From f366d449c89c64958ecfe3d5736f111ddf1e892b Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 10 Sep 2026 20:23:36 -0400 Subject: [PATCH] fix(ci): do not skip Frontend checks on isolation label events --- .github/workflows/ci.yaml | 10 +++------- QUALITY_GATES.md | 5 +++-- scripts/check-terraform-isolation.test.mjs | 14 ++++++-------- terraform/README.md | 9 ++++----- 4 files changed, 16 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 21a0130a..4bb22664 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -4,9 +4,9 @@ on: pull_request: branches: [main, dev, staging] # labeled/unlabeled re-evaluate terraform-isolation when the override - # label is added or removed. Without them a mixed PR can keep a stale - # green isolation check after the label is taken off. Other jobs skip - # on those events so a label change does not re-run the suite. + # label is added or removed. Every Frontend checks job runs on those + # events. Skipping the suite would report required checks as success + # and could merge a failing SHA. types: - opened - synchronize @@ -23,15 +23,12 @@ permissions: jobs: build-and-test: name: Build and test - # Skipped jobs satisfy the required checks on the unchanged SHA. - if: github.event_name != 'pull_request' || (github.event.action != 'labeled' && github.event.action != 'unlabeled') # Org reusable workflow (Node 24): format check, lint, build, unit tests. uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8 with: node-version: "24" governance: - if: github.event_name != 'pull_request' || (github.event.action != 'labeled' && github.event.action != 'unlabeled') # Repo-owned guarantee that every frontend quality gate runs from this # repository, independent of (and in addition to) the reusable workflow. # `npm run verify` is the single command that chains: format check, lint @@ -111,7 +108,6 @@ jobs: visual-regression: name: Visual regression - if: github.event_name != 'pull_request' || (github.event.action != 'labeled' && github.event.action != 'unlabeled') runs-on: ubuntu-latest container: mcr.microsoft.com/playwright:v1.61.1-noble steps: diff --git a/QUALITY_GATES.md b/QUALITY_GATES.md index 17ea3de5..e97c5c2c 100644 --- a/QUALITY_GATES.md +++ b/QUALITY_GATES.md @@ -53,8 +53,9 @@ and synthesis. A task is not done until this is green. `terraform-isolation-override` label is the only way to merge a mixed Terraform/application PR. `ci.yaml` runs `terraform-isolation` on `labeled` and `unlabeled` as well as the default pull-request types, so - adding or removing the label re-checks the current labels. The other CI - jobs skip on those events. Removing the label fails a mixed PR that had + adding or removing the label re-checks the current labels. The other + Frontend checks jobs run on those events too; skipping them would report + required checks as success. Removing the label fails a mixed PR that had previously passed with the override. ## Where the gates run diff --git a/scripts/check-terraform-isolation.test.mjs b/scripts/check-terraform-isolation.test.mjs index 8d3fa662..9cd0d704 100644 --- a/scripts/check-terraform-isolation.test.mjs +++ b/scripts/check-terraform-isolation.test.mjs @@ -147,7 +147,7 @@ test("CLI refuses to run without a base ref or --stdin", () => { assert.notEqual(result.status, 0); }); -test("ci.yaml re-evaluates isolation on labeled and unlabeled and skips other jobs", () => { +test("ci.yaml re-evaluates isolation on labeled and unlabeled without skipping other jobs", () => { const yaml = readFileSync( path.join(path.dirname(fileURLToPath(import.meta.url)), "..", ".github/workflows/ci.yaml"), "utf8", @@ -156,15 +156,13 @@ test("ci.yaml re-evaluates isolation on labeled and unlabeled and skips other jo assert.match(yaml, new RegExp(`^ - ${eventType}$`, "m"), eventType); } - const skipLabelEvents = - /^ if: github\.event_name != 'pull_request' \|\| \(github\.event\.action != 'labeled' && github\.event\.action != 'unlabeled'\)$/gm; - assert.equal( - [...yaml.matchAll(skipLabelEvents)].length, - 3, - "build-and-test, governance, and visual-regression skip label events", + assert.match(yaml, /^ terraform-isolation:\n/m); + assert.doesNotMatch( + yaml, + /github\.event\.action != 'labeled'/, + "skipping other jobs on label events would report required checks as success", ); const isolation = yaml.split(/^ terraform-isolation:\n/m)[1]?.split(/^ [a-z]/m)[0] ?? ""; assert.match(isolation, /if: github\.event_name == 'pull_request'/); - assert.doesNotMatch(isolation, /if: github\.event\.action != 'labeled'/); }); diff --git a/terraform/README.md b/terraform/README.md index b1814740..68b2da42 100644 --- a/terraform/README.md +++ b/terraform/README.md @@ -222,11 +222,10 @@ the labels. Push-to-`dev` releases return behind the repository variable `scripts/*terraform*` tooling are allowed alongside. A reviewer may add the `terraform-isolation-override` label for the rare change that must introduce Terraform variables together with the workflow that consumes them (PR C). - Adding or removing that label re-runs `terraform-isolation` against the - labels currently on the PR; the other CI jobs skip on those events so a - label change does not re-run the suite. Removing the label fails a mixed - PR that had previously passed with the override, so a stale green check - cannot merge. Markdown under `terraform/` does not count as a Terraform + Adding or removing that label re-runs the Frontend checks workflow, + including `terraform-isolation`, against the labels currently on the PR. + Removing the label fails a mixed PR that had previously passed with the + override, so a stale green check cannot merge. Markdown under `terraform/` does not count as a Terraform change for this gate; it does not match the workspace trigger patterns. The label is the approval record. The override is temporary: a follow-up PR after PR C removes the label path from the checker and