ci: automatically track verified ASAPPlanner main revisions

Author: zzylol

.github/workflows/mvp-ci.yml

@@ -49,6 +49,10 @@ jobs:
           # post-step can package `target`; registry/git inputs are sufficient.
           cache-targets: false
 
+      - name: Test Planner dependency updater
+        working-directory: ASAPQuery-backend
+        run: python3 -m unittest discover -s scripts/ci -p 'test_*.py'
+
       - name: Check workspace formatting
         working-directory: ASAPQuery-backend
         # `--all` also follows this workspace's sibling path dependencies.
@@ -59,20 +63,20 @@ jobs:
         env:
           CARGO_NET_GIT_FETCH_WITH_CLI: "true"
         working-directory: ASAPQuery-backend
-        run: cargo check --workspace
+        run: cargo check --workspace --locked
 
       - name: Lint workspace
         env:
           CARGO_NET_GIT_FETCH_WITH_CLI: "true"
         working-directory: ASAPQuery-backend
         # Preserve the existing warning policy while expanding runtime coverage.
-        run: cargo clippy --workspace --all-targets -- -D warnings
+        run: cargo clippy --workspace --all-targets --locked -- -D warnings
 
       - name: Build process-test control plane
         env:
           CARGO_NET_GIT_FETCH_WITH_CLI: "true"
         working-directory: ASAPQuery-backend
-        run: cargo build -p control_plane --bin control_plane
+        run: cargo build -p control_plane --bin control_plane --locked
 
       - name: Test workspace
         env:
@@ -84,4 +88,4 @@ jobs:
         # Match scripts/e2e.sh to avoid competing flushers exhausting those waits.
         run: |
           export ASAP_E2E_CONTROL_PLANE_BIN="$PWD/target/debug/control_plane"
-          cargo test --workspace -- --test-threads=1
+          cargo test --workspace --locked -- --test-threads=1

.github/workflows/planner-main-merge.yml

@@ -0,0 +1,42 @@
+name: Merge verified Planner update
+
+on:
+  workflow_run:
+    workflows: ['MVP CI']
+    types: [completed]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: planner-main-merge
+  cancel-in-progress: false
+
+jobs:
+  merge:
+    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      # Never check out or execute PR content in this privileged workflow.
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            const {owner, repo} = context.repo;
+            const run = context.payload.workflow_run;
+            const prs = await github.rest.pulls.list({owner, repo, state: 'open', base: 'main', head: `${owner}:automation/planner-main`});
+            if (prs.data.length !== 1) return;
+            const {data: pr} = await github.rest.pulls.get({owner, repo, pull_number: prs.data[0].number});
+            if (pr.head.repo.full_name !== `${owner}/${repo}` || pr.head.sha !== run.head_sha || pr.draft) return;
+            const testedPr = run.pull_requests.find(p => p.number === pr.number);
+            if (!testedPr || testedPr.base.sha !== pr.base.sha) {
+              core.info('Main changed since this CI run; wait for the next updater refresh.');
+              return;
+            }
+            const files = await github.paginate(github.rest.pulls.listFiles, {owner, repo, pull_number: pr.number});
+            if (!files.length || files.some(f => !['Cargo.toml', 'Cargo.lock'].includes(f.filename))) {
+              core.setFailed('Planner automation may only change Cargo.toml and Cargo.lock');
+              return;
+            }
+            // Required branch protection checks still apply; sha prevents merging a newer, untested head.
+            await github.rest.pulls.merge({owner, repo, pull_number: pr.number, sha: run.head_sha, merge_method: 'squash'});

