Repository navigation
refactor(ci): one reusable changes job replaces sixteen checkout + paths-filter copies, and the migration gate watches the code its tests import (#15360) - #18275
Merged
Conversation
…eckout + paths-filter (#15360)
…n callers when _changes.yml is edited (#15360)
…erived onto the reusable changes job (#17822) The gate's filter listed where its tests live, not the code they import, so #17772 changed services/secrets_coordinator.py, migration-tests was skipped and the run rolled up to success. Re-derived from the preserved branch wip-17822-filter-guard, not cherry-picked, because the filter now lives in the with: filters block of the changes job that calls _changes.yml. - 3006cacbb8: the eleven secrets/credential entries go into migration-gate.yml's on.push.paths and the changes job's migrations filter; python-paths.yml gains migration-gate.yml so the guard runs when the workflow is edited. - c88938bd72: the import-derived coverage guard, now parsing the changes job's with: filters (and requiring it to call _changes.yml), with a declared reach, floor, policy entry and scope claim. - changes_job_equivalence_15360_test: the eleven entries and the python-paths.yml entry are a named, pinned allowed delta citing #17822; the frozen pre-#15360 fixture is untouched. - 5258acc (the secrets_coordinator fix) already landed on main as 26ecfab (#17824) and is not part of this change. Refs #17822
…main after the ghcr mirror change (#15360)
… glob constants the 15900 census reads as guard reads (#15360)
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 6 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
✅ SSOT Configuration Compliance: Passing🎉 No new hardcoded values of either class — Known backlog in |
3 tasks
…ter-reuse # Conflicts: # repo_tests/_reach_policy.py # repo_tests/reach_scope_claim_17844_test.py
This was referenced Oct 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thinking Path
#15360: sixteen workflows each carried their own copy of
checkout+dorny/paths-filter, so a path rule had sixteen homes and drifted. The owner decided dedup now, with the job-graph merge (one change detection per PR) as the follow-up #18208. This PR is the dedup. It was finished from a local-only branch, rebased onto currentmain, and checked for reversals of latermainwork (none).What Changed
644314de6a: one reusable.github/workflows/_changes.ymlreplaces the inline checkout + paths-filter copies in 16 workflows. The filter sets live in.github/filters/*.yml.fa6e331783: a guard (repo_tests/one_paths_filter_job_15360_test.py) fails on a 17th inline copy. It has a declared reach, floor, policy entry and scope claim. Three workflows keep their own step, each with its reason in_ALLOWED:ci.yml,codeql.ymlandenforce-precommit.yml.0a3d6720b5:migration-gateandai-security-revieware converted too. Editing_changes.ymlreruns its callers.344413ab25(security(secrets): the #16982 wiring guard passes on a docstring, and the scope pre-check loads legacy rows and 403s a missing secret #17822 remainder): the migration gate now watches the code its tests import (11 secrets/API path entries). This had not landed onmain: noprovider_key_vault/secrets_vaultentry under.github, and its guard test was absent. Without it, the gate would not have run on security(secrets): ask the secret's own scope, not just the vault grant (#16982) #17772.22ff8e87d0: the frozen pre-conversion hashes formigration-gateare re-frozen aftermain's fix(ci): service containers pull from the ghcr mirror with the workflow token (#18160) #18197 changed that workflow. Regenerating them with the module's own generator changed only those two lines.c529d6b597: the 11 pinned security(secrets): the #16982 wiring guard passes on a docstring, and the scope pre-check loads legacy rows and 403s a missing secret #17822 entries live inrepo_tests/fixtures/issue_17822_migration_gate_entries.json, loaded by the equivalence test, with an assertion that there are exactly 11. They are workflow-filter data, but as Python constants the guard(ci): the filter-coverage checker ignores glob-declared reads, so its green over-claims #15900 glob census (which scans.pyconstants only) readautobot-backend/api/**as a guard reading that tree. No debt entry was added. The expected set has one home and is not derived from the workflow it checks: deleting one entry frommigration-gate.ymlfails 25 equivalence tests.Equivalence: every caller's path filters, before → after
_changes.yml_changes.yml, +migration-gate.ymlEvery widening is pinned by name in
changes_job_equivalence_15360_test.py. Everything else is asserted identical. Runtime equivalence can only be shown by CI itself.Verification
check_workflow_path_filters, symbol-fork ratchet, size ratchet, ceiling parity.guard_reach_meta_test23,reach_scope_claim_17844_test10.yaml.safe_loadpasses on every changed workflow.actionlintis not installed, so it was not run.actions/upload-artifact) touches these workflows, in a different hunk.Not done, stated rather than implied
workflow_callcannot do. By the owner's split, that is ci: merge the PR-triggered workflows so change detection runs once per PR #18208: a different job graph, the required-context shims (ci(queue): gate CI on ready-for-review so an open PR does not start runs automatically #17957), and a branch-protection migration order. So this PR is Refs ci(perf): collapse 15 duplicate paths-filter jobs into one reusable workflow #15360.Refs #15360
Refs #17822
Refs #18208
Model Used
Claude Opus 5.5 (master session: brief, review of the report, PR). Finished by a Claude Sonnet subagent; the earlier commits came from a subagent earlier this session.
🤖 Generated with Claude Code