ci: delegate gate-attestation to the fleet reusable - #10
Merged
Merged
Conversation
Replace the inline copy (which lacked any release-please waiver, failing every release PR with 'No Gate-Passed trailer found') with a thin caller of the canonical reusable, pinned past the branch-shaped release-please waiver (forkwright/.github#10). One fact, one place. Gate-Passed: kanon 0.1.6 +stages:fmt,check,clippy,nextest,lint sha:e1f5bbf3613d800a989cbb5191a27201b59e0a43
forkwright
added a commit
that referenced
this pull request
Aug 16, 2026
## Finding `.github/workflows/ci.yml` scoped its `pull_request` trigger to `branches: [main]`. That filter matches the pull request's **base**, so a PR opened against any branch other than `main` matched nothing and **no CI run was ever created for it**. That is not a pending check or a slow check. It is an absent one — which renders as a PR with a calm status area and nothing red on it, indistinguishable from a PR whose checks all passed. ## Evidence Two PRs shipped unverified through this in a single session: - **`epistole` #98** — the Phase 2 SMTP send path, stacked on #97. Zero CI runs for its entire life. Its body asserted idempotency behaviour that no independent witness had ever executed. - **`pinax` #11** — 3,510 lines of pager, buffer pool and B+tree, stacked on #10. Also zero CI. Once rebased onto `main` and gated for the first time it produced **42 compile errors**. It had never been compiled anywhere, by anything, and it sat open looking mergeable. `heurema` already carries the unfiltered form, so this is not a new convention — it is bringing this repo to a shape the fleet already proves out. ## Why this matters The filter withdraws verification from exactly the case that needs it most: a dependent change written against a contract that has not merged yet. Stacked PRs are the shape the fleet's process produces whenever one unit depends on another, so this silently un-verifies the work most likely to be built on an assumption. It is also a live instance of `PHILOSOPHY.md` § *an instrument must be able to be wrong*: a check that cannot run teaches every reader to skim past its absence. ## Desired correction Drop the `branches` filter from `pull_request` only. `push: branches: [main]` is unchanged — that one is correct, and is what prevents duplicate runs. ```yaml on: pull_request: push: branches: [main] ``` The class fix — a `basanos` rule so the next repo cannot inherit this — is tracked at forkwright/kanon#3475. **Done when:** a PR whose base is not `main` produces an actual CI run in this repo. Refs forkwright/kanon#3475 Co-authored-by: forkwright <cody@forkwright.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the inline gate-attestation (no release-please waiver — every release PR failed with "No Gate-Passed trailer found") with a thin caller of the canonical reusable, pinned past the branch-shaped RP waiver (forkwright/.github#10). Note: the check context becomes
gate / gate-attestation; branch protection (where present) is updated in lockstep.