ci: repin fleet-ci to the stable check-context revision - #9
Merged
Conversation
…sion Picks up SecurityRonin/fleet-ci#9. Repin only -- no gate behaviour changes. Two fixes, both of which only matter when a check context is REQUIRED: - A skipped job publishes its `name:` EXPRESSION, not the evaluated value. The coverage job's name was a multi-line ternary, so any repo turning the coverage gate off published a check named with the raw expression source, newlines included. That name is now the constant `Coverage`. - Matrix jobs cannot serve as required contexts, because GitHub appends the matrix values -- `MSRV (<crate>, <floor>)`, `Test (<os>)` -- so the context name moves whenever a crate is added or a floor is raised, and a required context that stops reporting makes every PR unmergeable with no explanation. The workflow now publishes an aggregate `All checks` job that needs all twelve others and whose name never varies. `ci / All checks` becomes requirable once every repo carries this pin.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Repins the shared workflow to
9234e1fa9f85b14a8d6fddc7a8f7378f7e30b183, whichmakes this repo publish a stable, requirable check context.
Two defects in
fleet-ciblocked required status checks fleet-wide:The coverage job's
name:was an expression. GitHub does not evaluate ajob's
name:when the job is skipped — it publishes the raw expressiontext as the check name, newlines and all. Repos that skip coverage were
therefore publishing a check named after the ternary that computed it, which
no branch-protection rule can name. The job is now statically
Coverage.There was no single invariant context to require. The remaining checks
are matrix jobs (
MSRV (<crate>, <ver>),Test (<os>)), whose publishednames vary per repo and per matrix entry. A new aggregate job,
All checks,needs:every other job withif: always()and fails unless eachone succeeded or was deliberately skipped — so
ci / All checksis onecontext every consumer publishes identically.
The gate refuses an empty result set and refuses an all-skipped run: an empty
check list means not run, never passed.
No behaviour change to this repo's own CI configuration — only the pinned
revision moves. Nothing is required yet; branch protection is left untouched
until every consumer carries this pin, because requiring a context before it
exists everywhere would block merges.
Verified end-to-end on
sqlite-forensicbefore this sweep: the pre-changecommit published the expression-named check run, the post-change commit
publishes
ci / Coverage(skipped) plusci / All checks(success), with thegate's own log listing twelve results matching its twelve
needs:.