From e94be50a0fb944d2d0e7ba690f2e386e7c79c814 Mon Sep 17 00:00:00 2001 From: t Date: Tue, 15 Sep 2026 22:47:58 +0530 Subject: [PATCH] Run CI on every pull request, not only those targeting master `ci.yml` filtered `pull_request` to `branches: [master]`, so a pull request stacked on another branch triggered no run at all. The consequence was not a missing badge: such a PR reports `mergeStateStatus: CLEAN`, because the only check that does run is GitGuardian, and "clean" means "no required check failed" rather than "the suite ran". A stack accumulated unchecked changes until its root merged, at which point the first real run met several pull requests' worth of change at once. This was reached, not hypothesised. #397 merged into `claude/voucher-presence` with one check on it; #308 sat on that branch through a base sync, a conflict resolution and a test rewrite, showing CLEAN throughout. A manual `workflow_dispatch` on #308's branch was the first Bridge CI run it ever had, and it passed on macOS and Windows -- so the gap was coverage, not a latent failure. It could as easily have been the other way. The `push` trigger stays master-only: a branch worth checking has a pull request, and that is what triggers the run, so filtering the push side avoids a second run per branch rather than losing coverage. `ci.yml` is in the compatibility surface, so the surface and matrix are resealed: one hash changed, pin set unchanged at 212, `reseal.sh --verify` exit 0 read directly. Verified: `check-ci-workflow-consistency.mjs` passes; the compatibility gate passes; tools workspace 11 binaries, 53 passed, 0 failed. The workflow parses and keeps its 9 jobs, with `pull_request` now carrying only `types`. Not changed, and worth a separate decision: `dependency-security.yml` carries the same `branches: [master]` filter, and `docs/proposed-merge-gate-ci.md` proposes a merge-gate workflow with it too. Both inherit this gap. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 9 ++++++++- docs/tally/compatibility/compatibility-matrix.json | 2 +- docs/tally/compatibility/compatibility-surface.json | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2f6567b0..5aecc211 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,9 +2,16 @@ name: Bridge CI on: push: + # Only master. A branch push needs no run of its own: a branch worth + # checking has a pull request, and that is what triggers below. branches: [master] pull_request: - branches: [master] + # Deliberately unfiltered by base branch. Filtering to `[master]` meant a + # pull request stacked on another branch got no run at all, and reported + # `mergeStateStatus: CLEAN` off the one check that is not this workflow -- + # a green that said only "nothing required failed", never "the suite ran". + # A stack then accumulated unchecked changes until its root merged, so the + # first real run faced several pull requests' worth of change at once. types: [opened, reopened, synchronize, ready_for_review] workflow_dispatch: diff --git a/docs/tally/compatibility/compatibility-matrix.json b/docs/tally/compatibility/compatibility-matrix.json index 524ddd7a..6ddba8ad 100644 --- a/docs/tally/compatibility/compatibility-matrix.json +++ b/docs/tally/compatibility/compatibility-matrix.json @@ -1,7 +1,7 @@ { "schema_version": 1, "bridge_commit_sha": "be1c20cc3fd66fa1ece196505c69f26e555e4b8e", - "compatibility_surface_sha256": "baaa9c6bc7559df335c6f79236cdd79e2cc38d7b26505d3732c5d59ac31d8d67", + "compatibility_surface_sha256": "b0a658a972bd150599add28b408fddf5026c3dc67a105e49f7256ca7ada255ad", "claims": [ { "claim_id": "erp9-6-6-3-windows-education-xml-one-company", diff --git a/docs/tally/compatibility/compatibility-surface.json b/docs/tally/compatibility/compatibility-surface.json index 604cbaf0..078e04a0 100644 --- a/docs/tally/compatibility/compatibility-surface.json +++ b/docs/tally/compatibility/compatibility-surface.json @@ -3,7 +3,7 @@ "files": [ { "path": ".github/workflows/ci.yml", - "sha256": "e9221b186b18d6c8df148e4492ac6733df55e772c041f3246f1aeee0249273c2" + "sha256": "c986297046d65dc1d218583410e693c9d017e1d72e3891d667012c8474db2ed1" }, { "path": ".github/workflows/dependency-security.yml", @@ -850,5 +850,5 @@ "sha256": "a8ac2714fecf51947f2822c8c46d7ce2e8602c732780ff60566a7771f0836f9a" } ], - "manifest_sha256": "baaa9c6bc7559df335c6f79236cdd79e2cc38d7b26505d3732c5d59ac31d8d67" + "manifest_sha256": "b0a658a972bd150599add28b408fddf5026c3dc67a105e49f7256ca7ada255ad" } \ No newline at end of file