Skip to content

[None][infra] CBTS coverage data enhancement#16835

Open
crazydemo wants to merge 3 commits into
NVIDIA:mainfrom
crazydemo:cbts-coverage-completeness
Open

[None][infra] CBTS coverage data enhancement#16835
crazydemo wants to merge 3 commits into
NVIDIA:mainfrom
crazydemo:cbts-coverage-completeness

Conversation

@crazydemo

@crazydemo crazydemo commented Jul 24, 2026

Copy link
Copy Markdown
Collaborator

Dev Engineer Review

  • Enhanced CBTS coverage capture to be stage-aware by introducing proc_meta (stage) and test_meta (test outcome, expected worker count, and saved_procs) and bumping the reporting schema to schema_version: "2".
  • Extended the pytest/coverage plumbing to record per-test subprocess/pool expected worker counts (note_expected_workers via an MPIPoolExecutor patch), switch test context with sitecustomize, and persist non-passing outcomes (pytest_runtest_makereportrecord_test_outcome).
  • Updated SQLite merge/reporting to emit (test, file, qualname, stage) in touch, add/merge test_meta, and compute completeness using saved_procs < expected_workers + 1 (unsafe-to-skip only when passed and coverage is fully saved).
  • Refreshed CBTS reporting documentation/queries to match the new schema/contracts (including (file, stage) querying and tightened “(test, stage) safe to skip” criteria).
  • Removed the post-merge CI gate so CBTS coverage eligibility is enabled unconditionally based on ENABLE_CBTS_COVERAGE in setupPipelineEnvironment.
  • No test files, test lists, or QA configuration changes.

QA Engineer Review
No test changes.

Description

Test Coverage

PR Checklist

Please review the following before submitting your PR:

  • PR description clearly explains what and why. If using CodeRabbit's summary, please make sure it makes sense.

  • PR Follows TRT-LLM CODING GUIDELINES to the best of your knowledge.

  • Test cases are provided for new code paths (see test instructions)

  • If PR introduces API changes, an appropriate PR label is added - either api-compatible or api-breaking. For api-breaking, include BREAKING in the PR title.

  • Any new dependencies have been scanned for license and vulnerabilities

  • CODEOWNERS updated if ownership changes

  • Documentation updated as needed

  • Update tava architecture diagram if there is a significant design change in PR.

  • The reviewers assigned automatically/manually are appropriate for the PR.

  • Please check this after reviewing the above items as appropriate for this PR.

GitHub Bot Help

To see a list of available CI bot commands, please comment /bot help.

…eteness, per-stage attribution

Recover per-test coverage that was lost for inference-in-subprocess tests, and
let the merged touch DB flag its own gaps so the selector can force-run anything
that was not cleanly captured.

- sitecustomize: periodic save is now unconditional so mpi4py.futures pool
  workers save before the pool is torn down at test end (their atexit save was
  lost); only the mpi-session patcher and marker poller remain daemon-gated.
- cbts_plugin: record each test outcome via pytest_runtest_makereport, and count
  the pool workers each test spawns by patching MPIPoolExecutor.__init__.
- cbts_pystart: each per-process file now carries proc_meta (stage) and, in the
  coordinator, test_meta (outcome + expected worker count).
- pystart_report: merged touch gains a stage column; a merged test_meta
  (test, stage, outcome, expected_workers, saved_procs) exposes completeness;
  meta gains schema_version.

Signed-off-by: Ivy Zhang <25222398+crazydemo@users.noreply.github.com>
@crazydemo
crazydemo requested a review from a team as a code owner July 24, 2026 09:07
@crazydemo

Copy link
Copy Markdown
Collaborator Author

/bot run --disable-fail-fast --stage-list "RTXPro6000D-PyTorch-1, RTXPro6000D-PyTorch-Post-Merge-1"

@coderabbitai

coderabbitai Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Walkthrough

CBTS coverage capture now records per-test outcomes, expected subprocess counts, and process stages. Tracker SQLite output and merged reports include completeness metadata, stage-aware touch entries, schema version 2, updated query guidance, and broader pipeline coverage eligibility.

