[anth-volk]

Fixes #1005

Same-Repository Draft PR Check

• This PR is a draft.
• This PR is from a branch in PolicyEngine/policyengine-sim-api, not a personal fork.

Changelog

• This PR adds a changelog fragment, changelog.d/<name>.<type>.md, whose type is breaking, added, changed, fixed or removed.

Summary

Phase 1 step 1.7, last part. Stacked on #1004, which moves the deploy workflow's seven blocks and teaches the routing writer discovery to read the scripts a step calls.

The six multi-line run: blocks that #744 added to simulation-rollback.yml now live in tested scripts under .github/scripts/, each called from a single-command step:

Step	Script
Restore Modal routing	rollback-restore-routing.sh
Resolve the unfinished routing publication	rollback-resolve-pending-publication.sh
Read the restored release identity	rollback-read-release-identity.sh
Resolve the stable service	rollback-stable-service-state.sh
Restore entrypoint traffic	rollback-restore-entrypoint-traffic.sh
Verify the stable service serves the restored release	rollback-verify-stable-service.sh

With the baseline then empty, sim.ci.multiline-run-is-script is enforced: rules/baselines/ci-multiline-run.txt is deleted, the rule loses its [rule.baseline], and [ci_scripts] lists no baseline for the check, so any multi-line run: block in a workflow fails the quality-guards job. The rules tool now lets [ci_scripts] leave out a check's baseline (scripts/rules/model.py, load.py, ci_scripts.py): every finding of that check then fails, and --write-baselines skips it and says so. python -m scripts.rules validate, which the rules-registry guard runs, also fails when [ci_scripts] lists a baseline with an entry for a check whose rule is enforced, so neither this rule's baseline nor the two empty ones listed for the other enforced checks can tolerate a finding again. docs/engineering/skills/ci-workflows.md describes the enforcement.

Behaviour is unchanged. A PyYAML comparison of the workflow on main and on this branch shows identical top-level keys, job settings and step keys other than run:; only these six steps' run: text differs. Four script bodies are the old inline shell, byte for byte. The traffic restore and the verification call their sibling scripts (set-cloud-run-simulation-entry-revision.sh, cloud-run-simulation-entry-smoke.sh) through the script's own directory instead of a path from the repository root. The scripts add set -u; every variable they read is set by the job or step env: or by the runner. The step IDs identity and service and the outputs later steps read are written by the same commands.

Kept as it was, for a follow-up: "Resolve the stable service" writes url=$(jq -er …) and revision=$(jq -er …) inside echo arguments, where a failing jq does not stop a bash -e shell. Without a URL it records url=null, and without exactly one revision at 100 percent it records an empty revision, and the step succeeds. The script keeps this, says so in a comment, and test_stable_service_records_what_jq_prints_when_a_value_is_missing pins it. Failing the step there would be a behaviour change, so it is not made here.

Tests.

• test_simulation_rollback_scripts.py runs each new script with fake uv and gcloud first on PATH (jq is real), or as a copy beside a fake sibling script that records its arguments and environment, and checks the exact calls, $GITHUB_OUTPUT and exit status. It also checks that each moved step keeps every setting it had and calls its script.
• The Gate releases on a numerical sentinel and make them reversible #744 tests of how the restore reads a deployment run's kept plans (test_simulation_rollback.py) now run rollback-restore-routing.sh instead of extracting the step's inline shell, and the step lookups read each step with the scripts it calls.
• A routing discovery test pins the rollback workflow's two writing steps, which discovery now finds through the scripts.

Environment variables

Every variable the scripts read, and where it comes from. The job and step env: blocks are unchanged.

Variable	Script	Provider and wiring
MODAL_TOKEN_ID, MODAL_TOKEN_SECRET	routing scripts (read by the Modal client)	Repository GitHub Actions secrets, set in each step's env:.
GH_TOKEN	rollback-restore-routing.sh (read by gh)	${{ github.token }} in the step's env:; the job grants actions: read for the run and job lookups.
TARGET, DEPLOY_RUN_ID, POLICYENGINE_VERSION, EXPECTED_LATEST, MODAL_ENVIRONMENT, SERVICE	routing, traffic and verification scripts	Job env:, from the workflow_dispatch inputs.
PROJECT_ID, REGION	rollback-stable-service-state.sh; also passed to the traffic script as SIMULATION_ENTRYPOINT_GCP_*	Job env:, from the beta and prod environment variables SIMULATION_ENTRYPOINT_GCP_PROJECT_ID and SIMULATION_ENTRYPOINT_GCP_REGION (region defaults to us-central1). The job sets environment: ${{ inputs.target }}, and target is beta or prod.
SIMULATION_ENTRYPOINT_*	rollback-restore-entrypoint-traffic.sh	Step env:, from the job env:, the entrypoint_revision input and step service's revision output.
EXPECTED_*, STABLE_URL, EXPECTED_REVISION, PREVIOUS_REVISION	rollback-verify-stable-service.sh	Step env:, from steps identity and service and the entrypoint_revision input.
Google credentials for gcloud	stable service and traffic scripts	google-github-actions/auth with the beta and prod environment secrets SIMULATION_ENTRYPOINT_GCP_WIF_PROVIDER and SIMULATION_ENTRYPOINT_GCP_DEPLOY_SERVICE_ACCOUNT.
GITHUB_REPOSITORY, RUNNER_TEMP, GITHUB_OUTPUT	all	Set by the GitHub Actions runner.

Testing

• The first commit adds the tests. Against the old workflow, 34 entry tests and the two rules-tool tests fail; three rewritten structure tests pass, since they read each step with its scripts. With the second commit, all of them pass. From review, a third commit adds a failing validation test for an enforced check's baseline with an entry and the new --write-baselines message, and the fourth makes them pass:
  • projects/policyengine-simulation-entry: the tests in test_simulation_rollback_scripts.py, the rewritten tests in test_simulation_rollback.py, the rollback writers test and the routing discovery tests in test_routing_workflow_invariants.py, and test_deployment_assets_routing.py::test_a_failing_routing_command_fails_its_step_and_job and ::test_routing_jobs_never_allow_command_failures (157 passed).
  • scripts/rules/tests/test_ci_scripts.py: CompareTest.test_a_check_without_a_baseline_fails_every_finding, CompareTest.test_writing_baselines_skips_a_check_without_one and the three EnforcedCheckBaselineTest tests; scripts/rules/tests/test_cli.py: CiScriptsCommandTest.test_write_baselines_records_the_findings.
• python -m scripts.rules ci-scripts passes with no baseline file; python scripts/run_quality_guards.py, python -m scripts.rules validate and python -m scripts.rules guard --base-ref origin/main pass.
• shellcheck and actionlint pass on the new scripts and the workflow.

🤖 Generated with Claude Code