.github/workflows/planner-main-sync.yml

@@ -0,0 +1,47 @@
+name: Sync Planner main
+
+on:
+  schedule:
+    - cron: '17 * * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: planner-main-sync
+  cancel-in-progress: false
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+      - name: Configure private Cargo dependencies
+        env:
+          ASAP_CI_REPO_TOKEN: ${{ secrets.ASAP_CI_REPO_TOKEN }}
+        run: git config --global url."https://x-access-token:${ASAP_CI_REPO_TOKEN}@github.com/".insteadOf "https://github.com/"
+      - name: Resolve Planner main
+        env:
+          CARGO_NET_GIT_FETCH_WITH_CLI: 'true'
+        run: python3 scripts/ci/update_planner.py
+      # A repository token is needed so the resulting PR triggers MVP CI.
+      # GITHUB_TOKEN-created PRs do not trigger pull_request workflows.
+      - uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.ASAP_CI_REPO_TOKEN }}
+          branch: automation/planner-main
+          base: main
+          add-paths: |
+            Cargo.toml
+            Cargo.lock
+          commit-message: 'build: sync ASAPPlanner main'
+          title: 'build: sync ASAPPlanner main'
+          body: |
+            Before this PR: the backend pins an earlier ASAPPlanner revision.
+            After this PR: all four Planner dependencies and Cargo.lock use the latest main revision observed by the updater.
+
+            MVP CI runs workspace formatting, checking, linting, and all workspace tests, including process E2E. Successful updates are merged automatically; incompatible updates remain open for investigation.

Cargo.lock

@@ -20,10 +20,10 @@ asap_sketchlib = { git = "https://github.com/ProjectASAP/asap_sketchlib", branch
 [workspace.dependencies]
 # Keep Planner frontends, selection, and IR on the same immutable revision.
 # Alias upstream asap-types because this workspace also defines asap_types.
-planner-types = { package = "asap-types", git = "https://github.com/ProjectASAP/ASAPPlanner", rev = "10d93846f0ef9f06ab19e599701d699d9cdd15af" }
-asap-aware-mapping = { git = "https://github.com/ProjectASAP/ASAPPlanner", rev = "10d93846f0ef9f06ab19e599701d699d9cdd15af" }
-asap-frontend-promql = { git = "https://github.com/ProjectASAP/ASAPPlanner", rev = "10d93846f0ef9f06ab19e599701d699d9cdd15af" }
-asap-frontend-sql = { git = "https://github.com/ProjectASAP/ASAPPlanner", rev = "10d93846f0ef9f06ab19e599701d699d9cdd15af" }
+planner-types = { package = "asap-types", git = "https://github.com/ProjectASAP/ASAPPlanner", rev = "2ec3fc80caa922c8e1f33aa05f60b7d787e73257" }
+asap-aware-mapping = { git = "https://github.com/ProjectASAP/ASAPPlanner", rev = "2ec3fc80caa922c8e1f33aa05f60b7d787e73257" }
+asap-frontend-promql = { git = "https://github.com/ProjectASAP/ASAPPlanner", rev = "2ec3fc80caa922c8e1f33aa05f60b7d787e73257" }
+asap-frontend-sql = { git = "https://github.com/ProjectASAP/ASAPPlanner", rev = "2ec3fc80caa922c8e1f33aa05f60b7d787e73257" }
 
 # Shared external deps (used by 2+ crates)
 serde = { version = "1.0", features = ["derive"] }

Cargo.toml

@@ -0,0 +1,27 @@
+# Planner main updates
+
+The backend keeps reproducible Planner revisions in `Cargo.toml` and `Cargo.lock`.
+`Sync Planner main` checks upstream main hourly (or on manual dispatch), updates
+all four Planner dependencies together, and opens or refreshes
+`automation/planner-main` against backend main. GitHub scheduled runs can be delayed.
+
+The existing `ASAP_CI_REPO_TOKEN` secret must have read access to private dependency
+repositories and **Contents and Pull requests write** access to this backend repo.
+The updater uses this token to create its PR so GitHub triggers `MVP CI`.
+The merge workflow uses the repository's `GITHUB_TOKEN` and does not require
+GitHub's optional auto-merge feature to be enabled.
+
+MVP CI uses `--locked` and runs the workspace checks, Clippy, unit tests, and
+process E2E tests. Only a successful run for the current update PR head can
+trigger the merge workflow; it also verifies the repository, branch, base, and
+that main has not advanced since that run and only the two Cargo files changed. Branch protection remains in force.
+Failed updates stay open and main retains its last verified version. Fix an
+upstream incompatibility separately, or let the next upstream update refresh the
+PR. An automation failure is visible in Actions; check token permissions there.
+
+Locally, run `python3 scripts/ci/update_planner.py` from the repository root,
+then run the same checks as MVP CI. Updater unit tests run with:
+
+```sh
+python3 -m unittest discover -s scripts/ci -p 'test_*.py'
+```

