Skip to content

ci: skip test and e2e-test jobs for docs-only changes - #4455

Merged
reinkrul merged 2 commits into
masterfrom
ci/skip-checks-docs-only
Aug 19, 2026
Merged

ci: skip test and e2e-test jobs for docs-only changes#4455
reinkrul merged 2 commits into
masterfrom
ci/skip-checks-docs-only

Conversation

@reinkrul

@reinkrul reinkrul commented Aug 18, 2026

Copy link
Copy Markdown
Member

What

test and e2e-test are required status checks. Both now check whether the PR/push diff touches anything outside docs/, *.md and *.rst (via dorny/paths-filter), and skip their actual work when it doesn't.

Why

All the code checks, especially the unit and e2e tests, are slow and consume resources that aren't required - not very sustainable.

Docs-only changes can't affect Go code or e2e behavior, so there's nothing for either job to catch — but skipping them entirely at the workflow-trigger level (paths-ignore) would leave the required check stuck pending forever and block merging, since GitHub doesn't auto-satisfy a required check that never ran. Gating the steps instead of the trigger keeps the job itself running (so the required check resolves quickly with a pass) while skipping the actual test/build/e2e work.

This also sidesteps spending CI minutes, and occasionally hitting flaky tests (e.g. the embedded-NATS timing flake in TestNetwork_Reprocess), on changes that can't have broken anything either job tests.

Scope

.github/workflows/go-test.yaml and .github/workflows/e2e-tests.yaml only. This PR itself touches .github/**, not docs/**, so it exercises the full test/e2e run as normal.

Backports to V6.2 and V5.4 to follow once this is reviewed.

Both are required status checks, so they must still run and report success
(rather than being skipped via workflow-level path filters, which would
leave the check stuck pending and block merging). Each job now checks
whether the diff touches anything outside docs/, *.md and *.rst via
dorny/paths-filter, and skips its actual work when it doesn't - docs-only
changes can't affect Go code or e2e behavior, so there's nothing for either
job to catch, and skipping avoids spending CI minutes (and hitting flaky
tests) on runs that can't be revealing anything.
@qltysh

qltysh Bot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

❌ 5 blocking issues (5 total)

Tool Category Rule Count
zizmor Vulnerability overly broad permissions 4
zizmor Vulnerability credential persistence through GitHub Actions artifacts 1

@qltysh

qltysh Bot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

Qlty


Coverage Impact

⬆️ Merging this pull request will increase total coverage on master by 0.2%.

🚦 See full report on Qlty Cloud »

🛟 Help
  • Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

  • Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

  • File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

    • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

@reinkrul reinkrul added the Maintainer QoL Improves the life of Nuts maintainers label Aug 19, 2026

@stevenvegt stevenvegt left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed with the changes.
I find all the if statements a bit ugly, but that might be the only way?
I saw a "credential persistence through GitHub Actions artifacts" warning that might be something to look into?

A job skipped via `if:` reports as a passing check, same as a workflow-level
paths-ignore trigger would if it worked for required checks (it doesn't: the
workflow just never runs, leaving the check stuck pending forever). That
means the per-step `if: steps.filter.outputs.code == 'true'` on every single
step wasn't needed - one job-level `if:` does the same job with far less
repetition.

Splits the path-filter into its own `changes` job (output: `code`), and both
`test` and `e2e-test` become `needs: changes` + a single job-level `if:`
instead of duplicating the condition on every step. `test`/`e2e-test` keep
their original job names so branch protection's required-status-check
matching is unaffected.
@reinkrul

Copy link
Copy Markdown
Member Author

Agreed with the changes. I find all the if statements a bit ugly, but that might be the only way? I saw a "credential persistence through GitHub Actions artifacts" warning that might be something to look into?

Simplified it

@reinkrul
reinkrul merged commit 7b2a375 into master Aug 19, 2026
14 checks passed
@reinkrul
reinkrul deleted the ci/skip-checks-docs-only branch August 19, 2026 09:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Maintainer QoL Improves the life of Nuts maintainers

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants