ci(gate): the aggregate check fails when path detection does - #493
Merged
Conversation
CI Gate is one of the two checks develop and main require, and it watched the four heavy jobs without watching the path-detection job they all gate on. When that job's git fetch returned HTTP 503 on run 30796472533 the four resolved to skipped rather than failure, so the gate found nothing to report and went green over a run that compiled nothing — both required checks green, and on a pull request that is branch protection satisfied by a build that never happened. The gate now aggregates the detection job. CiGateCoverageGuardTest reads the workflow and fails if any job that can run on a pull request is missing from that list; a schedule-only job is recognised from its own if: condition rather than an exclusion list, so a new job either joins the gate or fails the guard. A second case fails when the gate names a job that no longer exists, which is what a rename would leave behind. ./mvnw -B -ntp clean verify — BUILD SUCCESS. Both new cases confirmed red first: dropping `changes` from the needs list reports ["changes"] unwatched, and misspelling it reports the stale id.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CI Gateis one of the two checksdevelopandmainrequire —gh api repos/DemchaAV/GraphCompose/branches/develop/protectionreturns["Architecture and Documentation Guards", "CI Gate"]for both. It aggregated the four heavy jobs but notchanges, the path-detection job every one of them gates on.That is not hypothetical. On run 30796472533 the detection step died on
git fetch --no-tags --depth=100 origin main developwithRPC failed; HTTP 503. The four reactor jobs downstream resolved toskipped, notfailure;contains(needs.*.result, 'failure')was therefore false, and the gate reported success. The run is red, but both required checks are green — on a pull request that is branch protection satisfied by a build that never happened.What changed
.github/workflows/ci.yml—changesjoins theci-gateneedslist, with a comment naming the skipped-vs-failed distinction that made the omission invisible.CiGateCoverageGuardTest(new,core) — parses the workflow and asserts every job that can run on a pull request is aggregated by the gate. A schedule-only job is recognised from its ownif:condition (github.event_name == 'schedule') rather than an exclusion list, so a new job either joins the gate or fails this test. A second case fails when the gate names a job id that no longer exists, which is what a rename leaves behind.-Dtest=list of the job it protects, so a bad edit fails the step that made it — theCiGuardListGuardTestpattern, which in turn verifies the new name resolves undercore.Verification
./mvnw -B -ntp clean verify—BUILD SUCCESS, exit 0. 692 tests in the closing module.Both cases were confirmed to fail for the right reason before being accepted:
needsto the pre-fix list →Expecting empty but was: ["changes"]changesinneeds→'ci-gate' aggregates a job id that no longer existsThe workflow is checked out CRLF on Windows, so the parser normalises line endings before matching — without that the
jobs:anchor misses and the guard silently reads nothing; that failure mode was hit and fixed during development, and the empty-parse assertion now catches it.Lane: build/CI. No production code, no public API.