ci(test-scope): read the trusted classifier in one GraphQL query, not a REST call per file by cixzhang · Pull Request #9180 · meta/astryx

cixzhang · 2026-10-31T18:07:51Z

Maintainer impact

Before: every CI job that decides its own scope reads three trusted classifier files from the base commit with three REST calls (four for the component-audit jobs). About 17 jobs per pull-request run do this, so roughly 27,000 REST calls a day go to reading the same three small files. Those calls count against the repository's shared Actions token rate limit, which the review and comment workflows also use, and runs have been failing on it ("API rate limit exceeded for installation").
After: the step reads the same files at the same base commit in one GraphQL query. GraphQL has its own rate limit, so each job makes 3 fewer REST calls.
Unchanged: what is read (the base commit's change-scope.cjs, knowledge-paths.cjs, component-packages.cjs, and component-audit-scope.cjs for audit jobs), the trust model (a pull request cannot loosen its own classification), and fail-closed behavior: a missing, unreadable or truncated file, or a failed query, still puts everything in scope.

Intended invariant

spec:AST-030 FR3–FR4: classification uses trusted base policy, and uncertainty fails closed. Neither requirement changes; only the transport changes.

Change

.github/actions/test-scope/action.yml: one aliased GraphQL query (object(expression: "<base sha>:<path>") { ... on Blob { text isTruncated } }) replaces the per-file repos.getContent loop. A null, non-text or truncated blob throws into the existing "everything is in scope" path.
test-scope-action.test.mjs: the stub serves the policy through GraphQL, and new cases cover one query with no REST call, a failed query, and a truncated file.

Evidence

test-scope-action.test.mjs: 28 pass, including the existing missing-classifier and missing-audit-classifier cases, which still fall back to everything in scope.
I ran the query against this repository: it returns change-scope.cjs byte-for-byte (10,200 bytes, not truncated) and null for a missing path.
Expected savings, from the last day of runs: about 525 non-draft pull-request runs a day × 17 scope steps × 3 calls ≈ 27,000 REST calls a day (≈ 1,100 an hour), moved to about 9,000 GraphQL points a day. Runner minutes are unchanged.

Scope

No intended public API, product behavior, visual direction, or policy change.
Product changes discovered during the work were removed or split.
Public text and artifacts contain no internal Meta context.

Testing

pnpm exec vitest run .github/scripts/test-scope-action.test.mjs

… a REST call per file

vercel · 2026-10-31T18:07:56Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
astryx	Error		Oct 31, 2026 9:04pm UTC

astracat-bot · 2026-10-31T18:07:58Z

AI review status for this pull request.

Review status	Updated
🟢 Reviewed (for maintainers only)	Oct 31, 2026, 9:08 PM UTC

github-actions · 2026-10-31T18:09:05Z

PR Analysis Report

Preview: the links below open this branch's latest Vercel deployment, which can trail a new push until that push's deployment is ready.

📚 Storybook Preview

View Storybook for this PR

🧪 Sandbox Preview

View Sandbox for this PR

No new or modified components detected.

Bundle Size Summary

No component packages changed.

Published Package Size

No published package changed size (11 measured).

Download is the gzip tarball npm fetches; unpacked is what lands in node_modules.

Accessibility Audit

Status: Accessibility did not run on this pull request; add ci:run-a11y to run it. It runs after merges to main and before each release.

_{Generated by PR Enrichment workflow | Storybook | Sandbox | View full report}

astracat-bot

Recommending approval. Reading the trusted classifier in one GraphQL query keeps the same base-commit files and the same fail-closed fallback that spec:AST-030 FR3 and FR4 require, and the step's inputs, outputs and required checks are unchanged. The new tests cover the single query, a failed query and a truncated file, and this head's own CI decided scope through the real query without a warning. No changes are needed.

[Automated review]

…through GraphQL

astracat-bot

Changes requested: the GraphQL read keeps the trusted base-commit classifier and the fail-closed fallback intact, but one existing contract test still pins the old REST call. .github/scripts/spec-owner-workflow.test.mjs:44 expects ref: pr.base.sha in the scope action and now fails in test-node; switching it to the `${pr.base.sha}:${file}` assertion that ci-tooling-routing.test.mjs already uses should clear it. The build-storybook failure comes from main's newer workflow and should clear once main is merged.

