Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

CI gap: path-filtered checks never gate a merge; add the shepherd-posted ci-gate status (#4825 step 1) and stop auto-merge on red

クローズ
  • 何か問題がありますか？
#6,919 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
38/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
github, github-actions, python
領域
ci-cd, devops

調査の方向性

Start by reading shepherd_gh.decide() and the shepherd-event and shepherd-reconcile workflows, then inspect REQUIRED_CHECKS and ADVISORY; the issue does not name their file paths. Implement the ci-gate status rules described here, ensure real failures disable auto-merge, and check the workflows that trigger reconciliation. Done means open PRs receive the specified pending, failure, or success status and a red check blocks auto-merge; the owner still needs to decide whether equivalence-e2e is advisory.

索引モデルが issue の本文から書いたものです。

説明

bug ci-cd github-actions priority: high scope:core

The gap (found 2026-10-28)

Path-filtered workflows run when a change can affect them (#6278), but their result never gates a merge. #6881, #6894, #6895 and #6899 all merged with DOOM-rosetta and/or call-graph-accuracy-audit red, and main stayed red for both until #6908.

How they got through:

  1. Churn gives a merge verdict and adds shepherd:merge before full CI has run on that head (it relies on the worker's pr_gates --fast).
  2. The shepherd turns on auto-merge, and GitHub merges once the ruleset's required checks pass.
  3. Ruleset 24824983 requires only det, full-suite, ground-truth, mypy-audit and ruff-audit.
  4. In shepherd_gh.decide(), a real failure of any other check only adds shepherd:needs-fix and a digest comment. It never joins blocked, so auto-merge stays on. #6881, #6894 and #6895 merged wearing both shepherd:merge and shepherd:needs-fix.
  5. There's also a timing race. #6899's DOOM-rosetta run (40715491522) started at 15:23:39Z and took 31.5 min; GitHub merged at 15:54:37Z, about half a minute before it finished. A shepherd that blocks on red can't catch a check that hasn't finished.

#4825 step 1 planned the fix: one always-reporting ci-gate, required by the ruleset, with path-filtered workflows feeding into it. What shipped was the five core checks only.

Fix

A. A ci-gate commit status, posted by the shepherd (not a polling job).
A polling job would hold a runner for up to 30+ min per PR. The shepherd already reads every check run and status on the head, on every push (shepherd-event) and after CI (shepherd-reconcile). So it posts the status ci-gate on the PR head:

  • pending: a draft PR (its heavy checks are skipped, #5104), any check still running or being retried after an infra failure, a failure caused by main (waiting-on-main), or a required check (REQUIRED_CHECKS) that hasn't reported yet. Required checks always report (#4826), so this also covers check runs that haven't been created yet right after a push.
  • failure: any real failure, from any workflow.
  • success: otherwise.
  • The shepherd's own runs and the ci-gate status itself are left out of the verdict.
  • shepherd-reconcile also triggers on DOOM-rosetta and Call Graph Accuracy Audit completions. Other workflows are picked up by the 20-min cron.
  • ci-gate is posted for every open PR, not just labelled ones, so a merge by hand is gated too.

C. A real failure turns auto-merge off. A needs-fix finding joins blocked, so the shepherd disables auto-merge until the head is green again.

Rollout (owner steps)

  1. Merge the shepherd change. ci-gate starts reporting but is not yet required.
  2. Make sure the squid-shepherd App has Commit statuses: write. Without it the post fails and the PAT fallback is used.
  3. After ci-gate has reported on every open PR for a while, add ci-gate to ruleset 24824983 (status from the squid-shepherd app integration).

Open question for the owner

equivalence-e2e is documented as not required "so its wall time never holds a merge" (docs/ci.md). With ci-gate, every workflow that runs gates the merge, E2E included. Should E2E be advisory instead? It would be one entry in the ADVISORY tuple.

Related: #4825, #6278, #6770, #6266, #6908

主要言語
Python
スター
57
フォーク
11
平均マージ
1時間 14分
マージ済み PR（30日）
967

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

squid-protocol/gitgalaxy のほかの issue

squid-protocol/gitgalaxy の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。