batch: land #276, #270, #275, #252, #253, #258, #265, #268, #254, #273

.github/workflows/aur-deploy.yml

@@ -11,10 +11,14 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     name: Publish k3d-gpu to AUR
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -30,12 +34,29 @@ jobs:
             echo "version=$REF" >> "$GITHUB_OUTPUT"
           fi
 
+      # Releases build in parallel (one build-and-push queue per version), so an
+      # older release can reach this deploy after a newer one: AUR never moves back.
+      # When the AUR RPC cannot be read the deploy goes ahead.
+      - name: AUR already newer?
+        id: aur
+        env:
+          VER: ${{ steps.ver.outputs.version }}
+        run: |
+          cur=$(curl -fsSg --retry 3 --max-time 30 'https://aur.archlinux.org/rpc/v5/info?arg[]=k3d-gpu' \
+            | jq -r '.results[0].Version // empty' | cut -d- -f1) || cur=
+          if [ -n "$cur" ] && [ "$cur" != "$VER" ] && [ "$(printf '%s\n%s\n' "$cur" "$VER" | sort -V | tail -1)" = "$cur" ]; then
+            echo "AUR has k3d-gpu $cur, newer than $VER; leaving it"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Update PKGBUILD
+        if: steps.aur.outputs.skip != 'true'
         run: |
           sed -i "s/^pkgver=.*/pkgver=${{ steps.ver.outputs.version }}/" packaging/aur/PKGBUILD
           sed -i "s/^pkgrel=.*/pkgrel=1/" packaging/aur/PKGBUILD
 
       - name: Publish to AUR
+        if: steps.aur.outputs.skip != 'true'
         uses: KSXGitHub/github-actions-deploy-aur@084b0d9b15415bf9cdb65d44dad1efe37a354050 # v4.2.0
         with:
           pkgname: k3d-gpu

.github/workflows/auto-release.yml

@@ -1,22 +1,31 @@
 name: Auto-release AUR
 
-# Auto-tag a release on changes to packaging/, scripts/, share/ or the Dockerfile,
-# and when build-and-push.yml's nightly check bumps upstream pins (dispatch).
+# Auto-tag a release when a commit on main changes a path hack/release-paths lists
+# (what the packages, the formula and the image ship: packaging/, scripts/,
+# share/, the Dockerfile, console/, images.lock and the shipped bench/ and oracle/
+# files), and when build-and-push.yml's nightly check bumps upstream pins
+# (dispatch). The push paths: below repeat hack/release-paths (GitHub reads no
+# file there); tests/ci_wiring_test.sh checks they are equal.
 # Tag format: aur-vX.Y.Z. The launcher at that tag defaults to node image
 # cryptoandcoffee/k3d-gpu:X.Y.Z, so after tagging this dispatches build-and-push.yml
 # with release=X.Y.Z; that run publishes the image and then dispatches aur-deploy.yml.
 # Dispatches bypass the GITHUB_TOKEN downstream-trigger limit.
 #
+# A dispatch's mode: force (the default) always releases; changed releases only
+# when a commit above the last tag changed a shipped path (release_cas.sh runs as
+# for a push), so a merge that a GITHUB_TOKEN push did not announce can still cut
+# its release, and a dispatch with nothing shipped cuts none.
+#
 # hack/release_cas.sh releases from a fresh origin/main and pushes main and the
 # tag in one atomic push (--atomic), retrying when another writer moved main or
 # took the tag. On those lock and non-fast-forward races GitHub rejected both
 # refs together in a branch-ref spike (not yet seen on a live release push); for
 # other rejection classes a release commit can land
 # without its tag, and the next run tags it in place. A push run whose commits
 # an earlier run already released exits with no tag. The
-# concurrency group only queues runs; correctness does not depend on it. Push and
-# dispatch runs queue separately, so a pending forced dispatch is never replaced
-# by a push run that finds nothing to release.
+# concurrency group only queues runs; correctness does not depend on it. Push
+# runs and each dispatch mode queue separately, so a pending forced dispatch is
+# never replaced by a run that finds nothing to release.
 
 on:
   push:
@@ -26,7 +35,28 @@ on:
       - 'scripts/**'
       - 'share/**'
       - 'Dockerfile'
+      - 'console/**'
+      - 'images.lock'
+      - 'bench/vs.py'
+      - 'bench/llm_load.py'
+      - 'bench/energy.sh'
+      - 'bench/agent_trace.py'
+      - 'bench/agent_trace_gen.py'
+      - 'bench/apb/apb.py'
+      - 'bench/apb/capacity.py'
+      - 'bench/competitors.lock'
+      - 'oracle/bundle.py'
+      - 'oracle/project.py'
+      - 'oracle/validate.py'
+      - 'oracle/share.py'
+      - 'oracle/schema/bundle-v1.json'
   workflow_dispatch:
+    inputs:
+      mode:
+        description: 'force: always release; changed: release only when a shipped path changed since the last tag'
+        type: choice
+        options: [force, changed]
+        default: force
 
 permissions:
   contents: write
@@ -36,8 +66,9 @@ jobs:
   release:
     if: "github.actor != '88plug-bot' && !contains(github.event.head_commit.message, '[skip release]')"
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     concurrency:
-      group: auto-release-${{ github.event_name }}
+      group: auto-release-${{ github.event_name }}-${{ inputs.mode || 'push' }}
       cancel-in-progress: false
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -48,7 +79,7 @@ jobs:
       - name: Release (atomic push of main and the tag)
         id: rel
         env:
-          EVENT: ${{ github.event_name }}
+          EVENT: ${{ github.event_name == 'workflow_dispatch' && inputs.mode == 'changed' && 'push' || github.event_name }}
         run: |
           git config user.name  "88plug-bot"
           git config user.email "andrew@88plug.com"

.github/workflows/bot-sweep.yml

@@ -0,0 +1,41 @@
+name: Bot sweep
+
+# Hourly upkeep of the bot's PRs (branches autobump/*, opened by github-actions[bot]
+# with GITHUB_TOKEN, so their own pull_request runs wait for approval).
+#
+#   ci-fill: hack/bot-ci-dispatch runs ci.yml by workflow_dispatch on each bot PR
+#            branch with no run at its head, and re-runs a first-attempt failure
+#            once, one bot run in flight at a time and none while a human PR's CI
+#            is queued. It fills in what the nightly deferred.
+
+on:
+  schedule:
+    - cron: '13 * * * *'
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: bot-sweep
+  cancel-in-progress: false
+
+jobs:
+  ci-fill:
+    name: CI on bot PRs
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      actions: write
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: main
+          persist-credentials: false
+
+      - name: Dispatch CI on bot PRs that have none at their head
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: hack/bot-ci-dispatch