feat(foreman): run_integrate tool for sliced-workload union#1045
Merged
Conversation
4 tasks
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
Add the integrate and reconcile AgenticTaskKind values (enum widened on both AgenticTask.spec.kind and Workload pipeline steps) and the payload fields the sliced-workload pipeline needs: Slices ([]SliceRef of name/branch/files), Contract, and SharedIdentifiers ([]SharedIdentifier of id/definedBy/ referencedBy). integrate reads slices[].branch + baseBranch; reconcile reads sharedIdentifiers + slices[].files + contract. Base and integration branch reuse the existing baseBranch/branch fields. API surface only: no executor handling yet (a follow-up wires the two kinds to the slicer libraries). Regenerated deepcopy + CRD manifests + chart CRDs; the AgenticTask webhook validates only agentRef, so no webhook change. Part of defilantech#1033 Signed-off-by: Christopher Maher <chris@mahercode.io>
Task 4a of the Sliced Workloads epic (defilantech#1033): the deterministic run_integrate tool that a sliced Workload's integrate step dispatches. It fetches the base from upstream and each slice branch from origin into local refs, unions them via slicer.Integrate, and pushes the integration branch back to origin for the downstream reconcile step + PR. Verdict mapping: clean union -> GATE-PASS; overlap / stale-base apply-conflict / empty union -> GATE-FAIL (a slice violated its file scope, real signal); a fetch/push fault -> GATE-ERROR (retryable). Git auth comes from repo.TokenFromEnvOrFile (same source as fetch_issue), so the tool needs no new plumbing in makeRegistryFactory. buildDeterministicArgs surfaces the slice plan (slices, upstreamURL, and the reconcile fields) only for the integrate/reconcile kinds, so the gate's args stay byte-identical. Real-git tests cover the clean union (pushed, carries both slices), overlap -> GATE-FAIL, and bad-args -> GATE-ERROR. Part of defilantech#1033 Signed-off-by: Christopher Maher <chris@mahercode.io>
…jection The tool passed user-influenced values (integration branch, base, slice branches, upstream URL) straight to git argv, so a value beginning with '-' could be smuggled in as a git flag (e.g. fetch --upload-pack=<cmd> executes a command). Validate every such value up front with refSafe/gitURLSafe (mirroring repo.gitRefSafe: no leading '-', no '..', git-ref-safe charset; URL scheme allowlist) and reject with GATE-ERROR, and pass --end-of-options on fetch/push as defense in depth. Adds a test asserting option-looking refs/URLs are rejected. Flagged by the commit security review. Signed-off-by: Christopher Maher <chris@mahercode.io>
Defilan
force-pushed
the
feat/slicer-run-integrate
branch
from
7328c26 to
4981f51
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Task 4a of the Sliced Workloads epic (#1033): the deterministic
run_integratetool that a sliced Workload'sintegratestep dispatches.It fetches the base from upstream and each slice branch from origin into local refs, unions them via
slicer.Integrate, and pushes the integration branch back to origin for the downstreamreconcilestep + PR.GATE-PASS; overlap / stale-base apply-conflict / empty union →GATE-FAIL(a slice violated its file scope — real signal); a fetch/push fault →GATE-ERROR(retryable).repo.TokenFromEnvOrFile(same source asfetch_issue), so no new plumbing inmakeRegistryFactory.buildDeterministicArgssurfaces the slice plan (slices,upstreamURL, and the reconcile fields) only for theintegrate/reconcilekinds, so the gate's args stay byte-identical.Why
The slicer combines disjoint-file slices by union. This is the executor wiring that runs that union in-cluster as a deterministic task and drives the AgenticTask verdict, sitting between the slice
issue-fixtasks and thereconcilegate.How
Mirrors the
run_gate_jobdeterministic-tool pattern (Name/Schema/Execute→Terminalverdict). The two-remote fetch (base from upstream, slices from origin) into local refs is what letsslicer.Integrate'sbase...slicediffs resolve against the current base (#813).Testing
go test ./pkg/foreman/agent/tools/ -run TestRunIntegrate— real-git tests: clean union (pushed, carries both slices), overlap →GATE-FAIL, bad-args →GATE-ERROR. Fulltools+agentpackage tests,go vet,golangci-lint,go build ./...all clean.Stacked PR
Checklist
go test/vet/golangci-lint/buildcleanPart of #1033
Assisted-by: Claude Code (Opus 4.8); reviewed and verified by the author.