Compare commits

...

2 Commits

Author SHA1 Message Date
cp-be e60801ee2e chore: retrigger CI
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 21s
CI / Shellcheck (E2E scripts) (pull_request) Successful in 34s
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 26s
Handlers Postgres Integration / detect-changes (pull_request) Successful in 30s
CI / Detect changes (pull_request) Successful in 1m40s
E2E API Smoke Test / detect-changes (pull_request) Successful in 1m34s
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 1m37s
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 40s
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m47s
gate-check-v3 / gate-check (pull_request) Failing after 1m4s
qa-review / approved (pull_request) Failing after 30s
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 1m25s
security-review / approved (pull_request) Failing after 25s
sop-checklist / all-items-acked (pull_request) Successful in 21s
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 11s
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 3m20s
sop-tier-check / tier-check (pull_request) Successful in 19s
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 2m12s
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 15s
lint-mask-pr-atomicity / lint-mask-pr-atomicity (pull_request) Successful in 3m20s
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 3m3s
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 15s
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 24s
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 3m39s
CI / Python Lint & Test (pull_request) Successful in 7m53s
CI / Platform (Go) (pull_request) Successful in 11m5s
CI / Canvas (Next.js) (pull_request) Successful in 11m30s
CI / Canvas Deploy Reminder (pull_request) Successful in 4s
CI / all-required (pull_request) Successful in 11m37s
audit-force-merge / audit (pull_request) Has been skipped
2026-05-15 08:57:49 +00:00
cp-be 32d1d6f1a5 fix(ci): add canvas-deploy-reminder to all-required polling list
Issue: molecule-core#1148 [ci-drift] (F3b finding).

The polling sentinel in `all-required` was missing `CI / Canvas Deploy
Reminder` from its `required:` list. Without this, a force-merge that
skipped the canvas-deploy-reminder check (e.g. the check was still
pending or failed) would not be flagged by the §SOP-6 force-merge audit.

The polling approach handles this correctly: the sentinel waits for all
required contexts to emit 'success' (or timeout), unlike the needs:-based
approach which could deadlock when canvas-deploy-reminder is skipped on
CI-only PRs (it needs canvas-build which is also skipped).

Also updated `audit-force-merge.yml REQUIRED_CHECKS` to include
`CI / Canvas Deploy Reminder (pull_request)`, ensuring the §SOP-6
audit evaluates this check at merge time.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-15 08:04:45 +00:00
2 changed files with 7 additions and 4 deletions
+1
View File
@@ -54,5 +54,6 @@ jobs:
# read-only by design (least-privilege).
REQUIRED_CHECKS: |
CI / all-required (pull_request)
CI / Canvas Deploy Reminder (pull_request)
sop-checklist / all-items-acked (pull_request)
run: bash .gitea/scripts/audit-force-merge.sh
+6 -4
View File
@@ -552,10 +552,11 @@ jobs:
# required commit-status contexts for this SHA and fails if any fail, skip,
# or never emit.
#
# canvas-deploy-reminder is intentionally NOT included in all-required.needs.
# It is an informational main-push reminder, not a PR quality gate. Keeping
# it in this dependency list lets a skipped reminder skip the required
# sentinel before the `always()` guard can emit a branch-protection status.
# canvas-deploy-reminder is included in the polling list below. Unlike the
# needs:-based approach (which could deadlock when canvas-deploy-reminder is
# skipped on CI-only PRs since it needs canvas-build), the polling sentinel
# safely handles skipped/never-emitted status: it reports failure for any
# required context that is not 'success' within the timeout window.
#
continue-on-error: false
runs-on: ubuntu-latest
@@ -587,6 +588,7 @@ jobs:
f"CI / Detect changes ({event})",
f"CI / Platform (Go) ({event})",
f"CI / Canvas (Next.js) ({event})",
f"CI / Canvas Deploy Reminder ({event})",
f"CI / Shellcheck (E2E scripts) ({event})",
f"CI / Python Lint & Test ({event})",
]