clawbot
50a49e8d4e
All checks were successful
check / check (push) Successful in 2m52s
Gitea cancels an in-flight run when a newer commit lands on the same branch and records the cancellation as `failure` / "Has been cancelled". The workflow rewrote that to `skipped`, but Gitea's Combine() folds `skipped` into `success`, so the combined-status API returned green for a commit nothing had ever tested. Rewrite it to `failure` / "Superseded by a newer commit; never tested" instead: red-but-honest, and never `pending`, which would block the commit forever. Re-running the superseded commit would have been better still, but is not reachable on this Gitea (1.25.4): its API exposes no rerun endpoint, workflow dispatch takes a ref rather than a SHA, and every replay would be a full uncached build with no bound on how many pile up behind a burst of merges. The step also stops hardcoding its status context: the logic moves into script/ci-mark-superseded, which derives the context from the workflow name, job id and event, and fails loudly when no status on the commit being built carries that context, so renaming the workflow or the job cannot silently disable the rewrite. The derivation is not byte-exact with Gitea's own rule -- Gitea uses the job's display `name:` where the runner exports the job id -- so adding a `name:` to the job turns every push red rather than quietly doing nothing; the script header says so, because that loud failure is the point. That is item 2 of #147; item 1 there is untouched. Nothing about the walk may fail quietly, since the script exists to stop CI lying quietly. An ANCESTOR_LIMIT that is set but not a positive integer aborts instead of passing an unusable value to git and discarding the error; the root-commit case is detected explicitly so every other rev-list failure aborts too; and per-ancestor status reads carry the same `--retry 3 --max-time 30` as the head-commit read and abort on failure rather than losing curl's exit status through a pipe. Tests drive the script against a fake Gitea covering the cancelled, laundered-skipped, genuinely-failed, passing and renamed cases, an unparseable ANCESTOR_LIMIT and an ancestor whose status read answers HTTP 500, so jq joins the builder image to run them.
44 lines
1.7 KiB
YAML
44 lines
1.7 KiB
YAML
name: check
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- '**'
|
|
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 2024-10-23
|
|
with:
|
|
# The fingerprint step below needs history to find the last commit
|
|
# that touched the Docker build context, and the superseded-status
|
|
# step needs it to walk ancestors (it aborts on a shallow clone).
|
|
fetch-depth: 0
|
|
|
|
- name: Mark superseded run statuses
|
|
# Gitea cancels the in-flight run when another commit is pushed to the
|
|
# same branch and records the cancellation as `failure`, so a commit
|
|
# that was never tested reads as a test result. The script rewrites
|
|
# those statuses to say what happened. See its header for why the
|
|
# state stays `failure` and not `skipped`.
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: script/ci-mark-superseded
|
|
|
|
- name: Fingerprint the build context
|
|
# `.dockerignore` keeps docs out of the build context, so a docs-only
|
|
# commit legitimately replays the whole image from cache and stays
|
|
# cheap. Every other commit writes a new fingerprint into the context,
|
|
# which invalidates the `COPY . .` layer of both check stages: a
|
|
# commit that was never linted, formatted-checked, tested and built
|
|
# cannot report success from cache.
|
|
run: |
|
|
set -eu
|
|
fp="$(git log -1 --format=%H -- . ':!*.md' ':!LICENSE' ':!.editorconfig')"
|
|
printf '%s\n' "${fp:-$GITHUB_SHA}" > .ci-fingerprint
|
|
|
|
- name: Build Docker image (runs make check)
|
|
run: script/cibuild
|