From 4f53ef659e1fc5cbad132f5530270569225c9355 Mon Sep 17 00:00:00 2001 From: Dmitrii Creed Date: Tue, 19 May 2026 00:10:09 +0400 Subject: [PATCH] chore(ci): drop wildcard push trigger from fuzz + codeql MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every PR commit was firing two events with the same SHA — push (broad '**' trigger) and pull_request (main) — and the SHA-keyed concurrency group cancelled one of them. The pull_request twin won every time; the push twin appeared as a "cancelled" check on every PR's checks page, which looked like a CI failure on cursory inspection. Restricting push to [main] eliminates the duplicate without losing coverage: - PR commits: pull_request event still runs CodeQL + fuzz, gating the PR exactly as before. - Direct pushes to main (post-merge): push event still runs. - Scorecard's SAST check looks at merged PRs on the default branch and asks if SAST ran on each PR's HEAD — every merged PR has a pull_request CodeQL run, so SAST score is unchanged. - Scorecard's Fuzzing check is static-detection only (is a *_fuzz_test.go using testing.F wired into a workflow), not a frequency check — Fuzzing score is unchanged. Reverts the broader trigger added under the assumption that it helped Scorecard SAST coverage. Source-code read of the Scorecard SAST check shows it scopes to merged-PR HEADs on the default branch, so the broader net was not contributing to the score. Concurrency group kept as-is so manual reruns on the same commit still supersede the in-flight one. Signed-off-by: Dmitrii Creed --- .github/workflows/codeql.yml | 28 ++++++++++++++++------------ .github/workflows/fuzz.yml | 19 ++++++++++--------- 2 files changed, 26 insertions(+), 21 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cd097dcd..9b4f8024 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -11,10 +11,18 @@ name: CodeQL on: push: - # Run on every branch push so Scorecard's "% of commits scanned by SAST" - # check sees coverage on intermediate / feature commits, not just main. - # The concurrency group below cancels superseded runs on the same ref. - branches: ['**'] + # Direct pushes to main only (post-merge). PR commits are covered + # by the pull_request event below. + # + # Scorecard's SAST check counts merged PRs on the default branch + # and asks whether a SAST tool ran successfully on each PR's HEAD + # commit. Every commit landing in main arrives via a merged PR + # (pull_request scan) or a direct push (push scan), so coverage is + # complete without the `['**']` net that triggered duplicate runs + # for every PR commit — push and pull_request fired on the same + # SHA, one was cancelled by the concurrency group, leaving noisy + # "cancelled" entries on every PR's checks page. + branches: [main] pull_request: branches: [main] schedule: @@ -22,14 +30,10 @@ on: - cron: '23 4 * * 0' workflow_dispatch: -# Cancel in-progress runs for the same commit when a new event lands. -# Key on commit SHA (PR head when triggered by pull_request, pushed SHA -# otherwise) instead of github.ref. With `push: branches: ['**']` and -# `pull_request: branches: [main]` both active, a single PR commit -# triggers two runs — one for the push event (refs/heads/) and -# one for the PR event (refs/pull/N/merge). Keying on ref leaves both -# in distinct groups, so neither cancels the other. SHA-keyed grouping -# dedups them. Codex round-2 P2 catch on PR #264. +# SHA-keyed dedup so a manual rerun on the same commit supersedes the +# in-flight one. With push restricted to main + pull_request on PRs, +# a single commit no longer fires two events; no PR-side cancellation +# noise. concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.head.sha || github.sha }} cancel-in-progress: true diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 1ac13386..eb242680 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -27,10 +27,13 @@ name: Go Fuzz on: push: - # Run on every branch push so fuzz coverage is contiguous, not just - # at PR-open and merge. Concurrency group below cancels superseded - # runs on the same ref. - branches: ['**'] + # Direct pushes to main only (post-merge). PR commits are covered + # by the pull_request event below; the weekly cron picks up corpus + # the per-PR 30s budget cannot reach. Scorecard's Fuzzing check is + # static-detection only ("is there a *_fuzz_test.go using + # testing.F wired into CI") — it doesn't measure run frequency, so + # restricting to main does not affect the Fuzzing score. + branches: [main] pull_request: branches: [main] schedule: @@ -39,11 +42,9 @@ on: - cron: '17 7 * * 1' workflow_dispatch: -# Cancel in-progress runs for the same commit when a new event lands. -# SHA-keyed (PR head SHA or push SHA) instead of ref-keyed, so a single -# PR commit doesn't run twice — once for the push:[**] event and once -# for the pull_request event with different github.ref values. Same -# fix as codeql.yml. Codex round-2 P2 catch on PR #264. +# SHA-keyed dedup so a manual rerun on the same commit supersedes the +# in-flight one. With push restricted to main + pull_request on PRs, +# a single commit no longer fires two events. concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.head.sha || github.sha }} cancel-in-progress: true