Skip to content

ci(infra): check-name convention + dispatch-mode edited-run suppression (RIG-2791) - #686

Merged
mattwilkinsonn merged 2 commits into
mainfrom
compass-repo/rig-2791-ci-dispatch-mode
Aug 28, 2026
Merged

ci(infra): check-name convention + dispatch-mode edited-run suppression (RIG-2791)#686
mattwilkinsonn merged 2 commits into
mainfrom
compass-repo/rig-2791-ci-dispatch-mode

Conversation

@rigel-mintaka

@rigel-mintaka rigel-mintaka commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Implements the frozen design record
docs/designs/infra/ci/compass-ci-check-naming/design.md (#663), ruling A1 +
B1/OQ1-option-3.

A — check-name convention

Every ci.yml gate job renames to the slash-namespaced kebab form ci / <job>:
ci / setup, ci / moon (<group>), ci / pgtest, ci / microvm,
ci / forge, ci / gtk3, ci / e2e, ci / regen-fixtures. The required CI
rollup keeps its name, so ruleset 20090117 is untouched — branch protection
still requires exactly one check. The dogfood-e2e job id renames to e2e
(absorbing RIG-2739); the rollup's needs: and needs.e2e.result read move
with it. Sibling single-job workflows take the bare kebab stem:
renovate gains name: renovate, publish → publish-agent-image, deploy
gains name: eng-docs-deploy.

B — suppress the no-op edited phantom (OQ1 = dispatch-mode)

edited leaves ci.yml's types: (now [opened, synchronize, reopened]), so
jj-vine's every-PR body edit no longer fires a phantom run that self-skips and
double-lists every check (closing the latent skipped-required-as-passing false
green). The one thing edited bought — a fresh run on a stacked PR's base
re-point — moves to a dedicated guard, .github/workflows/pr-base-repoint.yml:
it listens to edited, guards on changes.base != null (+ same-repo head), and
re-triggers ci.yml via workflow_dispatch carrying the PR number, then verifies
a fresh run actually started (fails red if not — "loud to a log" is not loud to
the gate).

Dispatch-mode (OQ1 option 3) needs no minted credential: a default
GITHUB_TOKEN event triggers no workflow, but workflow_dispatch is exempt.
ci.yml gains a workflow_dispatch.inputs.pr input; a non-empty pr is the
base-re-point re-trigger (gate jobs run the full battery against the recomputed
refs/pull/<pr>/merge, which a fresh run picks up per actions/checkout#919),
an empty pr is the existing operator-only fixture-regen lane. Every gate
job's guard, its checkout ref:, the forge oracle's tri-event if:, the
dogfood image-affected seed (builds from the merge tree on a re-point, never a
stale :latest), the CI rollup, and the regen guard are all disambiguated on
that input.

Validation

moon ci green (markdownlint, app-bundle build, eng-docs, ref-gates);
actionlint clean on both workflows (zero new findings — the 9 shellcheck
advisories are pre-existing bootstrap-script notes identical to main). Live
gate behavior (names render once, no-op edit produces one guard context, a real
base re-point produces a fresh full run) validates on this PR — T5.

Spec-impact: none. Refs RIG-2791

Co-authored-by: Matt Wilkinson matt@rigel.build

@linear-code

linear-code Bot commented Aug 27, 2026

Copy link
Copy Markdown

RIG-2791

@github-actions

github-actions Bot commented Aug 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Compass engineering docs preview: https://compass-repo-rig-2791-ci-dis.compass-eng-docs.pages.dev

Deployed from compass-repo/rig-2791-ci-dispatch-mode at 270fa6e.

Changed pages:

rigel-mintaka added a commit that referenced this pull request Aug 27, 2026
@rigel-mintaka @mattwilkinsonn
fix(ci): anchor repoint verify-poll to dispatch instant; e2e-consiste…
825c433 
…nt rollup strings (RIG-2791)

Review findings on PR #686:

- medium (pr-base-repoint.yml): the fresh-run verify poll fetched `createdAt`
  but filtered only on `status`, so it confirmed ANY queued/in-progress
  workflow_dispatch ci.yml run on the head branch — during a rapid double
  re-point a prior still-in-flight run could satisfy the check even if this
  dispatch silently produced nothing (the exact silent-no-dispatch case the
  guard exists to catch). Capture a UTC timestamp just before `gh workflow
  run` as a step output and anchor the poll's jq to `createdAt >= env.SINCE`,
  so only a run this step caused can pass. Poll window widened to ~2min for
  run-creation lag.
- low (ci.yml): post-rename residue — the rollup's internal shell var, echo,
  comment, error text, and the e2e step's display name still said
  `dogfood`/`dogfood-e2e` after the job id became `e2e`. Renamed to `e2e` for
  consistency (none are check-name surfaces, so zero gating impact).

