From 80b7c033be1d745e03f958a03295979e5f5b1f93 Mon Sep 17 00:00:00 2001 From: forkwright Date: Wed, 26 Aug 2026 13:57:28 -0500 Subject: [PATCH] ci: run the workflow guards on every PR so they can be required forkwright/.github requires ZERO status checks to merge. The repository that authors the fleet's required-gate reusables -- inherited by eleven repos -- has no required gate of its own; one approving review is the entire merge control, and enforce_admins is false. Both guards that could serve already exist here and both are path-filtered to `.github/workflows/**` and `scripts/**`, so neither runs on a PR touching only docs. Each carries its own WARNING saying it must not be made a required check until that filter is dropped, because a required check that never runs blocks its PR permanently -- nothing failing, nothing pending, nothing to point at. That is the exact shape that made politeia's main unmergeable, so the warning is right and this change is the half it asks for first. The filter is dropped and both WARNINGs are rewritten as NOTEs stating why it must not come back. Branch protection follows only after a PR touching neither filtered path is observed producing both checks -- the filter drop is a claim until something outside it reports. The cost is that a docs-only PR re-lints unchanged workflows, which is seconds. That is the correct trade for a repository whose entire content is other repos' CI, and it is not a change in what either job verifies. --- .github/workflows/actionlint.yml | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml index 4b052f4..62b42b5 100644 --- a/.github/workflows/actionlint.yml +++ b/.github/workflows/actionlint.yml @@ -3,10 +3,15 @@ name: actionlint on: + # WHY no `paths:` filter: both jobs below are REQUIRED status checks on main. + # A required check that never runs blocks its PR permanently -- nothing fails, + # nothing is pending, and there is nothing to point at. A filter here would + # strand every PR touching only docs or a script outside `scripts/`. + # + # The cost is that a docs-only PR re-lints unchanged workflows. That is seconds, + # and it is the correct trade for the repository whose entire content is the CI + # eleven other repos inherit. pull_request: - paths: - - ".github/workflows/**" - - "scripts/**" permissions: contents: read @@ -40,10 +45,10 @@ jobs: # the expressions but never evaluates them, so the gate's verdict ladder # is outside what it can see. # - # WARNING: this workflow is path-filtered. Do not add it to required - # status checks without dropping the `paths:` filter first — a required - # check that never runs blocks its PR permanently, with nothing failing - # and nothing pending to point at. + # NOTE: this job is a required status check on main, which is why the + # `paths:` filter was removed from the trigger above. Do not reintroduce + # one: a required check that cannot run on some PRs blocks those PRs + # forever, with nothing failing and nothing pending to point at. - name: Check the gate verdict against the event matrix run: | python3 -m pip install --quiet --disable-pip-version-check pyyaml @@ -58,10 +63,10 @@ jobs: # step it missed). Runs beside actionlint because both answer "is this # workflow correct before 11 repos inherit it". # - # WARNING: this workflow is path-filtered, so it does not run on every PR. - # Do not add either job to required status checks without dropping the - # `paths:` filter first — a required check that never runs blocks its PR - # permanently, with nothing failing and nothing pending to point at. + # NOTE: this job is a required status check on main, which is why the + # `paths:` filter was removed from the trigger above. Do not reintroduce + # one: a required check that cannot run on some PRs blocks those PRs + # forever, with nothing failing and nothing pending to point at. runs-on: ubuntu-latest timeout-minutes: 5 steps: