Add stable 'CI success' aggregate gate for branch protection - #867
Draft
cmraible wants to merge 1 commit into
Draft
Add stable 'CI success' aggregate gate for branch protection#867cmraible wants to merge 1 commit into
cmraible wants to merge 1 commit into
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueComment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## repo-audit/pnpm #867 +/- ##
================================================
Coverage 95.52% 95.52%
================================================
Files 40 40
Lines 939 939
Branches 171 171
================================================
Hits 897 897
Misses 42 42 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Branch protection currently requires 'Lint and Test (Node 22)', a matrix-leg name that renames — and silently stops gating — if the Node matrix changes. Add a single 'CI success' job that needs all lint-and-test legs and fails if any did not succeed, so the ruleset can require one stable check instead. Claude-Session: https://claude.ai/code/session_019VZskjJgacTYkiystBAHmP
cmraible
force-pushed
the
repo-audit/settings
branch
from
September 2, 2026 21:20
522fe6d to
8eb87a2
Compare
Comment on lines
+97
to
+114
| name: CI success | ||
| if: always() | ||
| needs: [prepare, lint-and-test] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| # Fail closed: require every needed job to be exactly 'success'. Checking | ||
| # only for 'failure'/'cancelled' would let a 'skipped' result pass — e.g. | ||
| # if prepare emitted an empty matrix, lint-and-test would be skipped and | ||
| # this gate would go green with zero tests run. | ||
| - name: Fail unless every required job succeeded | ||
| if: ${{ needs.prepare.result != 'success' || needs.lint-and-test.result != 'success' }} | ||
| run: | | ||
| echo "One or more required CI jobs did not succeed:" | ||
| echo " prepare: ${{ needs.prepare.result }}" | ||
| echo " lint-and-test: ${{ needs.lint-and-test.result }}" | ||
| exit 1 | ||
| - name: All required CI jobs passed | ||
| run: echo "All required CI jobs passed" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the repo audit (Step 4: settings & rulesets). Stacked on #866 (base
repo-audit/pnpm) — merge that first; GitHub auto-retargets this tomain.The problem
The
Protect Mainruleset requires the status checkLint and Test (Node 22)— a matrix-leg name. If the Node version in the matrix ever changes, that check renames, and branch protection would require a check that no longer runs: it either blocks all PRs forever or silently stops gating. Requiring a per-matrix-leg name is fragile.This PR
Adds a single
CI successjob toci.ymlthatneeds: [prepare, lint-and-test]and fails if any leg didn't succeed. Its name is stable regardless of the matrix, so the ruleset can require one check that always reflects "did all of CI pass". No behavior change to the existing jobs.Follow-up settings changes (manual, admin — after this merges)
These are GitHub config, not code, and need doing once
CI successis running onmain:Protect Mainruleset:Lint and Test (Node 22)→CI success.Protect default branchruleset (16859469) — its only rule (block deletion) is already covered byProtect Main.(Disabling rebase-merge was considered and dropped: the ruleset already enforces
allowed_merge_methods: ["squash"]formain, so the repo-level toggle is moot.)https://claude.ai/code/session_019VZskjJgacTYkiystBAHmP