Spec-impact: none. Refs RIG-2791

Co-authored-by: Matt Wilkinson <matt@rigel.build>
@rigel-mintaka
rigel-mintaka force-pushed the compass-repo/rig-2791-ci-dispatch-mode branch from 46c63c7 to 825c433 Compare August 27, 2026 21:30
rigel-mintaka added a commit that referenced this pull request Aug 27, 2026
@rigel-mintaka @mattwilkinsonn
fix(ci): anchor repoint verify-poll to dispatch instant; e2e-consiste…
ce5bd99 
…nt rollup strings (RIG-2791)

Review findings on PR #686:

- medium (pr-base-repoint.yml): the fresh-run verify poll fetched `createdAt`
  but filtered only on `status`, so it confirmed ANY queued/in-progress
  workflow_dispatch ci.yml run on the head branch — during a rapid double
  re-point a prior still-in-flight run could satisfy the check even if this
  dispatch silently produced nothing (the exact silent-no-dispatch case the
  guard exists to catch). Capture a UTC timestamp just before `gh workflow
  run` as a step output and anchor the poll's jq to `createdAt >= env.SINCE`,
  so only a run this step caused can pass. Poll window widened to ~2min for
  run-creation lag.
- low (ci.yml): post-rename residue — the rollup's internal shell var, echo,
  comment, error text, and the e2e step's display name still said
  `dogfood`/`dogfood-e2e` after the job id became `e2e`. Renamed to `e2e` for
  consistency (none are check-name surfaces, so zero gating impact).

Spec-impact: none. Refs RIG-2791

Co-authored-by: Matt Wilkinson <matt@rigel.build>
@rigel-mintaka
rigel-mintaka force-pushed the compass-repo/rig-2791-ci-dispatch-mode branch from 825c433 to ce5bd99 Compare August 27, 2026 21:31
rigel-mintaka added a commit that referenced this pull request Aug 28, 2026
@rigel-mintaka @mattwilkinsonn
fix(ci): anchor repoint verify-poll to dispatch instant; e2e-consiste…
b506c34 
…nt rollup strings (RIG-2791)

Review findings on PR #686:

- medium (pr-base-repoint.yml): the fresh-run verify poll fetched `createdAt`
  but filtered only on `status`, so it confirmed ANY queued/in-progress
  workflow_dispatch ci.yml run on the head branch — during a rapid double
  re-point a prior still-in-flight run could satisfy the check even if this
  dispatch silently produced nothing (the exact silent-no-dispatch case the
  guard exists to catch). Capture a UTC timestamp just before `gh workflow
  run` as a step output and anchor the poll's jq to `createdAt >= env.SINCE`,
  so only a run this step caused can pass. Poll window widened to ~2min for
  run-creation lag.
- low (ci.yml): post-rename residue — the rollup's internal shell var, echo,
  comment, error text, and the e2e step's display name still said
  `dogfood`/`dogfood-e2e` after the job id became `e2e`. Renamed to `e2e` for
  consistency (none are check-name surfaces, so zero gating impact).

Spec-impact: none. Refs RIG-2791

Co-authored-by: Matt Wilkinson <matt@rigel.build>
@rigel-mintaka
rigel-mintaka force-pushed the compass-repo/rig-2791-ci-dispatch-mode branch from e078a44 to b4ea3d0 Compare August 28, 2026 02:47
@rigel-mintaka rigel-mintaka changed the title ci(infra): slash-namespaced check names + dispatch-mode edited-run suppression (RIG-2791) ci(infra): check-name convention + dispatch-mode edited-run suppression (RIG-2791) Aug 28, 2026
@rigel-mintaka
rigel-mintaka force-pushed the compass-repo/rig-2791-ci-dispatch-mode branch 2 times, most recently from 5a8d00c to 4a67e50 Compare August 28, 2026 03:09
rigel-mintaka and others added 2 commits August 27, 2026 23:20
@rigel-mintaka @mattwilkinsonn
ci(infra): check-name convention + dispatch-mode edited-run suppressi…
9e6acf9 
…on (RIG-2791)

Implements the frozen design record
`docs/designs/infra/ci/compass-ci-check-naming/design.md` (#663), rulings
A1 + B1/OQ1-option-3, plus the A4 contingency the record named.

