Repository navigation
ci: skip main re-verification of PR-verified trees; harden release workflow - #403
Conversation
…rkflow A main push whose tree a merged PR head already verified re-ran the full 3-OS matrix on an already green tree (25 of the last 30 main pushes). ci.yml gains a first `decision` job: run_full is false only when the push is the merge_commit_sha of a merged PR, the tree SHAs are equal, and the five gate check runs on the PR head are all completed/success (the same five names the release gates require, so one contract holds across the three files). Any API failure falls back to run_full=true with a warning. lint, pdf-parity and test are gated on it; the paths filter is unchanged. release.yml verify-ci and release-readiness.yml Gate ci-matrix accept that identical-tree PR head signal as a fallback when the target commit has no own green check runs, recording evidence that names the PR head. The readiness logic stays inline: Gate ci-matrix is a controller step and must not execute code from the evaluated checkout. release.yml also gets a workflow concurrency group (cancel-in-progress: false, so update-formula runs cannot race on Formula/hwp.rb) and timeout-minutes on all seven jobs. Refs #402
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
An organization admin can review the limit in your organization's usage and billing settings.
Once the limit resets or is raised, reopen this pull request to trigger a review.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 000aabcbdc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The #403 identical-tree fallback ran unconditionally when own checks were not all green, so an own failed CI could be overridden by a green PR head on the same tree (Codex P1 on #403). The fallback now applies only when all five own check runs are absent or completed/skipped — the dedup signature observed on 4d23291 — and any own failed, cancelled, pending or partial run keeps the pre-#403 failure behavior. Scenario harness 31/31.
Closes #402
Summary
.github/workflows/ci.yml: new first jobdecision(timeout 10 min; permissionscontents:read,pull-requests:read,checks:read). Its outputrun_fullisfalseonly when the event ispush, the pushed SHA is themerge_commit_shaof a merged PR, the pushed commit's tree SHA equals the PR head's tree SHA, and the five gate check runs (lint,pdf-parity,test (ubuntu-latest),test (macos-latest),test (windows-latest)) on the PR head are allcompleted/success— the same five names the release gates already require, so one contract holds across the three workflow files (a deliberate difference from the maru reference, which matches on run-name). Any API failure falls back torun_full=truewith a::warning::; the reason is written to$GITHUB_STEP_SUMMARY.lint,pdf-parity, andtestare gated withneeds: decision+if: needs.decision.outputs.run_full == 'true'. The paths filter is unchanged; the concurrency comment now notes that deduplicated main commits borrow the identical tree's PR signal..github/workflows/release.yml:verify-ci'sTagged commit has green CIstep gains the identical-tree fallback, inline: (a) own five check runs green -> pass, evidenceown check runs; (b) else resolve the merged PR withmerge_commit_sha== tagged SHA, require equal tree SHAs and five green check runs on the PR head -> pass, evidencePR #N head <sha> validated identical tree <tree>; (c) else the previous fail behavior and message. Also adds workflow-levelconcurrency: { group: release, cancel-in-progress: false }(twoupdate-formularuns can no longer race onFormula/hwp.rb) andtimeout-minuteson all seven jobs (verify-ci 10, verify-version 5, create-release 5, upload-assets 30, skill-bundle 10, publish-release 5, update-formula 15)..github/workflows/release-readiness.yml: the same identical-tree fallback, inline, inGate ci-matrix. The pass evidence recordsPR #N head <sha> validated identical tree <tree>in the run record, so the record names the PR head it relied on. Kept inline (not a repository script) because the step is a controller step under the trust policy at L13-28 and must not execute code from the evaluated checkout. Fail/pending outcomes and their messages are unchanged.docs/release-readiness.md+docs/release-readiness.ko.md(same commit, per the bilingual policy): the CI-matrix checklist item now notes that CI green can come from the commit's own check runs or from an identical-tree merged PR head.scripts/tests/release-readiness-selfcheck.shand the verification-block fixtures were re-grepped: neither referencesci-matrix, so no extension was needed (matches the issue's task list).Verification
Local, before opening this PR:
yaml.safe_load); every editedrun:block passesbash -n.ghAPI serving fixture JSON. 16/16 scenarios pass, covering: own-green pass, identical-tree fallback pass, tree-differs fail, no-PR fail/pending, head-checks-not-green fallthrough, API-failure fallback torun_full=truewith::warning::,pull_request/workflow_dispatch/unmerged-PR always running the full matrix, and the readiness evidence string naming the PR head.scripts/check.shends with== check: OK (fmt/clippy/test/crate-edges/pdf-runner/structured-corpus/claims/doc-surface/release-block/readiness-selfcheck/skip-accounting/public-parity=skipped) skipped-for-missing-fixtures=4 (optional=4) ==(
public-parity=skippedis expected on a host without the pinnedpdfinfo version 24.02.0.)Acceptance criteria from #402:
decisionon main)decisionjob executing, with the summary naming this PR and the tree. Run URL to be pasted into #402 after merging.workflow_dispatchscenarios above);workflow_dispatchand direct-push behavior will also be observable on any subsequent non-PR main eventverify-ciwith identical-tree evidence)verify-ci)ci-matrixpass with identical-tree evidence)docs/**/*.mdoutsidedocs/manual/; expect no CI run. PR URL to be pasted into #402.release.ymljob hastimeout-minutes; workflow hasconcurrencywithcancel-in-progress: false)timeout-minutes; workflow-levelconcurrency: { group: release, cancel-in-progress: false }added.No gates were weakened:
scripts/check.shpassed unmodified, the paths filter is untouched, and every fallback defaults to running the full matrix on any doubt.