Skip to content

ci: add CI gate workflow#19912

Merged
anacrolix merged 14 commits intomainfrom
anacrolix/ci-gate
Mar 18, 2026
Merged

ci: add CI gate workflow#19912
anacrolix merged 14 commits intomainfrom
anacrolix/ci-gate

Conversation

@anacrolix
Copy link
Copy Markdown
Contributor

@anacrolix anacrolix commented Mar 16, 2026

Closes #19909.

Summary

Switches CI from individual per-workflow required checks to a single CI Gate / ci-gate aggregator. This is required for clean handling of merge queues and PRs simultaneously — without a gate, there's no single check to require on merge_group events, and managing required checks means touching GitHub settings rather than code.

The gate currently requires exactly the same jobs that were previously required, so this is a one-to-one transition:

  • Lint / lint
  • All tests / tests-mac-linux (ubuntu-24.04, macos-15, windows-2025)
  • All tests (with -race) / ...
  • Test Hive / test-hive (...)
  • Consensus spec / ...
  • Check large files / check
  • Benchmarks / benchmarks
  • Kurtosis Assertoor GitHub Action / assertoor_{regular,pectra}_test
  • Manifest Check / ManifestCheck
  • Reproducible build / reproducible-build (...)
  • QA - RPC Integration Tests (Gnosis) / gnosis-rpc-integ-tests
  • QA - RPC Integration Tests Remote / mainnet-rpc-integ-tests-remote

Each called workflow gains workflow_call: and loses its pull_request: trigger — the gate owns PR and merge-queue coverage. Standalone push, schedule, and workflow_dispatch triggers are preserved.

Running different jobs on PR vs merge queue

Because the gate triggers on both pull_request and merge_group, it's now straightforward to run a lighter suite on PRs and the full suite only when merging:

# ci-gate.yml
expensive-job:
  if: github.event_name == 'merge_group'
  uses: ./.github/workflows/expensive.yml
  secrets: inherit

The aggregator ignores skipped jobs, so jobs conditional on event type don't block the gate in the other context. This is a follow-up opportunity — for now all jobs run on both.

How to merge

  1. In branch protection for main, remove all individual required checks and add CI Gate / ci-gate
  2. Merge this PR — the gate is now in effect for all subsequent PRs and merge queue entries

Other changes

  • Deletes stub workflows ci.yml, test-win-downloader.yml, check.yml
  • Fixes event_name-dependent conditions in test-hive.yml and test-kurtosis-assertoor.yml
  • Upgrades check-large-files.yml checkout v4→v6
  • Adds workflow_dispatch to test-bench.yml and test-integration-caplin.yml
  • Removes redundant daily schedule from test-all-erigon.yml
  • Documents workflow_call vs inline guidance in .github/README.md

Adds ci-gate.yml which aggregates all required CI checks into a single
required status check (CI Gate / ci-gate), fixing several problems with
the current per-workflow branch protection setup:

- Adding/removing required checks is now a code change, not an admin
  settings change
- Path filtering and merge_group support are handled in one place
- No more stub workflows needed to keep check names alive

Each existing workflow gains workflow_call: so ci-gate.yml can call
them directly. Their pull_request: triggers are removed to avoid double
runs on PRs — the gate owns PR coverage. Push, schedule, and
workflow_dispatch triggers are preserved for standalone use.

Other fixes included:
- test-hive.yml: fix concurrency group and Docker login conditions to
  not rely on github.event_name == 'pull_request'
- test-kurtosis-assertoor.yml: same fix for Docker login condition
- check-large-files.yml: upgrade checkout action v4 -> v6, add
  workflow_dispatch trigger
- test-bench.yml, test-integration-caplin.yml: add workflow_dispatch
  trigger per README guidelines
- test-all-erigon.yml: remove daily schedule (redundant with push runs)
@anacrolix anacrolix mentioned this pull request Mar 16, 2026
12 tasks
@anacrolix anacrolix marked this pull request as ready for review March 16, 2026 05:56
@anacrolix anacrolix requested a review from VBulikov March 16, 2026 05:56
@anacrolix
Copy link
Copy Markdown
Contributor Author

Just trying to iron out why a few jobs won't run, I think it's a naming clash.

When called via workflow_call, github.workflow resolves to the caller's
name ("CI Gate") rather than the called workflow's own name. This caused
multiple ci-gate jobs to share the same concurrency group and cancel each
other with cancel-in-progress: true.

Add github.job to all affected concurrency group formulas so each job
gets a unique slot even when github.workflow is the same.

Affected: lint, test-bench, qa-rpc-gnosis, qa-rpc-remote,
test-all-erigon, reproducible-build.
Add workflow-level concurrency group keyed on PR number so that pushing
a new commit to a PR cancels the in-progress ci-gate run and all its
called sub-workflows. merge_group and workflow_dispatch runs use run_id
to stay independent.
….job

github.job resolves to empty string in reusable workflow (workflow_call)
context, same as github.workflow resolves to the caller name. Using it
as a differentiator produced groups like "CI Gate--macos-15-..." (double
dash) that still collided between test-all-erigon and reproducible-build.

Replace github.job with hardcoded workflow-specific literals so each
reusable workflow gets a genuinely unique concurrency group.
Remove job-level concurrency blocks from all sub-workflows called via
workflow_call. ci-gate's workflow-level concurrency already cancels the
entire previous run on new PR push, making job-level groups redundant.
In workflow_call context, github.workflow and github.job resolve to the
caller's values (or empty), causing collisions that cancel sibling jobs
within the same run.

Add push trigger for main and release branches so ci-gate runs on
direct pushes while the merge queue is not yet active.

Switch PR concurrency group key from PR number to head branch name so
the group is stable across force-pushes that change the PR number's
run context.

Update .github/README.md to document the rule.
@anacrolix
Copy link
Copy Markdown
Contributor Author

Ok, should be good. Add CI Gate to required checks. Remove the rest.

If upon adding to main, something breaks, or something unwanted runs, modify the ci-gate workflow to fix.

A small tweak to ci-gate workflow is then only step required to tune for merge queues, to come after.

@anacrolix
Copy link
Copy Markdown
Contributor Author

@copilot fix the artifact upload for qa RPC by making it distinct from the other qa RPC workflow. Pls no mistakes

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 17, 2026

@anacrolix I've opened a new pull request, #19959, to work on those changes. Once the pull request is ready, I'll request review from you.

Both `qa-rpc-integration-tests-gnosis.yml` and
`qa-rpc-integration-tests-remote.yml` uploaded artifacts under the same
name `test-results`. When `ci-gate.yml` calls both as reusable workflows
in the same run, the uploads collide.

- `qa-rpc-integration-tests-gnosis.yml`: `test-results` →
`test-results-gnosis`
- `qa-rpc-integration-tests-remote.yml`: `test-results` →
`test-results-remote-mainnet`

<!-- START COPILOT CODING AGENT TIPS -->
---

💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: anacrolix <988750+anacrolix@users.noreply.github.com>
@anacrolix
Copy link
Copy Markdown
Contributor Author

All green

@anacrolix anacrolix enabled auto-merge (squash) March 18, 2026 09:36
@anacrolix anacrolix merged commit 9dd5317 into main Mar 18, 2026
32 checks passed
@anacrolix anacrolix deleted the anacrolix/ci-gate branch March 18, 2026 09:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Cleanup CI gating

4 participants