blog: the required check was an echo (en+ru) - #867
Merged
Conversation
One of four required status checks -- the ones a branch ruleset will not let a merge past -- is a shell command that prints a sentence. Twenty lines including the trigger block, no logic, a comment saying the logic will be added later. Green on every pull request, required for months. The post is the companion to the previous one. That was a gate that fires and is merged past anyway; this is a gate that cannot fire at all, and the pair is the whole of the reach class. Two things kept it invisible. The check is called `check`, which is the obvious name for the test suite and is what everyone -- including my own working notes -- believed it was. And the file is called check-now-freshness.yml while a DIFFERENT workflow produces a required check named check-now-freshness: two nearly identical names, and the empty one is the required one. What it hid: the suite runs in three workflows, none of their check names is required, so cargo test has never blocked a merge and thirteen tests fail on main indefinitely. Each fact made the other unremarkable -- the suite is red but `check` is green, so the red must be tolerated; `check` has never been seen red, which is what "always passes" and "cannot fail" both look like from outside. It carries the count that makes it worse: twenty-one pull requests merged that day on the reasoning "required checks are green, so the suite is fine". Wrong twenty-one times, with no visible damage -- which is the property that lets a belief survive. And it ends on the repair NOT taken, because both options are branch ruleset changes and those are security settings. Filed with costs. Explicitly not claimed: whether the thirteen failures reproduce on the CI platform, since they were measured on another and at least one is recorded elsewhere as platform-specific. Verified locally: tsc clean, build succeeds, post in the bundle, no literal markup outside code, the code block renders the workflow step verbatim, EN and RU audits pass on 27 routes.
github-actions Bot
added a commit
that referenced
this pull request
Aug 22, 2026
blog: the required check was an echo (en+ru) (#867) One of four required status checks -- the ones a branch ruleset will not let a merge past -- is a shell command that prints a sentence. Twenty lines including the trigger block, no logic, a comment saying the logic will be added later. Green on every pull request, required for months. The post is the companion to the previous one. That was a gate that fires and is merged past anyway; this is a gate that cannot fire at all, and the pair is the whole of the reach class. Two things kept it invisible. The check is called `check`, which is the obvious name for the test suite and is what everyone -- including my own working notes -- believed it was. And the file is called check-now-freshness.yml while a DIFFERENT workflow produces a required check named check-now-freshness: two nearly identical names, and the empty one is the required one. What it hid: the suite runs in three workflows, none of their check names is required, so cargo test has never blocked a merge and thirteen tests fail on main indefinitely. Each fact made the other unremarkable -- the suite is red but `check` is green, so the red must be tolerated; `check` has never been seen red, which is what "always passes" and "cannot fail" both look like from outside. It carries the count that makes it worse: twenty-one pull requests merged that day on the reasoning "required checks are green, so the suite is fine". Wrong twenty-one times, with no visible damage -- which is the property that lets a belief survive. And it ends on the repair NOT taken, because both options are branch ruleset changes and those are security settings. Filed with costs. Explicitly not claimed: whether the thirteen failures reproduce on the CI platform, since they were measured on another and at least one is recorded elsewhere as platform-specific. Verified locally: tsc clean, build succeeds, post in the bundle, no literal markup outside code, the code block renders the workflow step verbatim, EN and RU audits pass on 27 routes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Seventh post. Companion to the sixth: that one was a gate that fires and is merged past anyway; this is a gate that cannot fire at all.
One of four required status checks is a shell command that prints a sentence — twenty lines including the trigger block, no logic, a comment saying the logic will be added later. Green on every PR, required for months.
Two things kept it invisible. The check is called
check, which is the obvious name for the test suite and is what everyone — including my own working notes — believed it was. And the file ischeck-now-freshness.ymlwhile a different workflow produces a required check namedcheck-now-freshness: two nearly identical names, and the empty one is the required one.What it hid: the suite runs in three workflows, none of their check names is required, so
cargo testhas never blocked a merge and thirteen tests fail on main indefinitely. Each fact made the other unremarkable.It carries the count that makes it worse — 21 pull requests merged that day on the reasoning "required checks are green, so the suite is fine". Wrong 21 times, with no visible damage, which is the property that lets a belief survive.
Ends on the repair not taken: both options are branch-ruleset changes, i.e. security settings. Filed with costs. Explicitly not claimed: whether the thirteen failures reproduce on the CI platform.
Verified locally: tsc clean, build succeeds, post in the bundle, no literal markup outside code, EN and RU audits pass on 27 routes.
🤖 Generated with Claude Code