ci: run acceptance on pull requests - #44
Merged
Merged
Conversation
The merge queue turned out not to be available: GitHub offers it for org-owned repositories and for private repositories on Team and above, and this one is owned by a user account. The merge_group trigger stays wired up so enabling a queue later is a settings change, not a workflow change — but it never fires today, which left the gate it was supposed to provide unmanned. So prove the change on the pull request instead. image and acceptance now run there too, and nothing merges without having passed E2E against the real stack. Trunk can no longer go red from a change that fails acceptance, which was the actual goal. The one thing a queue would still add is testing the combination of trunk plus the change. Branch protection requiring the branch to be up to date before merging forces the same question, paid for with a rebase. Costs ~10 minutes per PR push. Superseded PR runs cancel; trunk runs don't. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
BUILD.md claimed weekly base-image builds and multi-arch (amd64, arm64) images. Neither is true: ci.yml builds linux/amd64 only and has no base-image stage. It also omitted the part that matters — the candidate is built once and promoted by retag, so what carries :latest is bit-identical to what acceptance ran against. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Pull requests build release candidates now, so GHCR churns roughly three times faster. Each build produces several versions (manifest plus attestation entries), so KEEP=10 left about three builds of sha-tagged history — not enough to roll back through. :latest was never at risk; KEEP_TAG_REGEX preserves it regardless of age. This only bounds how far back a sha tag stays pullable. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #43. The merge queue isn't available on this repo — GitHub offers it for org-owned repositories, and for private ones on Team+;
klabast/audiothequeis user-owned. The API rejects the rule outright (Invalid rule 'merge_queue').That left the gate #43 built unmanned:
merge_groupnever fires, so acceptance still only ran after merge.So prove the change on the PR instead.
imageandacceptancenow run onpull_request, and nothing merges without having passed E2E against the real stack — which was the actual goal. Trunk can no longer go red from a change that fails acceptance.The
merge_grouptrigger stays wired up, so enabling a queue later (or moving the repo to an org) is a settings change rather than a workflow change.the one gap that remains
A queue also tests the combination of trunk + the change. Without one, the equivalent is branch protection requiring the branch to be up to date before merging — same question, answered with a rebase instead of a speculative merge build. I'll turn that on with the acceptance jobs as required checks once this lands.
cost
~10 min per PR push (image + three-device matrix). Superseded PR runs cancel via the
concurrencygroup from #43; trunk runs never do. That's the trunk-based trade: slower to merge, trunk always releasable.ADR updated to match reality rather than the plan.
🤖 Generated with Claude Code