ci: run the workflow guards on every PR so they can be required - #59
Merged
Conversation
forkwright/.github requires ZERO status checks to merge. The repository that authors the fleet's required-gate reusables -- inherited by eleven repos -- has no required gate of its own; one approving review is the entire merge control, and enforce_admins is false. Both guards that could serve already exist here and both are path-filtered to `.github/workflows/**` and `scripts/**`, so neither runs on a PR touching only docs. Each carries its own WARNING saying it must not be made a required check until that filter is dropped, because a required check that never runs blocks its PR permanently -- nothing failing, nothing pending, nothing to point at. That is the exact shape that made politeia's main unmergeable, so the warning is right and this change is the half it asks for first. The filter is dropped and both WARNINGs are rewritten as NOTEs stating why it must not come back. Branch protection follows only after a PR touching neither filtered path is observed producing both checks -- the filter drop is a claim until something outside it reports. The cost is that a docs-only PR re-lints unchanged workflows, which is seconds. That is the correct trade for a repository whose entire content is other repos' CI, and it is not a change in what either job verifies.
Uh oh!
There was an error while loading. Please reload this page.
forkwright added a commit
that referenced
this pull request
Aug 26, 2026
#62) This repository authors the reusables eleven repos inherit and until today required ZERO status checks to merge -- one approving review was the entire control. #59 removed the `paths:` filter from actionlint.yml so both guards run on every PR, which is the precondition for requiring them. The warning is the part worth writing down. The filter was not arbitrary: it existed so the workflow only ran when workflows or scripts changed. Removing it is what makes the checks eligible to be required, and reintroducing one would make every PR touching neither path unmergeable -- nothing failing, nothing pending, nothing to point at. That failure has already happened to a sibling repo's main, so the constraint is recorded here rather than left to be rediscovered. This file touches neither `.github/workflows/**` nor `scripts/**`, which makes it the probe: if both checks report on this PR, the filter drop is demonstrated rather than assumed, and the required contexts can be set on that evidence. Co-authored-by: forkwright <cody@forkwright.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finding
forkwright/.githubrequires zero status checks to merge. The repository that authors thefleet's required-gate reusables — inherited by eleven repos — has no required gate of its own.
Evidence
The only merge control is
required_approving_review_count = 1, andenforce_admins = false.This is not abstract:
.github#57and#58both reportedmergeStateStatus: CLEANtoday with anempty
statusCheckRollup— CLEAN because nothing was blocking, not because anything passed.A change to privileged CI code can merge here having been verified by nothing.
Why the fix has an order
Two guards already exist —
actionlintandevent-shape-guards, both inactionlint.yml— andboth are path-filtered to
.github/workflows/**andscripts/**. Each carries its own WARNING:That warning is correct, and it describes exactly how politeia's
mainbecame unmergeable. So thisPR is only the first half: drop the filter. Branch protection follows separately, and only
after a PR touching neither filtered path is observed producing both checks — until something
outside the old filter actually reports, "the filter is dropped" is a claim rather than a fact.
Desired correction
paths:filter so both jobs run on every PR.Neither job's verification changes — same steps, same scripts, same check-run names
(
actionlint,event-shape-guards), so nothing downstream is renamed.Done when: a PR touching only a non-workflow, non-
scripts/path shows both checks, andrequired_status_checkson main names them.Cost
A docs-only PR re-lints unchanged workflows — seconds. The correct trade for a repository whose
entire content is eleven other repos' CI.
Not in this change
enforce_adminsstaysfalse. Raising it would remove the--adminpath that is currently theonly way to land anything in a private fleet repo during the account's Actions billing lockout.
That is a deliberate hold, not an oversight, and worth revisiting once minutes are restored.