Changes

CBTS completeness tracking

Layer / File(s) Summary
Capture test and worker metadata
jenkins/scripts/cbts/coverage_utils/cbts_plugin.py, jenkins/scripts/cbts/coverage_utils/sitecustomize.py
Pytest hooks record test context, outcomes, and expected MPI workers through sitecustomize; periodic saving starts earlier and remains active for long-lived processes.
Persist process and test metadata
jenkins/scripts/cbts/coverage_utils/cbts_pystart.py
PyStartTracker stores outcomes and expected worker counts and writes proc_meta and test_meta data, including when no coverage rows were collected.
Merge and report stage-aware completeness
jenkins/scripts/cbts/coverage_utils/pystart_report.py, jenkins/scripts/cbts/coverage_utils/README.md
Merged SQLite output includes stage-aware touch rows, per-test metadata, saved-process counts, completeness reporting, schema version 2, and updated SQL guidance.
Pipeline coverage eligibility
jenkins/L0_MergeRequest.groovy
CBTS coverage filtering uses ENABLE_CBTS_COVERAGE directly instead of requiring a PostMerge job name.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant cbts_plugin
  participant sitecustomize
  participant PyStartTracker
  participant pystart_report
  cbts_plugin->>sitecustomize: record outcome and expected workers
  sitecustomize->>PyStartTracker: forward per-test metadata
  sitecustomize->>PyStartTracker: periodically save coverage
  pystart_report->>PyStartTracker: read staged SQLite outputs
  pystart_report->>pystart_report: merge touch and test_meta rows
  pystart_report->>pystart_report: compute CBTS completeness
Loading

Suggested reviewers: dpitman-nvda, tburt-nv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description is mostly the template boilerplate and does not explain the issue, solution, or test coverage. Add a short Description of the problem and fix, plus the relevant Test Coverage details; keep the checklist items if helpful.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title is concise, follows the required template, and accurately summarizes the CBTS coverage data enhancement.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🧹 Nitpick comments (1)
jenkins/scripts/cbts/coverage_utils/cbts_plugin.py (1)

86-91: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Narrow the swallowed accounting errors.

except Exception: pass hides hook/programming failures and leaves expected_workers at zero, weakening completeness reporting. Catch known conversion errors separately and handle hook failures explicitly.

As per coding guidelines, “Catch the narrowest possible exceptions.”

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@jenkins/scripts/cbts/coverage_utils/cbts_plugin.py` around lines 86 - 91,
Update the worker-accounting logic around _sitecustomize_call to catch only
expected max_workers conversion errors, such as TypeError or ValueError, while
handling failures from note_expected_workers explicitly rather than swallowing
them. Preserve the fallback of one worker for missing or invalid worker counts,
and ensure hook failures are surfaced or otherwise handled according to the
module’s established error behavior.

Sources: Coding guidelines, Linters/SAST tools

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@jenkins/scripts/cbts/coverage_utils/cbts_plugin.py`:
- Around line 115-119: Update the marker-polled sitecustomize watcher to also
call install_expected_workers_patch(), matching the existing pytest_configure
installation while retaining install_mpi_pool_patch. Ensure non-pytest
coordinators and subprocesses creating MPIPoolExecutor record expected workers
for merge accounting.
- Around line 147-149: Update the report filtering condition in the
outcome-recording logic to include non-passing teardown reports, alongside call
reports and non-passing setup reports. Ensure a failing or skipped teardown
passed to _sitecustomize_call("record_test_outcome", ...) overwrites the earlier
passed outcome for the same item.nodeid.

In `@jenkins/scripts/cbts/coverage_utils/cbts_pystart.py`:
- Around line 120-124: Update the fork-child reset logic in _after_fork_child()
to clear _outcomes and _expected alongside _data, ensuring save() does not
snapshot inherited coordinator metadata. Preserve normal parent-process metadata
and existing per-process coverage data behavior.

In `@jenkins/scripts/cbts/coverage_utils/pystart_report.py`:
- Around line 116-120: Update the batch construction in the _safe_rows
processing loop to store the stage-prefixed test key in touch.test, using the
existing stage and test values so staged inputs are persisted as “stage/test”.
Keep the remaining file, qualification, and stage columns unchanged, ensuring
coverage_selection/touch_db.py can derive the correct stage and nodeid.

---

Nitpick comments:
In `@jenkins/scripts/cbts/coverage_utils/cbts_plugin.py`:
- Around line 86-91: Update the worker-accounting logic around
_sitecustomize_call to catch only expected max_workers conversion errors, such
as TypeError or ValueError, while handling failures from note_expected_workers
explicitly rather than swallowing them. Preserve the fallback of one worker for
missing or invalid worker counts, and ensure hook failures are surfaced or
otherwise handled according to the module’s established error behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 622941c6-7ae7-430f-8491-89e57b8dc8c8

📥 Commits

Reviewing files that changed from the base of the PR and between 75b39d4 and 783527c.

