From e87c8dc8c5cc979083b9f721f1084180db9bf19d Mon Sep 17 00:00:00 2001 From: Connor Tsui Date: Fri, 19 Jun 2026 16:26:50 -0400 Subject: [PATCH 1/2] ci: install uv before assuming the v4 ingest role The v4 Postgres dual-write assumes GitHubBenchmarkIngestRole via configure-aws-credentials, which persists those creds as the job's ambient AWS credentials. The ingest role only has rds-db:connect, so the following "Install uv" step -- which runs uv sync and compiles vortex-python through sccache (S3-backed) -- failed with s3:GetObject AccessDenied on the benchmark runners. Reorder the v4 block so "Install uv" runs before "Configure AWS credentials": sccache keeps the job's original S3-capable creds, and the role is assumed immediately before the ingest, which needs only rds-db:connect. The step is continue-on-error so CI stayed green, but every affected bench.yml / sql-benchmarks.yml run showed a red v4 step once the ingest-role variable was set. A comment in each workflow records why the order is load-bearing. Signed-off-by: Connor Tsui --- .github/workflows/bench.yml | 15 +++++++++++---- .github/workflows/sql-benchmarks.yml | 15 +++++++++++---- .github/workflows/v3-commit-metadata.yml | 15 +++++++++++---- 3 files changed, 33 insertions(+), 12 deletions(-) diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index cc26c6975ad..695c4d80e23 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -136,6 +136,17 @@ jobs: # `continue-on-error` so an OIDC / uv / connect hiccup never breaks the v3 # pipeline. post-ingest.py mints the RDS IAM token internally (boto3) from # the assumed GitHubBenchmarkIngestRole; sslmode=verify-full validates the cert. + # + # ORDER MATTERS: "Install uv" runs BEFORE "Configure AWS credentials". + # configure-aws-credentials persists the assumed ingest-role (rds-db:connect + # only) as the job's ambient AWS creds; the uv setup compiles via sccache + # (S3-backed), so running it after the role switch fails with S3 AccessDenied. + # Installing uv first keeps sccache on the original S3-capable creds; the role + # is assumed immediately before the ingest, which needs only rds-db:connect. + - name: Install uv for v4 ingest + if: vars.GH_BENCH_INGEST_ROLE_ARN != '' + continue-on-error: true + uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63 # 0.18.6 - name: Configure AWS credentials for v4 ingest (OIDC) if: vars.GH_BENCH_INGEST_ROLE_ARN != '' continue-on-error: true @@ -143,10 +154,6 @@ jobs: with: role-to-assume: ${{ vars.GH_BENCH_INGEST_ROLE_ARN }} aws-region: ${{ vars.RDS_BENCH_REGION }} - - name: Install uv for v4 ingest - if: vars.GH_BENCH_INGEST_ROLE_ARN != '' - continue-on-error: true - uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63 # 0.18.6 - name: Ingest results to v4 Postgres (best-effort) if: vars.GH_BENCH_INGEST_ROLE_ARN != '' continue-on-error: true diff --git a/.github/workflows/sql-benchmarks.yml b/.github/workflows/sql-benchmarks.yml index ffefa28b802..092b3548510 100644 --- a/.github/workflows/sql-benchmarks.yml +++ b/.github/workflows/sql-benchmarks.yml @@ -689,6 +689,17 @@ jobs: # input that MUST exist for OIDC to succeed; it no-ops until v4 infra is wired), and # every step is continue-on-error. post-ingest.py mints the RDS IAM token (boto3) from # the assumed GitHubBenchmarkIngestRole; sslmode=verify-full validates the cert. + # + # ORDER MATTERS: "Install uv" runs BEFORE "Configure AWS credentials". + # configure-aws-credentials persists the assumed ingest-role (rds-db:connect + # only) as the job's ambient AWS creds; the uv setup compiles via sccache + # (S3-backed), so running it after the role switch fails with S3 AccessDenied. + # Installing uv first keeps sccache on the original S3-capable creds; the role + # is assumed immediately before the ingest, which needs only rds-db:connect. + - name: Install uv for v4 ingest + if: inputs.mode == 'develop' && vars.GH_BENCH_INGEST_ROLE_ARN != '' + continue-on-error: true + uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63 # 0.18.6 - name: Configure AWS credentials for v4 ingest (OIDC) if: inputs.mode == 'develop' && vars.GH_BENCH_INGEST_ROLE_ARN != '' continue-on-error: true @@ -696,10 +707,6 @@ jobs: with: role-to-assume: ${{ vars.GH_BENCH_INGEST_ROLE_ARN }} aws-region: ${{ vars.RDS_BENCH_REGION }} - - name: Install uv for v4 ingest - if: inputs.mode == 'develop' && vars.GH_BENCH_INGEST_ROLE_ARN != '' - continue-on-error: true - uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63 # 0.18.6 - name: Ingest results to v4 Postgres (best-effort) if: inputs.mode == 'develop' && vars.GH_BENCH_INGEST_ROLE_ARN != '' continue-on-error: true diff --git a/.github/workflows/v3-commit-metadata.yml b/.github/workflows/v3-commit-metadata.yml index 0e411730db8..52bfba48664 100644 --- a/.github/workflows/v3-commit-metadata.yml +++ b/.github/workflows/v3-commit-metadata.yml @@ -39,6 +39,17 @@ jobs: # a v4 failure never fails the job (promoted to required at cutover, PR-5.1). # Gated on the ingest-role ARN var (the assume-role input that MUST exist) so # it no-ops until v4 infra is wired. + # + # ORDER MATTERS: "Install uv" runs BEFORE "Configure AWS credentials". + # configure-aws-credentials persists the assumed ingest-role (rds-db:connect + # only) as the job's ambient AWS creds; the uv setup compiles via sccache + # (S3-backed), so running it after the role switch fails with S3 AccessDenied. + # Installing uv first keeps sccache on the original S3-capable creds; the role + # is assumed immediately before the ingest, which needs only rds-db:connect. + - name: Install uv for v4 ingest + if: vars.GH_BENCH_INGEST_ROLE_ARN != '' + continue-on-error: true + uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63 # 0.18.6 - name: Configure AWS credentials for v4 ingest (OIDC) if: vars.GH_BENCH_INGEST_ROLE_ARN != '' continue-on-error: true @@ -46,10 +57,6 @@ jobs: with: role-to-assume: ${{ vars.GH_BENCH_INGEST_ROLE_ARN }} aws-region: ${{ vars.RDS_BENCH_REGION }} - - name: Install uv for v4 ingest - if: vars.GH_BENCH_INGEST_ROLE_ARN != '' - continue-on-error: true - uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63 # 0.18.6 - name: Ingest commit metadata to v4 Postgres (best-effort) if: vars.GH_BENCH_INGEST_ROLE_ARN != '' continue-on-error: true From b2ab6c803f52bad56b3b0296d1358013e2ff05dc Mon Sep 17 00:00:00 2001 From: Connor Tsui Date: Fri, 19 Jun 2026 16:33:47 -0400 Subject: [PATCH 2/2] ci: rename the v3-commit-metadata workflow to commit-metadata The commit-metadata upload feeds BOTH the v3 server and the v4 Postgres (the `commits` dim), so naming it "v3" is misleading. Rename the file and the workflow `name:` to drop "v3"; the per-step `v3 server` / `v4 Postgres` labels stay (they target specific backends). Not a required check and referenced nowhere else, so the rename is self-contained. Signed-off-by: Connor Tsui --- .../{v3-commit-metadata.yml => commit-metadata.yml} | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) rename .github/workflows/{v3-commit-metadata.yml => commit-metadata.yml} (92%) diff --git a/.github/workflows/v3-commit-metadata.yml b/.github/workflows/commit-metadata.yml similarity index 92% rename from .github/workflows/v3-commit-metadata.yml rename to .github/workflows/commit-metadata.yml index 52bfba48664..1cd2601736c 100644 --- a/.github/workflows/v3-commit-metadata.yml +++ b/.github/workflows/commit-metadata.yml @@ -1,7 +1,9 @@ -# Posts a v3 ingest envelope with no records on every push to develop, so the -# `commits` dim stays populated even when no benchmark ran. +# Uploads commit metadata (an empty ingest envelope -- no benchmark records) on +# every push to develop, to both the v3 server and the v4 Postgres, so the +# `commits` dim stays populated even when no benchmark ran. Needed by both +# backends, hence not named for either. -name: v3 commit metadata +name: Commit metadata on: push: