Skip to content

Make the required CI gate fail closed #162

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jmcte merged 2 commits into from
Jul 11, 2026
+296 −54
Merged

Make the required CI gate fail closed #162

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8bdb259
Make the required CI gate fail closed
Jul 10, 2026
0f8150e
Merge branch 'main' into codex/ci-gate-governance
jmcte Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
78 changes: 55 additions & 23 deletions .github/workflows/extended-validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ permissions:
contents: read

env:
NODE_VERSION: '20'
NODE_VERSION: '24.14.1'
PYTHON_VERSION: '3.12'

defaults:
Expand All @@ -27,8 +27,9 @@ jobs:
name: Detect Extended Validation Scope
runs-on: ['self-hosted', 'synology', 'shell-only', 'public']
outputs:
app: ${{ steps.preset.outputs.app || steps.filter.outputs.app || 'false' }}
ci: ${{ steps.preset.outputs.ci || steps.filter.outputs.ci || 'false' }}
behavior: ${{ steps.preset.outputs.behavior || steps.filter.outputs.behavior || 'false' }}
docs: ${{ steps.preset.outputs.docs || steps.filter.outputs.docs || 'false' }}
unknown: ${{ steps.preset.outputs.unknown || steps.filter.outputs.unknown || 'false' }}
extended: ${{ steps.preset.outputs.extended || steps.filter.outputs.extended || 'false' }}
steps:
- uses: actions/checkout@v7
Expand All @@ -41,8 +42,9 @@ jobs:
if: github.event_name != 'push'
run: |
cat >>"$GITHUB_OUTPUT" <<'EOF'
app=true
ci=true
behavior=true
docs=false
unknown=false
extended=true
EOF

Expand All @@ -51,28 +53,58 @@ jobs:
if: github.event_name == 'push'
with:
filters: |
app:
behavior:
- 'src/**'
- 'test/**'
- 'config/**'
- 'docker/**'
- 'actions/**'
- 'package.json'
- 'pnpm-lock.yaml'
- 'tsconfig*.json'
- 'vitest*.ts'
- 'stryker.config.json'
- 'project.bootstrap.yaml'
- 'AGENTS.md'
- 'CLAUDE.md'
- '.devcontainer/**'
- '.githooks/**'
- '.github/workflows/**'
- 'scripts/**'
- 'docs/bootstrap/**'
- 'README.md'
- 'docs/**'
ci:
- 'project.bootstrap.yaml'
- 'AGENTS.md'
- 'CLAUDE.md'
- '.devcontainer/**'
- '.githooks/**'
- '.github/workflows/**'
- 'scripts/**'
- 'docs/bootstrap/**'
- '.env.example'
- 'CODEOWNERS'
- 'infra/**'
- 'ops/**'
docs:
- 'AGENTS.md'
- 'CLAUDE.md'
- 'README.md'
- 'docs/**'
- 'LICENSE*'
unknown:
- '**'
- '!src/**'
- '!test/**'
- '!config/**'
- '!docker/**'
- '!actions/**'
- '!package.json'
- '!pnpm-lock.yaml'
- '!tsconfig*.json'
- '!vitest*.ts'
- '!stryker.config.json'
- '!project.bootstrap.yaml'
- '!.devcontainer/**'
- '!.githooks/**'
- '!.github/workflows/**'
- '!scripts/**'
- '!.env.example'
- '!CODEOWNERS'
- '!infra/**'
- '!ops/**'
- '!AGENTS.md'
- '!CLAUDE.md'
- '!README.md'
- '!docs/**'
- '!LICENSE*'
extended:
- 'infra/**'
- 'ops/**'
Expand All @@ -82,7 +114,7 @@ jobs:
runs-on: ['self-hosted', 'synology', 'shell-only', 'public']
timeout-minutes: 15
needs: changes
if: needs.changes.outputs.app == 'true' || needs.changes.outputs.ci == 'true'
if: needs.changes.outputs.behavior == 'true' || needs.changes.outputs.unknown == 'true'
steps:
- uses: actions/checkout@v7

Expand All @@ -98,7 +130,7 @@ jobs:
runs-on: ['self-hosted', 'synology', 'shell-only', 'public']
timeout-minutes: 20
needs: changes
if: needs.changes.outputs.extended == 'true' || needs.changes.outputs.app == 'true'
if: needs.changes.outputs.extended == 'true' || needs.changes.outputs.behavior == 'true' || needs.changes.outputs.unknown == 'true'
steps:
- uses: actions/checkout@v7

Expand Down Expand Up @@ -147,7 +179,7 @@ jobs:
runs-on: ['self-hosted', 'synology', 'shell-only', 'public']
timeout-minutes: 30
needs: changes
if: needs.changes.outputs.extended == 'true' || needs.changes.outputs.app == 'true'
if: needs.changes.outputs.extended == 'true' || needs.changes.outputs.behavior == 'true' || needs.changes.outputs.unknown == 'true'
steps:
- uses: actions/checkout@v7

Expand Down
140 changes: 112 additions & 28 deletions .github/workflows/pr-fast-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ permissions:
pull-requests: read

env:
NODE_VERSION: '20'
NODE_VERSION: '24.14.1'
PYTHON_VERSION: '3.12'
SHELL: /bin/bash

Expand All @@ -30,35 +30,66 @@ jobs:
- shell-only
- public
outputs:
app: ${{ steps.filter.outputs.app }}
ci: ${{ steps.filter.outputs.ci }}
behavior: ${{ steps.filter.outputs.behavior }}
docs: ${{ steps.filter.outputs.docs }}
unknown: ${{ steps.filter.outputs.unknown }}
steps:
- uses: dorny/paths-filter@v4
id: filter
with:
filters: |
app:
behavior:
- 'src/**'
- 'test/**'
- 'config/**'
- 'docker/**'
- 'actions/**'
- 'package.json'
- 'pnpm-lock.yaml'
- 'tsconfig*.json'
- 'vitest*.ts'
- 'stryker.config.json'
- 'project.bootstrap.yaml'
- 'AGENTS.md'
- 'CLAUDE.md'
- '.devcontainer/**'
- '.githooks/**'
- '.github/workflows/**'
- 'scripts/**'
- 'docs/bootstrap/**'
- 'README.md'
- 'docs/**'
ci:
- 'project.bootstrap.yaml'
- 'AGENTS.md'
- 'CLAUDE.md'
- '.devcontainer/**'
- '.githooks/**'
- '.github/workflows/**'
- 'scripts/**'
- 'docs/bootstrap/**'
- '.env.example'
- 'CODEOWNERS'
- 'infra/**'
- 'ops/**'
docs:
- 'AGENTS.md'
- 'CLAUDE.md'
- 'README.md'
- 'docs/**'
- 'LICENSE*'
unknown:
- '**'
- '!src/**'
- '!test/**'
- '!config/**'
- '!docker/**'
- '!actions/**'
- '!package.json'
- '!pnpm-lock.yaml'
- '!tsconfig*.json'
- '!vitest*.ts'
- '!stryker.config.json'
- '!project.bootstrap.yaml'
- '!.devcontainer/**'
- '!.githooks/**'
- '!.github/workflows/**'
- '!scripts/**'
- '!.env.example'
- '!CODEOWNERS'
- '!infra/**'
- '!ops/**'
- '!AGENTS.md'
- '!CLAUDE.md'
- '!README.md'
- '!docs/**'
- '!LICENSE*'

