ci: add aggregate "Required checks" gate so docs-only PRs aren't blocked#85
Merged
Merged
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 90e69f305f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The native and bundle-smoke matrix jobs skip on docs-only PRs (via the
"Determine bundle scope" path filter). Because branch protection requires those
matrix contexts directly, a skipped required check leaves the PR permanently
"expected" and unmergeable — even though every substantive check passed.
Add a single `required-checks` gate job that always runs and passes when each
upstream job succeeded or was legitimately skipped, and fails if any failed or
was cancelled. Point branch protection at this one stable context ("Required
checks") instead of the individual native/bundle matrix jobs.
Also:
- Reseal compatibility-surface.json / -matrix.json: `.github/workflows/ci.yml`
is a hash-pinned file in the Tally compatibility surface, so the gate edit
requires a reseal (gate + matrix-markdown checks pass locally).
- Update docs/bootstrap/managed-git.md required-status guidance to require the
aggregate `Required checks` context instead of the individual path-filtered
matrix contexts, so a future policy reconciliation does not re-block docs PRs.
No change to what actually gets built or tested.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
lamemustafa
force-pushed
the
ci/docs-friendly-required-checks
branch
from
July 24, 2026 03:48
90e69f3 to
5f708cf
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Native checks (*)andBundle smoke (*)skip on docs-only PRs (the Determine bundle scope job path-filters them out). Branch protection requires those matrix contexts directly, so on a docs PR they reportskippedand the PR stays permanently "expected" / unmergeable — even when every substantive check (Frontend build, Rust format, Tally portable core, Dependency security) passes. This is what blocked #84.Fix
Add one
required-checksgate job (context name: "Required checks") that:if: always()),needsall the real jobs,No change to what gets built or tested — only the required-status semantics for path-filtered matrix jobs.
Required follow-up (branch protection — maintainer)
After this merges, update
masterprotection's required status checks:Required checksNative checks (windows-latest),Native checks (macos-latest),Bundle smoke (windows-latest),Bundle smoke (macos-latest)(now covered transitively by the gate)Dependency security(separate workflow) and your GitGuardian check as you see fit.This composes with the separate GitGuardian settings fix. Together they let docs-only PRs (e.g. #84) merge normally instead of via admin override.
Note
This PR touches
.github/workflows/ci.yml, so the native/bundle jobs do run here and should pass — this PR is itself the proof the gate behaves on a code change.🤖 Generated with Claude Code