A — check-name convention (A1 + A4). GitHub renders each Actions check as
`<workflow name> / <job name>`, so an embedded `ci /` job prefix under the
workflow named `CI` double-rendered (`CI / ci / moon (go)`). Per the record's
§A verification step, that forces A4: the workflow itself is renamed `CI` ->
`ci` and every gate job takes a bare kebab name (`setup`, `moon
(${{ matrix.group }})`, `pgtest`, `microvm`, `forge`, `gtk4`, `e2e`,
`regen-fixtures`), rendering `ci / <job>` natively. The rollup — the sole
required check — is renamed key and name `CI` -> `rollup` (rendering
`ci / rollup`); nothing `needs:` it, so the key rename is inert to the graph.
The `dogfood-e2e` job id becomes `e2e` (absorbs RIG-2739). Sibling workflows
normalize to `<kebab workflow> / <kebab job>`: `eng-docs`/`deploy`,
`agent-image`/`publish`, `renovate`/`run`, and pr-base-repoint's job to bare
`guard`. The matching ruleset flip (required context `CI` -> `rollup`) ships in
orion IaC (RigelBuild/orion#1907) as a coordinated cutover.

B — suppress the no-op `edited` phantom (OQ1 = dispatch-mode). `edited` leaves
ci.yml's `types:` (now `[opened, synchronize, reopened]`), so jj-vine's
per-PR body edit no longer fires a phantom run that self-skips and double-lists
every check (closing the latent skipped-required-as-passing false green). The
base-re-point coverage `edited` bought moves to a dedicated guard,
`.github/workflows/pr-base-repoint.yml`: it listens to `edited`, guards on
`changes.base != null` (+ same-repo head), re-triggers ci.yml via
`workflow_dispatch` carrying the PR number, then verifies a fresh run actually
started (anchored to a pre-dispatch timestamp so a pre-existing queued run
can't satisfy it). Dispatch-mode needs no minted credential: a default
`GITHUB_TOKEN` event triggers no workflow, but `workflow_dispatch` is exempt.
Every gate job's guard, its checkout `ref:`, the forge oracle's tri-event
`if:`, the dogfood image-affected seed (builds from the merge tree on a
re-point, never a stale `:latest`), the rollup, and the regen guard are
disambiguated on `inputs.pr` (non-empty = base-re-point, empty = operator
fixture-regen).

Rebased onto #684's gtk3 -> gtk4 migration: the gtk job keeps #684's `gtk4-e2e`
key / weston+xvfb two-backend gate / closure-input affected detection, with the
A4 bare name (`gtk4`) and the dispatch-mode guard + checkout arm layered on;
the rollup's `needs:` and shell carry both renames (`e2e` and `gtk4-e2e`).

Refs RIG-2791

Co-authored-by: Matt Wilkinson <matt@rigel.build>
@rigel-mintaka @mattwilkinsonn
fix(ci): restore gtk4-e2e job-level guard dropped in the #684 rebase …
270fa6e 
…(RIG-2791)

The 7-conflict rebase onto #684's gtk3->gtk4 migration correctly merged the two
renames everywhere except the gtk4-e2e job header, where the conflict hunk
spanned both the job comment and the `if:`/`timeout-minutes:`/`env:` block and
the resolution re-supplied only the comment — dropping the job-level guard
entirely. Restore it in the dispatch-aware form the sibling gate jobs use
(pgtest/microvm/forge-oracle): the affected gate keyed on
`needs.setup.outputs.gtk4_affected`, the `timeout-minutes: 30` ceiling, and
`env: TMPDIR: /tmp` (the 108-byte AF_UNIX sun_path budget the multi-window e2e
needs). Without it the leg ran on every pull_request (a cost regression, not a
false green — the in-step guard + the rollup's fail-closed require_gated kept
correctness), had no 30m ceiling, and inherited a long TMPDIR.

Refs RIG-2791

Co-authored-by: Matt Wilkinson <matt@rigel.build>
@rigel-mintaka
rigel-mintaka force-pushed the compass-repo/rig-2791-ci-dispatch-mode branch from 4a67e50 to 270fa6e Compare August 28, 2026 03:22
@mattwilkinsonn
mattwilkinsonn merged commit 9d4b3d6 into main Aug 28, 2026
13 checks passed
@mattwilkinsonn
mattwilkinsonn deleted the compass-repo/rig-2791-ci-dispatch-mode branch August 28, 2026 03:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mattwilkinsonn mattwilkinsonn Awaiting requested review from mattwilkinsonn mattwilkinsonn is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@rigel-mintaka @mattwilkinsonn