Skip to content

[maestro] Restore public Bzlmod module name and guard it#799

Closed
haasonsaas wants to merge 3 commits into
mainfrom
guardrail/394-bazel-module-name
Closed

[maestro] Restore public Bzlmod module name and guard it#799
haasonsaas wants to merge 3 commits into
mainfrom
guardrail/394-bazel-module-name

Conversation

@haasonsaas

Copy link
Copy Markdown
Contributor

Note: Stacked on #798 (both add a guardrail-regression-suite entry). Once #798 merges, this PR's diff shrinks to just the MODULE.bazel fix + guard test. Reviewing this one is fine independently.

Summary

Guardrail for #394 (other-feedback). Manual review conclusion: convert this class into a repo-local guardrail.

The public evalops/maestro MODULE.bazel declared module(name = "evalops_maestro_internal"), leaking the internal module identity to public Bzlmod consumers — any downstream workspace using bazel_dep(name = "evalops_maestro", ...) stops resolving. This was introduced by the mirror sync in #417 and flagged by both cursor and codex review as a breaking Bzlmod change; no later commit restored it.

Change

  • Fix: MODULE.bazel evalops_maestro_internalevalops_maestro. Safe and self-contained — nothing in-repo self-references the module name (BUILD.bazel/.bzl), and MODULE.bazel.lock carries only BCR dependency hashes (no root-module identity), so no lock change is needed.
  • Guard test (test/scripts/ci-guardrails.test.ts): keeps the public Bazel module name public-facing — asserts module(name = "evalops_maestro") and forbids evalops_maestro_internal, so a future mirror sync that re-leaks the internal name fails CI.
  • Guardrail registry: adds the public-bazel-module-identity entry to scripts/guardrail-regression-suite.json.

Acceptance (#394)

  • A repo-local guardrail fails for the representative feedback shape (the guard test fails while MODULE.bazel reads evalops_maestro_internal).
  • Wired into the smallest relevant test target — test/scripts/ci-guardrails.test.ts (run by ci-nx-tests.sh / Nx maestro:test).
  • Sentinel re-scan reports the other-feedback fingerprint closed/absent (happens after merge).

Verification

  • bunx vitest --run test/scripts/ci-guardrails.test.ts — 172 passed
  • node scripts/check-guardrail-regression-suite.mjs — covers 13 bug classes
  • bunx biome check test/scripts/ci-guardrails.test.ts — clean
  • Pre-commit hook (buf + biome + tsc build + bundle) — passed

Follow-up (out of scope here)

If the internal→public mirror sync rewrites module names, the rewrite (evalops_maestro_internalevalops_maestro) belongs in the internal sync path (maestro-internal). The guardrail here will catch any sync that fails to do so.

Closes #394.

…acting

stripRustTestModules stripped every inline `mod tests { }` block regardless
of #[cfg(test)], so edits inside an unguarded inline test module were dropped
from the release diff and packageChangedSinceTag could return false even
though compiled package sources changed. Gate stripping on a preceding
#[cfg(test)] attribute so only test-only modules are stripped; unguarded
modules stay package-impacting and force the required version bump.

Adds inline regression coverage (unguarded = impacting, cfg(test)-gated =
ignored) and registers the release-train-drift guardrail in the regression
suite manifest.

Refs #604
The public evalops/maestro MODULE.bazel declared module(name =
"evalops_maestro_internal"), leaking the internal module identity to public
Bzlmod consumers and breaking downstream bazel_dep(name = "evalops_maestro")
resolution. Restore the public name and add a repo-local guardrail that fails
if MODULE.bazel regresses to the internal name.

Representative feedback: PR #417 renamed module(name = ...) on the public
mirror, flagged as a breaking Bzlmod change.

Refs #394
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@github-actions

Copy link
Copy Markdown
Contributor

This PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR.

Add one of these to the PR body, then re-run the check:

  • https://github.com/evalops/maestro-internal/pull/<number>
  • evalops/maestro-internal#<number>
  • maestro-internal#<number>

Mirrored files touched:

  • MODULE.bazel
  • scripts/guardrail-regression-suite.json
  • scripts/release-impact-filter.mjs
  • test/scripts/ci-guardrails.test.ts
  • test/scripts/release-impact-filter.test.ts

@cursor

cursor Bot commented Jun 20, 2026

Copy link
Copy Markdown

PR Summary

Medium Risk
Touches release tagging semantics (Rust test stripping) and a consumer-facing Bzlmod module name; mistakes could either force unnecessary version bumps or break external Bazel workspaces again.

Overview
Restores the public Bazel module identity and hardens release-train detection around Rust test modules.

Public Bzlmod identity: MODULE.bazel now declares module(name = "evalops_maestro") instead of evalops_maestro_internal, so downstream bazel_dep(name = "evalops_maestro", …) resolves again after mirror sync drift. A CI guard in test/scripts/ci-guardrails.test.ts and a public-bazel-module-identity entry in scripts/guardrail-regression-suite.json block re-leaking the internal name.

Release impact filter: stripRustTestModules in scripts/release-impact-filter.mjs only removes inline mod tests blocks that are gated by #[cfg(test)], including when #[cfg(test)] is separated from mod tests by comments or blank lines (rustOuterAttributeGroupInfo). Unguarded mod tests is treated as production code, so edits inside it count as package-impacting for packageChangedSinceTag. Regression tests cover unguarded vs cfg-gated inline modules; the suite also documents this as release-train-drift.

Reviewed by Cursor Bugbot for commit fc9c973. Bugbot is set up for automated code reviews on this repo. Configure here.

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix prepared a fix for the issue found in the latest run.

  • ✅ Fixed: Discontiguous cfg skips test stripping
    • Updated Rust test-module stripping to honor cfg(test) attributes across intervening blank/comment trivia and added a regression test for the inline-module case.

You can send follow-ups to the cloud agent here.

Reviewed by Cursor Bugbot for commit 8902225. Configure here.

Comment thread scripts/release-impact-filter.mjs
@haasonsaas

Copy link
Copy Markdown
Contributor Author

Closing as superseded. The durable fix landed in the source-of-truth repo via maestro-internal#2830: the public Bzlmod module name is now rewritten to evalops_maestro during mirror prep (prepare-public-release-mirror.mjs), with a prep regression test guarding it. It propagates to public through the generated sync PR #797.

This PR's direct MODULE.bazel edit was the wrong shape for this mirror model — it would be overwritten by the next sync (which is how the _internal leak originally happened in #417), and its ci-guardrails.test.ts assertion would fail internal CI where the name is correctly evalops_maestro_internal. The internal prep-rewrite approach in #2830 is the correct durable fix.

@haasonsaas haasonsaas closed this Jun 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[codex] Guardrail candidate: Other feedback (other-feedback)

2 participants