ci: report required check contexts on docs-only changes#21
Open
ak2k wants to merge 1 commit into
Open
Conversation
The check workflow was path-filtered to code files (**.nix, flake.lock, workflows, pyproject.toml, *.py), so docs-only PRs never triggered it. Branch protection requires the three check (<os>) contexts, so those PRs were permanently BLOCKED — only an admin enforce_admins toggle could land a README change. Drop the path filter and gate the expensive build behind a changes job (dorny/paths-filter). The check (<os>) matrix now always runs and always reports its contexts: real nix flake check when code changed, an instant pass when the change is docs-only. Branch protection is unchanged (same context names, enforce_admins/strict stay on), and docs PRs become mergeable — including via auto-merge, which is already enabled on the repo. Gating in one workflow (rather than a second no-op workflow on paths-ignore) avoids a masking window on mixed code+docs PRs, where an instant green could let a still-running real build be merged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
check.ymlis path-filtered to code files (**.nix,flake.lock,.github/workflows/**,pyproject.toml,*.py), so a docs-only PR never triggers it. But branch protection onmainrequirescheck (ubuntu-latest)/check (ubuntu-24.04-arm)/check (macos-14), and required checks that never report leave the PR permanentlyBLOCKED. Withenforce_admins: true, not even an admin can bypass — #20 (a README change) only landed via a temporary enforce_admins toggle.Fix
Drop the trigger path filter; gate the expensive build behind a
changesjob (dorny/paths-filter). Thecheck (<os>)matrix now always runs and always reports its contexts:nix flake check -LBranch protection is untouched — same context names,
enforce_admins/strictstay on. Docs PRs become mergeable, including via auto-merge (already enabled on the repo).Why gate in one workflow vs. a second no-op workflow
A separate no-op workflow on
paths-ignorewould report green instantly on a mixed code+docs PR while the real build is still running — a window where a broken build could be merged. Single-workflow gating yields exactly one authoritative result per context.Self-validating
This PR touches
.github/workflows/**⇒code=true⇒ the realnix flake checkruns on it ⇒ merges through the normal green path, no admin bypass.dorny/paths-filter@v3is the one new third-party action (tag-pinned to match repo convention; happy to pin to a SHA if preferred).