Talos compatibility guard is skipped on pull requests and only fails in the merge queue

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

The check that decides whether a Kubernetes version bump is admissible does not run on the pull request that proposes it. It is filtered out by path detection and runs only in the merge group, so the failure appears after the change is already queued.

Measured on #3534 (update Kubernetes to v1.37.0), 2026-09-06:

surface	🧪 Validate Talos Machine Config	outcome
pull request, head dd40ed9e	skipping	28 checks green, no conflict, green review at head — reads merge-ready
merge group, run 34026228941	failure	evicted from the queue

The merge-group failure is a true finding, not a flake:

ksail.prod.yaml: Kubernetes v1.37.0 is not verified compatible with Talos v1.13.9:
version of Kubernetes 1.37.0 is too new to be used with Talos 1.13.9.

Affected audience and impact

Any update that changes the Kubernetes version reaches the queue looking fully ready and is then evicted. The pull request shows no signal at all about why, so it sits indefinitely: #3534 was open and apparently merge-ready for three days with auto-merge never armed.

The cost is worse than a delay. Eviction is the only feedback, so the natural response is to re-queue, which reproduces the same failure and consumes a full merge-group deploy cycle each time. The guard exists and is correct — it simply runs where it cannot prevent the wasted cycle.

Expected behaviour

A change that the Talos compatibility guard would reject fails on the pull request, before it is ever queued.

Acceptance criteria

• The compatibility validation runs on pull_request for any change that alters the Kubernetes or Talos version, rather than being filtered out by path detection.
• A pull request proposing an incompatible pair reports a failing check on the pull request itself.
• The merge-group run keeps the guard as well, so nothing weakens the final gate.

Rough size: small.

Observed while driving #3534.

[devantler]

🤖 Generated by the Agentic Engineer

This report reproduces the workflow on an old PR revision; the missing guard has already been delivered by #3583, which closed #3536 on 2026-09-04.

Verified against current main c174a93f5b2d09dd1d2dc33578804707bc8b0c48:

• The Talos path filter includes ksail.prod.yaml, the Talos installer, validator sources, and Go dependencies.
• The validation job runs for matching pull requests and merge groups, and invokes the Kubernetes/Talos compatibility validator.
• chore(deps): update dependency kubernetes/kubernetes to v1.37.0 #3534 still has head dd40ed9ea0456896fa0c1fe085ae656d3e053e51. Its older workflow omits the production pin from the filter and has no compatibility-validator step. Its earlier green checks therefore do not validate the workflow now on main.

Closing this duplicate as not planned; another path-filter implementation is unnecessary. #3534 remains blocked by its existing incompatible Kubernetes/Talos pairing. Its branch must receive current main and fresh checks when that dependency work resumes; closing this issue does not clear or requeue that PR.