Skip to content

ci(golang): decide in a selector job which Go jobs run - #1423

Draft
auxesis wants to merge 3 commits into
ci/test-eql-selector-jobfrom
ci/golang-selector-job
Draft

auxesis wants to merge 3 commits into
ci/test-eql-selector-jobfrom
ci/golang-selector-job

Conversation

@auxesis

@auxesis auxesis commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

Summary

Tests (Go) checks the Go module and the WASI guests it embeds. It used a workflow-level path filter, so it did not start at all on most pull requests. A workflow skipped that way leaves its required checks pending, and GitHub's documentation on required status checks says that blocks a merge.

After this change, Tests (Go) starts on every pull request. A selector job decides which of its jobs run, and a summary job reports the result. The Go lint no longer runs for a change to a stack crate alone.

This pull request is stacked on #1417. Merge that one first.

Changes

  • Selector job: first in tests-golang.yml, on ubuntu-latest. It has two filters: go for the guest jobs, and go_lint for the lint. It fails when a filter gives no answer on a pull request.
  • go filter: the old filter's paths. wasi-check reads it. go-binding-cross and live need wasi-check, so they run when it runs.
  • go_lint filter: languages/golang/**, mise.toml, and the workflow file. mise.toml pins go and golangci-lint. The lint needs no guests.
  • Documentation: both filters still skip Markdown and .example files. They use dorny's every quantifier for that.
  • Summary job: Tests (Go) summary needs every other job. It passes when each passed or was skipped.
  • Push list: unchanged. It matches the union of the two filters, and the parity test now checks that.
  • Shared test code: the first two commits are the same as in ci(crates): decide in selector jobs which crate checks run #1421.
  • New test: golang-selector.test.mjs pins what the selector decides.

Verification

  • pnpm run test:scripts: 83 files, 1,461 tests passed, 3 skipped.
  • actionlint 1.7.12 with shellcheck 0.11.0 on tests-golang.yml: no findings.
  • I read the go:lint mise task. It runs golangci-lint run ./... in languages/golang. The workflow comment says the packages compile without the guests.
  • Not yet verified: a run on GitHub. This pull request changes tests-golang.yml, so every job runs here.

Related

Review notes

  • Look first at the go_lint filter.
  • go-binding-cross and live do not read the selector. They are skipped when wasi-check is skipped.
  • Merge queue runs select every job. Comparing a queue commit with the entry ahead of it is a separate change.

Test EQL has a selector job, and the other pull request workflows are
getting one each. Each workflow's selector must follow the same rules:
no path filter on pull_request, one dorny/paths-filter step, an output
named after each filter, every job selected on other events, a failure
when a filter gives no answer, `if:` conditions that exclude
pull_request, and a summary job that needs every other job.

workflow-selectors.test.mjs checks those rules for every workflow that
has a selector job, found by scanning. It runs the selector's own
decision script and the summary job's own check.

lib/selector.mjs holds the shared code. It reads a selector job, runs
its script, and works out which jobs a pull request runs from the files
it changes. It reads dorny's `every` quantifier and brace patterns,
which a filter needs to exclude documentation.

The parity test now compares a selector workflow's push paths with the
union of its selector filters, by what each selects from the tracked
files. That replaces Test EQL's written exemption. The dispatch test
holds every selector output open, whatever its name.
Three guards check that a workflow's path filter covers what its jobs
read: the binding build inputs, the auth binding sources, and the
sources the integration suites import. They read `on.push.paths` and
`on.pull_request.paths`. Once a workflow has a selector job, its pull
request list moves into the selector filter of each job, and those
guards would stop checking it.

They now read, per job, the lists that decide whether that job runs:
the workflow's push and pull_request lists, and the selector filter the
job reads. For a workflow without a selector job this is the same two
lists as before. They also check only the jobs that build or load the
binding, not every job in the workflow.
Tests (Go) used a workflow-level path filter on pull_request. A
workflow that a path filter skips leaves its required checks pending,
and GitHub's documentation on required status checks says that blocks
a merge.

The workflow now runs on every pull request. A `selector` job on a
GitHub-hosted runner decides which jobs run, and fails when a filter
gives no answer. A `Tests (Go) summary` job ends the workflow, and
passes when every needed job passed or was skipped.

wasi-check keeps the old filter's paths. go-binding-cross and live need
it, so they run when it runs. go-lint gets its own filter: the Go module
and mise.toml, which pins go and golangci-lint. It needs no guests, so a
change to a stack crate alone no longer lints the Go module. Markdown
and `.example` files are still excluded, through dorny's `every`
quantifier. The push list is unchanged, and matches the union of the
two filters.

golang-selector.test.mjs pins what the selector decides.
@changeset-bot

changeset-bot Bot commented Oct 28, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 6eff111

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai

coderabbitai Bot commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant