@vzn/vx-ci 0.0.652 → 0.0.653

package/README.md

@@ -24,23 +24,27 @@ export default defineWorkspace({
 That's the whole setup. On a GitHub Actions runner (`GITHUB_STEP_SUMMARY`
 set) every `vx run` appends a summary block, on its own line after
 anything already written in the step: verdict headline, stats
-(tasks / executed / cache hits / duration, and the ideal time an executor says
+(tasks / executed / cache hits / aborted and not run when a stop cut the run short / duration, and the ideal time an executor says
 the run could have taken, as `@vzn/vx-dte` replays it), the workers
 that would have run it best (`@vzn/vx-dte`'s "Workers to declare"), failures called out above the
 per-task table (rows by status, failures first, then the longest first) with their exit code, the signal an exit above 128
 stands for (`exit 137 (128 + SIGKILL)`, as the run's own frame and
 `vx last` say it), a timeout as `timed out, exit 143`, a persistent task
-that never became ready as `never ready (timed out)`, a sandboxed task's
-violation count, and the tasks each failure blocked. A server a
+that never became ready as `never ready (timed out)`, a hit whose restore
+failed as `cache restore failed` (a failure, not executed and not a hit), a task whose
+command exited 0 but whose save vx refused as `cache save failed`, a sandboxed task's
+violation count, and the tasks each failure blocked. A task that retried
+or proved flaky carries the run's own row mark after its status
+(`✅ ran · flaky - failed 1× before · 2 attempts`). A server a
 DTE run carried to its dependants' workers reads `served`,
-with no duration of its own. When an executor
+with no duration of its own, as a skipped task has none. When an executor
 ran the run on other machines (`@vzn/vx-dte`'s workers), a Workers table
 shows each one's status, when it was asked for, its total time (warm-up
 plus online), its warm-up, its time online after the warm-up and the part
 of that with no task on it (a task counts from its send to its result,
 restore and save included), its tasks, the cores
 its tasks were expected to use (their last run's) beside the cores it used, its peak RAM of its memory, and
-its utilization, under a line
+its machine's cpu utilization from its first task's send to its last one's end, under a line
 of the expected and used share of all their core-time (the expected share over the workers whose executor reports one). Tasks the executor left to the run's own machine get a `this machine` row, and a line splits the executed count between workers and this machine. A footer line
 names the vx version, the command (what follows `--` counted, not
 quoted), tasks passed and outputs restored.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-ci",
-  "version": "0.0.652",
+  "version": "0.0.653",
   "license": "MIT",
   "description": "GitHub Actions and GitLab CI integration for vx — a job summary on Actions and the branch cache scope on both.",
   "keywords": [
@@ -33,7 +33,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.652"
+    "@vzn/vx": "^0.0.653"
   },
   "repository": {
     "type": "git",

package/src/setup.ts

@@ -5,7 +5,7 @@
 // verb is the plugin's, so a repo on neither CI has none.
 
 import { existsSync, readdirSync, readFileSync } from 'node:fs'
-import { mkdir, writeFile } from 'node:fs/promises'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import os from 'node:os'
 import path from 'node:path'
 import { ui, UserError } from '@vzn/vx'
@@ -124,12 +124,20 @@ export async function setup(o: SetupOptions): Promise<number> {
       await run(['apparmor_parser', '-R', '/etc/apparmor.d/bwrap-userns-restrict'])
       await run(['rm', '/etc/apparmor.d/bwrap-userns-restrict'])
     }
-    const profile = path.join(os.tmpdir(), `vx-bwrap-${process.pid}.apparmor`)
-    await writeFile(
-      profile,
-      'abi <abi/4.0>,\ninclude <tunables/global>\nprofile bwrap /usr/bin/bwrap flags=(unconfined) {\n  userns,\n}\n',
-    )
-    await run(['cp', profile, '/etc/apparmor.d/bwrap'])
+    // A fresh directory, only this user's: at tmpdir/vx-bwrap-<pid>.apparmor,
+    // a guessable name, a planted symlink took the write and root copied
+    // whatever that file held into /etc/apparmor.d.
+    const dir = await mkdtemp(path.join(os.tmpdir(), 'vx-bwrap-'))
+    try {
+      const profile = path.join(dir, 'bwrap.apparmor')
+      await writeFile(
+        profile,
+        'abi <abi/4.0>,\ninclude <tunables/global>\nprofile bwrap /usr/bin/bwrap flags=(unconfined) {\n  userns,\n}\n',
+      )
+      await run(['cp', profile, '/etc/apparmor.d/bwrap'])
+    } finally {
+      await rm(dir, { recursive: true, force: true })
+    }
     await run(['apparmor_parser', '-r', '/etc/apparmor.d/bwrap'])
   }
   // GitLab keeps it in the checkout, where a root task's `**` keyed the

package/src/summary.ts

@@ -43,6 +43,30 @@ function statusLabel(t: TaskTelemetry): string {
   return STATUS_LABEL[t.status] ?? t.status
 }
 
