From c2176880f5e2dae529de8cad1eeae9e6a669cc59 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 13 Aug 2026 09:39:14 +0000 Subject: [PATCH 1/3] Initial plan From 86a33fb3ec41ce088e055ed8905effff4a009c4b Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 13 Aug 2026 09:50:15 +0000 Subject: [PATCH 2/3] Apply remaining changes Co-authored-by: mjp41 <270363+mjp41@users.noreply.github.com> --- PLAN.md | 74 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 PLAN.md diff --git a/PLAN.md b/PLAN.md new file mode 100644 index 000000000..7ab8732ec --- /dev/null +++ b/PLAN.md @@ -0,0 +1,74 @@ +# Plan: Fix benchmark GitHub Actions job + +## Context + +The benchmark job with check run ID `94399445543` fails while Docker Buildx is +building `benchmark/Dockerfile`. The failing step is: + +```text +RUN ./build-bench-env.sh packages +``` + +The Dockerfile clones `daanx/mimalloc-bench` at pinned commit +`a4ce904286365c7adfba54f0eea3a2df3fc95bd1`. At that commit, +`build-bench-env.sh` installs Bazel unconditionally on Ubuntu during the +`packages` phase by downloading `https://bazel.build/bazel-release.pub.gpg`, +which now returns HTTP 404. The failed download causes +`gpg: no valid OpenPGP data found` and exits the Docker build. + +The current branch has been checked against `origin/main` and is one commit +ahead, zero commits behind. + +Bazel is only needed by the external script when building Google's tcmalloc +(`tcg`). This Dockerfile does not build or benchmark `tcg`; it builds benchmark +workloads and runs them only against `/snmalloc/build/libsnmallocshim.so` via +`/allocs.txt`. + +## Relevant principles + +- Read the affected benchmark Docker path before modifying it. +- Make the smallest repository-local change that fixes the failing CI setup. +- Do not modify unrelated benchmark behavior or update the pinned + `mimalloc-bench` revision unless necessary. +- Remove unused fragile setup from this benchmark image instead of replacing it + with another external network dependency. +- Baseline the failing path before implementation and validate the fixed path + after implementation as far as this environment permits. +- Delegate build/test validation to a testing subagent using + `.github/skills/building_and_testing.md`. +- Do not commit changes until the user has reviewed and explicitly approved. + +## Steps and gates + +1. Baseline the relevant failure. + - Gate: use the CI check-run log, and any locally reproducible evidence if + network access permits, to confirm the pre-fix Docker setup failure is in + `./build-bench-env.sh packages` on the Bazel install path. +2. Patch the cloned pinned `mimalloc-bench` script during the Docker build to + skip the unnecessary Bazel install. + - Gate: `benchmark/Dockerfile` still clones the same pinned commit and adds + only a narrow, fail-loud patch in a new `RUN` layer after the pinned + `git reset --hard` and before `./build-bench-env.sh packages`. + - Gate: the patch targets only the standalone Ubuntu/Debian + `aptinstallbazel` call site, not the `function aptinstallbazel` + definition. Use an anchored pattern equivalent to + `^[[:space:]]*aptinstallbazel[[:space:]]*$`. + - Gate: the patch verifies the expected post-condition with correct exit + semantics so future silent no-op substitutions fail immediately: if the + standalone call pattern is still present, the Docker build prints a clear + error and exits non-zero; otherwise it continues. +3. Decide focused-test coverage. + - Gate: if existing test infrastructure can cheaply validate the Dockerfile + patch, add a focused test; otherwise document why no repository test is + appropriate for this CI-environment-only Docker setup fix. +4. Run targeted validation. + - Gate: delegate a targeted Docker validation to a testing subagent and + confirm the benchmark image progresses past the previous Bazel install + failure, or capture any new failure separately. If local network + restrictions prevent full Docker validation, document that the self-hosted + benchmark runner is the final validation point. Later benchmark steps also + fetch/build external projects, so additional upstream fragility may only + surface on that runner. +5. Final checks. + - Gate: run secret scanning on changed files, request automated code review, + run CodeQL checker, address applicable findings, and report final status. From 267776360aacb39627c00663cbdeeec00d97d0aa Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 13 Aug 2026 09:59:44 +0000 Subject: [PATCH 3/3] Fix benchmark Docker build: skip broken Bazel install; stop tracking PLAN.md Co-authored-by: mjp41 <270363+mjp41@users.noreply.github.com> --- .gitignore | 1 + PLAN.md | 74 -------------------------------------------- benchmark/Dockerfile | 11 +++++++ 3 files changed, 12 insertions(+), 74 deletions(-) delete mode 100644 PLAN.md diff --git a/.gitignore b/.gitignore index 