chore: remove the no-op Skip Tests workflow - #451
Open
NickJosevski wants to merge 1 commit into
Open
Conversation
Branch protection requires a status check named `test`. Two workflows publish
a check by that name from the same app: the real job in integration-tests.yml,
and this one, whose entire body is `echo "No build required"`. They collapse
onto a single required context, resolved by whichever finishes last. The merge
gate for main was therefore decided by job duration rather than by policy.
The shared name was deliberate — it is the usual workaround for pairing a
required check with a path filter, supplying a green `test` on docs-only PRs
when the real job is skipped. But neither trigger works:
- integration-tests.yml applies paths-ignore to `push` only, so the real job
already runs on docs-only PRs.
- skip-test.yml filters on `path:`, which is not a valid key, so this job
runs on every PR and is always green.
Repairing both triggers would not be enough. `paths-ignore` fires when any
changed file falls outside the pattern and `paths` fires when any changed file
matches it, so a PR touching both .md and .go files would still trigger both
workflows and re-create the collision.
Removing this workflow leaves exactly one check named `test`. Docs-only PRs now
run the full suite, which costs about three minutes and is a fair price for a
merge gate that means what it says.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem
Branch protection on
mainrequires a status check namedtest. Two workflows publish a check by that name, from the same app: the real job inintegration-tests.yml, andskip-test.yml, whose entire body is:They collapse onto a single required context, resolved by whichever finishes last. The integration job takes ~3 minutes and the no-op takes ~2 seconds, so today the real result usually wins — but the merge gate for
mainis being decided by job duration rather than by policy.The shared name was deliberate. Both triggers are broken.
Naming both jobs
testis the usual workaround for pairing a required check with a path filter: supply a greenteston docs-only PRs when the real job is skipped. That's why renaming the job is the wrong fix — it would leave docs-only PRs with notestcheck at all, so the required context would never report and the PR could never merge.The problem is that neither trigger does what it was meant to:
integration-tests.ymlappliespaths-ignoretopushonly — itspull_requesttrigger is unfiltered, so the real job already runs on docs-only PRs.skip-test.ymlfilters onpath:, which is not a valid key (it should bepaths:), so the no-op runs on every PR and is always green.Why repairing the triggers isn't enough
paths-ignorefires when any changed file falls outside the pattern;pathsfires when any changed file matches it. A PR touching both.mdand.gofiles satisfies both conditions, so both workflows would still run and the collision would return.This change
Delete the no-op workflow. Exactly one check named
testremains, so the required context always reflects a real run.Docs-only PRs now run the full suite — about three minutes. That seems a fair price for a merge gate that means what it says, and this repo does not see many docs-only PRs.
Related
While looking at CI I found that fork PRs can never satisfy this check at all:
integration-tests.ymlneedssecrets.DB_IMAGE_SA_PASSWORD,OD_IMAGE_ADMIN_API_KEYandOCTOPUS_SERVER_BASE64_LICENSE, and GitHub withholds secrets frompull_requestruns originating on a fork. The job dies at Initialize containers before any Go runs. That affects #435, #436, #433, #430, #298, #399 and #400, and across the last 200 merged PRs only 2 came from forks — both from December 2023. Worth a follow-up to split the workflow so fork PRs get a realtestresult, with the container job gated behind an Environment with required reviewers. Not in scope here.