+/**
+ * A retried or flaky task's mark, in the words of the run's own row
+ * (`flaky - failed 1× before · 2 attempts`): a pass that needed a retry
+ * read as a plain `ran`. Numbers only, so no escape.
+ */
+function flakyMark(t: TaskTelemetry): string {
+  const attempts = (t.attempts ?? 1) > 1 ? `${t.attempts} attempts` : undefined
+  if (t.flaky === undefined) return attempts === undefined ? '' : ` · ${attempts}`
+  const said: string[] = []
+  if (t.status === 'failed' && t.flaky.passes > 0) said.push(`passed ${t.flaky.passes}× before`)
+  if (t.status !== 'failed' && t.flaky.failures > 0) said.push(`failed ${t.flaky.failures}× before`)
+  if (attempts !== undefined) said.push(attempts)
+  return said.length === 0 ? ' · flaky' : ` · flaky - ${said.join(' · ')}`
+}
+
+/**
+ * Whether the task ran its command here or on a worker. A carried server ran
+ * inside its dependants, on their worker; a failure in no cache column
+ * (`cacheSource: 'none'`) is a hit whose restore failed, which ran nothing.
+ */
+const executed = (t: TaskTelemetry): boolean =>
+  (t.status === 'success' || (t.status === 'failed' && t.cacheSource !== 'none')) &&
+  t.carried !== true
+
 /** Rows by status label, in this order; any other after them. */
 const ORDER = [
   '❌ failed',
@@ -143,22 +167,21 @@ function codeSpan(raw: string): string {
 /** Render the whole job summary. Deterministic for a given record. */
 export function renderJobSummary(summary: RunSummaryRecord, title = 'vx run'): string {
   const failed = summary.tasks.filter((t) => t.status === 'failed')
-  const cancelled = !summary.exitOk && summary.failedCount === 0 && summary.abortedCount > 0
+  const notRun = summary.notRunCount ?? 0
+  const cancelled =
+    !summary.exitOk && summary.failedCount === 0 && summary.abortedCount + notRun > 0
   const verdict = summary.exitOk ? '✅' : cancelled ? '⏹️' : '❌'
   const lines: string[] = []
   lines.push(`## ${verdict} ${title}`)
   lines.push('')
-  // A carried server ran inside its dependants, on their worker.
-  const executed = summary.tasks.filter(
-    (t) => (t.status === 'success' || t.status === 'failed') && t.carried !== true,
-  ).length
   const stats = [
     `**${summary.taskCount}** task${summary.taskCount === 1 ? '' : 's'}`,
-    `**${executed}** executed`,
+    `**${summary.tasks.filter(executed).length}** executed`,
     `**${summary.hitCount}** cache hit${summary.hitCount === 1 ? '' : 's'}` +
       (summary.hitCount > 0 ? ` ${hitSplit(summary)}` : ''),
     ...(summary.failedCount > 0 ? [`**${summary.failedCount}** failed`] : []),
     ...(summary.abortedCount > 0 ? [`**${summary.abortedCount}** aborted`] : []),
+    ...(notRun > 0 ? [`**${notRun}** not run`] : []),
     // The run played perfectly on what each task took, beside the real time (2026-10-23).
     summary.idealMs === undefined
       ? fmtMs(summary.totalDurationMs)
@@ -189,7 +212,7 @@ export function renderJobSummary(summary: RunSummaryRecord, title = 'vx run'): s
       const signal = exitSignal(t.exitCode)
       const blocked = blockedBy.get(t.taskId) ?? []
       lines.push(
-        `- **${escapeMarkdownCell(escapeInline(t.taskId))}** — ${t.notReady !== undefined ? `never ready (${t.notReady === 'timeout' ? 'timed out' : t.notReady === 'exited' ? 'exited' : 'spawn failed'}), exit ${t.exitCode}` : t.timedOut === true ? `timed out, exit ${t.exitCode}` : `exit ${t.exitCode}${signal === undefined ? '' : ` (128 + ${signal})`}`}${t.sandboxViolations !== undefined && t.sandboxViolations > 0 ? ` · ${t.sandboxViolations} sandbox violation${t.sandboxViolations === 1 ? '' : 's'}` : ''}${blocked.length > 0 ? ` · blocked ${blocked.join(', ')}` : ''}`,
+        `- **${escapeMarkdownCell(escapeInline(t.taskId))}** — ${t.cacheSource === 'none' ? 'cache restore failed' : t.notReady !== undefined ? `never ready (${t.notReady === 'timeout' ? 'timed out' : t.notReady === 'exited' ? 'exited' : 'spawn failed'}), exit ${t.exitCode}` : t.timedOut === true ? `timed out, exit ${t.exitCode}` : t.exitCode === 0 ? 'cache save failed' : `exit ${t.exitCode}${signal === undefined ? '' : ` (128 + ${signal})`}`}${t.sandboxViolations !== undefined && t.sandboxViolations > 0 ? ` · ${t.sandboxViolations} sandbox violation${t.sandboxViolations === 1 ? '' : 's'}` : ''}${blocked.length > 0 ? ` · blocked ${blocked.join(', ')}` : ''}`,
       )
     }
     lines.push('')
@@ -215,8 +238,8 @@ export function renderJobSummary(summary: RunSummaryRecord, title = 'vx run'): s
   for (const t of ordered) {
     const cells = [
       escapeMarkdownCell(escapeInline(t.taskId)),
-      statusLabel(t),
-      t.carried === true ? '' : fmtMs(t.durationMs),
+      statusLabel(t) + flakyMark(t),
+      t.carried === true || t.status === 'skipped' ? '' : fmtMs(t.durationMs),
     ]
     lines.push(`| ${cells.join(' | ')} |`)
   }
@@ -318,11 +341,8 @@ function renderWorkers(
     )
   }
   // Nothing runs on a distributed run's own machine (2026-10-23):
-  // a task that did is named, a bug to see. A carried server ran inside its
-  // dependants, on their worker.
-  const ran = tasks.filter(
-    (t) => (t.status === 'success' || t.status === 'failed') && t.carried !== true,
-  )
+  // a task that did is named, a bug to see.
+  const ran = tasks.filter(executed)
   const here = ran.filter((t) => t.where === undefined)
   if (here.length > 0) {
     const failed = here.filter((t) => t.status === 'failed').length