From 9421c96f4fe98a54d1b29a80fded0fa2d8a6519a Mon Sep 17 00:00:00 2001 From: forkwright Date: Wed, 26 Aug 2026 15:38:39 -0500 Subject: [PATCH] docs: record which checks are required on main, and why no path filter This repository authors the reusables eleven repos inherit and until today required ZERO status checks to merge -- one approving review was the entire control. #59 removed the `paths:` filter from actionlint.yml so both guards run on every PR, which is the precondition for requiring them. The warning is the part worth writing down. The filter was not arbitrary: it existed so the workflow only ran when workflows or scripts changed. Removing it is what makes the checks eligible to be required, and reintroducing one would make every PR touching neither path unmergeable -- nothing failing, nothing pending, nothing to point at. That failure has already happened to a sibling repo's main, so the constraint is recorded here rather than left to be rediscovered. This file touches neither `.github/workflows/**` nor `scripts/**`, which makes it the probe: if both checks report on this PR, the filter drop is demonstrated rather than assumed, and the required contexts can be set on that evidence. --- README.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/README.md b/README.md index 6cd4ea3..c0ec753 100644 --- a/README.md +++ b/README.md @@ -180,6 +180,20 @@ repo the token cannot search reads identically to one that never converted. | forkwright/typikon | gate-attestation, release-pr-checks | | forkwright/zetesis | gate-attestation, release-please, release-pr-checks, security | +## Required checks on main + +`actionlint` and `event-shape-guards` are required status checks on `main`. Both live in +`actionlint.yml` and both run on **every** pull request. + +WARNING for anyone editing `actionlint.yml`: do not reintroduce a `paths:` filter on its trigger. +It carried one (`.github/workflows/**`, `scripts/**`) until it became required, and a required +check that cannot run on some pull requests blocks those pull requests forever — nothing failing, +nothing pending, nothing to point at. This repository has watched that happen to a sibling repo's +`main`. + +The cost is that a docs-only pull request re-lints unchanged workflows. That is seconds, and it is +the correct trade for the repository whose entire content is other repositories' CI. + ## Visibility requirement This repo must remain **public**. GitHub does not allow private repos to call