From 0069d53f5b3cdd269ab0ba0495cb6fe75f998a48 Mon Sep 17 00:00:00 2001 From: danbugs Date: Tue, 12 May 2026 22:46:25 +0000 Subject: [PATCH 1/3] ci: add all-checks-passed umbrella jobs and smart path filtering Add all-checks-passed umbrella job to each workflow for use as a required status check in branch protection (auto-merge gate). Scope test-examples.yml PR trigger to examples/runtimes/host paths so docs-only or unrelated changes skip the heavy build+test matrix. Signed-off-by: danbugs --- .github/workflows/benchmarks.yml | 15 +++++++++++++++ .github/workflows/host-checks.yml | 15 +++++++++++++++ .github/workflows/test-examples.yml | 20 ++++++++++++++++++++ 3 files changed, 50 insertions(+) diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index 1c52f9d..e5fe713 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -444,3 +444,18 @@ jobs: Write-Host "| Disk usage | ${diskMiB} MiB |" Write-Host "" Write-Host "::notice::snapshot: apparent=${apparentMiB}MiB disk=${diskMiB}MiB" + + all-checks-passed: + if: always() + needs: [build-image, bench-linux, bench-windows] + runs-on: ubuntu-latest + steps: + - run: | + results=("${{ needs.build-image.result }}" "${{ needs.bench-linux.result }}" "${{ needs.bench-windows.result }}") + for r in "${results[@]}"; do + if [[ "$r" != "success" && "$r" != "skipped" ]]; then + echo "Job failed with result: $r" + exit 1 + fi + done + echo "All checks passed" diff --git a/.github/workflows/host-checks.yml b/.github/workflows/host-checks.yml index 1834554..7039056 100644 --- a/.github/workflows/host-checks.yml +++ b/.github/workflows/host-checks.yml @@ -71,3 +71,18 @@ jobs: # skip themselves if /dev/kvm isn't available. RUST_BACKTRACE: '1' run: cargo test --all-targets --locked + + all-checks-passed: + if: always() + needs: [checks] + runs-on: ubuntu-latest + steps: + - run: | + results=("${{ needs.checks.result }}") + for r in "${results[@]}"; do + if [[ "$r" != "success" && "$r" != "skipped" ]]; then + echo "Job failed with result: $r" + exit 1 + fi + done + echo "All checks passed" diff --git a/.github/workflows/test-examples.yml b/.github/workflows/test-examples.yml index fb920c3..41e99cb 100644 --- a/.github/workflows/test-examples.yml +++ b/.github/workflows/test-examples.yml @@ -4,6 +4,11 @@ on: workflow_dispatch: pull_request: branches: [main] + paths: + - 'examples/**' + - 'runtimes/**' + - 'host/**' + - '.github/workflows/test-examples.yml' push: branches: [main] paths: @@ -738,3 +743,18 @@ jobs: Write-Error "FAIL: expected >=5 pandas_ok lines, got $hits" exit 1 } + + all-checks-passed: + if: always() + needs: [build-example, runtime-test, package-images-for-windows, runtime-test-windows, pyhl-snapshot-test] + runs-on: ubuntu-latest + steps: + - run: | + results=("${{ needs.build-example.result }}" "${{ needs.runtime-test.result }}" "${{ needs.package-images-for-windows.result }}" "${{ needs.runtime-test-windows.result }}" "${{ needs.pyhl-snapshot-test.result }}") + for r in "${results[@]}"; do + if [[ "$r" != "success" && "$r" != "skipped" ]]; then + echo "Job failed with result: $r" + exit 1 + fi + done + echo "All checks passed" From a9f096cc0bf943869f54d74afe7c419c83e48023 Mon Sep 17 00:00:00 2001 From: danbugs Date: Tue, 12 May 2026 22:48:54 +0000 Subject: [PATCH 2/3] ci(host-checks): add explicit permissions to fix CodeQL alert Signed-off-by: danbugs --- .github/workflows/host-checks.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/host-checks.yml b/.github/workflows/host-checks.yml index 7039056..c0f4d7a 100644 --- a/.github/workflows/host-checks.yml +++ b/.github/workflows/host-checks.yml @@ -28,6 +28,8 @@ concurrency: jobs: checks: runs-on: ubuntu-latest + permissions: + contents: read timeout-minutes: 25 defaults: run: From 91371a0d12b04c50342d94f3427fa6fcddc0a701 Mon Sep 17 00:00:00 2001 From: danbugs Date: Tue, 12 May 2026 22:51:37 +0000 Subject: [PATCH 3/3] ci: add empty permissions to all umbrella jobs (CodeQL) Signed-off-by: danbugs --- .github/workflows/benchmarks.yml | 1 + .github/workflows/host-checks.yml | 1 + .github/workflows/test-examples.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index e5fe713..6506af7 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -449,6 +449,7 @@ jobs: if: always() needs: [build-image, bench-linux, bench-windows] runs-on: ubuntu-latest + permissions: {} steps: - run: | results=("${{ needs.build-image.result }}" "${{ needs.bench-linux.result }}" "${{ needs.bench-windows.result }}") diff --git a/.github/workflows/host-checks.yml b/.github/workflows/host-checks.yml index c0f4d7a..f2bbcfd 100644 --- a/.github/workflows/host-checks.yml +++ b/.github/workflows/host-checks.yml @@ -78,6 +78,7 @@ jobs: if: always() needs: [checks] runs-on: ubuntu-latest + permissions: {} steps: - run: | results=("${{ needs.checks.result }}") diff --git a/.github/workflows/test-examples.yml b/.github/workflows/test-examples.yml index 41e99cb..6bfee81 100644 --- a/.github/workflows/test-examples.yml +++ b/.github/workflows/test-examples.yml @@ -748,6 +748,7 @@ jobs: if: always() needs: [build-example, runtime-test, package-images-for-windows, runtime-test-windows, pyhl-snapshot-test] runs-on: ubuntu-latest + permissions: {} steps: - run: | results=("${{ needs.build-example.result }}" "${{ needs.runtime-test.result }}" "${{ needs.package-images-for-windows.result }}" "${{ needs.runtime-test-windows.result }}" "${{ needs.pyhl-snapshot-test.result }}")