Skip the vendor job on a branch with no composer tree - #19
Merged
Conversation
This workflow is shared by every fogproject branch, and only the 1.6 line has a composer tree -- committed vendor/ arrived with Phase 0.3. dev-branch has no packages/web/composer.json at all, so `composer validate` exited non-zero there and EVERY dev-branch pull request showed a red "vendor matches composer.lock" for a file it is not supposed to have. Confirmed on fogproject#1161, which is not the pull request that found it. A check that is always red teaches people to ignore red checks, which costs more than the job is worth. The steps are gated on the presence of packages/web/composer.json rather than on the branch name: which branch carries a composer tree is a thing that will change, and the file is the actual precondition. When it is absent the job succeeds and says so in the step summary, so a skip cannot be mistaken for a pass that checked something. "Report scaffolding drift" keeps always() -- it exists to report even when an earlier step failed -- but gains the same tree check, because it runs `composer --version` and Composer is not installed on a branch that skipped the setup step. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017aBSWrDArXHTpKWkkN27LR
mastacontrola
added a commit
that referenced
this pull request
Aug 18, 2026
This workflow is shared by every fogproject branch, but only the 1.6 line carries tests/secureboot-authvars.test.sh. On dev-branch the apt install bought nothing -- and it is not free. It is the flakiest step in the job: a transient apt failure or a slow mirror wedges it for twenty minutes and takes the whole run with it, which is how a dev-branch pull request whose suite passed in 24 seconds came to need a manual cancel and rerun (fogproject#1170). Same shape as the composer probe added in #19, and for the same reason: decide from the tree rather than the branch name, because the branch that has the test is a thing that will change and the presence of the file is the actual precondition. The step summary says why it was skipped, so a missing efitools reads as a deliberate skip rather than as something that quietly did not happen. The 1.6 side is unchanged -- the file is there, the probe is true, and the install runs exactly as before. secureboot-authvars.test.sh still skips itself when efitools is absent and run-all.sh still counts that as a pass, so this does not weaken enforcement anywhere it existed. Claude-Session: https://claude.ai/code/session_017aBSWrDArXHTpKWkkN27LR Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
This workflow is shared by every fogproject branch, but only the 1.6 line has a composer tree — committed
vendor/arrived with Phase 0.3. dev-branch has nopackages/web/composer.jsonat all, socomposer validateexits non-zero there and every dev-branch pull request shows a red vendor matches composer.lock for a file it is not supposed to have.Confirmed on FOGProject/fogproject#1161 — a PR that is not the one that found this, and that was merged with the check red.
A check that is always red teaches people to ignore red checks, which costs more than the job is worth.
The fix
A first step decides from the tree, not the branch name — which branch carries a composer tree is a thing that will change, and the presence of the file is the actual precondition — and the rest of the job is gated on it.
When it is absent the job succeeds and writes "No
packages/web/composer.jsonon this branch… Skipped." into the step summary, so a skip cannot be mistaken for a pass that checked something.Report scaffolding driftkeepsalways()— it exists to report even when an earlier step failed — but gains the same tree check, because it runscomposer --versionand Composer is not installed on a branch that skipped the setup step.Verification
YAML parses; every step after the probe carries the guard:
The real proof is the next dev-branch PR going green; FOGProject/fogproject#1167 is waiting on this.
🤖 Generated with Claude Code
https://claude.ai/code/session_017aBSWrDArXHTpKWkkN27LR