ci: switch doc-skip from workflow paths-ignore to a job-level gate#39
Merged
jnasbyupgrade merged 5 commits intoJul 20, 2026
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
jnasbyupgrade
added a commit
to jnasbyupgrade/cat_tools
that referenced
this pull request
Jul 18, 2026
Doc-only commit to HISTORY.asc to prove, on a live CI run, that the job-level docs-only gate correctly skips the heavy matrix jobs (test, pg-upgrade-test, extension-update-test) while all-checks-passed still runs and reports green. Kept in the branch intentionally as evidence; can be squashed/dropped before merge.
jnasbyupgrade
force-pushed
the
ci-per-commit-docs-gate
branch
from
July 18, 2026 21:03
34892ba to
27e64df
Compare
3 tasks
jnasbyupgrade
added a commit
to jnasbyupgrade/cat_tools
that referenced
this pull request
Jul 20, 2026
…hs-ignore The GitHub CI note still described workflow-level paths-ignore, which this PR (Postgres-Extensions#39) replaces with a per-push changes/docs_only job-level gate. Update the note so it reflects the mechanism actually in ci.yml.
jnasbyupgrade
force-pushed
the
ci-per-commit-docs-gate
branch
from
July 20, 2026 19:56
3dc7d91 to
4b4a85d
Compare
jnasbyupgrade
added a commit
to jnasbyupgrade/cat_tools
that referenced
this pull request
Jul 20, 2026
…hs-ignore The GitHub CI note still described workflow-level paths-ignore, which this PR (Postgres-Extensions#39) replaces with a per-push changes/docs_only job-level gate. Update the note so it reflects the mechanism actually in ci.yml.
jnasbyupgrade
force-pushed
the
ci-per-commit-docs-gate
branch
from
July 20, 2026 19:59
4b4a85d to
38bbb94
Compare
paths-ignore on the workflow trigger only skips CI when the entire push/PR diff is docs-only; for a PR that also touches code, every commit runs the full matrix even if that commit is doc-only. It's also the classic "stuck Pending" hazard for a required status check: if the whole workflow (including all-checks-passed) never runs, the required check never reports. Add a cheap `changes` job that computes the per-push changed file set (github.event.before/after for push and PR synchronize; PR base/head sha otherwise) and sets docs_only only when every changed file matches .md/.asc, failing safe (docs_only=false) on any diff failure or ambiguous base. Gate `test`, `pg-upgrade-test`, and `extension-update-test` on `needs.changes.outputs.docs_only != 'true'`, and add `changes` to all-checks-passed's needs so it keeps running and reporting on every commit.
actions/checkout@v4 pins to the deprecated Node 20 runtime, which GitHub Actions warns about on every run. ci.yml already uses @v6; align claude-code-review.yml and claude.yml so all workflows are on the same, non-deprecated major version.
…st_target job actions/checkout added a guard that refuses to check out fork PR heads under pull_request_target/workflow_run by default (a "pwn request" mitigation), plus an allow-unsafe-pr-checkout escape hatch for the reviewed cases where that is intentional. This job is exactly that case: it already gates on the trusted fork owner, checks out read-only (persist-credentials: false), and the workflow file itself always comes from master under pull_request_target, so a PR can't alter the job that reviews it. The guard/input shipped in actions/checkout v7.0.0 and has since been backported to the v4/v5/v6 floating major tags too (confirmed directly against actions/checkout's live action.yml on each tag), so no major-version bump beyond the existing @v6 is needed to use it here. claude.yml is unaffected: it doesn't trigger on pull_request_target/workflow_run and its checkout step doesn't target a fork PR head, so it isn't subject to this guard.
…hs-ignore The GitHub CI note still described workflow-level paths-ignore, which this PR (Postgres-Extensions#39) replaces with a per-push changes/docs_only job-level gate. Update the note so it reflects the mechanism actually in ci.yml.
…ces it The allow-unsafe-pr-checkout comment listed several reasons the fork checkout was "safe" (owner gate, persist-credentials: false, read-only, workflow sourced from master). A laundry list like that rots: any one item can change later while the comment keeps reassuring, and the actual enforcing control is easy to miss among the secondary points. Move the security-critical statement to the owner-only `if:` on the claude-review job, since that gate is the one thing that makes the fork checkout acceptable at all: it stops arbitrary fork code from being checked out in the trusted pull_request_target context (a "pwn request"). The allow-unsafe-pr-checkout comment now just states it's unsafe by default and points to that gate, instead of re-deriving the safety case inline.
jnasbyupgrade
force-pushed
the
ci-per-commit-docs-gate
branch
from
July 20, 2026 22:34
ab21c4c to
da986fe
Compare
jnasbyupgrade
merged commit Jul 20, 2026
7b23d1a
into
Postgres-Extensions:master
19 of 20 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace the workflow-level
paths-ignoredoc-skip with a job-level gate. A cheapchangesjob computes the actual per-push changed-file set and exposesdocs_only; the heavytest,pg-upgrade-test, andextension-update-testjobs run only when it is false. This skips the matrix for a doc-only commit per-commit (not just when an entire PR is docs-only), and because the workflow always triggers, the requiredall-checks-passedjob always reports — avoiding the "stuck pending" hazard that trigger-level path filtering has with a required status check.Also repairs
claude-review, which is currently failing on every fork PR:actions/checkout's floating major tags recently gained a guard that refuses to check out fork-PR code underpull_request_target, soclaude-code-review.yml's checkout now errors. This addsallow-unsafe-pr-checkout: trueto that step (the job is the vetted case — gated to the trusted fork owner, read-only, workflow sourced frommaster), restoring the review. Also bumpsactions/checkoutv4->v6 in the Claude workflows (the v4 pin uses the deprecated Node 20 runtime) and updates the stale CLAUDE.md CI note to describe the new gate.Details
changesjob:fetch-depth: 0; BASE/HEAD fromevent.before/event.after(push, and PRsynchronize) else PRbase.sha/head.sha; fails safe todocs_only=false(run the full matrix) on a missing/all-zero BASE or a failedgit diff; setsdocs_only=trueonly when every changed file matches\.(md|asc)$.needs: [changes]+if: needs.changes.outputs.docs_only != 'true';all-checks-passedaddschangestoneeds(its pass/fail logic is unchanged — it already treatsskippedas success).skippedsiblings as clean (its bad-check set is onlyfailure|cancelled|timed_out|action_required|stale), so the review still runs on doc-only changes — no gate-logic change needed.claude-code-review.yml's fork-checkout safety rationale now lives in one place: the owner-onlyif:on theclaude-reviewjob carries the security-critical statement that this gate is what makesallow-unsafe-pr-checkoutacceptable, and the comment atallow-unsafe-pr-checkout: trueitself just points back to that gate instead of repeating a list of secondary reasons (persist-credentials, read-only, workflow-sourced-from-master) that could go stale independently of the actual control.Note: the checkout bump and the fork-checkout fix can't be observed on this PR's own run —
claude-code-review.ymlruns the base-branch (master) copy underpull_request_target, so both only take effect once this merges (which is also whyclaude-reviewstays red on this PR itself).mastercurrently has no branch protection, so nothing is blocked today; the gate change also preempts the stuck-Pending hazard for whenever a required check is added. This branch has been rebased twice ontomasteras it moved (most recently past #42's relkind fix) to keep the diff limited to the workflow files andCLAUDE.md.