means the job is directly playable now, as with named component + jobs or an `[auto]` job whose manual fallback is available after its build. +- `skipped` can mean **skipped until the build runs**: a dormant `[auto]` job + whose required build is still an unplayed, non-blocking manual job is shown + as skipped rather than manual/created. Playing and completing that build + makes the downstream job available; the selection was not deleted. + +The last state also covers the creation-time `cram::skip` scenario: the label +makes both the build and `[auto]` fallback non-blocking, so GitLab displays the +downstream job as `skipped`. If `cram::skip` is added only after pipeline +creation, the runtime label check exits an already-armed job green before +labgrid reservation. Other empty results (`nothing-mapped` and the guarded +coarse/runtime drift case) also log their reason and exit before any DUT +interaction; resolver or malformed-matrix errors remain failures. + To start named component jobs automatically, set the pipeline-level `CRAM_COMPONENTS` variable to a comma-separated list containing one or more of `full`, @@ -172,6 +197,15 @@ CRAM_COMPONENTS=lcm,prplos CRAM_COMPONENTS=full ``` +### Kill switches + +Use the narrowest suitable control: + +1. Add `cram::skip` to disable automatic selection for one MR. +2. Run one pipeline with `CRAM_COMPONENTS=none`. +3. Set the project CI variable `CRAM_COMPONENTS=none` for a global stand-down. +4. Revert the CI wiring commit for the hard rollback. + Release tag pipelines (`prplware-v*`) start the `full` jobs automatically; the other buckets stay manual there. Scheduled pipelines never create cram jobs, because they also never create the build jobs these jobs need. The job