From 36cd39533ae58d28fa52d747e11eb0da6581029c Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Thu, 30 Jul 2026 11:47:41 +0200 Subject: [PATCH] fix(ci): stop reporting success for work that did not happen The pipeline gate only listed twelve of seventeen jobs in its needs, leaving out wait-fork-prereq-run, fork-prereqs-ready, build-ci-images, images-mirror-missing and test-dns. A failure in any of them turns its dependents into skipped rather than failure, and the gate's check matches only failure and cancelled, so the run would have concluded green without images ever being built. A caller-supplied whitelist was also passed through verbatim. Run 30492550883 was dispatched with web-app-prometheu; discovery dropped the unknown id without a warning, the empty resolution became [], the deploy workflows skipped their whole matrix on that condition and the parent job still concluded success. Validate every id against roles/ and exit naming the offenders, so a typo cannot quietly remove an application from a run. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci-orchestrator.yml | 5 +++++ scripts/github/resolve/effective_whitelist.sh | 9 +++++++++ 2 files changed, 14 insertions(+) diff --git a/.github/workflows/ci-orchestrator.yml b/.github/workflows/ci-orchestrator.yml index 5d34c3385b..0f29f8d4d1 100644 --- a/.github/workflows/ci-orchestrator.yml +++ b/.github/workflows/ci-orchestrator.yml @@ -293,6 +293,11 @@ jobs: done: name: 🏁 Finish pipeline needs: + - wait-fork-prereq-run + - fork-prereqs-ready + - build-ci-images + - images-mirror-missing + - test-dns - test-install-make - test-install-pkgmgr - test-deploy-single-node-priority diff --git a/scripts/github/resolve/effective_whitelist.sh b/scripts/github/resolve/effective_whitelist.sh index be445b3c55..256481238f 100755 --- a/scripts/github/resolve/effective_whitelist.sh +++ b/scripts/github/resolve/effective_whitelist.sh @@ -38,6 +38,15 @@ fi shopt -u nocasematch if [[ -n "${input_trimmed}" ]]; then + unknown=() + for role in ${input}; do + [[ -d "roles/${role}" ]] || unknown+=("${role}") + done + if ((${#unknown[@]})); then + echo "[ERROR] Unknown role id(s) in the caller-supplied whitelist: ${unknown[*]}" >&2 + echo "[ERROR] They match no directory under roles/, so they would be dropped silently and never deployed." >&2 + exit 1 + fi printf 'whitelist=%s\n' "${input}" >>"${GITHUB_OUTPUT}" echo "Using caller-supplied whitelist: ${input}" exit 0