fix(template): Make "Finished Build and Publish" gate reflect real build outcome#614
Open
lfrancke wants to merge 1 commit into
Open
fix(template): Make "Finished Build and Publish" gate reflect real build outcome#614lfrancke wants to merge 1 commit into
lfrancke wants to merge 1 commit into
Conversation
…ild outcome The `finished` job is the single required status check for the build workflow. It had no `if:` clause, so a failed dependency caused GitHub to *skip* it rather than fail it - and branch protection treats a skipped required check as passing. A broken build (e.g. a failed publish-index-manifest) therefore became mergeable. Two fixes: - Add `if: always()` so the gate always runs and reports a real success/failure conclusion. - List every leaf job directly in `needs` and fail the gate on any `failure`/`cancelled` result. Previously publish-index-manifest was only a transitive dependency (via openshift-preflight-check), so its failure would not surface in `needs.*.result`. `skipped` is tolerated, since jobs skip legitimately on merge_group events, forks, and when detect-changes finds no relevant changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
finishedjob (Finished Build and Publish) is the single required status check for the build workflow. We did this so we don't have to list every step in between as required.During our 26.7 release we saw a build that succeeded even though it shouldn't have: https://github.com/stackabletech/listener-operator/actions/runs/29825092091
Fix
Github considers skipped jobs as succeeded rather than failing the job. So we need to make sure our
finishedjob always runs.This PR changes it by introducing an
if: always()to the jobif: always()so the gate always runs and reports a real success/failure conclusion.needsand fail on anyfailure/cancelledresult.publish-index-manifestwas previously only a transitive dependency (viaopenshift-preflight-check), so its failure would not surface inneeds.*.resulteven withalways().skippedis tolerated on purpose, jobs skip legitimately onmerge_groupevents, forks, and whendetect-changesfinds no relevant changes.