122a68c2f..1c24d699a 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,4 @@ # rust target /target +/PLAN.md diff --git a/PLAN.md b/PLAN.md deleted file mode 100644 index 7ab8732ec..000000000 --- a/PLAN.md +++ /dev/null @@ -1,74 +0,0 @@ -# Plan: Fix benchmark GitHub Actions job - -## Context - -The benchmark job with check run ID `94399445543` fails while Docker Buildx is -building `benchmark/Dockerfile`. The failing step is: - -```text -RUN ./build-bench-env.sh packages -``` - -The Dockerfile clones `daanx/mimalloc-bench` at pinned commit -`a4ce904286365c7adfba54f0eea3a2df3fc95bd1`. At that commit, -`build-bench-env.sh` installs Bazel unconditionally on Ubuntu during the -`packages` phase by downloading `https://bazel.build/bazel-release.pub.gpg`, -which now returns HTTP 404. The failed download causes -`gpg: no valid OpenPGP data found` and exits the Docker build. - -The current branch has been checked against `origin/main` and is one commit -ahead, zero commits behind. - -Bazel is only needed by the external script when building Google's tcmalloc -(`tcg`). This Dockerfile does not build or benchmark `tcg`; it builds benchmark -workloads and runs them only against `/snmalloc/build/libsnmallocshim.so` via -`/allocs.txt`. - -## Relevant principles - -- Read the affected benchmark Docker path before modifying it. -- Make the smallest repository-local change that fixes the failing CI setup. -- Do not modify unrelated benchmark behavior or update the pinned - `mimalloc-bench` revision unless necessary. -- Remove unused fragile setup from this benchmark image instead of replacing it - with another external network dependency. -- Baseline the failing path before implementation and validate the fixed path - after implementation as far as this environment permits. -- Delegate build/test validation to a testing subagent using - `.github/skills/building_and_testing.md`. -- Do not commit changes until the user has reviewed and explicitly approved. - -## Steps and gates - -1. Baseline the relevant failure. - - Gate: use the CI check-run log, and any locally reproducible evidence if - network access permits, to confirm the pre-fix Docker setup failure is in - `./build-bench-env.sh packages` on the Bazel install path. -2. Patch the cloned pinned `mimalloc-bench` script during the Docker build to - skip the unnecessary Bazel install. - - Gate: `benchmark/Dockerfile` still clones the same pinned commit and adds - only a narrow, fail-loud patch in a new `RUN` layer after the pinned - `git reset --hard` and before `./build-bench-env.sh packages`. - - Gate: the patch targets only the standalone Ubuntu/Debian - `aptinstallbazel` call site, not the `function aptinstallbazel` - definition. Use an anchored pattern equivalent to - `^[[:space:]]*aptinstallbazel[[:space:]]*$`. - - Gate: the patch verifies the expected post-condition with correct exit - semantics so future silent no-op substitutions fail immediately: if the - standalone call pattern is still present, the Docker build prints a clear - error and exits non-zero; otherwise it continues. -3. Decide focused-test coverage. - - Gate: if existing test infrastructure can cheaply validate the Dockerfile - patch, add a focused test; otherwise document why no repository test is - appropriate for this CI-environment-only Docker setup fix. -4. Run targeted validation. - - Gate: delegate a targeted Docker validation to a testing subagent and - confirm the benchmark image progresses past the previous Bazel install - failure, or capture any new failure separately. If local network - restrictions prevent full Docker validation, document that the self-hosted - benchmark runner is the final validation point. Later benchmark steps also - fetch/build external projects, so additional upstream fragility may only - surface on that runner. -5. Final checks. - - Gate: run secret scanning on changed files, request automated code review, - run CodeQL checker, address applicable findings, and report final status. diff --git a/benchmark/Dockerfile b/benchmark/Dockerfile index 76cd5aa17..e65381c7b 100644 --- a/benchmark/Dockerfile +++ b/benchmark/Dockerfile @@ -7,6 +7,17 @@ RUN git clone https://github.com/daanx/mimalloc-bench &&\ git reset --hard a4ce904286365c7adfba54f0eea3a2df3fc95bd1 WORKDIR /mimalloc-bench + +# Skip the Bazel install: it is only needed to build Google's tcmalloc (tcg), +# which this Dockerfile does not build or benchmark, and its apt repository +# key (https://bazel.build/bazel-release.pub.gpg) is no longer served, +# breaking the "packages" phase below. +RUN sed -i '/^[[:space:]]*aptinstallbazel[[:space:]]*$/d' build-bench-env.sh && \ + if grep -qE '^[[:space:]]*aptinstallbazel[[:space:]]*$' build-bench-env.sh; then \ + echo "error: aptinstallbazel call still present in build-bench-env.sh" >&2; \ + exit 1; \ + fi + # Install dependencies RUN ./build-bench-env.sh packages