Repository navigation
Conversation
Test EQL has a selector job, and the other pull request workflows are getting one each. Each workflow's selector must follow the same rules: no path filter on pull_request, one dorny/paths-filter step, an output named after each filter, every job selected on other events, a failure when a filter gives no answer, `if:` conditions that exclude pull_request, and a summary job that needs every other job. workflow-selectors.test.mjs checks those rules for every workflow that has a selector job, found by scanning. It runs the selector's own decision script and the summary job's own check. lib/selector.mjs holds the shared code. It reads a selector job, runs its script, and works out which jobs a pull request runs from the files it changes. It reads dorny's `every` quantifier and brace patterns, which a filter needs to exclude documentation. The parity test now compares a selector workflow's push paths with the union of its selector filters, by what each selects from the tracked files. That replaces Test EQL's written exemption. The dispatch test holds every selector output open, whatever its name.
Three guards check that a workflow's path filter covers what its jobs read: the binding build inputs, the auth binding sources, and the sources the integration suites import. They read `on.push.paths` and `on.pull_request.paths`. Once a workflow has a selector job, its pull request list moves into the selector filter of each job, and those guards would stop checking it. They now read, per job, the lists that decide whether that job runs: the workflow's push and pull_request lists, and the selector filter the job reads. For a workflow without a selector job this is the same two lists as before. They also check only the jobs that build or load the binding, not every job in the workflow.
Five JavaScript and TypeScript workflows used a workflow-level path filter on pull_request. A workflow that a path filter skips leaves its required checks pending, and GitHub's documentation on required status checks says that blocks a merge. Each workflow now runs on every pull request. A `selector` job on a GitHub-hosted runner decides which jobs run, and fails when a filter gives no answer. A summary job ends each workflow, and passes when every needed job passed or was skipped. Each filter keeps the paths of the filter it replaced, so the checks run for the same changes as before: - Test JS: every file except docs/plans/. Its jobs read most of the repository, so one filter gates all five. dorny's `every` quantifier makes the `!docs/plans/**` rule exclude. - FTA Complexity, Test Benchmark JS, Test supply chain security and Require @cipherstash/auth changeset: one filter each, the old list. Push lists that remain match the selector filters, which the parity test checks. Test supply chain security is a target of the no-caching lint, which allows only audited actions. dorny/paths-filter is added to AUDITED_ACTIONS: at the pinned v3.0.4 it lists changed files through the GitHub REST API, and none of its dependencies caches. The auth changeset test reads the job by id, because the selector is now the first job, and reads the selector filter. js-selectors.test.mjs pins what each selector decides.
|
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
This was referenced Oct 28, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Five JavaScript and TypeScript workflows used a workflow-level path filter, so they did not start at all on some pull requests. A workflow skipped that way leaves its required checks pending, and GitHub's documentation on required status checks says that blocks a merge.
After this change, each workflow starts on every pull request. A selector job decides which of its jobs run, and a summary job reports the result. Each check runs for the same changes as before.
This pull request is stacked on #1417. Merge that one first.
Changes
tests.yml,fta-v3.yml,tests-bench.yml,tests-supply-chain.yml, andrequire-auth-npm-changeset.yml.ubuntu-latest. It fails when a filter gives no answer on a pull request.docs/plans/. These jobs read most of the repository: Biome checks every file, andrun-testsruns the script guards, the typechecks, and every package's tests. It uses dorny'severyquantifier, so the!docs/plans/**rule excludes.fta-v3.yml,tests-bench.yml, andtests-supply-chain.ymlkeep apushlist. Each matches its selector filter, and the parity test checks that.tests-supply-chain.ymlis a target of the no-caching lint. That lint allows only audited actions. This addsdorny/paths-filtertoAUDITED_ACTIONSinscripts/lint-no-workflow-caching.mjs.js-selectors.test.mjspins what each selector decides.tests.ymlfilter test reads the selector filter. The parity test loses five entries.Verification
pnpm run test:scripts: 83 files, 1,514 tests passed, 3 skipped.actionlint1.7.12 withshellcheck0.11.0 on the five workflows: two SC2129 style findings intests.yml, at steps this pull request does not change. The base branch has the same two.src/main.tsandpackage.jsonofdorny/paths-filterat v3.0.4. On a pull request it lists the changed files through the GitHub REST API. Its dependencies are@actions/core,@actions/exec,@actions/github, andpicomatch. None of them caches.Related
Review notes
AUDITED_ACTIONSentry. Adding an action there is a supply-chain decision.impact.ymlis not converted. It is an advisory report with no path filter, not a check.workflow-paths-filter-parity.test.mjs, these pull requests edit neighbouring lines. The second to merge needs a rebase.