ci: add a stable ci-gate check for the ruleset to require - #6
Merged
Conversation
Requiring job names directly is brittle. Adding a matrix renames a check from `build` to `build (x)` and a new job is simply never required — either way the ruleset waits on a name nothing reports and the PR hangs on "Expected", with no failing check to point at. That has now happened twice across the two repos. ci-gate's name never changes, so jobs can be added, renamed, or given a matrix without touching the ruleset. It runs with `if: always()`, without which it would itself be skipped whenever a dependency failed, report nothing, and reproduce exactly the hang it exists to prevent. Any result other than success blocks — including skipped, which is what test-feature and build become when `changes` fails. `comment` is excluded on purpose: it only advertises image tags, needs pull-requests: write which fork PRs do not get, and must never block a merge. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR adds a stable “ci-gate” GitHub Actions job intended to be the single required ruleset check, avoiding brittle required-check names that can change (e.g., due to matrix expansion) and preventing PRs from hanging on “Expected” when a required check name is never reported.
Changes:
- Add a new
ci-gatejob that depends onchanges,test-feature, andbuild, and runs withif: always()to report a deterministic pass/fail outcome. - Fail the gate for any upstream job result other than
success(includingskipped,cancelled, andfailure). - Document why
commentis excluded from the required gate.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Require all CI jobs to have succeeded | ||
| env: | ||
| CHANGES: ${{ needs.changes.result }} | ||
| TEST_FEATURE: ${{ needs.test-feature.result }} |
Contributor
|
🐳 PR images built (amd64 only):
To test, point a devcontainer.json |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requiring job names directly is brittle. Adding a matrix renames a check from
buildtobuild (x)and a new job is simply never required — either way the ruleset waits on a name nothing reports and the PR hangs on "Expected", with no failing check to point at. That has now happened twice across the two repos.ci-gate's name never changes, so jobs can be added, renamed, or given a matrix without touching the ruleset. It runs with
if: always(), without which it would itself be skipped whenever a dependency failed, report nothing, and reproduce exactly the hang it exists to prevent.Any result other than success blocks — including skipped, which is what test-feature and build become when
changesfails.commentis excluded on purpose: it only advertises image tags, needs pull-requests: write which fork PRs do not get, and must never block a merge.