Repository navigation
Conversation
Test EQL has a selector job, and the other pull request workflows are getting one each. Each workflow's selector must follow the same rules: no path filter on pull_request, one dorny/paths-filter step, an output named after each filter, every job selected on other events, a failure when a filter gives no answer, `if:` conditions that exclude pull_request, and a summary job that needs every other job. workflow-selectors.test.mjs checks those rules for every workflow that has a selector job, found by scanning. It runs the selector's own decision script and the summary job's own check. lib/selector.mjs holds the shared code. It reads a selector job, runs its script, and works out which jobs a pull request runs from the files it changes. It reads dorny's `every` quantifier and brace patterns, which a filter needs to exclude documentation. The parity test now compares a selector workflow's push paths with the union of its selector filters, by what each selects from the tracked files. That replaces Test EQL's written exemption. The dispatch test holds every selector output open, whatever its name.
Mutants used a workflow-level path filter on pull_request. A workflow that a path filter skips leaves its required checks pending, and GitHub's documentation on required status checks says that blocks a merge. So Mutants could not become a required check. The workflow now runs on every pull request. A `selector` job on a GitHub-hosted runner compares the changed files with the old filter's paths and decides whether the gate runs. When the filter gives no answer, the selector fails. A `Mutants summary` job ends the workflow. It passes when every needed job passed or was skipped. It is the job that branch rules will require. The trigger paths are the old filter's paths, so the gate runs for the same changes as before. The filter uses dorny's `every` quantifier, so its `!` rules still exclude Markdown and `.example` files. A manual dispatch still sweeps both crates. mutants-selector.test.mjs pins what the selector decides for code, configuration, documentation and other crates.
|
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
Contributor
Mutation testing (cargo-mutants,
|
This was referenced Oct 28, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Mutants is the mutation-testing gate for
stack-authandstack-encrypt. It used a workflow-level path filter, so it did not run at all on most pull requests. A workflow skipped that way leaves its required checks pending, and GitHub's documentation on required status checks says that blocks a merge. So Mutants could not become a required check.After this change, Mutants starts on every pull request. A selector job decides whether the gate runs, and a summary job reports the result. The gate runs for the same files as before.
This pull request is stacked on #1417. Merge that one first.
Changes
mutants.ymlstarts with aselectorjob onubuntu-latest. It usesdorny/paths-filterwith the old filter's paths. It fails when the filter gives no answer on a pull request.everyquantifier. Under the default, a!**/*.mdrule matches every file that is not Markdown. So the trigger paths are one brace pattern, followed by the two!rules.mutantsjob needs the selector. Itsif:isgithub.event_name != 'pull_request' || needs.selector.outputs.mutants == 'true'. A manual dispatch still sweeps both crates.Mutants summaryneeds both jobs. It passes when each passed or was skipped.on.pull_requestis now{}.scripts/__tests__/lib/selector.mjsreads a selector job, runs its script, and works out which jobs a pull request runs.workflow-selectors.test.mjschecks the same rules for every workflow with a selector job, including Test EQL.mutants-selector.test.mjspins what the Mutants selector decides.true.Verification
pnpm run test:scripts: 83 files, 1,463 tests passed, 3 skipped.actionlint1.7.12 withshellcheck0.11.0 onmutants.yml: no findings.picomatch2.3.2, the matcher dorny uses, withdot: true. It matched the crates' code and the configuration files. It did not match Markdown,.examplefiles,stack-kms, orstack-encrypt-derive.dorny/paths-filter(v3.0.4). On a pull request it lists changed files through the GitHub API, so the selector needs no checkout.mutants.yml, so the gate runs here.Related
Review notes
selectorjob and the multi-line brace pattern. YAML drops a line break that ends in\, so dorny reads one pattern.test(ci): check every selector job the same way. Git merges identical changes cleanly. Their edits to the lists inworkflow-paths-filter-parity.test.mjssit next to each other, so the second to merge may need a rebase.timeout-minutes: 10. That matches the floor in the change that adds timeouts.