📒 Files selected for processing (5)
  • jenkins/scripts/cbts/coverage_utils/README.md
  • jenkins/scripts/cbts/coverage_utils/cbts_plugin.py
  • jenkins/scripts/cbts/coverage_utils/cbts_pystart.py
  • jenkins/scripts/cbts/coverage_utils/pystart_report.py
  • jenkins/scripts/cbts/coverage_utils/sitecustomize.py

Comment on lines 115 to +119
def pytest_configure(config): # noqa: D401 - pytest hook
"""Apply ``mpi_session`` monkeypatch with a compatibility guard."""
"""Apply the ``mpi_session`` env monkeypatch and the pool-worker accounting patch."""
del config
install_mpi_pool_patch(raise_on_refactor=True)
install_expected_workers_patch()

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Install expected-worker accounting in non-pytest coordinators too.

This patch is installed only by pytest_configure, while the marker-polled sitecustomize path installs only install_mpi_pool_patch. A service/subprocess that creates an MPIPoolExecutor therefore records no expected workers; merge treats that as zero and can incorrectly mark incomplete capture safe. Install install_expected_workers_patch() from that watcher as well.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@jenkins/scripts/cbts/coverage_utils/cbts_plugin.py` around lines 115 - 119,
Update the marker-polled sitecustomize watcher to also call
install_expected_workers_patch(), matching the existing pytest_configure
installation while retaining install_mpi_pool_patch. Ensure non-pytest
coordinators and subprocesses creating MPIPoolExecutor record expected workers
for merge accounting.

Comment on lines +147 to +149
# The call phase is the test body; a non-passing setup is the test's effective outcome.
if report.when == "call" or (report.when == "setup" and report.outcome != "passed"):
_sitecustomize_call("record_test_outcome", item.nodeid, report.outcome)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Record failing teardown outcomes.

A passing call phase is persisted as passed, but a subsequent failing/skipped teardown is ignored. Include non-passing teardown reports so these tests remain unsafe to skip.

Proposed fix
-        if report.when == "call" or (report.when == "setup" and report.outcome != "passed"):
+        if report.when == "call" or (
+            report.when in {"setup", "teardown"} and report.outcome != "passed"
+        ):
             _sitecustomize_call("record_test_outcome", item.nodeid, report.outcome)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# The call phase is the test body; a non-passing setup is the test's effective outcome.
if report.when == "call" or (report.when == "setup" and report.outcome != "passed"):
_sitecustomize_call("record_test_outcome", item.nodeid, report.outcome)
# The call phase is the test body; a non-passing setup is the test's effective outcome.
if report.when == "call" or (
report.when in {"setup", "teardown"} and report.outcome != "passed"
):
_sitecustomize_call("record_test_outcome", item.nodeid, report.outcome)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@jenkins/scripts/cbts/coverage_utils/cbts_plugin.py` around lines 147 - 149,
Update the report filtering condition in the outcome-recording logic to include
non-passing teardown reports, alongside call reports and non-passing setup
reports. Ensure a failing or skipped teardown passed to
_sitecustomize_call("record_test_outcome", ...) overwrites the earlier passed
outcome for the same item.nodeid.

Comment on lines 120 to +124
def save(self):
# Write a per-process SQLite the downstream merge reads directly; uploaded compressed only.
snap = self._data.copy() # atomic shallow copy; each set snapshotted below
if not snap:
outcomes = dict(self._outcomes)
expected = dict(self._expected)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Clear coordinator metadata after a fork.

_after_fork_child() resets only _data; forked children inherit _outcomes and _expected. These snapshots then persist duplicated coordinator metadata, while merge sums expected_workers across files, inflating requirements for prior tests and producing false-incomplete results.

Proposed fix
 def _after_fork_child(self):
     # The child writes its own data file and rediscovers what it runs.
     self._new_suffix()
     self._data = {}
+    self._outcomes = {}
+    self._expected = {}
     if self._active:
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@jenkins/scripts/cbts/coverage_utils/cbts_pystart.py` around lines 120 - 124,
Update the fork-child reset logic in _after_fork_child() to clear _outcomes and
_expected alongside _data, ensuring save() does not snapshot inherited
coordinator metadata. Preserve normal parent-process metadata and existing
per-process coverage data behavior.

