ci: let a pull request produce the "Run tests" check it must pass - #111
Open
accesswatch wants to merge 1 commit into
Open
ci: let a pull request produce the "Run tests" check it must pass#111accesswatch wants to merge 1 commit into
accesswatch wants to merge 1 commit into
Conversation
Branch protection required a status check named "Run tests", but that job existed only in deploy.yml, which triggers on push to main and workflow_dispatch -- never on pull_request. A PR could therefore never produce the check it was required to pass, so every PR blocked forever, admin enforcement was switched off, and pushing straight to main became the only way to land anything. Moves the check into its own tests.yml running on pull_request and on pushes to main, deliberately with no paths: filter -- a path-filtered required check recreates the same deadlock for any PR touching other paths. deploy.yml keeps its own gating job, renamed "Pre-deploy tests" so only one workflow exports the required context. Also documents that production deploys are automatic on push to main, and that running deploy-app.sh by hand can collide with the Actions deploy: the concurrency group serialises Actions runs against each other but cannot see a person on SSH, and two concurrent runs fail in docker compose up with a container name conflict. That happened during this work. Renames the site-audit e2e regression test to say what it verifies. The SSRF guard refuses private addresses, so a scan aimed at the test server is always refused -- the test exercised submission, the results page and the artifact links, but never scanning, while its name claimed otherwise. It now also asserts the refusal is reported honestly (failed=1, scanned=0, per-page result "error") rather than passing identically whether the run reported an error or wrongly claimed a clean page. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NqHuFZ4bm7SKB4ebBczYgo
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Branch protection requires a status check named
Run tests. That job existed only indeploy.yml, which triggers onpushtomainandworkflow_dispatch— never onpull_request.So a PR could never produce the check it was required to pass. Every PR blocked indefinitely,
enforce_adminswas switched off, and pushing directly tomainbecame the only way to land anything.What this changes
.github/workflows/tests.yml(new) — producesRun testsonpull_requestand on pushes tomain. Deliberately nopaths:filter: a path-filtered required check recreates the same deadlock for any PR touching other paths.deploy.yml— its gating job is renamedPre-deploy testsso only one workflow exports the required context. The deploy is still gated.docs/deployment.md— records that production deploys are automatic on push tomain, and that runningdeploy-app.shby hand can collide with the Actions deploy. Theconcurrency: deploy-productiongroup serialises Actions runs against each other but cannot see a person on SSH; two concurrent runs fail indocker compose upwith a container-name conflict. This happened during this work.BRANCH_PROTECTION_RULES.md— documents where the check lives and the path-filter trap.web/e2e/tests/regression.spec.mjs— renames the site-audit test to say what it verifies. The SSRF guard refuses private addresses, so a scan aimed at the test server is always refused: the test exercised submission, the results page and artifact links, but never scanning, while its name claimed otherwise. It now also asserts the refusal is reported honestly (failed=1,scanned=0, per-page resulterror).Verification
This PR is its own test: if
Run testsreports here, the deadlock is fixed.Once it does,
enforce_adminsshould be turned on so the setting matches the documented policy.🤖 Generated with Claude Code