ci: route control-plane lanes through the governed selector #237
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,18 +3,5 @@ | |
| "repositoryOwner": "melodic-software", | ||
| "visibility": "private", | ||
| "selfHostedCi": true, | ||
| "exceptions": {} | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| name: do-not-merge | ||
|
|
||
| # Blocks merging while the PR carries the `do-not-merge` label, via the shared | ||
| # do-not-merge-gate reusable from ci-workflows. Runs on pull_request_target so | ||
| # the base-branch definition evaluates (a head edit cannot neuter the gate); | ||
| # safe because the reusable reads PR label metadata via the API and runs no head | ||
| # code. `labeled`/`unlabeled` are required so applying or removing the label | ||
| # re-evaluates the gate — a status check binds to a SHA, so without them a check | ||
| # that passed before the label was applied stays green and the merge is never | ||
| # blocked. `merge_group` re-checks the label in the queue (inert without a | ||
| # queue). The emitted required-check context is `do-not-merge / do-not-merge`. | ||
| on: | ||
| pull_request_target: | ||
| types: [opened, reopened, synchronize, labeled, unlabeled] | ||
| merge_group: | ||
|
|
||
| permissions: | ||
| pull-requests: read | ||
|
|
||
| # pull_request_target runs the base-branch definition, so github.ref is the base | ||
| # branch: the PR number scopes cancellation and github.ref covers merge_group | ||
| # (which carries no pull_request object); the fallback is inert without a queue. | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| select-runner: | ||
| name: Select runner | ||
| permissions: {} | ||
| uses: melodic-software/ci-workflows/.github/workflows/select-runner.yml@cdc5917c15aade1995bd810b60d818cadc635b52 # cdc5917 2026-07-16 | ||
| secrets: | ||
| observer-private-key: ${{ secrets.CI_RUNNER_OBSERVER_PRIVATE_KEY }} | ||
| with: | ||
| policy: ${{ vars.CI_RUNNER_POLICY }} | ||
| self-hosted-label: ${{ vars.CI_SELF_HOSTED_LABEL }} | ||
| hosted-runner: ${{ vars.CI_HOSTED_RUNNER }} | ||
| scope: ${{ vars.CI_RUNNER_SCOPE }} | ||
| managed-runner-prefix: ${{ vars.CI_MANAGED_RUNNER_PREFIX }} | ||
| observer-client-id: ${{ vars.CI_RUNNER_OBSERVER_CLIENT_ID }} | ||
|
|
||
| do-not-merge: | ||
| needs: select-runner | ||
| # Fail-closed selector-result reporter: always() so every routing outcome | ||
| # materializes the required check. The reusable receives the selector result | ||
| # and fail-closes on any non-success before evaluating the label, so a | ||
| # routing failure never dispatches this gate to paid hosted Linux. | ||
| if: ${{ always() }} | ||
| permissions: | ||
| pull-requests: read | ||
| uses: melodic-software/ci-workflows/.github/workflows/do-not-merge-gate.yml@885302176345486ca6c2c392d83131f9b5389251 # 8853021 2026-07-16 | ||
| with: | ||
| runner: ${{ needs.select-runner.outputs.runner || 'ubuntu-24.04' }} | ||
| prerequisite-result: ${{ needs.select-runner.result }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| name: pr-issue-linkage | ||
|
|
||
| # Validates the PR body carries a native closing keyword (Closes/Fixes/Resolves | ||
| # #N, including owner/repo#N, or the literal "No linked issue" when the PR closes | ||
| # nothing) and a non-empty `## Related` section, via the shared | ||
| # pr-issue-linkage reusable from ci-workflows. `pull_request_target` runs the | ||
| # base-branch definition, so a head-branch edit cannot bypass the gate — safe | ||
| # here because the reusable reads PR body metadata from the event payload only | ||
| # and runs no head code. `edited` re-validates on a body edit. `merge_group` | ||
| # reports the check green in the queue (the body was validated at PR time; inert | ||
| # without a queue). The emitted required-check context is | ||
| # `pr-issue-linkage / pr-issue-linkage`. | ||
| on: | ||
| pull_request_target: | ||
| types: [opened, edited, reopened, synchronize] | ||
| merge_group: | ||
|
|
||
| permissions: {} | ||
|
|
||
| # pull_request_target runs the base-branch definition, so github.ref is the base | ||
| # branch: the PR number scopes cancellation and github.ref covers merge_group | ||
| # (which carries no pull_request object); the fallback is inert without a queue. | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| select-runner: | ||
| name: Select runner | ||
| permissions: {} | ||
| uses: melodic-software/ci-workflows/.github/workflows/select-runner.yml@cdc5917c15aade1995bd810b60d818cadc635b52 # cdc5917 2026-07-16 | ||
| secrets: | ||
| observer-private-key: ${{ secrets.CI_RUNNER_OBSERVER_PRIVATE_KEY }} | ||
| with: | ||
| policy: ${{ vars.CI_RUNNER_POLICY }} | ||
| self-hosted-label: ${{ vars.CI_SELF_HOSTED_LABEL }} | ||
| hosted-runner: ${{ vars.CI_HOSTED_RUNNER }} | ||
| scope: ${{ vars.CI_RUNNER_SCOPE }} | ||
| managed-runner-prefix: ${{ vars.CI_MANAGED_RUNNER_PREFIX }} | ||
| observer-client-id: ${{ vars.CI_RUNNER_OBSERVER_CLIENT_ID }} | ||
|
|
||
| pr-issue-linkage: | ||
| needs: select-runner | ||
| # Fail-closed selector-result reporter: always() so every routing outcome | ||
| # materializes the required check. The reusable receives the selector result | ||
| # and fail-closes on any non-success before validating the body, so a | ||
| # routing failure never dispatches this gate to paid hosted Linux. | ||
| if: ${{ always() }} | ||
| permissions: {} | ||
| uses: melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@f7e94a80254fdca0aa85a600a07d784753b090e3 # f7e94a8 2026-07-16 | ||
|
kyle-sexton marked this conversation as resolved.
|
||
| with: | ||
| runner: ${{ needs.select-runner.outputs.runner || 'ubuntu-24.04' }} | ||
| prerequisite-result: ${{ needs.select-runner.result }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.