scripts/ci/README.md

@@ -0,0 +1,41 @@
+"""Guard atomic Planner revision updates and reject unexpected manifests."""
+import unittest
+
+from update_planner import pin_planner
+
+
+class PlannerPinTests(unittest.TestCase):
+    revision = "a" * 40
+    manifest = ''.join(
+        f'{name} = {{ git = "https://github.com/ProjectASAP/ASAPPlanner", rev = "{"b" * 40}" }}\n'
+        for name in ['planner-types', 'asap-aware-mapping', 'asap-frontend-promql', 'asap-frontend-sql']
+    )
+
+    def test_atomic_and_idempotent(self):
+        """All four dependencies advance together, without touching other Git pins."""
+        other = 'other = { git = "https://example.com/other", branch = "main" }\n'
+        result = pin_planner(self.manifest + other, self.revision)
+        self.assertEqual(result.count(f'rev = "{self.revision}"'), 4)
+        self.assertTrue(result.endswith(other))
+        self.assertEqual(pin_planner(result, self.revision), result)
+
+    def test_accepts_branch_selector(self):
+        """A branch-based Planner manifest can be converted to reproducible pins."""
+        result = pin_planner(self.manifest.replace(f'rev = "{"b" * 40}"', 'branch = "main"'), self.revision)
+        self.assertEqual(result.count(f'rev = "{self.revision}"'), 4)
+
+    def test_rejects_changed_dependency_layout(self):
+        """A removed dependency or missing selector requires a deliberate updater change."""
+        for manifest in [self.manifest.split('\n', 1)[1], self.manifest.replace(f', rev = "{"b" * 40}"', '')]:
+            with self.subTest(manifest=manifest), self.assertRaises(ValueError):
+                pin_planner(manifest, self.revision)
+
+    def test_rejects_invalid_revision(self):
+        """Branch names and truncated SHAs cannot become immutable pins."""
+        for revision in ['main', 'abc123', 'z' * 40]:
+            with self.subTest(revision=revision), self.assertRaises(ValueError):
+                pin_planner(self.manifest, revision)
+
+
+if __name__ == '__main__':
+    unittest.main()

scripts/ci/test_update_planner.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Pin every Planner workspace dependency to one main revision, then resolve it."""
+import re
+import subprocess
+from pathlib import Path
+
+URL = "https://github.com/ProjectASAP/ASAPPlanner"
+
+
+def pin_planner(manifest: str, revision: str) -> str:
+    if not re.fullmatch(r"[0-9a-f]{40}", revision):
+        raise ValueError("Expected a full Planner commit SHA")
+    count = 0
+    lines = []
+    for line in manifest.splitlines(keepends=True):
+        if re.search(r'git\s*=\s*"' + re.escape(URL) + r'"', line):
+            line, replaced = re.subn(r'(?:rev|branch|tag)\s*=\s*"[^"]+"', f'rev = "{revision}"', line)
+            if replaced != 1:
+                raise ValueError("Planner dependency must have exactly one Git revision selector")
+            count += 1
+        lines.append(line)
+    if count != 4:
+        raise ValueError(f"Expected four Planner dependencies, found {count}; review the updater")
+    return "".join(lines)
+
+
+if __name__ == "__main__":
+    revision = subprocess.check_output(
+        ["git", "ls-remote", URL, "refs/heads/main"], text=True
+    ).split()[0]
+    path = Path("Cargo.toml")
+    original = path.read_text()
+    updated = pin_planner(original, revision)
+    if updated == original:
+        print(f"Planner already pinned to main: {revision}")
+        raise SystemExit(0)
+    path.write_text(updated)
+    subprocess.run(["cargo", "update", "-p", "asap-aware-mapping"], check=True)
+    print(f"Planner main: {revision}")