Repository navigation
ci: keep label events out of the required CI gate - #595
Conversation
Label-triggered CI runs renamed the aggregate gate to a label marker, so the newest CI run on a Dependabot head lacked the required 'Typecheck, unit tests, and Web build' context and the protect-main ruleset reported it as expected, blocking merges on fully green PRs. Move label handling to a dedicated full-ci-label workflow that dispatches a full validation run for the full-ci label and produces no CI runs for unrelated labels.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d4f44d4231
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…arget Address two P1 review findings on full-ci-label.yml: - workflow_dispatch --ref requires a branch or tag ref, not the head commit SHA; use the pull-request head branch ref instead. - fork pull requests (including Dependabot) get a read-only GITHUB_TOKEN on pull_request events regardless of the permissions block; trigger via pull_request_target so the dispatch job keeps an actions:write token. The job stays a pure API caller: it never checks out or runs pull-request code, and it fails explicitly for forked head branches, which have no ref in this repository for workflow_dispatch to address.
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: e02fa3abfe
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
问题
Dependabot 开 PR 后 1 秒内自动打 2 个标签，每个
labeled事件都会触发一次 CI run。这些标签 run 里聚合门禁 job 被改名为CI label event (no validation)，导致该 head 上最新的 CI run 不包含必需检查Typecheck, unit tests, and Web build的上下文，protect-main规则评估报 "is expected"，检查全绿的 PR 无法合并（今天 #588/#589/#591/#593/#594 全部被拦，#591 已用 recreate 绕过合并）。修复
ci.yml触发器移除labeled，删除标签相关的条件分支（scope/quality 的if、动态 job 名、IGNORED_LABEL_EVENT早退、并发组特例）。full-ci-label.yml：普通标签不产生任何 CI 运行；full-ci标签对 PR head 分发一次完整workflow_dispatch运行（dispatch 事件本身即 complete 层级 + full 范围，与标签语义一致）。full-ci标签的持久效果保留：已打标签的 Draft 在后续synchronize等正常触发中仍按完整检查执行（classify/policy 继续读 PR 标签）。这样任何 head 上最新的 CI 运行永远带有正确命名的门禁 job，规则评估恢复正常。
验证
node --test scripts/ci/*.test.mjs scripts/check-public-repo-safety.test.mjs全部通过（含更新后的工作流结构断言）check-markdown-links通过；两个 workflow YAML 解析通过docs/maintenance/ci.md的触发事件说明已同步