[AAASM-5256] 🔧 (ci): Qualify all paths-filter blocks by file extension, remove bare dir/** wildcards - #1765
Open
Chisanan232 wants to merge 8 commits into
Open
Conversation
This was referenced Jul 28, 2026
The workflow-level push/pull_request paths list used bare dir/** entries (aa-*/**, dashboard/**, proto/**, etc.) with negated extension exclusions bolted on afterward. Per AAASM-5256, every positive entry must itself be extension/filename-qualified — negations alongside a bare wildcard don't satisfy that. Replaced with an enumerated allow-list of the extensions and config filenames each downstream job actually reads, verified against the repo's real file layout (Cargo.toml locations, dashboard source tree, conformance vectors, proto examples, storage migrations, etc).
The `rust` block matched bare aa-*/**, proto/**, conformance/**, and schemas/** — any non-code file under those trees (README, screenshot, generated report) flipped the filter and fanned out to ~22 Rust jobs. Replaced with the enumerated extensions/filenames those jobs actually compile or read, verified against the real file layout: .rs/.toml/.sql source, plus the non-Rust fixture types the integration-test suite spawns (.py/.ts/.js/.mjs/.go/.wat/.sh/.json/.jsonl) and the conformance crate's vector files. Dropped `schemas/**` — grepped the workspace and no Rust crate reads the JSON Schema files; only the schema-lint (ajv) job does, which is the dedicated `schema` filter below.
This is the block the ticket reproduced concretely: 3 screenshot-only commits under dashboard/verify/** each re-triggered the full dashboard job set, including the 5-7 minute Playwright e2e job, for diffs containing zero lines of code. Replaced the bare dashboard/** with the source extensions Vite/tsc/eslint/vitest actually compile or lint (.ts/.tsx/.css/.js/.mjs/.cjs) plus the exact config filenames (package.json, tsconfig.json, .npmrc, pnpm-lock.yaml, index.html) — verified against dashboard/package.json's scripts and the real directory tree (docs/, verify/, design/ are screenshots/markdown only, confirmed via `find`).
Four single-purpose validators shared the same bare-wildcard defect as `rust`: `proto` matched aa-proto/** (buf lint has no reason to run on a crate README), `schema` matched schemas/** (ajv doesn't care about non-JSON/YAML files there — there are none besides the two example formats), `openapi` matched aa-api/** and openapi/** wholesale, and `storage` matched aa-gateway/** and aa-storage*/** wholesale. Narrowed each to the extensions its job reads: buf lints .proto only; aa-proto's .rs wraps the generated client and its Cargo.toml pins the codegen version; ajv validates .json/.yaml; the openapi-drift/openapi-lint jobs diff/lint openapi/v1.yaml specifically (there is no other file under openapi/ besides a README); storage's TimescaleDB test and migration- drift-check jobs are Rust binaries built from .rs plus the embedded .sql migrations under aa-gateway/migrations/ and aa-storage-postgres/migrations/ (confirmed via `sqlx::migrate!` call sites).
`conformance` matched aa-api/src/**, conformance/**, and proto/**
wholesale. The conformance crate's test golden vectors live under
conformance/vectors/ as .json/.bin, its Rust harness under
conformance/{src,tests}/*.rs, and its config as Cargo.toml — narrowed
to those. aa-api/src/** and proto/** narrowed to .rs and .proto
respectively, matching the same reasoning as the `openapi` and `proto`
filters in the prior commit.
`ebpf` matched aa-ebpf*/** wholesale, gating the slow nightly BPF build + sudo e2e jobs on any file under aa-ebpf/aa-ebpf-common/aa-ebpf-probes/ aa-ebpf-programs — including READMEs and .gitignore. Narrowed to .rs (the probe/loader source, all four crates confirmed .rs-only besides Cargo.toml and one .md) and .toml (workspace + per-crate manifests, including aa-ebpf-probes' rust-toolchain.toml and .cargo/config.toml which select the nightly toolchain and build-std flags the job depends on).
aa-*/**/*.toml (added in the top-level on.paths commit) already matches every Cargo.toml under aa-*/, so the explicit Cargo.toml entry was a no-op duplicate.
The on.paths dashboard entries used dashboard/**/*.json and dashboard/**/*.yaml, which is broader than what the dashboard filter block (and therefore any job) actually needs — dashboard has no JSON config besides package.json/tsconfig.json and no YAML besides the pnpm-lock.yaml already listed. Swapped to the exact filenames so both lists describe the same real surface.
Chisanan232
force-pushed
the
v0.0.1/AAASM-5256/fix/ci_paths_filter_allowlist
branch
from
July 28, 2026 02:02
7033d1f to
674f681
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Every block in
.github/workflows/ci.yml'sdorny/paths-filterstep (rust,dashboard,proto,schema,openapi,storage,ebpf), plus the top-levelon.push.paths/on.pull_request.pathstrigger, used a baredir/**(ordir/*) wildcard with no file-extension qualifier. That means a commit touching only non-code content (screenshots, docs, generated reports) under any of these trees still flips the filter and re-triggers that area's full CI job set. Replaced every positive entry with the enumerated extensions/exact filenames that area's jobs actually read or compile, verified against the real file layout and downstream job bodies (not just the ticket's draft YAML) — grepped for consumers ofschemas/,openapi/v1.yaml,proto/examples/*.json,sqlx::migrate!call sites, dashboardpackage.jsonscripts, etc.Type of Change
Breaking Changes
Related Issues
Why (reproduced cost)
Confirmed today: 3 separate commits touching only
dashboard/verify/**screenshot evidence (PR #1733/AAASM-5199, PR #1745/AAASM-5197, PR #1746/AAASM-5162) each re-triggered the fulldashboardjob set including the 5-7 minuteDashboard e2e (Playwright)job, for diffs containing zero lines of code. The other six blocks share the identicaldir/**shape and are exposed to the same failure mode.Before → after per block
Top-level
on.*.paths— wasaa-*/**,proto/**,conformance/**,openapi/**,schemas/**,dashboard/**plus bolted-on!**/*.md/!**/*.png/etc. negations (which don't satisfy the qualification requirement — the positive entry itself must be qualified). Now an enumerated extension list per tree; the negations are no longer needed since the positive entries never match non-code files in the first place.rust— wasaa-*/**,proto/**,conformance/**,schemas/**(plus exactCargo.toml/Cargo.lock/deny.toml/openapi/v1.yaml/.spectral.yaml). Now:.rs/.sql/.toml/.py/.ts/.js/.mjs/.go/.wat/.sh/.json/.jsonlunderaa-*/**(covers every fixture type the integration-test suite spawns),.protounderproto/**, and the conformance crate's.rs/.json/.bin/.toml/.pyvector + harness files. Droppedschemas/**entirely — grepped the whole workspace; no Rust crate reads the JSON Schema files, only theschema-lint(ajv) job does, which has its own dedicated filter.dashboard— wasdashboard/**. Now.ts/.tsx/.css/.js/.mjs/.cjsplus exactpackage.json/tsconfig.json/.npmrc/pnpm-lock.yaml/index.html— verified againstpackage.json's actual scripts (vite,tsc,eslint,vitest,playwright) and confirmeddocs/,verify/,design/underdashboard/are screenshot/markdown-only viafind.proto— wasproto/**,aa-proto/**. Nowproto/**/*.proto(buf only lints.proto) andaa-proto/**/*.rs+Cargo.toml(the crate's generated-client wrapper + codegen pin; itsbuild.rsembeds the proto sources from the siblingproto/dir, already covered by the first entry).schema— wasschemas/**. Now.json/.yamlunderschemas/**(ajv validatespolicy-document.schema.json/simulation-report.schema.jsonagainst the.yamlexample fixtures — there is nothing else in that tree).openapi— wasaa-api/**,openapi/**. Nowaa-api/**/*.rs+Cargo.toml(the crate that generates/serves the spec) andopenapi/v1.yamlspecifically (the only file underopenapi/besides a README — theopenapi-drift/openapi-lintjobs diff/lint that one file).storage— wasaa-gateway/**,aa-storage*/**. Now.rs/Cargo.toml/.sqlunder both — the TimescaleDB and migration-drift-check jobs are Rust binaries that embed the.sqlmigrations at compile time viasqlx::migrate!("./migrations")(confirmed call sites inaa-storage-postgres/src/pool.rsandaa-gateway/src/{approval/*,audit_consumer.rs,...}).conformance— wasaa-api/src/**,conformance/**,proto/**(plus 3 exact.rspaths). Now.rsunderaa-api/src/**, the conformance crate's.rs/.json/.bin/.toml(harness + golden vectors), and.protounderproto/**.ebpf— wasaa-ebpf*/**. Now.rs/.tomlunderaa-ebpf*/**— covers the probe/loader source plus every crate'sCargo.toml,rust-toolchain.toml, and.cargo/config.toml(the nightly-toolchain and-Zbuild-stdconfig the job depends on).No entry in any block, or in the top-level trigger, remains of the shape
dir/**/dir/*with no type qualifier.Testing
python3 -c "import yaml; yaml.safe_load(...)", passes) and by grepping the actual downstream job bodies / Rust source for every file type each filter area consumes before finalizing the allow-list (see commit messages for specifics:sqlx::migrate!sites forstorage,package.jsonscripts fordashboard, etc).Detect changed areasjob's output on this PR — will report its filter outputs (which areas evaluated true/false) as verification evidence once CI runs. This PR's own commits only touch.github/workflows/ci.yml, which is in-scope for every filter, so all downstream job groups should still run/skip sanely.Checklist
dashboard/tests/e2e/README.md's "CI gate" section; it references thedashboardpath filter generically and does not quote the old wildcard shape, so no update neededCloses AAASM-5256