From bffcc66566b5b6155031d2b757a912115ce97555 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 23 Jul 2026 12:21:15 +0000 Subject: [PATCH 1/2] ci: fix merge-queue trigger gaps and add develop to CI branches Default branch moved to develop; keep CI running on both develop and main. Also close two merge-queue trigger mismatches surfaced during a workflow trigger audit. - ci/typecheck/unit-tests/ui-tests: add `develop` to push branches so post-merge runs happen on both develop and main. - pr-tittle-check: add a `merge_group` trigger and guard the validate step with `if: github.event_name != 'merge_group'`. As a required check it was never reporting on the queue commit, leaving the merge queue stuck "waiting for status to be reported"; it now reports success without re-validating (the title can't change in the queue). - linter (Frappe Linter): drop `if: github.event_name == 'pull_request'` so lint is enforced in the merge queue instead of being skipped (a skipped required check counts as green). - linter (Vulnerable Dependency Check): restrict to pull_request plus a new weekly schedule, and keep it off merge_group/push so a freshly published CVE in the external advisory DB can't block a queued merge. - ci: rename concurrency prefix main-buzz -> ci-buzz now that main is not the default branch (no functional effect). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_013EYfuce7SdhQDyZNCRMaNa --- .github/workflows/ci.yml | 3 ++- .github/workflows/linter.yml | 12 +++++++++++- .github/workflows/pr-tittle-check.yml | 5 +++++ .github/workflows/typecheck.yml | 1 + .github/workflows/ui-tests.yml | 1 + .github/workflows/unit-tests.yml | 1 + 6 files changed, 21 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6a6c35d1..b0485e32 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,12 +3,13 @@ name: CI on: push: branches: + - develop - main pull_request: merge_group: concurrency: - group: main-buzz-${{ github.event.number || github.sha }} + group: ci-buzz-${{ github.event.number || github.sha }} cancel-in-progress: true jobs: diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index b3731d0f..4f32493a 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -3,10 +3,14 @@ name: Linters on: push: branches: + - develop - main pull_request: merge_group: workflow_dispatch: + schedule: + # Weekly dependency-advisory sweep (Mondays 00:00 UTC), independent of any PR. + - cron: '0 0 * * 1' permissions: contents: read @@ -19,7 +23,9 @@ jobs: linter: name: 'Frappe Linter' runs-on: ubuntu-latest - if: github.event_name == 'pull_request' + # Runs on PRs, pushes to develop/main, and in the merge queue so lint is + # actually enforced before code lands (not just on the PR head). + if: github.event_name != 'schedule' steps: - uses: actions/checkout@v4 @@ -40,6 +46,10 @@ jobs: deps-vulnerable-check: name: 'Vulnerable Dependency Check' runs-on: ubuntu-latest + # pip-audit reads an external advisory DB, so its result depends on when it + # runs, not on the diff. Keep it off merge_group/push so a freshly published + # CVE can't block a queued merge; run it on PRs and on a weekly schedule. + if: github.event_name == 'pull_request' || github.event_name == 'schedule' steps: - uses: actions/setup-python@v5 diff --git a/.github/workflows/pr-tittle-check.yml b/.github/workflows/pr-tittle-check.yml index c0648fb1..f46a1e76 100644 --- a/.github/workflows/pr-tittle-check.yml +++ b/.github/workflows/pr-tittle-check.yml @@ -7,6 +7,10 @@ on: - reopened - synchronize - edited + # Required status checks must report on the merge_group commit or the queue + # waits forever. The title can't change in the queue, so we report success + # without re-validating (see the step-level guard below). + merge_group: permissions: pull-requests: write @@ -17,6 +21,7 @@ jobs: steps: - name: Validate PR title id: validate + if: github.event_name != 'merge_group' uses: amannn/action-semantic-pull-request@v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml index c6aa43a8..f7bd93e7 100644 --- a/.github/workflows/typecheck.yml +++ b/.github/workflows/typecheck.yml @@ -3,6 +3,7 @@ name: Dashboard TypeScript on: push: branches: + - develop - main pull_request: merge_group: diff --git a/.github/workflows/ui-tests.yml b/.github/workflows/ui-tests.yml index ab12b56c..e7a60406 100644 --- a/.github/workflows/ui-tests.yml +++ b/.github/workflows/ui-tests.yml @@ -3,6 +3,7 @@ name: UI Tests on: push: branches: + - develop - main pull_request: merge_group: diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index f395d21f..3c41af0e 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -3,6 +3,7 @@ name: Dashboard Unit Tests on: push: branches: + - develop - main pull_request: merge_group: From c69d59b57d417fdb98052fcf3719002669e84192 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 23 Jul 2026 12:27:57 +0000 Subject: [PATCH 2/2] ci: trim verbose workflow comments Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_013EYfuce7SdhQDyZNCRMaNa --- .github/workflows/linter.yml | 7 +------ .github/workflows/pr-tittle-check.yml | 4 +--- 2 files changed, 2 insertions(+), 9 deletions(-) diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index 4f32493a..c3423957 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -9,7 +9,6 @@ on: merge_group: workflow_dispatch: schedule: - # Weekly dependency-advisory sweep (Mondays 00:00 UTC), independent of any PR. - cron: '0 0 * * 1' permissions: @@ -23,8 +22,6 @@ jobs: linter: name: 'Frappe Linter' runs-on: ubuntu-latest - # Runs on PRs, pushes to develop/main, and in the merge queue so lint is - # actually enforced before code lands (not just on the PR head). if: github.event_name != 'schedule' steps: @@ -46,9 +43,7 @@ jobs: deps-vulnerable-check: name: 'Vulnerable Dependency Check' runs-on: ubuntu-latest - # pip-audit reads an external advisory DB, so its result depends on when it - # runs, not on the diff. Keep it off merge_group/push so a freshly published - # CVE can't block a queued merge; run it on PRs and on a weekly schedule. + # Off merge_group/push so a newly published CVE can't block a queued merge. if: github.event_name == 'pull_request' || github.event_name == 'schedule' steps: diff --git a/.github/workflows/pr-tittle-check.yml b/.github/workflows/pr-tittle-check.yml index f46a1e76..02dfc3bd 100644 --- a/.github/workflows/pr-tittle-check.yml +++ b/.github/workflows/pr-tittle-check.yml @@ -7,9 +7,7 @@ on: - reopened - synchronize - edited - # Required status checks must report on the merge_group commit or the queue - # waits forever. The title can't change in the queue, so we report success - # without re-validating (see the step-level guard below). + # Report on the queue commit (title is fixed there, so the step below no-ops). merge_group: permissions: