Skip to content

Canary: end every failed check with an ::error:: line - #5

Merged
jehrr merged 2 commits into
mainfrom
fix/canary-proxy-error-annotation
Oct 20, 2026
Merged

jehrr merged 2 commits into
mainfrom
fix/canary-proxy-error-annotation

Conversation

@jehrr

@jehrr jehrr commented Oct 20, 2026

Copy link
Copy Markdown
Collaborator

Problem

On 2026-10-20 the canary was dispatched with the proxy secret set. The scraper exited 5 (every navigation through the proxy timed out), and the check step ended the job red with only canary requires EXIT_OK=0, got 5. That step printed an ::error:: line only for a run without the proxy secret, so a failure through the proxy left no annotation. A missing or malformed output file also produced only a traceback.

Change

  • The check step installs an exception hook that prints the traceback and then an ::error:: line. This covers a missing sidecar and a failed row assertion.
  • A nonzero exit through the proxy secret now prints an ::error:: line with the exit code and the meaning of each code. The line also notes that a proxy rejecting its credential (HTTP 407) reaches Chromium as a navigation timeout, so an exit 5 should be checked against the secret first. On 2026-10-20 the same proxy credential produced Chromium navigation timeouts and an HTTP 407 for a plain HTTP client in another repository of this family.
  • smoke_test.py gets a new check. It extracts the workflow's python3 -c check snippet and runs it in an empty directory with exit codes 0, 1, 3, 4, 5 and 6, with and without the proxy secret. Each run must fail and print ::error::.

Evidence

  • The offline suite passes in a core-only venv (requirements.txt), and so do .github/ci_checks.py and --sample-check.
  • Control 1: the old canary.yml with the new check makes the check fail. Exit 0 with a missing sidecar printed no ::error::.
  • Control 2: the new canary.yml without the proxy-path print makes the check fail on ('true', '1', ...), with no ::error:: printed. After each control the file was restored and the suite was green again.
  • The workflow still parses as YAML (PyYAML safe_load).

Not changed

  • Scraper code, exit codes and thresholds.
  • The proxy secret. Its credential is rejected with HTTP 407 as of 2026-10-20 08:21 UTC, and the owner has to replace it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CKsd7q25N19WzUZjrAdzx8

jehrr and others added 2 commits October 20, 2026 08:26
A canary run through the proxy secret that exited nonzero ended red with
no annotation, and a missing or malformed output file showed only a
traceback. The check step now prints an ::error:: line on every failure
path, and the proxy-path message says that a proxy rejecting its
credential (HTTP 407) reaches Chromium as a navigation timeout.

smoke_test.py runs the workflow's check snippet with every exit code,
with and without the proxy secret, and requires an ::error:: line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CKsd7q25N19WzUZjrAdzx8
… no workflows

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CKsd7q25N19WzUZjrAdzx8
@jehrr
jehrr merged commit 9ca7be1 into main Oct 20, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant