Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

CI gap: path-filtered checks never gate a merge; add the shepherd-posted ci-gate status (#4825 step 1) and stop auto-merge on red

未关闭
  • 哪里不对？
#6,919 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
38/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
github, github-actions, python
领域
ci-cd, devops

调研方向

Start by reading shepherd_gh.decide() and the shepherd-event and shepherd-reconcile workflows, then inspect REQUIRED_CHECKS and ADVISORY; the issue does not name their file paths. Implement the ci-gate status rules described here, ensure real failures disable auto-merge, and check the workflows that trigger reconciliation. Done means open PRs receive the specified pending, failure, or success status and a red check blocks auto-merge; the owner still needs to decide whether equivalence-e2e is advisory.

由索引模型根据 Issue 内容生成。

描述

bug ci-cd github-actions priority: high scope:core

The gap (found 2026-10-28)

Path-filtered workflows run when a change can affect them (#6278), but their result never gates a merge. #6881, #6894, #6895 and #6899 all merged with DOOM-rosetta and/or call-graph-accuracy-audit red, and main stayed red for both until #6908.

How they got through:

  1. Churn gives a merge verdict and adds shepherd:merge before full CI has run on that head (it relies on the worker's pr_gates --fast).
  2. The shepherd turns on auto-merge, and GitHub merges once the ruleset's required checks pass.
  3. Ruleset 24824983 requires only det, full-suite, ground-truth, mypy-audit and ruff-audit.
  4. In shepherd_gh.decide(), a real failure of any other check only adds shepherd:needs-fix and a digest comment. It never joins blocked, so auto-merge stays on. #6881, #6894 and #6895 merged wearing both shepherd:merge and shepherd:needs-fix.
  5. There's also a timing race. #6899's DOOM-rosetta run (40715491522) started at 15:23:39Z and took 31.5 min; GitHub merged at 15:54:37Z, about half a minute before it finished. A shepherd that blocks on red can't catch a check that hasn't finished.

#4825 step 1 planned the fix: one always-reporting ci-gate, required by the ruleset, with path-filtered workflows feeding into it. What shipped was the five core checks only.

Fix

A. A ci-gate commit status, posted by the shepherd (not a polling job).
A polling job would hold a runner for up to 30+ min per PR. The shepherd already reads every check run and status on the head, on every push (shepherd-event) and after CI (shepherd-reconcile). So it posts the status ci-gate on the PR head:

  • pending: a draft PR (its heavy checks are skipped, #5104), any check still running or being retried after an infra failure, a failure caused by main (waiting-on-main), or a required check (REQUIRED_CHECKS) that hasn't reported yet. Required checks always report (#4826), so this also covers check runs that haven't been created yet right after a push.
  • failure: any real failure, from any workflow.
  • success: otherwise.
  • The shepherd's own runs and the ci-gate status itself are left out of the verdict.
  • shepherd-reconcile also triggers on DOOM-rosetta and Call Graph Accuracy Audit completions. Other workflows are picked up by the 20-min cron.
  • ci-gate is posted for every open PR, not just labelled ones, so a merge by hand is gated too.

C. A real failure turns auto-merge off. A needs-fix finding joins blocked, so the shepherd disables auto-merge until the head is green again.

Rollout (owner steps)

  1. Merge the shepherd change. ci-gate starts reporting but is not yet required.
  2. Make sure the squid-shepherd App has Commit statuses: write. Without it the post fails and the PAT fallback is used.
  3. After ci-gate has reported on every open PR for a while, add ci-gate to ruleset 24824983 (status from the squid-shepherd app integration).

Open question for the owner

equivalence-e2e is documented as not required "so its wall time never holds a merge" (docs/ci.md). With ci-gate, every workflow that runs gates the merge, E2E included. Should E2E be advisory instead? It would be one entry in the ADVISORY tuple.

Related: #4825, #6278, #6770, #6266, #6908

主要语言
Python
星标
57
派生
11
平均合并
1 小时 15 分钟
30 天内合并 PR
976

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

squid-protocol/gitgalaxy 的其他 Issue

查看 squid-protocol/gitgalaxy 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。