ci: stop the docs-auto-update treadmill from exhausting free CI budgets - #2396
Merged
Conversation
main takes ~40 pushes/day and ~70% of them are `docs: auto-update` bot commits (~21/day from the LLM brief alone -- it embeds a timestamp so it always diffs, and its PR auto-merges, which is itself another push). Two mirrors of the same full-precision galaxyscope run fired on every one of those pushes: - gitgalaxy.yml's `full-report` job (SARIF/SBOM/LLM brief). Moved from per-push to a daily schedule + workflow_dispatch. The brief is an orientation doc and the SARIF feed is a dashboard -- daily is plenty. The real per-PR malware gate is the unchanged PRE-GATE jobs. - azure-pipelines.yml. main pushes there ~40x/day exhausted the Azure DevOps org's free Microsoft-hosted minute grant, so every run failed with "no free minutes remaining" -- a permanent red X on every main commit. Now triggers on `v*` tags + a weekly heartbeat only (~5 runs/month), keeping it as a "still green on Azure" reference. Also shallow-checkout (the audit reads the working tree, not history). Follow-ups: make the LLM brief itself stable (drop the volatile timestamp/duration/commit lines) so most scheduled runs are no-ops; and on the Azure side, disable the pipeline or request the free-parallelism grant to green the historical commits. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
maintakes ~43 commits/day (last 7d: ~300 commits), and ~69% aredocs: auto-updatebot commits — 292 "LLM architectural brief" regensin 14 days (~21/day). The brief embeds a
Timestamp/Scan Duration/Git Commit, so every scan diffs; its PR auto-merges; that merge isanother push to
main.Every one of those pushes fired a full-precision
galaxyscoperun ontwo mirrored pipelines:
gitgalaxy.ymlfull-reportjobazure-pipelines.ymlmaincommit, for a scangitgalaxy.ymlalready does for freeChanges
gitgalaxy.yml:full-reportmoves from per-push → daily schedule(
cron: "17 5 * * *") +workflow_dispatch.push:trigger removed(nothing else in the file used it — the pre-gate jobs are
pull_request-only). The per-PR--fail-on-malwaregate is unchanged.azure-pipelines.yml: trigger onv*tags + a weekly heartbeat(
cron: "0 6 * * 1") instead of every push tomain— ~5 runs/month,enough to keep a "still green on Azure" reference. Shallow checkout
(
fetchDepth: 1; the audit reads the working tree, not history).zizmor: no new findings (1 pre-existing informational, untouched).
Follow-ups (not in this PR)
timestamp/duration/commit lines from
llm_recorder.py— so mostscheduled runs produce no PR at all.
squid-protocol.gitgalaxypipeline (Pipelines → Settings) or request the free-parallelism grant
(aka.ms/azpipelines-parallelism-request) to green the historical commits.
🤖 Generated with Claude Code