Comment on lines +116 to +120
for test, file, qual in _safe_rows(fp):
seen_tests.add(test)
batch.append((test, file, qual, stage))
if len(batch) >= 20000:
con.executemany("INSERT OR IGNORE INTO touch VALUES (?, ?, ?)", batch)
con.executemany("INSERT OR IGNORE INTO touch VALUES (?, ?, ?, ?)", batch)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Preserve the selector’s stage-prefixed test key.

The plugin supplies raw item.nodeid, and this insert keeps it raw. coverage_selection/touch_db.py derives (stage, nodeid) by splitting touch.test, so a node ID such as tests/... is misread as stage tests; per-stage selection breaks. Store f"{stage}/{test}" in touch.test for staged inputs, or update all selector consumers atomically.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@jenkins/scripts/cbts/coverage_utils/pystart_report.py` around lines 116 -
120, Update the batch construction in the _safe_rows processing loop to store
the stage-prefixed test key in touch.test, using the existing stage and test
values so staged inputs are persisted as “stage/test”. Keep the remaining file,
qualification, and stage columns unchanged, ensuring
coverage_selection/touch_db.py can derive the correct stage and nodeid.

@tensorrt-cicd

Copy link
Copy Markdown
Collaborator

PR_Github #61548 [ run ] triggered by Bot. Commit: 783527c Link to invocation

@crazydemo

Copy link
Copy Markdown
Collaborator Author

/bot kill

…ction

Temporary: collect CBTS per-test coverage on a manual pre-merge run to validate
the completeness/attribution changes. Revert before merge (restore the
env.JOB_NAME PostMerge gate on testFilter[cbts_coverage]).

Signed-off-by: Ivy Zhang <25222398+crazydemo@users.noreply.github.com>
@tensorrt-cicd

Copy link
Copy Markdown
Collaborator

PR_Github #61552 [ kill ] triggered by Bot. Commit: fe96440 Link to invocation

@crazydemo

Copy link
Copy Markdown
Collaborator Author

/bot run --disable-fail-fast --stage-list "RTXPro6000D-PyTorch-1"

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@jenkins/L0_MergeRequest.groovy`:
- Around line 342-345: Restore the JOB_NAME post-merge condition in the
CBTS_COVERAGE assignment within testFilter, combining ENABLE_CBTS_COVERAGE with
the existing PostMerge job-name regex. Remove the temporary test-only assignment
so isCbtsStage() enables coverage only for eligible post-merge pipelines.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 54f8db78-05d6-4a1f-857c-d6b1c5d84bcc

📥 Commits

Reviewing files that changed from the base of the PR and between 783527c and fe96440.

📒 Files selected for processing (1)
  • jenkins/L0_MergeRequest.groovy

Comment on lines +342 to +345
// TEST ONLY (revert before merge): the official-post-merge gate is dropped so coverage is
// collected on a manual run to validate collection. Restore the JOB_NAME gate before merging:
// testFilter[(CBTS_COVERAGE)] = ENABLE_CBTS_COVERAGE && (env.JOB_NAME ==~ /.*PostMerge.*/)
testFilter[(CBTS_COVERAGE)] = ENABLE_CBTS_COVERAGE

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀 Performance & Scalability | 🟠 Major | ⚡ Quick win

Restore the post-merge gate before merging.

ENABLE_CBTS_COVERAGE is true, so this assignment enables CBTS coverage for every eligible pre-merge pipeline. Downstream isCbtsStage() consumes this flag directly, causing non-excluded single-GPU pre-merge stages to collect coverage, contrary to the documented post-merge-only contract. The comments do not enforce the required rollback.

Proposed fix
-    testFilter[(CBTS_COVERAGE)] = ENABLE_CBTS_COVERAGE
+    testFilter[(CBTS_COVERAGE)] = ENABLE_CBTS_COVERAGE && (env.JOB_NAME ==~ /.*PostMerge.*/)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// TEST ONLY (revert before merge): the official-post-merge gate is dropped so coverage is
// collected on a manual run to validate collection. Restore the JOB_NAME gate before merging:
// testFilter[(CBTS_COVERAGE)] = ENABLE_CBTS_COVERAGE && (env.JOB_NAME ==~ /.*PostMerge.*/)
testFilter[(CBTS_COVERAGE)] = ENABLE_CBTS_COVERAGE
// TEST ONLY (revert before merge): the official-post-merge gate is dropped so coverage is
// collected on a manual run to validate collection. Restore the JOB_NAME gate before merging:
// testFilter[(CBTS_COVERAGE)] = ENABLE_CBTS_COVERAGE && (env.JOB_NAME ==~ /.*PostMerge.*/)
testFilter[(CBTS_COVERAGE)] = ENABLE_CBTS_COVERAGE && (env.JOB_NAME ==~ /.*PostMerge.*/)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@jenkins/L0_MergeRequest.groovy` around lines 342 - 345, Restore the JOB_NAME
post-merge condition in the CBTS_COVERAGE assignment within testFilter,
combining ENABLE_CBTS_COVERAGE with the existing PostMerge job-name regex.
Remove the temporary test-only assignment so isCbtsStage() enables coverage only
for eligible post-merge pipelines.

