From 09ff85f06288514397f09ddfd793bdddf5d750f8 Mon Sep 17 00:00:00 2001 From: Kin Lane Date: Mon, 3 Aug 2026 15:21:36 -0400 Subject: [PATCH] fix(repo): let CI check its own configuration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Option 1 from #33. Workflows and composite actions were the one category of file nothing verified, because the pull_request trigger ignored .github/** — so the riskiest edits in the repository were also the only unreviewed-by-machine ones. On 3 August that shipped three CI configuration changes to main without a single check running, and two of them were wrong: #17 retired the inherited workflows no CI ok #31 safe.directory, cache keys, test-windows no CI WRONG (host path in a container) #32 the upstream watcher no CI WRONG (same bug, caught by hand) Both were found by manually triggering things afterwards. That is not a system, and there is no reason to expect it to hold. The cost is a full matrix run when a workflow comment changes. At this volume that is a few minutes and worth it. Note the setting is defensible upstream, where the pull request volume is far higher — it is wrong here, which is a good reminder that inherited configuration can be correct in its original home and wrong in this one. README.md stays ignored, per the decision on #33. This also unblocks the required-status-checks criterion in #10: with .github/** ignored, a pull request touching only workflows would never report the Commit check, and a required check that never reports leaves the pull request permanently unmergeable. Closes #33 Refs #10, #29, #16 Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/commit.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/commit.yml b/.github/workflows/commit.yml index 7678c445..55ee291f 100644 --- a/.github/workflows/commit.yml +++ b/.github/workflows/commit.yml @@ -3,9 +3,11 @@ on: workflow_call: pull_request: branches: [main] + # `.github/**` is deliberately NOT ignored. Workflows and composite actions are the + # riskiest files here and were the only ones nothing verified — see #33. Three CI + # config changes merged unchecked on 3 August and two of them were wrong. paths-ignore: - README.md - - .github/** jobs: test-node: runs-on: ubuntu-latest