ci: skip Build & Test e2e for docs/workflow-only PRs#101
Merged
Conversation
…green Adds a path filter to .github/workflows/build-and-test.yml so PRs that only touch documentation, license metadata, or workflow files unrelated to the action runtime no longer spend ~5 minutes running the full e2e matrix (build-dist + test-python/npm/maven/version-file). The repository ruleset requires the `all-tests-passed` commit status, so a paired skip workflow (.github/workflows/build-and-test-skip.yml) runs on the inverse path set and reports `all-tests-passed = success` directly. Both workflows share `name: Build & Test` for status-context identity. paths-ignore covers (inverse for the skip workflow): - **/*.md - LICENSE, LICENSES/**, REUSE.toml - renovate.json, .gitignore - .github/workflows/codeql.yml - .github/codeql/** - .github/dependabot.yml, .github/CODEOWNERS build-and-test.yml itself is intentionally NOT in the list \u2014 changes to the test workflow logic must run the full e2e suite.
CodeQL's `actions/unpinned-tag` rule (security-and-quality suite) flagged the `@master` ref as a supply-chain risk: a third-party action's master branch can be force-pushed by its maintainer at any time, and any malicious version would run in our CI with our GITHUB_TOKEN. Pin to the v2.0.1 release commit (3730c0a3) in both: - .github/workflows/build-and-test.yml (existing tech debt; same finding was waiting to surface as soon as the new CodeQL workflow ran on any non-skipped PR) - .github/workflows/build-and-test-skip.yml (the new file in this PR) The trailing `# v2.0.1` comment is renovate/dependabot-friendly so future updates can still be automated against the upstream tag.
Contributor
Author
|
@mdanish98 . please kindly help do a review, thanks! |
mdanish98
approved these changes
Jun 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix #51
Summary
Stop running the full ~5-minute Build & Test e2e suite on PRs that only change documentation, license metadata, or unrelated workflow files (CodeQL, Dependabot, Renovate, Codeowners). The repository ruleset still requires the
all-tests-passedcommit status to merge, so a paired skip workflow reports it directly for the ignored paths.PR #99 is a concrete example of where this would have helped: 4 commits to
.github/workflows/codeql.ymltriggered 4 full e2e runs, the cancel-in-progress concurrency caused a ~5-minute pending stretch on the latest commit, and none of those runs could possibly have caught a behavior regression — the action runtime wasn't touched.Why a skip workflow at all
GitHub's required status check rule (
required_status_checks→context: all-tests-passed) treats a workflow that doesn't run as not satisfied rather than skipped/passed. Without a paired skip workflow, addingpaths-ignoretobuild-and-test.ymlwould leave docs-only PRs permanentlyBLOCKED. The pattern below is GitHub's documented solution for required checks with path filters.Changes
Modified
.github/workflows/build-and-test.yml— addedpaths-ignore:listing files that cannot affect the action runtime.Added
.github/workflows/build-and-test-skip.yml— runs on the inverse path set (paths:matches whatbuild-and-test.yml'spaths-ignore:excludes) and reportsall-tests-passed = successvia the samemyrotvorets/set-commit-status-action@mastercall the real workflow uses. Both workflows sharename: Build & Testso the status context is identical.Path list
Files that cannot break the action runtime (skip e2e):
Notably not in the list (they still run e2e):
.github/workflows/build-and-test.yml— changes to the test workflow itself must be exercised end-to-end..github/workflows/release.yml— release logic uses the same composite actions..github/actions/**— the action source itself.action.yml— composite action entry point.test-resources/**— e2e test fixtures.package.json,tsconfig.json,jest.config.*— change the build/test toolchain.Behavior matrix
build-and-test.yml(real)build-and-test-skip.yml(paired)all-tests-passedstatusThe mixed case is benign because the skip workflow finishes in ~30s while the real run takes ~3min, so the real result is always the last write to the commit status. (Even in the unlikely race where skip wrote last, GitHub recomputes mergeability on each status update — the real workflow's eventual write would still settle the merge gate.)
Compatibility & impact
Breaking changes
CI impact
Status-context identity
Confirmed: the ruleset rule is
required_status_checks: [{context: "all-tests-passed", integration_id: 15368}]—integration_id: 15368is the GitHub Actions app, and both workflows post viaset-commit-status-actionusing${{ secrets.GITHUB_TOKEN }}, so the status integration_id matches.Verification
After merge, expected behavior on a docs-only PR:
Build & Test / build-dist,test-*checks: not present (skipped).Build & Test / all-tests-passedcheck: present and green (from skip workflow).all-tests-passed: success.On a source-only PR, behavior is unchanged.
Checklist
paths-ignorecovers only files that demonstrably cannot affect runtimebuild-and-test.ymlitself is excluded from the ignore list (test changes still run)name: Build & Testfor status-context identityset-commit-status-actionand context name as the real oneall-tests-passedis reported by the skip workflow