Skip to content

fix(ci): arm code-quality — gitleaks was a required check that could not fail (backend#1681)#104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
LukasWodka merged 1 commit into from
Aug 11, 2026
Merged

fix(ci): arm code-quality — gitleaks was a required check that could not fail (backend#1681) #104

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 13 additions & 4 deletions .github/workflows/code-quality-caller.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -21,10 +21,19 @@ jobs:
# Armed 2026-08-06 (backend#1492). Measured zero pin violations on every
# develop branch first, so this makes a green check stay green rather than
# importing a backlog. Soft-fail let #1449 add a second unpinned call site
# of an action while #1446 was open to pin it. Independent of soft-fail
# above: this repo's other jobs keep whatever posture they have.
# of an action while #1446 was open to pin it. Both this and `soft-fail`
# below are now false, so the pin check is armed either way.
action-pins: true
action-pins-soft-fail: false
# gitleaks + house-rules run by default -- these are docs' real content gates
# (backend#1420, off-train gates-only). soft-fail left default (advisory) until
# a first green run is observed; arm required on main afterward.
# (backend#1420, off-train gates-only). soft-fail is armed below
# (backend#1681); required-on-main remains a separate decision.
# ARMED 2026-08-11 (backend#1681). Until now `soft-fail` was left at its
# default of TRUE, so every job here -- including the credential scan --
# reported findings and then exited 0. On this repo gitleaks and
# house-rules are REQUIRED status checks, i.e. required checks that could
# not fail. backend#1303 ("flip code-quality to required per repo once its
# backlog is clean") closed 2026-07-31, and the most recent run reports
# zero real findings for gitleaks, house-rules and action-pins -- so this
# arms a green check rather than importing a backlog.
soft-fail: false
Loading