Merge pull request 'release: promote dev -> stage (ci publish hardening for stage/main)' (#76 ) from dev into stage

Merge pull request 'ci(stage,main): decouple ci-base rebuild, make SDK publish fail loudly' (#75 ) from hotfix/ci-stage-main-publish-hardening into dev
ci(stage,main): decouple ci-base rebuild, make SDK publish fail loudly
2026-07-15 21:16:11 +00:00 · 2026-07-15 21:15:27 +00:00 · 2026-07-15 16:14:50 -05:00 · 2026-07-15 17:20:11 +00:00 · 2026-07-15 16:34:14 +00:00 · 2026-07-15 11:33:37 -05:00
3 changed files with 45 additions and 0 deletions
@@ -214,9 +214,18 @@ jobs:
        env:
          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
        run: |
+          # Fail loudly: previously this step had no `set -e`, so an auth or
+          # upload failure was swallowed (step exited 0 on the trailing echo)
+          # and the SDK silently never published. Surface failures now.
+          set -euo pipefail
+          if [ -z "${GCP_SA_KEY:-}" ]; then
+            echo "FATAL: GCP_SA_KEY secret is empty — cannot authenticate to publish" >&2
+            exit 1
+          fi
          echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
          gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
          gcloud config set project neuron-785695
+          echo "Publishing as active account: $(gcloud config get-value account 2>/dev/null)"

          VERSION="${GITHUB_SHA:0:8}"

@@ -268,6 +277,12 @@ jobs:
        # Patches ci-base:dev in-place: pulls the existing image (which has all
        # system deps — Node, Go, gcloud, Docker CLI, etc.) and overlays the freshly
        # built El SDK on top. Keeps the full ci-base rebuild fast and incremental.
+        #
+        # continue-on-error: this is a CI-cache optimization, NOT the release
+        # artifact. It runs Docker (pull/build/push ~600MB) on the host-mode GCE
+        # runner where DinD/Docker availability is fragile. A failure here must
+        # never block or redden the job — the SDK publish above is the deliverable.
+        continue-on-error: true
        if: github.event_name == 'push'
        env:
          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
@@ -212,12 +212,21 @@ jobs:
        env:
          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
        run: |
+          # Fail loudly: previously this step had no `set -e`, so an auth or
+          # upload failure was swallowed (step exited 0 on the trailing echo)
+          # and the SDK silently never published. Surface failures now.
+          set -euo pipefail
+          if [ -z "${GCP_SA_KEY:-}" ]; then
+            echo "FATAL: GCP_SA_KEY secret is empty — cannot authenticate to publish" >&2
+            exit 1
+          fi
          echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
          apt-get install -y -qq apt-transport-https ca-certificates curl
          echo "deb [trusted=yes] https://packages.cloud.google.com/apt cloud-sdk main" > /etc/apt/sources.list.d/google-cloud-sdk.list
          apt-get update -qq && apt-get install -y google-cloud-cli
          gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
          gcloud config set project neuron-785695
+          echo "Publishing as active account: $(gcloud config get-value account 2>/dev/null)"

          VERSION="${GITHUB_SHA:0:8}"

@@ -253,6 +262,12 @@ jobs:
        # Patches ci-base:stage in-place: pulls the existing image (which has all
        # system deps — Node, Go, gcloud, Docker CLI, etc.) and overlays the freshly
        # built El SDK on top. Keeps the full ci-base rebuild fast and incremental.
+        #
+        # continue-on-error: this is a CI-cache optimization, NOT the release
+        # artifact. It runs Docker (pull/build/push ~600MB) on the host-mode GCE
+        # runner where DinD/Docker availability is fragile. A failure here must
+        # never block or redden the job — the SDK publish above is the deliverable.
+        continue-on-error: true
        if: github.event_name == 'push'
        env:
          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
@@ -288,12 +288,21 @@ jobs:
        env:
          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
        run: |
+          # Fail loudly: previously this step had no `set -e`, so an auth or
+          # upload failure was swallowed (step exited 0 on the trailing echo)
+          # and the SDK silently never published. Surface failures now.
+          set -euo pipefail
+          if [ -z "${GCP_SA_KEY:-}" ]; then
+            echo "FATAL: GCP_SA_KEY secret is empty — cannot authenticate to publish" >&2
+            exit 1
+          fi
          echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
          apt-get install -y -qq apt-transport-https ca-certificates curl
          echo "deb [trusted=yes] https://packages.cloud.google.com/apt cloud-sdk main" > /etc/apt/sources.list.d/google-cloud-sdk.list
          apt-get update -qq && apt-get install -y google-cloud-cli
          gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
          gcloud config set project neuron-785695
+          echo "Publishing as active account: $(gcloud config get-value account 2>/dev/null)"