@tensorrt-cicd

Copy link
Copy Markdown
Collaborator

PR_Github #61548 [ run ] completed with state ABORTED. Commit: 783527c

Link to invocation

@tensorrt-cicd

Copy link
Copy Markdown
Collaborator

PR_Github #61552 [ kill ] completed with state SUCCESS. Commit: fe96440
Successfully killed previous jobs for commit fe96440

Link to invocation

@tensorrt-cicd

Copy link
Copy Markdown
Collaborator

PR_Github #61554 [ run ] triggered by Bot. Commit: fe96440 Link to invocation

@tensorrt-cicd

Copy link
Copy Markdown
Collaborator

PR_Github #61554 [ run ] completed with state SUCCESS. Commit: fe96440
/LLM/main/L0_MergeRequest_PR pipeline #49765 (Partly Tested) completed with status: 'SUCCESS'

CI Report

Link to invocation

…e running test

MPI-pool workers saved their coverage (periodic save) but recorded it under the
empty context: they don't run the pytest plugin and their inherited CBTS_TEST_ID
is stale/empty at spawn, and the marker poller was gated off for them. Run the
marker poller for pool workers too (not _is_pytest_main) so they follow the
per-test marker file and attribute coverage to the test they serve, the same way
long-lived non-pytest processes do.

Signed-off-by: Ivy Zhang <25222398+crazydemo@users.noreply.github.com>
@crazydemo

Copy link
Copy Markdown
Collaborator Author

/bot run --disable-fail-fast --stage-list "RTXPro6000D-PyTorch-1"

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@jenkins/scripts/cbts/coverage_utils/sitecustomize.py`:
- Line 185: Update the non-pytest marker handling guarded by _is_pytest_main to
use a private per-run temporary directory instead of a predictable global /tmp
path. Ensure cbts_plugin.py marker writes use atomic file replacement rather
than open(..., "w"), preserving marker polling while preventing symlink
redirection and partial/truncated marker contents.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 614c8544-4597-47cb-a92d-8fe0658afea6

📥 Commits

Reviewing files that changed from the base of the PR and between fe96440 and 775e2c5.

📒 Files selected for processing (1)
  • jenkins/scripts/cbts/coverage_utils/sitecustomize.py

# Pool workers and long-lived non-pytest processes follow the per-test marker file to switch
# context; a pool worker would otherwise record every test it serves under one inherited (often
# empty) context. The outer pytest switches context via the plugin instead.
if not _is_pytest_main:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Avoid a predictable shared /tmp marker path.

With marker polling now enabled for non-pytest processes, the fallback path can be manipulated on shared CI hosts. cbts_plugin.py writes the same path with open(..., "w"); a same-user process could inject node IDs or use a symlink to redirect and truncate another file. Use a private per-run directory and atomic marker-file replacement instead of a predictable global /tmp path.

🧰 Tools
🪛 ast-grep (0.44.1)

[info] 185-185: Do not hardcode temporary file or directory names
Context: "/tmp/cbts/current_test.txt"
Note: [CWE-377] Insecure Temporary File.

(hardcoded-tmp-file)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@jenkins/scripts/cbts/coverage_utils/sitecustomize.py` at line 185, Update the
non-pytest marker handling guarded by _is_pytest_main to use a private per-run
temporary directory instead of a predictable global /tmp path. Ensure
cbts_plugin.py marker writes use atomic file replacement rather than open(...,
"w"), preserving marker polling while preventing symlink redirection and
partial/truncated marker contents.

Source: Linters/SAST tools

@tensorrt-cicd

Copy link
Copy Markdown
Collaborator

PR_Github #61568 [ run ] triggered by Bot. Commit: 775e2c5 Link to invocation

@tensorrt-cicd

Copy link
Copy Markdown
Collaborator

PR_Github #61568 [ run ] completed with state SUCCESS. Commit: 775e2c5
/LLM/main/L0_MergeRequest_PR pipeline #49779 (Partly Tested) completed with status: 'SUCCESS'

CI Report

Link to invocation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants