From 86595336055c0d049e3336bbbb62317844196f1d Mon Sep 17 00:00:00 2001 From: tamirms Date: Wed, 3 Jun 2026 14:32:16 +0200 Subject: [PATCH 1/2] ci: add required_status_check.yml aggregator gate Emit a single `complete` status check that mirrors the PR CI workflow's conclusion, so the org branch ruleset can require one stable context instead of individual (matrix) CI job names. Waits only on the "CI" workflow (ci.yml); Race Stress runs on push, not pull_request, so it is deliberately excluded from the filter. Required by stellar/terraform#6140. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/required_status_check.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 .github/workflows/required_status_check.yml diff --git a/.github/workflows/required_status_check.yml b/.github/workflows/required_status_check.yml new file mode 100644 index 0000000..d53748b --- /dev/null +++ b/.github/workflows/required_status_check.yml @@ -0,0 +1,15 @@ +# workaround to simplify terraform management of required status checks, +# see https://github.com/orgs/community/discussions/12377 +name: "Required status check" +on: + pull_request: + +jobs: + complete: + runs-on: ubuntu-latest + timeout-minutes: 60 + steps: + - uses: int128/wait-for-workflows-action@8aa9c53102cda84041a879b99a88b2a93721231d # v1.10.0 + with: + filter-workflow-names: | + CI From 6834346b8d888de60fa8175fbd32458541134121 Mon Sep 17 00:00:00 2001 From: tamirms Date: Wed, 3 Jun 2026 14:43:21 +0200 Subject: [PATCH 2/2] =?UTF-8?q?ci:=20harden=20required=5Fstatus=5Fcheck=20?= =?UTF-8?q?=E2=80=94=20scoped=20token=20+=20concurrency?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address the Copilot/CodeQL review on PR #1: replace the org-default token with a least-privilege read-only set (contents/actions/checks: read — actions:read is what wait-for-workflows-action needs to query runs) and add a concurrency group so force-pushes cancel superseded `complete` jobs instead of leaving them polling. Job id `complete` and the CI-only filter are unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/required_status_check.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/required_status_check.yml b/.github/workflows/required_status_check.yml index d53748b..2a2f4d9 100644 --- a/.github/workflows/required_status_check.yml +++ b/.github/workflows/required_status_check.yml @@ -4,6 +4,19 @@ name: "Required status check" on: pull_request: +# Cancel superseded runs on the same ref (e.g. force-pushes to a PR), so a +# new push doesn't leave an old `complete` job polling until it times out. +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +# Least-privilege, read-only token: the action only reads workflow/check +# runs on the PR head to mirror the CI conclusion. +permissions: + contents: read + actions: read + checks: read + jobs: complete: runs-on: ubuntu-latest