          VERSION="${GITHUB_SHA:0:8}"

@@ -345,6 +354,12 @@ jobs:
        # Patches ci-base:latest in-place: pulls the existing image (which has all
        # system deps — Node, Go, gcloud, Docker CLI, etc.) and overlays the freshly
        # built El SDK on top. Keeps the full ci-base rebuild fast and incremental.
+        #
+        # continue-on-error: this is a CI-cache optimization, NOT the release
+        # artifact. It runs Docker (pull/build/push ~600MB) on the host-mode GCE
+        # runner where DinD/Docker availability is fragile. A failure here must
+        # never block or redden the job — the SDK publish above is the deliverable.
+        continue-on-error: true
        if: github.event_name == 'push'
        env:
          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
Author	SHA1	Message	Date
will.anderson	6a8b2461cd	Merge pull request 'release: promote dev -> stage (ci publish hardening for stage/main)' (#76 ) from dev into stage El SDK CI - stage / build-and-test (push) Successful in 8m19s Details El SDK Release / build-and-release (pull_request) Failing after 13m1s Details	2026-07-15 21:16:11 +00:00
will.anderson	bcb356fe69	Merge pull request 'ci(stage,main): decouple ci-base rebuild, make SDK publish fail loudly' (#75 ) from hotfix/ci-stage-main-publish-hardening into dev El SDK CI - stage / build-and-test (pull_request) Successful in 4m27s Details El SDK CI - dev / build-and-test (push) Failing after 14m3s Details	2026-07-15 21:15:27 +00:00
will.anderson	dd7827059a	ci(stage,main): decouple ci-base rebuild, make SDK publish fail loudly El SDK CI - dev / build-and-test (pull_request) Failing after 14m30s Details Mirror the PR #72 fix (applied to ci-dev.yaml) onto ci-stage.yaml and sdk-release.yaml. The stage and prod release jobs reported FAILURE even when the el-runtime-c/-h publish SUCCEEDED, because the ancillary ci-base Docker rebuild (a CI-cache optimization on the fragile host-mode GCE runner) reddened the whole job. - Rebuild ci-base step: continue-on-error: true — never blocks/reddens the job; the SDK publish is the deliverable. - Publish step: set -euo pipefail + empty-key guard + active-account echo so a real publish failure still fails loud and is diagnosable.	2026-07-15 16:14:50 -05:00
will.anderson	b97ce74d1f	Merge pull request 'release: promote dev -> stage (tokenized search, get_node_by_label, epm fix)' (#73 ) from dev into stage El SDK CI - stage / build-and-test (push) Failing after 8m45s Details El SDK Release / build-and-release (pull_request) Successful in 4m1s Details	2026-07-15 17:20:11 +00:00
will.anderson	155a449c4e	Merge pull request 'ci(dev): make SDK publish fail loudly, decouple ci-base rebuild' (#72 ) from hotfix/ci-dev-publish-hardening into dev El SDK CI - dev / build-and-test (push) Successful in 8m56s Details El SDK CI - stage / build-and-test (pull_request) Successful in 4m10s Details	2026-07-15 16:34:14 +00:00
will.anderson	4696fd6833	ci(dev): make SDK publish fail loudly, decouple ci-base rebuild El SDK CI - dev / build-and-test (pull_request) Successful in 8m51s Details The dev push build went green-then-red while nothing published: the Publish step had no set -e, so an auth/upload failure exited 0 (silent no-publish), while the ci-base rebuild (set -euo pipefail + Docker on the host-mode runner) hard-failed the job. Add set -euo pipefail + an empty-key guard + active-account echo to the Publish step so failures surface with a retrievable log, and mark the ci-base cache rebuild continue-on-error so the fragile Docker step can never block the actual SDK artifact publish.	2026-07-15 11:33:37 -05:00
will.anderson	581a351fb1	Merge pull request 'integrate: stack PRs #65–#69 (elc OOM guard, tokenized+semantic engram search, get_node_by_label, win portability) for green CI' (#71 ) from hotfix/stage-elc-engram-integration into dev El SDK CI - dev / build-and-test (push) Failing after 14m31s Details	2026-07-15 15:49:57 +00:00
will.anderson	5c41c66a0f	Merge pull request 'fix(windows): guard el_mem_check with _WIN32 — rusage is POSIX-only' (#60 ) from fix/windows-rusage-guard into stage El SDK CI - stage / build-and-test (push) Failing after 13m21s Details fix(windows): guard el_mem_check with _WIN32 — rusage is POSIX-only	2026-06-25 16:48:13 +00:00