From 46dbe3599875a7ea0b211454a6cf477822a9023a Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 10 Sep 2026 20:27:41 -0400 Subject: [PATCH] ci(terraform-isolation): run label retriggers in a dedicated workflow --- .github/workflows/ci.yaml | 35 ------------------ .github/workflows/terraform-isolation.yaml | 43 ++++++++++++++++++++++ QUALITY_GATES.md | 20 +++++----- README.md | 8 ++-- scripts/check-terraform-isolation.test.mjs | 29 ++++++++------- terraform/README.md | 10 ++--- 6 files changed, 78 insertions(+), 67 deletions(-) create mode 100644 .github/workflows/terraform-isolation.yaml diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 4bb22664..9a39ad3b 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -3,16 +3,6 @@ name: Frontend checks on: pull_request: branches: [main, dev, staging] - # labeled/unlabeled re-evaluate terraform-isolation when the override - # label is added or removed. Every Frontend checks job runs on those - # events. Skipping the suite would report required checks as success - # and could merge a failing SHA. - types: - - opened - - synchronize - - reopened - - labeled - - unlabeled push: branches: [main, dev, staging] workflow_dispatch: {} @@ -81,31 +71,6 @@ jobs: env: GOVERNANCE_BASE: ${{ steps.governance-ref.outputs.base }} - terraform-isolation: - # Fails a pull request that changes `terraform/**` together with deployable - # application code (scripts/check-terraform-isolation.mjs). A merge that - # does both queues an HCP VCS run and a content release at the same time, - # and the two race for the workspace lock. The - # `terraform-isolation-override` label is the reviewed exception. This - # job runs on labeled/unlabeled as well as the default PR types so the - # check matches the labels currently on the PR. - name: Terraform and application changes are isolated - if: github.event_name == 'pull_request' - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: "24" - - name: Check changed files - env: - BASE_SHA: ${{ github.event.pull_request.base.sha }} - HEAD_SHA: ${{ github.event.pull_request.head.sha }} - TERRAFORM_ISOLATION_OVERRIDE: ${{ contains(github.event.pull_request.labels.*.name, 'terraform-isolation-override') }} - run: node scripts/check-terraform-isolation.mjs --base "${BASE_SHA}" --head "${HEAD_SHA}" - visual-regression: name: Visual regression runs-on: ubuntu-latest diff --git a/.github/workflows/terraform-isolation.yaml b/.github/workflows/terraform-isolation.yaml new file mode 100644 index 00000000..92cc9d38 --- /dev/null +++ b/.github/workflows/terraform-isolation.yaml @@ -0,0 +1,43 @@ +name: Terraform isolation + +# Own workflow so labeled/unlabeled re-evaluate this gate without starting a +# new Frontend checks run. Skipping jobs inside `ci.yaml` on those events +# would report required checks as success and could merge a failing SHA. + +on: + pull_request: + branches: [main, dev, staging] + types: + - opened + - synchronize + - reopened + - labeled + - unlabeled + +permissions: + contents: read + +jobs: + terraform-isolation: + # Fails a pull request that changes Terraform infrastructure together with + # deployable application code (scripts/check-terraform-isolation.mjs). A + # merge that does both queues an HCP VCS run and a content release at the + # same time, and the two race for the workspace lock. The + # `terraform-isolation-override` label is the reviewed exception. This + # job is unconditional so adding or removing that label always reads the + # current label set; a previous green check does not survive removal. + name: Terraform and application changes are isolated + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: "24" + - name: Check changed files + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + TERRAFORM_ISOLATION_OVERRIDE: ${{ contains(github.event.pull_request.labels.*.name, 'terraform-isolation-override') }} + run: node scripts/check-terraform-isolation.mjs --base "${BASE_SHA}" --head "${HEAD_SHA}" diff --git a/QUALITY_GATES.md b/QUALITY_GATES.md index e97c5c2c..64d5292e 100644 --- a/QUALITY_GATES.md +++ b/QUALITY_GATES.md @@ -30,7 +30,7 @@ and synthesis. A task is not done until this is green. | Terraform isolation gate contract | `npm run test:terraform-isolation` → `scripts/check-terraform-isolation.test.mjs` | `governance` + CI | Changed-file classifier | | Terraform formatting/validation | `npm run test:terraform` → `scripts/terraform-validate.mjs` | `governance` + CI | `terraform/live/dev` | | CDK build, tests, synthesis | `npm run test:infra` | `governance` + CI | `infra/cdk/**`, both synth modes | -| Terraform/app change isolation | `ci.yaml` job `terraform-isolation` → `scripts/check-terraform-isolation.mjs` | CI (PR) | Changed files of the PR | +| Terraform/app change isolation | `terraform-isolation.yaml` job `terraform-isolation` → `scripts/check-terraform-isolation.mjs` | CI (PR) | Changed files of the PR | ## No-false-pass guarantees @@ -51,12 +51,11 @@ and synthesis. A task is not done until this is green. (`terraform/README.md`). - **The isolation gate re-evaluates on label changes** — the `terraform-isolation-override` label is the only way to merge a mixed - Terraform/application PR. `ci.yaml` runs `terraform-isolation` on - `labeled` and `unlabeled` as well as the default pull-request types, so - adding or removing the label re-checks the current labels. The other - Frontend checks jobs run on those events too; skipping them would report - required checks as success. Removing the label fails a mixed PR that had - previously passed with the override. + Terraform/application PR. `.github/workflows/terraform-isolation.yaml` + runs `terraform-isolation` on `labeled` and `unlabeled` as well as the + default pull-request types, so adding or removing the label re-checks + the current labels without starting a new Frontend checks run. Removing + the label fails a mixed PR that had previously passed with the override. ## Where the gates run @@ -67,9 +66,10 @@ and synthesis. A task is not done until this is green. format/lint/build/tests, **and** a repo-owned `governance` job runs `npm run verify` (with Terraform 1.16.0 installed) so the maintainability ratchets and repository gates are guaranteed from this repository regardless - of the reusable workflow. On pull requests the same workflow's - `terraform-isolation` job fails when `terraform/**` and application code - change together. + of the reusable workflow. +- **Terraform isolation ([`.github/workflows/terraform-isolation.yaml`](.github/workflows/terraform-isolation.yaml)):** + on pull requests, fails when Terraform infrastructure and application code + change together. Label add/remove re-runs only this workflow. ## Toolchain pin diff --git a/README.md b/README.md index 9a4bc04a..1abeac15 100644 --- a/README.md +++ b/README.md @@ -156,10 +156,10 @@ No stored AWS keys — OIDC only. Infrastructure and content deploy separately: [`AGENTS.md`](AGENTS.md), [`QUALITY_GATES.md`](QUALITY_GATES.md), [`ARCHITECTURE_AND_CODE_QUALITY.md`](ARCHITECTURE_AND_CODE_QUALITY.md), and [`REVIEW_AND_PR_FRAMEWORK.md`](REVIEW_AND_PR_FRAMEWORK.md). -- **Terraform isolation** (the `terraform-isolation` job in - [`.github/workflows/ci.yaml`](.github/workflows/ci.yaml)) — fails a PR that - mixes `terraform/**` with application code, so a Terraform merge never races - a content release for the HCP workspace. +- **Terraform isolation** + ([`.github/workflows/terraform-isolation.yaml`](.github/workflows/terraform-isolation.yaml)) + — fails a PR that mixes `terraform/**` with application code, so a Terraform + merge never races a content release for the HCP workspace. - **Dev content** ([`.github/workflows/deploy.yml`](.github/workflows/deploy.yml)) — `workflow_dispatch` on `dev` only while the Terraform adoption is in progress. Runs `npm run verify`, assumes `githubdeploy-shoc-frontend-new-dev`, diff --git a/scripts/check-terraform-isolation.test.mjs b/scripts/check-terraform-isolation.test.mjs index 9cd0d704..0f3b9855 100644 --- a/scripts/check-terraform-isolation.test.mjs +++ b/scripts/check-terraform-isolation.test.mjs @@ -147,22 +147,25 @@ test("CLI refuses to run without a base ref or --stdin", () => { assert.notEqual(result.status, 0); }); -test("ci.yaml re-evaluates isolation on labeled and unlabeled without skipping other jobs", () => { - const yaml = readFileSync( - path.join(path.dirname(fileURLToPath(import.meta.url)), "..", ".github/workflows/ci.yaml"), - "utf8", +test("isolation workflow re-evaluates on labeled and unlabeled without rerunning Frontend checks", () => { + const workflows = path.join( + path.dirname(fileURLToPath(import.meta.url)), + "..", + ".github/workflows", ); + const ciYaml = readFileSync(path.join(workflows, "ci.yaml"), "utf8"); + const isolationYaml = readFileSync(path.join(workflows, "terraform-isolation.yaml"), "utf8"); + for (const eventType of ["opened", "synchronize", "reopened", "labeled", "unlabeled"]) { - assert.match(yaml, new RegExp(`^ - ${eventType}$`, "m"), eventType); + assert.match(isolationYaml, new RegExp(`^ - ${eventType}$`, "m"), eventType); } - assert.match(yaml, /^ terraform-isolation:\n/m); - assert.doesNotMatch( - yaml, - /github\.event\.action != 'labeled'/, - "skipping other jobs on label events would report required checks as success", - ); + assert.doesNotMatch(ciYaml, /^ - labeled$/m); + assert.doesNotMatch(ciYaml, /^ - unlabeled$/m); + assert.doesNotMatch(ciYaml, /^ terraform-isolation:\n/m); + assert.doesNotMatch(ciYaml, /github\.event\.action != 'labeled'/); - const isolation = yaml.split(/^ terraform-isolation:\n/m)[1]?.split(/^ [a-z]/m)[0] ?? ""; - assert.match(isolation, /if: github\.event_name == 'pull_request'/); + assert.match(isolationYaml, /^ terraform-isolation:\n/m); + assert.match(isolationYaml, /name: Terraform and application changes are isolated/); + assert.doesNotMatch(isolationYaml, /github\.event\.action != 'labeled'/); }); diff --git a/terraform/README.md b/terraform/README.md index 68b2da42..e0b2b4ab 100644 --- a/terraform/README.md +++ b/terraform/README.md @@ -218,14 +218,14 @@ the labels. Push-to-`dev` releases return behind the repository variable - **Terraform-only PRs.** A PR that changes `terraform/**` may not change deployable application code. The `terraform-isolation` job in - `.github/workflows/ci.yaml` enforces this; documentation and the + `.github/workflows/terraform-isolation.yaml` enforces this; documentation and the `scripts/*terraform*` tooling are allowed alongside. A reviewer may add the `terraform-isolation-override` label for the rare change that must introduce Terraform variables together with the workflow that consumes them (PR C). - Adding or removing that label re-runs the Frontend checks workflow, - including `terraform-isolation`, against the labels currently on the PR. - Removing the label fails a mixed PR that had previously passed with the - override, so a stale green check cannot merge. Markdown under `terraform/` does not count as a Terraform + Adding or removing that label re-runs only that workflow against the labels + currently on the PR; Frontend checks does not start a new run. Removing the + label fails a mixed PR that had previously passed with the override, so a + stale green check cannot merge. Markdown under `terraform/` does not count as a Terraform change for this gate; it does not match the workspace trigger patterns. The label is the approval record. The override is temporary: a follow-up PR after PR C removes the label path from the checker and