fix(ci): skip docs-only changes for ci and CodeQL workflows - #141
Conversation
Org-wide audit found these workflows lack paths-ignore, triggering full CI on every docs-only push/PR and adding to Actions queue congestion. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| paths-ignore: | ||
| - "docs/**" | ||
| - "*.md" |
There was a problem hiding this comment.
🟡 Documentation contracts lose validation
When a pull request changes only contract documents, paths-ignore suppresses the sole job validating their invariants. Broken documentation contracts can merge undetected.
Prompt for agents
The CI workflow contains tests/test_documentation_contract.py, which validates files covered by docs/** and *.md. The pull_request and push paths-ignore filters now suppress that test precisely when a documentation-only change can break those contracts. Keep CodeQL skipped for documentation-only changes, but preserve a lightweight documentation-contract check for those changes. This can be done by narrowing the CI exclusion, splitting documentation validation into a separate workflow/job with appropriate path triggers, or otherwise ensuring the contract test runs on documentation-only pull requests and pushes.
Was this helpful? React with 👍 or 👎 to provide feedback.
| branches: [main] | ||
| paths-ignore: | ||
| - "docs/**" | ||
| - "*.md" |
There was a problem hiding this comment.
🟡 Nested documentation still triggers workflows
Markdown outside the root and docs/ does not match *.md. Deployment and service guide changes still launch both workflows.
Prompt for agents
Both .github/workflows/ci.yml and .github/workflows/codeql.yml use *.md, which does not cover nested Markdown guides such as deploy/keycloak/README.md, deploy/templates/README.md, and services/account_unification/README.md. Use a recursive Markdown glob in every filter intended to skip all documentation. Account for the separate documentation-contract requirement in ci.yml rather than suppressing that validation.
Was this helpful? React with 👍 or 👎 to provide feedback.
| paths-ignore: | ||
| - "docs/**" | ||
| - "*.md" | ||
| pull_request: | ||
| paths-ignore: | ||
| - "docs/**" | ||
| - "*.md" |
There was a problem hiding this comment.
🔍 Exact-head policy needs reconciliation
Documentation-only heads no longer receive local CI or CodeQL evidence. Repository guidance still presents both as universal exact-head gates.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughCI와 CodeQL 워크플로의 push 및 pull_request 트리거에 문서 경로 제외 조건을 추가했습니다. 문서만 변경되면 두 워크플로가 실행되지 않습니다. Changes워크플로 트리거 필터링
Estimated code review effort: 1 (Trivial) | ~5 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…es to protect documentation contracts (#142) tests/test_documentation_contract.py reads doc content and asserts required text; #141's paths-ignore on ci.yml made that job skip on docs-only changes, silently defeating it. Reverts ci.yml's paths-ignore (codeql.yml left as-is). See PR body for full analysis and verification.
1 participant
What
Adds
paths-ignore: ["docs/**", "*.md"]to both thepushandpull_requesttriggers of.github/workflows/ci.ymland.github/workflows/codeql.yml.Why
An org-wide audit found these workflows lack a
paths-ignorefilter, so every push/PR — including docs-only changes — triggers a full CI run (Python tests, realm-config validation, docker-compose validation, and a CodeQL scan). This is contributing to org-wide GitHub Actions queue congestion across ContextualWisdomLab repos (the 60-concurrent-job plan ceiling means every unnecessary job run delays everyone else's queue).Safety check performed
mainhas no branch protection (GET .../branches/main/protection-> 404) and no classic required status-check contexts, so no named check depends on these workflows always running.CWL Central required workflows, id 18156473) requires a fixed list of central workflow files (opencode-review.yml, pr-review-merge-scheduler.yml, security-scan.yml, strix.yml, sast-semgrep.yml, noema-review.yml, codeql-pr.yml, scorecard-pr.yml, osv-scanner-pr.yml, close-empty-pr.yml) via itsworkflowsrule type.ci.ymlandcodeql.yml(this repo's own workflows) are not in that list, so this change does not touch anything the ruleset enforces.paths-ignore/pathsfilter (verified by reading both files before editing).🤖 Generated with Claude Code
Summary by CodeRabbit