Skip to content

Add downstream-check CI (builds Strata-CLI against Python PRs)#3

Draft
shigoel wants to merge 2 commits into
mainfrom
add-downstream-check
Draft

Add downstream-check CI (builds Strata-CLI against Python PRs)#3
shigoel wants to merge 2 commits into
mainfrom
add-downstream-check

Conversation

@shigoel

@shigoel shigoel commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

What

Advisory, non-blocking cross-repo check: when a Strata-Python PR is ready (or a collaborator comments !downstream-check), build Strata-CLI against this PR's Strata-Python code (CLI requires StrataPython) to catch breakage before it lands on main. Result shows up as a Downstream / Strata-CLI job on the PR.

Strata-CLI has no lake testDriver, so verification mirrors CLI's own ci.yml: build, then lake exe strata --help + ./scripts/run_examples.sh.

Mechanism

Checks out the PR's Strata-Python, clones Strata-CLI, rewrites CLI's require "StrataPython" to a local path (fork-safe), then lake update StrataPython + build + checks. CLI's other requires (Strata, StrataDDM at main) resolve normally — only the StrataPython edge is overridden. Reuses Strata's composite actions via @main.

Depends on

⚠️ strata-org/Strata#1387 must land first (the composite actions must exist on Strata main). Until then this check will error (expected). See #1387 for the full design.

Draft for early feedback.

Advisory, non-blocking check: builds Strata-CLI against this PR's
Strata-Python code (CLI requires StrataPython) to catch breakage before it
lands on main. CLI has no lake testDriver, so it verifies via the binary +
examples, mirroring CLI's own ci.yml. Reuses Strata's composite actions via @main.

Depends on strata-org/Strata#1387 landing first.
Comment thread .github/workflows/downstream-check.yml Fixed
The issue_comment trigger runs in the privileged default-branch context;
building untrusted PR code there is a cache-poisoning / code-execution vector
(CodeQL actions/cache-poisoning/poisonable-step). Run only on pull_request,
which builds the same code in an isolated, unprivileged context.

Collapses the gate job into a job-level draft check and reads the PR head SHA
from the event payload (no shared gate action needed).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants