Repository navigation
Conversation
Test EQL has a selector job, and the other pull request workflows are getting one each. Each workflow's selector must follow the same rules: no path filter on pull_request, one dorny/paths-filter step, an output named after each filter, every job selected on other events, a failure when a filter gives no answer, `if:` conditions that exclude pull_request, and a summary job that needs every other job. workflow-selectors.test.mjs checks those rules for every workflow that has a selector job, found by scanning. It runs the selector's own decision script and the summary job's own check. lib/selector.mjs holds the shared code. It reads a selector job, runs its script, and works out which jobs a pull request runs from the files it changes. It reads dorny's `every` quantifier and brace patterns, which a filter needs to exclude documentation. The parity test now compares a selector workflow's push paths with the union of its selector filters, by what each selects from the tracked files. That replaces Test EQL's written exemption. The dispatch test holds every selector output open, whatever its name.
Three guards check that a workflow's path filter covers what its jobs read: the binding build inputs, the auth binding sources, and the sources the integration suites import. They read `on.push.paths` and `on.pull_request.paths`. Once a workflow has a selector job, its pull request list moves into the selector filter of each job, and those guards would stop checking it. They now read, per job, the lists that decide whether that job runs: the workflow's push and pull_request lists, and the selector filter the job reads. For a workflow without a selector job this is the same two lists as before. They also check only the jobs that build or load the binding, not every job in the workflow.
Six of the Rust crate workflows used a workflow-level path filter on pull_request. A workflow that a path filter skips leaves its required checks pending, and GitHub's documentation on required status checks says that blocks a merge. Tests (auth refresh cancellation) already had a `changes` job, without the rest of the design. Each workflow now runs on every pull request. A `selector` job on a GitHub-hosted runner decides which jobs run, and fails when a filter gives no answer. A summary job ends each workflow, and passes when every needed job passed or was skipped. The trigger paths are per check, and list what it builds: - CRAP gets one filter per crate. stack-auth's gate also reads stack-profile, and stack-encrypt's reads stack-encrypt-derive, stack-kms, stack-auth and stack-profile. Both read .config/nextest.toml, because the mise tasks use its `ci` profile. - Fuzz adds stack-profile and stack-encrypt-derive, which the fuzzed crates build by path. - Tests (crates) splits in two. The cargo job no longer runs for a change to pnpm-lock.yaml alone. The node bindings job no longer runs for stack-kms, stack-encrypt or stack-guest-abi, and gains package.json and pnpm-workspace.yaml, which its pnpm install reads. - Unused dependencies and Tests (Rust) add the root mise.toml, which pins the rust they build with. - The long auth refresh soak adds stack-profile. CRAP, Fuzz, Miri and Unused dependencies keep excluding Markdown and `.example` files, through dorny's `every` quantifier. Push lists that remain match the union of each selector's filters, which the parity test now checks.
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
|
This was referenced Oct 28, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Seven workflows check the Rust crates. Six of them used a workflow-level path filter, so they did not start at all on most pull requests. A workflow skipped that way leaves its required checks pending, and GitHub's documentation on required status checks says that blocks a merge. So none of them could become a required check.
After this change, each workflow starts on every pull request. A selector job decides which of its checks run, and a summary job reports the result. Each check's trigger paths now list what that check builds. So some checks run less often than before, and a few run for files they missed.
This pull request is stacked on #1417. Merge that one first.
Changes
crap-crates.yml,fuzz.yml,miri.yml,udeps.yml,tests-crates.yml,tests-rust.yml, andtests-auth-refresh.yml.ubuntu-latest. It usesdorny/paths-filterwith one filter per check. It fails when a filter gives no answer on a pull request.needs: [selector]and anif:that excludes pull requests, such asgithub.event_name != 'pull_request' || needs.selector.outputs.stack_auth == 'true'.stack-profile. The stack-encrypt gate also readsstack-encrypt-derive,stack-kms,stack-auth, andstack-profile. Both read.config/nextest.toml, because the mise tasks use itsciprofile.stack-profileandstack-encrypt-derive. The fuzzed crates build them by path.pnpm-lock.yamlalone. The node bindings job no longer runs forstack-kms,stack-encrypt, orstack-guest-abi. Its filter now includespackage.jsonandpnpm-workspace.yaml. Itspnpm installreads both.mise.toml. That file pins the rust they build with.changesjob becomes the selector job. The long soak addsstack-profile. The short soak still runs on every pull request..examplefiles. They use dorny'severyquantifier for that.tests-crates.ymlandudeps.ymlkeep apushlist. Each now matches the union of its selector's filters.on.*.paths.crates-selectors.test.mjspins what each selector decides.crap-crates.yml,fuzz.yml,miri.yml, andtests-rust.yml. The soak test reads the selector job.Verification
pnpm run test:scripts: 83 files, 1,565 tests passed, 3 skipped.src/lintWiring.test.tsandsrc/integrationSuiteCi.test.tsinprotect-ffireadtests-rust.yml. Both pass, afterpnpm --filter @cipherstash/protect-ffi run build.actionlint1.7.12 withshellcheck0.11.0 on the seven workflows: no findings.Cargo.tomlof each crate. I read thecrap:*,fuzz:*,miri:*, andtest:integration:*mise tasks.Related
mutants.ymlthe same way.Review notes
crap-crates.ymlandtests-crates.yml. Those are the changes to when checks run.fuzz-campaignnever runs on a pull request. So the selector does not decide it.workflow-paths-filter-parity.test.mjs, this pull request and ci(mutants): decide in a selector job whether the gate runs #1420 edit neighbouring lines. The second to merge needs a rebase.timeout-minutes: 10. The selector job intests-auth-refresh.ymlreplaces achangesjob that had 5.