feat: capture a failed composed child's run log via the run token#220
Open
grubmeshi wants to merge 2 commits into
Open
feat: capture a failed composed child's run log via the run token#220grubmeshi wants to merge 2 commits into
grubmeshi wants to merge 2 commits into
Conversation
When a composition waits on a child building block that fails, fetch the failed run's logs with the run-scoped MESHSTACK_RUN_TOKEN (env-only) when present, so the child's system message is captured into the parent run even if the child has run transparency disabled. Falls back to the workspace credentials when no run token is set. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
📊 Test Coverage
Uncovered functions (combined run)Combined with |
A meshstack_building_block_definition with an empty version_spec.inputs = {}
failed with "Provider produced inconsistent result after apply": the backend
collapses a null and an empty inputs map, and the read-back only restored a
null shape, so an empty map became null. Preserve the caller's exact shape
(nil stays nil, {} stays {}) when the version carries no inputs, on apply and
on refresh.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Capture a failed composed child's run log via the run token
Pairs with the meshfed-release PR on the identically-named branch
feature/composed-run-failure-logs.Why
When a composition building block (e.g. a starter kit) waits on a child building block it created and that
child fails,
addRunFailureDiagnosticsfetches the child run's logs and adds the failing step as an error, sothe tf-block-runner streams the real error into the parent run's log. Fetched with the consumer's workspace
credentials, a child with
run_transparency = falsereturns nosystemMessage, so the parent log only carrieda generic "run failed". meshStack injects a privileged, run-scoped token (
MESHSTACK_RUN_TOKEN) into such runsthat can read the composition's own children's runs.
Change
provider.go: readMESHSTACK_RUN_TOKEN(env-only — it is set per run by the platform, never in HCL); whenpresent, build a run-token-authorized run-log client.
client.go:NewBuildingBlockRunClientWithAuthbuilds a standaloneMeshBuildingBlockRunClientwith its ownauthorization (skipping the version check the main client already did). New
Client.BuildingBlockRunWithRunTokenfield, nil unless the token is set.
building_block_resource.go:addRunFailureDiagnosticsfetches the failed run's logs with the run-tokenclient when available, else the workspace client. Everything else (CRUD, polling) keeps the workspace
credentials.
The child run uuid the provider polls comes from
bb.Status.LatestRunUuid, which the paired backend changenow exposes to the block owner regardless of the child's run transparency.
Additive on a
-previewAPI — not breaking, noTerraformProviderVersionRequirements.ktcoordination needed.Tests
building_block_resource_await_test.go):addRunFailureDiagnosticsuses the run-token client whenconfigured (and not the workspace client), and falls back to the workspace client when it is not; the fetched
system message reaches the diagnostics. Hermetic, CI-runnable.
forced to fail at
run_transparency = false); it is not automated because CI runs the tf-block-runner as aservice container that pulls the released provider from the registry, so it cannot exercise a dev-built
provider. Wiring the dev provider into the local runner requires a
dev_overridesblock in$HOME/.terraformrc(the runner strips
TF_CLI_CONFIG_FILE).task testandtask lintgreen.CHANGELOG.md: newv0.23.1FEATURES entry.Cross-repo PR