Surface early sticky disk commit denial and stop logging false commit success (#49)

The VM agent reports commit_early_deny/commit_early_deny_reason on
GetStickyDisk when it already knows the commit will be denied (branch
protection). Emit a notice when the git mirror is set up, save the reason to
state, release the sticky disk without a commit in the post step, and stop
logging a successful commit: the RPC only records intent and the host
applies it at VM shutdown.

Bumps @buf/blacksmith_vm-agent.{bufbuild_es,connectrpc_es} to the BSR build
that includes the new fields, with the matching .licenses records.

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: piob-io

….0-20260115212136-f78b3d5805ba.1.dep.yml ….0-20260904133914-c6beb298c70c.1.dep.yml.licenses/npm/@buf/blacksmith_vm-agent.bufbuild_es-1.10.0-20260115212136-f78b3d5805ba.1.dep.yml renamed to .licenses/npm/@buf/blacksmith_vm-agent.bufbuild_es-1.10.0-20260904133914-c6beb298c70c.1.dep.yml .licenses/npm/@buf/blacksmith_vm-agent.bufbuild_es-1.10.0-20260115212136-f78b3d5805ba.1.dep.yml renamed to .licenses/npm/@buf/blacksmith_vm-agent.bufbuild_es-1.10.0-20260904133914-c6beb298c70c.1.dep.yml

@@ -33,8 +33,8 @@
     "@actions/github": "^6.0.0",
     "@actions/io": "^1.1.3",
     "@actions/tool-cache": "^2.0.1",
-    "@buf/blacksmith_vm-agent.bufbuild_es": "1.9.0-20260115212136-f78b3d5805ba.2",
-    "@buf/blacksmith_vm-agent.connectrpc_es": "1.6.1-20260115212136-f78b3d5805ba.2",
+    "@buf/blacksmith_vm-agent.bufbuild_es": "1.9.0-20260904133914-c6beb298c70c.2",
+    "@buf/blacksmith_vm-agent.connectrpc_es": "1.6.1-20260904133914-c6beb298c70c.2",
     "@bufbuild/protobuf": "^1.9.0",
     "@connectrpc/connect": "^1.6.1",
     "@connectrpc/connect-node": "^1.6.1",

….0-20260115212136-f78b3d5805ba.2.dep.yml ….0-20260904133914-c6beb298c70c.2.dep.yml.licenses/npm/@buf/blacksmith_vm-agent.bufbuild_es-1.9.0-20260115212136-f78b3d5805ba.2.dep.yml renamed to .licenses/npm/@buf/blacksmith_vm-agent.bufbuild_es-1.9.0-20260904133914-c6beb298c70c.2.dep.yml .licenses/npm/@buf/blacksmith_vm-agent.bufbuild_es-1.9.0-20260115212136-f78b3d5805ba.2.dep.yml renamed to .licenses/npm/@buf/blacksmith_vm-agent.bufbuild_es-1.9.0-20260904133914-c6beb298c70c.2.dep.yml

@@ -84,6 +84,10 @@ export interface CacheInfo {
   // performedHydration indicates that this job performed the initial git mirror clone.
   // Used to notify the backend on commit so it can mark hydration as complete.
   performedHydration: boolean
+  // commitEarlyDenyReason is non-empty when the host already knows this job's
+  // sticky disk commit will be denied (e.g. branch protection): the mirror can
+  // be used but changes to it are discarded at VM teardown.
+  commitEarlyDenyReason: string
 }
 
 /**
@@ -326,7 +330,8 @@ export async function setupCache(
         mirrorPath: '',
         hydrationInProgress: true,
         hydrationMessage,
-        performedHydration: false
+        performedHydration: false,
+        commitEarlyDenyReason: ''
       }
     }
     // Re-throw other errors
@@ -350,6 +355,15 @@ export async function setupCache(
     `[git-mirror] Got sticky disk device: ${device}, exposeId: ${exposeId}`
   )
 
+  const commitEarlyDenyReason = response.commitEarlyDeny
+    ? response.commitEarlyDenyReason || 'denied by host policy'
+    : ''
+  if (commitEarlyDenyReason) {
+    core.notice(
+      `[git-mirror] Sticky disk changes will not be committed for this job (${commitEarlyDenyReason}). The git mirror cache is used as-is and any changes to it are discarded.`
+    )
+  }
+
   // Format if needed
   await waitForNonZeroDeviceSize(device, 10000)
   await maybeFormatDevice(device)
@@ -370,7 +384,8 @@ export async function setupCache(
     mountPoint,
     mirrorPath: getMirrorPath(owner, repo),
     hydrationInProgress: false,
-    performedHydration: false // Will be set by ensureMirror if we do initial clone
+    performedHydration: false, // Will be set by ensureMirror if we do initial clone
+    commitEarlyDenyReason
   }
 }
 
@@ -1996,7 +2011,13 @@ export async function cleanup(options: CleanupOptions): Promise<CleanupResult> {
       vmHydratedGitMirror: vmHydratedGitMirror
     })
 
-    core.info('[git-mirror] Successfully committed sticky disk')
+    // The host applies the commit at VM teardown, after this step has ended;
+    // the RPC only records whether a commit was requested.
+    core.info(
+      shouldCommit
+        ? '[git-mirror] Sticky disk commit requested; applied at VM shutdown'
+        : '[git-mirror] Sticky disk released without commit'
+    )
   } catch (error) {
     core.warning(
       `[git-mirror] Failed to commit sticky disk: ${(error as any)?.message ?? error}`

.licenses/npm/@buf/blacksmith_vm-agent.connectrpc_es.dep.yml

@@ -138,6 +138,9 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
           stateHelper.setBlacksmithCacheRepoName(cacheInfo.repoName)
           stateHelper.setBlacksmithCacheMirrorPath(cacheInfo.mirrorPath)
           stateHelper.setBlacksmithCacheMountPoint(cacheInfo.mountPoint)
+          stateHelper.setBlacksmithCacheCommitEarlyDenyReason(
+            cacheInfo.commitEarlyDenyReason
+          )
 
           const performedHydration = await blacksmithCache.ensureMirror(
             cacheInfo.mirrorPath,

dist/index.js

@@ -79,28 +79,38 @@ async function cleanup(): Promise<void> {
     let cleanupResult: blacksmithCache.CleanupResult | undefined
 
     try {
-      // Check for previous step failures by reading runner logs
-      // This is the same approach used by setup-docker-builder (BPA)
-      core.info(
-        '[git-mirror] Checking for previous step failures before committing'
-      )
-      const failureCheck = await checkPreviousStepFailures()
-
       let shouldCommit = true
       let skipReason = ''
 
-      if (failureCheck.error) {
-        // If we can't determine failure status, skip commit to be safe
+      const commitEarlyDenyReason =
+        stateHelper.BlacksmithCacheCommitEarlyDenyReason
+      if (commitEarlyDenyReason) {
+        // The host already told us at mount time that this job's writes are
+        // discarded, so there is nothing to persist and no need to inspect
+        // step results.
         shouldCommit = false
-        skipReason = `Unable to check for step failures: ${failureCheck.error}`
-      } else if (failureCheck.hasFailures) {
-        shouldCommit = false
-        skipReason = `Found ${failureCheck.failedCount} failed/cancelled steps`
-        if (failureCheck.failedSteps) {
-          for (const step of failureCheck.failedSteps) {
-            core.warning(
-              `[git-mirror]   - Step: ${step.stepName || step.action || 'unknown'} (${step.result})`
-            )
+        skipReason = `commit denied for this job (${commitEarlyDenyReason}); mirror changes are discarded`
+      } else {
+        // Check for previous step failures by reading runner logs
+        // This is the same approach used by setup-docker-builder (BPA)
+        core.info(
+          '[git-mirror] Checking for previous step failures before committing'
+        )
+        const failureCheck = await checkPreviousStepFailures()
+
+        if (failureCheck.error) {
+          // If we can't determine failure status, skip commit to be safe
+          shouldCommit = false
+          skipReason = `Unable to check for step failures: ${failureCheck.error}`
+        } else if (failureCheck.hasFailures) {
+          shouldCommit = false
+          skipReason = `Found ${failureCheck.failedCount} failed/cancelled steps`
+          if (failureCheck.failedSteps) {
+            for (const step of failureCheck.failedSteps) {
+              core.warning(
+                `[git-mirror]   - Step: ${step.stepName || step.action || 'unknown'} (${step.result})`
+              )
+            }
           }
         }
       }
@@ -109,7 +119,7 @@ async function cleanup(): Promise<void> {
         core.warning(`[git-mirror] Skipping cache commit: ${skipReason}`)
         if (performedHydration) {
           core.warning(
-            '[git-mirror] Initial hydration was in progress but job failed - backend will delete entry for retry'
+            '[git-mirror] Initial hydration was performed but is not being committed - backend will delete entry for retry'
           )
         }
       } else {

package-lock.json

@@ -98,6 +98,14 @@ export const BlacksmithCacheRepoUrl = core.getState('blacksmithCacheRepoUrl')
 export const BlacksmithCacheVerbose =
   core.getState('blacksmithCacheVerbose') === 'true'
 
+/**
+ * Reason the host gave at mount time for denying this job's sticky disk commit
+ * (e.g. branch protection). Empty when no denial was reported.
+ */
+export const BlacksmithCacheCommitEarlyDenyReason = core.getState(
+  'blacksmithCacheCommitEarlyDenyReason'
+)
+
 /**
  * Save the repository path so the POST action can retrieve the value.
  */
@@ -217,6 +225,14 @@ export function setBlacksmithCacheVerbose(verbose: boolean) {
   core.saveState('blacksmithCacheVerbose', verbose ? 'true' : 'false')
 }
 
+/**
+ * Save the host's early commit denial reason so the POST action can skip the
+ * commit and explain why.
+ */
+export function setBlacksmithCacheCommitEarlyDenyReason(reason: string) {
+  core.saveState('blacksmithCacheCommitEarlyDenyReason', reason)
+}
+
 // Publish a variable so that when the POST action runs, it can determine it should run the cleanup logic.
 // This is necessary since we don't have a separate entry point.
 if (!IsPost) {