Context
PR #1840 added two L4 real-binary CI jobs — plugin-integration (customer-fork builds against the extension/platform plugin contract, tests/plugin_e2e/) and sidecar-integration (authsidecar HMAC round trip, tests/sidecar_e2e/). Both were wired observe-only: they appear in the results summary table but are deliberately excluded from its blocking loop while they prove stable (see the comment in the results job in .github/workflows/ci.yml).
An observe-only job that never graduates protects nothing: if a plugin envelope regression lands, plugin-integration turns red in a summary row nobody is required to look at, PRs keep merging, and the regression ships — the exact class of failure (#1764) these jobs were built to catch. This issue is the accountability anchor so the soft launch has an end date.
Graduation criteria
Promote both jobs into the results blocking loop once 4 consecutive weeks with zero false positives (a false positive = a job failure not caused by a real regression in the code under test — e.g. GOPROXY flakiness, runner issues).
Track per job; either job may graduate independently if one proves stable sooner.
What graduation looks like
In .github/workflows/ci.yml, results job:
- Add
plugin-integration / sidecar-integration results into the blocking for result in ... loop.
- Remove the "intentionally NOT in this loop yet" comment block.
Baseline
At PR #1840 merge time both jobs were green on every run of the PR (~1m19s / ~1m40s), with zero false positives observed during the PR's CI history.
Context
PR #1840 added two L4 real-binary CI jobs —
plugin-integration(customer-fork builds against theextension/platformplugin contract,tests/plugin_e2e/) andsidecar-integration(authsidecar HMAC round trip,tests/sidecar_e2e/). Both were wired observe-only: they appear in theresultssummary table but are deliberately excluded from its blocking loop while they prove stable (see the comment in theresultsjob in.github/workflows/ci.yml).An observe-only job that never graduates protects nothing: if a plugin envelope regression lands,
plugin-integrationturns red in a summary row nobody is required to look at, PRs keep merging, and the regression ships — the exact class of failure (#1764) these jobs were built to catch. This issue is the accountability anchor so the soft launch has an end date.Graduation criteria
Promote both jobs into the
resultsblocking loop once 4 consecutive weeks with zero false positives (a false positive = a job failure not caused by a real regression in the code under test — e.g. GOPROXY flakiness, runner issues).Track per job; either job may graduate independently if one proves stable sooner.
What graduation looks like
In
.github/workflows/ci.yml,resultsjob:plugin-integration/sidecar-integrationresults into the blockingfor result in ...loop.Baseline
At PR #1840 merge time both jobs were green on every run of the PR (~1m19s / ~1m40s), with zero false positives observed during the PR's CI history.