ci: run CI on pull requests targeting any base branch - #104
Closed
kakadlec wants to merge 1 commit into
Closed
Conversation
`on.pull_request.branches` filters on the pull request's base branch, so `branches: [main]` meant a stacked PR — one whose base is another feature branch rather than main — triggered none of the three required jobs. The checks never appeared on those PRs, leaving the stack without any CI signal until each PR was retargeted to main. This also brings the workflow back in line with the canonical `development-workflow` spec, whose Automated Test Gate, SAST Gate, and Vulnerability Scan Gate requirements all read "every push to `main` and every pull request" — unqualified by base branch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates CI triggers so all pull requests run required quality gates, including stacked PRs.
Changes:
- Removes the
mainbase-branch filter frompull_request. - Documents why the trigger is intentionally unfiltered.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
.github/workflows/ci.ymldeclared:on.pull_request.branchesfilters on the pull request's base branch. Pinning it tomainmeant a stacked PR — one whose base is another feature branch — triggered none of the three jobs.Build & Test,SAST (gosec)andVulnerability Scan (govulncheck)simply never appeared on those PRs, so the whole stack ran without any CI signal until each PR was retargeted tomain(which GitHub does automatically once the base branch is deleted post-merge, i.e. only at the very end).Branch protection still guarded
mainitself, so nothing unverified reachedmain— but the feedback arrived at the worst possible moment, after the stack was already built on top of unverified commits.Fix
Drop the
branches:filter so every pull request runs CI regardless of base. Thepushtrigger keeps itsbranches: [main]filter, which is correct there — that one avoids duplicate runs on feature-branch pushes that already have a PR.Conformance
This also restores agreement with the canonical
openspec/specs/development-workflow/spec.md, whose three gate requirements all read "Every push tomainand every pull request SHALL …" — unqualified by base branch. The workflow was under-implementing an already-approved requirement, so no spec delta is needed.Verification
{'push': {'branches': ['main']}, 'pull_request': None}—Nonebeing the "all base branches" form.git diff --checkclean..go/go.mod/go.sum) in the diff, so the localgo test ./... -vgate does not apply and was not run. The three CI jobs run on this PR itself, which exercises the changed trigger directly.🤖 Generated with Claude Code