[Automated review]

astracat-bot · 2026-10-31T20:28:20Z

-    // both dependencies from the PR's base commit.
-    expect(scopeAction).toContain('ref: pr.base.sha');
+    // both dependencies from the PR's base commit, in one GraphQL query.
+    expect(scopeAction).toContain('`${pr.base.sha}:${file}`');


.github/scripts/spec-owner-workflow.test.mjs:44 makes the same check with the old string, expect(action).toContain('ref: pr.base.sha'), and it now fails in test-node (1/4). It needs this same update.

… through GraphQL

…-policy

astracat-bot

Recommending approval. Reading the trusted classifier in one GraphQL query keeps the same base-commit files and the fail-closed fallback that spec:AST-030 FR3 and FR4 require, and the step's inputs, outputs and required checks are unchanged. The contract test in spec-owner-workflow.test.mjs that pinned the old REST call now asserts the base-SHA expression and passes, and the new cases cover the single query, a failed query and a truncated file. No further changes are needed.

[Automated review]

ci(test-scope): read the trusted classifier in one GraphQL query, not…

6466991

… a REST call per file

meta-cla Bot added the CLA Signed This label is managed by the Meta Open Source bot. label Oct 31, 2026

ci(test-scope): say rate limit

e6d2f8c

cixzhang marked this pull request as ready for review October 31, 2026 18:13

cixzhang requested review from imdreamrunner and josephfarina as code owners October 31, 2026 18:13

vercel Bot deployed to Preview October 31, 2026 18:17

View deployment

astracat-bot Bot approved these changes Oct 31, 2026

View reviewed changes

test(ci-tooling-routing): the scope action reads the base classifier …

ca6f438

…through GraphQL

cixzhang marked this pull request as draft October 31, 2026 20:15

cixzhang marked this pull request as ready for review October 31, 2026 20:17

vercel Bot had a problem deploying to Preview October 31, 2026 20:23 Failure

astracat-bot Bot requested changes Oct 31, 2026

View reviewed changes

cixzhang added 2 commits October 31, 2026 13:30

test(spec-owner-workflow): the scope action reads the base classifier…

5decf9c

… through GraphQL

Merge remote-tracking branch 'origin/main' into ci/test-scope-graphql…

4044f81

…-policy

cixzhang marked this pull request as draft October 31, 2026 20:55

cixzhang marked this pull request as ready for review October 31, 2026 20:56

vercel Bot had a problem deploying to Preview October 31, 2026 21:04 Failure

astracat-bot Bot approved these changes Oct 31, 2026

View reviewed changes

cixzhang merged commit 0eb4eff into main Oct 31, 2026
88 of 89 checks passed

github-actions Bot deleted the ci/test-scope-graphql-policy branch November 1, 2026 06:05

Navigation Menu

Repository navigation

ci(test-scope): read the trusted classifier in one GraphQL query, not a REST call per file - #9180

ci(test-scope): read the trusted classifier in one GraphQL query, not a REST call per file#9180
cixzhang merged 5 commits into
mainfrom
ci/test-scope-graphql-policy

cixzhang commented Oct 31, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 31, 2026 •

edited

Loading

Uh oh!

astracat-bot Bot commented Oct 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 31, 2026 •

edited

Loading

Uh oh!

astracat-bot Bot left a comment

Uh oh!

astracat-bot Bot left a comment

Uh oh!

astracat-bot Bot Oct 31, 2026

Uh oh!

astracat-bot Bot left a comment

Uh oh!

Uh oh!

This branch had an error being deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

cixzhang commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Maintainer impact

Intended invariant

Change

Evidence

Scope

Testing

Uh oh!

vercel Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

astracat-bot Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Analysis Report

📚 Storybook Preview

🧪 Sandbox Preview

Bundle Size Summary

Published Package Size

Accessibility Audit

Uh oh!

astracat-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

astracat-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

astracat-bot Bot Oct 31, 2026

Choose a reason for hiding this comment

Uh oh!

astracat-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch had an error being deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cixzhang commented Oct 31, 2026 •

edited

Loading

vercel Bot commented Oct 31, 2026 •

edited

Loading

astracat-bot Bot commented Oct 31, 2026 •

edited

Loading

github-actions Bot commented Oct 31, 2026 •

edited

Loading