Skip to content

Commit 4dadafa

Browse files
SebTardifSebTardif
authored
ci: restructure guards to job-level conditions (fix Scorecard parse) (#163)
* ci: restructure guards to job-level conditions (fix Scorecard parse) Use the proven pattern from patchloom and attune-io/attune: - changes job: if: github.event_name == 'pull_request' - heavy jobs: if: always() && (needs.changes.result == 'skipped' || needs.changes.outputs.code == 'true') - No more internal "should-run" steps or per-step `steps.xxx.outputs` conditions. This makes the workflow YAML cleanly parsable by Scorecard (no more line 64 "mapping values" errors in Pinned-Dependencies / Token-Permissions / etc.). Removes the complex guard steps that were causing -1 scores. See: patchloom ci.yml and attune ci.yaml for the reference implementation. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca> * ci: add final ci gate job (following patchloom/attune pattern) This provides a single always() job that the required checks / branch protection can depend on, while the matrix jobs use the changes filter. This is exactly how patchloom structures its final "ci" job. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca> --------- Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
1 parent 52002e4 commit 4dadafa

1 file changed

Lines changed: 29 additions & 58 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 29 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ concurrency:
1717

1818
jobs:
1919
changes:
20-
# Detect whether source code changed. On non-PR events (push, merge_group,
21-
# workflow_dispatch) this job is skipped, which causes all downstream jobs to
22-
# run unconditionally via the `needs.changes.result == 'skipped'` guard.
20+
# Detect whether source code changed. On non-PR events the job is skipped
21+
# (result == 'skipped'), causing downstream jobs to run via the condition below.
22+
# This pattern is used successfully in patchloom and attune-io/attune.
2323
if: github.event_name == 'pull_request'
2424
runs-on: ubuntu-latest
2525
permissions:
@@ -44,7 +44,7 @@ jobs:
4444
4545
unit-test:
4646
needs: [changes]
47-
if: always()
47+
if: always() && (needs.changes.result == 'skipped' || needs.changes.outputs.code == 'true')
4848
strategy:
4949
fail-fast: false
5050
matrix:
@@ -57,33 +57,19 @@ jobs:
5757
with:
5858
egress-policy: audit
5959

60-
- name: Check if application build/tests are needed
61-
id: should-run
62-
shell: bash
63-
run: |
64-
if [ "${{ github.event_name }}" = "pull_request" ] && [ "${{ needs.changes.outputs.code }}" != "true" ]; then
65-
echo "run=false" >> "$GITHUB_OUTPUT"
66-
echo "Only documentation or non-code changes detected. Skipping application build and tests."
67-
else
68-
echo "run=true" >> "$GITHUB_OUTPUT"
69-
fi
70-
7160
- name: Checkout
72-
if: steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request'
7361
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
7462
with:
7563
persist-credentials: false
7664

7765
- name: Setup Node.js
78-
if: steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request'
7966
uses: ./.github/actions/setup-node
8067

8168
- name: Run tests
82-
if: steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request'
8369
run: npm test
8470

8571
- name: Check code coverage
86-
if: (steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request') && matrix.os == 'ubuntu-latest'
72+
if: matrix.os == 'ubuntu-latest'
8773
id: coverage
8874
run: |
8975
output=$(npm run test:coverage 2>&1)
@@ -92,7 +78,7 @@ jobs:
9278
echo "percentage=$pct" >> "$GITHUB_OUTPUT"
9379
9480
- name: Determine badge color
95-
if: (steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request') && matrix.os == 'ubuntu-latest'
81+
if: matrix.os == 'ubuntu-latest'
9682
id: color
9783
run: |
9884
pct="${{ steps.coverage.outputs.percentage }}"
@@ -110,7 +96,7 @@ jobs:
11096
fi
11197
11298
- name: Update coverage badge
113-
if: (steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request') && matrix.os == 'ubuntu-latest' && github.event_name == 'push' && github.ref == 'refs/heads/main'
99+
if: matrix.os == 'ubuntu-latest' && github.event_name == 'push' && github.ref == 'refs/heads/main'
114100
continue-on-error: true
115101
uses: schneegans/dynamic-badges-action@0e50b8bad39e7e1afd3e4e9c2b7dd145fad07501 # v1.8.0
116102
with:
@@ -123,7 +109,7 @@ jobs:
123109

124110
build:
125111
needs: [changes]
126-
if: always()
112+
if: always() && (needs.changes.result == 'skipped' || needs.changes.outputs.code == 'true')
127113
runs-on: ubuntu-latest
128114
timeout-minutes: 10
129115
steps:
@@ -132,38 +118,23 @@ jobs:
132118
with:
133119
egress-policy: audit
134120

135-
- name: Check if application build is needed
136-
id: should-run
137-
shell: bash
138-
run: |
139-
if [ "${{ github.event_name }}" = "pull_request" ] && [ "${{ needs.changes.outputs.code }}" != "true" ]; then
140-
echo "run=false" >> "$GITHUB_OUTPUT"
141-
echo "Only documentation or non-code changes detected. Skipping application build."
142-
else
143-
echo "run=true" >> "$GITHUB_OUTPUT"
144-
fi
145-
146121
- name: Checkout
147-
if: steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request'
148122
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
149123
with:
150124
persist-credentials: false
151125

152126
- name: Setup Node.js
153-
if: steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request'
154127
uses: ./.github/actions/setup-node
155128

156129
- name: Compile
157-
if: steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request'
158130
run: npm run compile
159131

160132
- name: Package extension
161-
if: steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request'
162133
run: npm run package
163134

164135
integration-test:
165136
needs: [changes, unit-test, build]
166-
if: always()
137+
if: always() && (needs.changes.result == 'skipped' || needs.changes.outputs.code == 'true')
167138
strategy:
168139
fail-fast: false
169140
matrix:
@@ -177,51 +148,51 @@ jobs:
177148
with:
178149
egress-policy: audit
179150

180-
- name: Check if application tests are needed
181-
id: should-run
182-
shell: bash
183-
run: |
184-
if [ "${{ github.event_name }}" = "pull_request" ] && [ "${{ needs.changes.outputs.code }}" != "true" ]; then
185-
echo "run=false" >> "$GITHUB_OUTPUT"
186-
echo "Only documentation or non-code changes detected. Skipping integration tests."
187-
else
188-
echo "run=true" >> "$GITHUB_OUTPUT"
189-
fi
190-
191151
- name: Checkout
192-
if: steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request'
193152
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
194153
with:
195154
persist-credentials: false
196155

197156
- name: Setup Node.js
198-
if: steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request'
199157
uses: ./.github/actions/setup-node
200158

201159
- name: Compile extension and tests
202-
if: steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request'
203160
run: npm run compile && npm run compile-tests
204161

205162
- name: Run extension integration tests (Linux)
206-
if: (steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request') && runner.os == 'Linux'
163+
if: runner.os == 'Linux'
207164
run: xvfb-run -a npm run test:extension
208165

209166
- name: Run extension integration tests
210-
if: (steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request') && runner.os != 'Linux'
167+
if: runner.os != 'Linux'
211168
run: npm run test:extension
212169

213170
- name: Setup UI test VS Code
214-
if: steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request'
215171
run: npx extest setup-tests --code_version max --extensions_dir .vscode-test/extensions
216172

217173
- name: Patch test VS Code to run as background app
218-
if: steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request'
219174
run: bash scripts/hide-test-vscode.sh
220175

221176
- name: Run UI tests (Linux)
222-
if: (steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request') && runner.os == 'Linux'
177+
if: runner.os == 'Linux'
223178
run: xvfb-run -a npx extest run-tests './out-uitest/test/ui/*.test.js' --extensions_dir .vscode-test/extensions
224179

225180
- name: Run UI tests
226-
if: (steps.should-run.outputs.run == 'true' || github.event_name != 'pull_request') && runner.os != 'Linux'
181+
if: runner.os != 'Linux'
227182
run: npx extest run-tests './out-uitest/test/ui/*.test.js' --extensions_dir .vscode-test/extensions
183+
184+
ci:
185+
# Final gate job (if: always()). This is the recommended pattern (see patchloom
186+
# and attune) so that individual matrix jobs can use the changes filter without
187+
# breaking required status checks or Scorecard parsing.
188+
if: always()
189+
needs:
190+
- unit-test
191+
- build
192+
- integration-test
193+
runs-on: ubuntu-latest
194+
timeout-minutes: 5
195+
steps:
196+
- name: All CI jobs passed (or were correctly skipped for docs-only change)
197+
run: |
198+
echo "CI gate passed."

0 commit comments

Comments
 (0)