fast-checks:
name: Fast Checks
Expand All @@ -72,7 +103,7 @@ jobs:
if: >-
github.event.pull_request.draft == false &&
github.event.pull_request.head.repo.full_name == github.repository &&
(needs.changes.outputs.app == 'true' || needs.changes.outputs.ci == 'true')
(needs.changes.outputs.behavior == 'true' || needs.changes.outputs.unknown == 'true')
steps:
- uses: actions/checkout@v7
with:
Expand Down Expand Up @@ -115,7 +146,7 @@ jobs:
if: >-
github.event.pull_request.draft == false &&
github.event.pull_request.head.repo.full_name != github.repository &&
(needs.changes.outputs.app == 'true' || needs.changes.outputs.ci == 'true')
(needs.changes.outputs.behavior == 'true' || needs.changes.outputs.unknown == 'true')
steps:
- uses: actions/checkout@v7
with:
Expand Down Expand Up @@ -167,22 +198,75 @@ jobs:
steps:
- name: Check required PR jobs
env:
BEHAVIOR_CHANGED: ${{ needs.changes.outputs.behavior }}
DOCS_CHANGED: ${{ needs.changes.outputs.docs }}
DRAFT_PULL_REQUEST: ${{ github.event.pull_request.draft }}
UNKNOWN_CHANGED: ${{ needs.changes.outputs.unknown }}
SAME_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
RESULTS: >-
changes=${{ needs.changes.result }}
fast-checks=${{ needs.fast-checks.result }}
validate-secrets=${{ needs.validate-secrets.result }}
hosted-fork-fast-checks=${{ needs.hosted-fork-fast-checks.result }}
hosted-fork-validate-secrets=${{ needs.hosted-fork-validate-secrets.result }}
run: |
failed=0
declare -A results
for entry in $RESULTS; do
job="${entry%%=*}"
status="${entry##*=}"
if [[ "$status" == "success" || "$status" == "skipped" ]]; then
echo "OK $job => $status"
else
echo "FAIL $job => $status"
results["${entry%%=*}"]="${entry##*=}"
done

expect_status() {
local job="$1"
local expected="$2"
local actual="${results[$job]:-missing}"
if [[ "$actual" != "$expected" ]]; then
echo "FAIL $job => $actual (expected $expected)"
failed=1
else
echo "OK $job => $actual"
fi
done
}

failed=0
expect_status changes success

if [[ "$DRAFT_PULL_REQUEST" == "true" ]]; then
echo "INFO draft pull request; validation jobs are intentionally skipped"
expect_status fast-checks skipped
expect_status validate-secrets skipped
expect_status hosted-fork-fast-checks skipped
expect_status hosted-fork-validate-secrets skipped
exit "$failed"
fi

checks_required=false
if [[ "$BEHAVIOR_CHANGED" == "true" || "$UNKNOWN_CHANGED" == "true" ]]; then
checks_required=true
elif [[ "$DOCS_CHANGED" == "true" ]]; then
echo "INFO docs-only change; behavior checks are intentionally skipped"
else
echo "FAIL change classification produced no matching scope"
failed=1
fi

if [[ "$SAME_REPOSITORY" == "true" ]]; then
expect_status validate-secrets success
expect_status hosted-fork-validate-secrets skipped
if [[ "$checks_required" == "true" ]]; then
expect_status fast-checks success
else
expect_status fast-checks skipped
fi
expect_status hosted-fork-fast-checks skipped
else
expect_status validate-secrets skipped
expect_status hosted-fork-validate-secrets success
expect_status fast-checks skipped
if [[ "$checks_required" == "true" ]]; then
expect_status hosted-fork-fast-checks success
else
expect_status hosted-fork-fast-checks skipped
fi
fi

exit "$failed"
11 changes: 8 additions & 3 deletions project.bootstrap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ repo:
- docs/bootstrap/**
archetype:
kind: generic-empty
packageManager: npm
packageManager: pnpm
moduleName: github_runner_fleet
github:
createRepo: false
Expand Down Expand Up @@ -52,12 +52,17 @@ github:
hasDiscussions: false
ci:
runnerPolicy: hybrid-safe
nodeVersion: "20"
nodeVersion: "24.14.1"
pythonVersion: "3.12"
fastChecks:
- lint
- test
- build
- secrets
extendedChecks:
- template-review
- extended-validation
- mutation-test
- drift-detect
nightlyCron: 0 7 * * *
agents:
manageCodexHome: true
Expand Down
Loading
Loading