Repository navigation
Conversation
Test EQL has a selector job, and the other pull request workflows are getting one each. Each workflow's selector must follow the same rules: no path filter on pull_request, one dorny/paths-filter step, an output named after each filter, every job selected on other events, a failure when a filter gives no answer, `if:` conditions that exclude pull_request, and a summary job that needs every other job. workflow-selectors.test.mjs checks those rules for every workflow that has a selector job, found by scanning. It runs the selector's own decision script and the summary job's own check. lib/selector.mjs holds the shared code. It reads a selector job, runs its script, and works out which jobs a pull request runs from the files it changes. It reads dorny's `every` quantifier and brace patterns, which a filter needs to exclude documentation. The parity test now compares a selector workflow's push paths with the union of its selector filters, by what each selects from the tracked files. That replaces Test EQL's written exemption. The dispatch test holds every selector output open, whatever its name.
Three guards check that a workflow's path filter covers what its jobs read: the binding build inputs, the auth binding sources, and the sources the integration suites import. They read `on.push.paths` and `on.pull_request.paths`. Once a workflow has a selector job, its pull request list moves into the selector filter of each job, and those guards would stop checking it. They now read, per job, the lists that decide whether that job runs: the workflow's push and pull_request lists, and the selector filter the job reads. For a workflow without a selector job this is the same two lists as before. They also check only the jobs that build or load the binding, not every job in the workflow.
Lint release tooling and musl build image used a workflow-level path filter on pull_request. A workflow that a path filter skips leaves its required checks pending, and GitHub's documentation on required status checks says that blocks a merge. CodeQL and OSV-Scanner had no path filter and ran on every pull request to main. Each workflow now runs a `selector` job on a GitHub-hosted runner, which decides whether the check runs and fails when its filter gives no answer. A summary job ends each workflow, and passes when every needed job passed or was skipped. - Lint release tooling and musl build image keep the paths of the filter they had. - CodeQL analyses JavaScript and TypeScript only. Its trigger paths are the file types its JavaScript extractor reads: HTML and templates, JavaScript, JSON, TypeScript and YAML. A change to Rust, Go, SQL or Markdown alone no longer runs it on a pull request. - OSV-Scanner reads dependencies from lockfiles and manifests. Its trigger paths are those files, for each ecosystem it supports, and its config. The weekday schedule still scans everything for new advisories. In CodeQL and OSV-Scanner the selector and summary jobs get `contents: read`, not the workflow's `security-events: write`. The release lint scope test and the musl image test read the selector filter. other-selectors.test.mjs pins what each selector decides.
|
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
Contributor
Author
|
"Build the Alpine musl image" fails here because an apk pin no longer resolves. That is #1380: the scheduled run on |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This converts the last four pull request workflows to the selector job design. Lint release tooling and musl build image used a workflow-level path filter. A workflow skipped that way leaves its required checks pending, and GitHub's documentation on required status checks says that blocks a merge. CodeQL and OSV-Scanner had no filter, and ran on every pull request to
main.After this change, each workflow starts with a selector job and ends with a summary job. CodeQL no longer runs for a pull request that changes only Rust, Go, SQL, or Markdown. OSV-Scanner no longer runs for a pull request that changes no lockfile or manifest.
This pull request is stacked on #1417. Merge that one first.
Changes
FileTypein the extractor'sFileExtractor.java.osv-scanner.toml. The weekday schedule still scans everything for new advisories.contents: read. They do not get thesecurity-events: writethat the workflow grants.other-selectors.test.mjspins what each selector decides.lint-release-scope.test.mjsandmusl-build-image.test.mjsread the selector filter. The parity test loses thelint-release.ymlentry.Verification
pnpm run test:scripts: 83 files, 1,506 tests passed, 3 skipped.actionlint1.7.12 withshellcheck0.11.0 on the four workflows: no findings.git ls-fileslists these lockfiles and manifests in the repository today:pnpm-lock.yaml, nineCargo.lock,deno.lock, elevengo.mod, and onerequirements.txt. The OSV filter covers all of them.Related
Review notes
main. A stacked pull request does not start them, before or after this change.impact.yml,claude-review.yml, andcode-review.ymlare not converted. They are advisory, not checks.