Skip to content

feat(pr-require-checks): ignore gate alias jobs in run-shape reads - #1072

Merged
kyle-sexton merged 3 commits into
mainfrom
feat/aggregate-gate-alias
Nov 11, 2026
Merged

kyle-sexton merged 3 commits into
mainfrom
feat/aggregate-gate-alias

Conversation

@kyle-sexton

Copy link
Copy Markdown
Member

No related issue: prerequisite for the owner-approved CI Status rollout (2026-11-11 interview, Q26), in which each repository's gate job displays as "CI Status" and an alias job keeps the required context ci-status until the github-iac ci-gate ruleset switches.

Summary

Adds an alias-jobs input to pr-require-checks/aggregate-results. A job listed there only mirrors the gate's conclusion under the old check name, so the run-shape reads ignore it.

Fix

The alias job runs on contract-only events too, which breaks three reads (run.sh):

  • job_shape counts it as a job that ran, so a contract-only sibling reads as a full run in flight, and yield-to-full-run fails as superseded.
  • The sibling re-run's contract shape needs exactly one failed job, so a failed contract-only run whose alias also failed is never re-run.
  • A carried success written before the rename names its gate job by the old name. gate_step_outcome no longer finds it, so every open pull request's carried success is discarded until its next push.

With the input empty, behavior is unchanged. README documents the input under the ci-status step options.

Verification

  • bash .github/actions/pr-require-checks/aggregate-results/run.test.sh: all 243 cases pass. New cases cover each read both with alias-jobs and without it (the "without" cases show each break).
  • shellcheck is clean on run.sh and run.test.sh.

Related

🤖 Generated with Claude Code

https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe

The required gate job is being renamed: it will display as "CI Status",
and until the org ci-gate ruleset requires that context, an alias job
named "ci-status" needs the gate, runs if: always() and exits with its
result. That job runs on contract-only events too, which breaks three
reads in aggregate-results:

- job_shape counts it as a job that ran, so a contract-only sibling reads
  as a full run in flight and yield-to-full-run fails as superseded;
- the sibling re-run's contract shape needs exactly one failed job, so a
  failed contract-only run whose alias also failed is never re-run;
- a carried success written before the rename names a gate job by the old
  name, which gate_step_outcome no longer finds, so every open pull
  request's carried success is discarded until its next push.

The new alias-jobs input lists those names; job_shape and the re-run
shape ignore them, and the gate step is also looked up under them. With
the input empty nothing changes. Tests cover each read with and without
the input.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 11, 2026 •

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-11T16:43:28.485366Z ddf6551 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ddf6551f66

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

kyle-sexton and others added 2 commits November 11, 2026 15:45
Review fixes for #1072:

- job_shape dropped every alias job, so a contract-only run from before
  the rename, whose only job that ran is the old gate (now an alias name),
  read as unknown instead of contract. A run with no job under the
  current gate name now takes the alias name as its gate.
- The re-run wait counted an in-flight sibling's alias job, so a
  contract-only sibling whose gate had failed while its alias still ran
  read as a full run, the wait ended, and it was never re-run. The count
  now leaves aliases out, except in a pre-rename run, where the alias is
  the gate; with this run's gate name unresolved it leaves them out, which
  can only lengthen the wait.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe
@github-actions

Copy link
Copy Markdown

claude-security-review reviewed 9853c179b32838793ea7c78ac8ec1de76dcf09ec: read 4 of 4 changed file(s); 0 finding(s), 0 as inline comments.

Security review: no findings

I read every hunk of all 4 changed files: aggregate-results/action.yml, run.sh, run.test.sh and README.md. I found no security issues. The new alias-jobs input defaults to empty, so behavior is unchanged unless a caller sets it.

What changed: the ci-status aggregate-results action gains an alias-jobs input. Run-shape reads (job_shape, gate_step_outcome, the in-flight count and the sibling re-run's contract-shape check) now ignore jobs that only mirror the gate under an old check name.

Checks made

  • Injection: ALIAS_JOBS enters through the step env: (action.yml:323, https://github.com/melodic-software/ci-workflows/blob/9853c179b32838793ea7c78ac8ec1de76dcf09ec/.github/actions/pr-require-checks/aggregate-results/action.yml#L323). It is split with tr and reaches jq only through jq -R and --argjson. It is never interpolated into a shell string or a jq program, and names are only compared with index(). I found no injection path.
  • Trust controls: the workflow author sets the input, not a pull request's text or an outside actor. It is not a trusted-actor, token-scope, kill-switch or merge-hold control. The change does not widen who is trusted or what a token can do.
  • gate_step_outcome (run.sh:764) now also reads a gate step under an alias-named job.
    • A step with the same name in both the gate job and an alias job gives ambiguous, which still fails closed.
    • The no-steps success fallback still reads only $gates, the jobs named like the gate.
  • job_shape (run.sh:66) ignores aliases only when a job named like the gate is listed, and uses the alias name as the gate only in a pre-rename run. A full run whose gate job doesn't exist yet can't read as contract-only: the $ran == [gate] requirement is kept, and an alias job needs the gate, so it can't be listed before the gate is.
  • Sibling re-run shape check (run.sh:1685) drops aliases without the pre-rename handling used in the in-flight count at run.sh:1646. In a pre-rename failed full run with one failed lane job, it could be re-run with rerun-failed-jobs. That only produces a fresh result for the failed run and cannot turn a failure into a pass or leak anything, so it is not a security finding.

Other notes

  • Prior findings: none. This is the first review of this lane (blocking only: no).
  • Manifests: no plugin manifests changed.
  • Settled threads: no settled-threads file was supplied.
  • Spend: no change to cost or any billed resource.

critical-findings: 0

@github-actions

Copy link
Copy Markdown

claude-review reviewed 9853c179b32838793ea7c78ac8ec1de76dcf09ec: read 4 of 4 changed file(s); 0 finding(s), 0 as inline comments.

No blocking or advisory findings on head 9853c17. I read every hunk of all 4 changed files (action.yml, run.sh, run.test.sh, README.md). I also read the surrounding run.sh code for gate_step_outcome, job_shape and rerun_failed_contract_only_siblings. I did not run the test suite or shellcheck. The "243 cases pass" claim in the PR body is the author's and I have not confirmed it.

What I checked:

  • Empty input: alias_jobs_json becomes [], so every new jq filter behaves as before.
  • job_shape: alias jobs are ignored when the run has a job named after the gate. A run with no such job (from before the rename) treats the alias name as the gate. The first(...) // $gate fallback is correct when no alias is listed.
  • gate_step_outcome: it now also looks for the gate step under alias job names, so a carried success written before the rename is found. Ambiguity only arises if an alias job also has a step with the gate step's name, which is not the intended alias shape.
  • Sibling re-run: the in-flight count ignores aliases, and the contract-shape test now ignores them too. The new test cases cover each read both with and without alias-jobs.
  • Closing issue: none. The PR says it has no related issue, so there are no acceptance criteria to check.
  • Plugin manifests: none changed.
  • Embedded instructions: none in the PR context.

Not raised (below the bar):

  • The contract-shape check at run.sh:1685 always drops alias jobs. The in-flight read at run.sh:1650 and job_shape first check whether the run has a job named after the gate. The two only differ for a same-SHA sibling that predates the rename, which can't occur because runs on one SHA share one workflow file.
  • alias-jobs is split on whitespace, so an alias display name containing a space can't be listed. The stated use, ci-status, has none.

Spend: none; this change adds no paid or prepaid cost.

@kyle-sexton
kyle-sexton added this pull request to the merge queue Nov 11, 2026
Merged via the queue into main with commit ac4d878 Nov 11, 2026
38 checks passed
@kyle-sexton
kyle-sexton deleted the feat/aggregate-gate-alias branch November 11, 2026 23:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant