From 5f4c968a47d1865e332e2d3602d04b09f1e721a4 Mon Sep 17 00:00:00 2001 From: Derek Lewis Date: Sat, 5 Sep 2026 02:20:51 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=8F=97=EF=B8=8F=F0=9F=94=A7=EF=BC=9Arun?= =?UTF-8?q?=20every=20check=20on=20every=20pull=20request?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The paths filter chose which linters ran from which file types had changed, and the tasks belonging to no language sat behind the same gate as the ones that do. Spelling, filenames, file modes, EditorConfig and the unit tests all live inside `nps test`, which ran only when JavaScript, JSON or TypeScript changed. A pull request touching only Markdown therefore skipped all five. `# Support[^1] abou the Projekt` passes verify.md -- it is well-formed Markdown -- and is caught only by verify.spelling, which such a pull request never runs. It lands green, then the push to main runs the full suite and the default branch goes red. That is the one place nobody is watching, and #897 is a Markdown-only pull request that took exactly this path. Filtering bought six seconds: eighteen against twenty-four, both mostly checkout, node and install. Not worth a class of change that passes review and breaks the branch it lands on. Everything runs now, which also retires a third-party action and the `pull-requests: read` permission it wanted. The portal filters for a reason that holds there and not here: its suite builds a site and starts a JVM. This one reads files. Signed-off-by: Derek Lewis Assisted-by: Claude-Code:claude-opus-5 --- .github/workflows/lint-and-test.yml | 94 +++++------------------------ 1 file changed, 14 insertions(+), 80 deletions(-) diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml index e4094a82..0b1550b8 100644 --- a/.github/workflows/lint-and-test.yml +++ b/.github/workflows/lint-and-test.yml @@ -10,11 +10,8 @@ on: branches: - main -# Stated, not inherited: paths-filter needs `pull-requests: read`, and naming -# any permission drops the rest to none. permissions: contents: read - pull-requests: read jobs: lint_and_test: @@ -47,85 +44,22 @@ jobs: pnpm install echo "$(pwd)/node_modules/.bin" >> $GITHUB_PATH - # No build step. `nps build` runs Jekyll over doc/, which wants a Ruby - # toolchain that nothing below reads the output of -- the checks read - # the sources. + # No build step: there is nothing to build. The checks read the sources. - # Checks to see if any files in the PR match one of the listed file types. - # We can use this filter to decide whether or not to run linters or tests. - # You can check if a file with a listed file type is in the PR by doing: - # if: ${{ steps.filter.outputs.md == 'true' }} - # This will return true if there's a Markdown file the PR has changed. - - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 - id: filter - with: - filters: | - dockerfile: - - '**/Dockerfile' - js: - - '**/*.js' - - '**/*.mjs' - json: - - '**/*.json' - - '**/*.json5' - - '**/*.jsonc' - liquid: - - '**/*.html' - - '**/*.liquid' - md: - - '**/*.md' - toml: - - '**/*.toml' - ts: - - '**/*.ts' - - '**/*.mts' - yaml: - - '**/*.yml' - - '**/*.yaml' - - # Not behind a filter: every pull request has commit messages, whatever - # it touches. - - name: Verify commit messages - run: nps verify.commits - - # Use the filter to check if files with a specific file type were changed - # in the PR. If they were, run the relevant linters. Otherwise, skip. - - name: Verify Dockerfile - if: ${{ steps.filter.outputs.dockerfile == 'true' }} - run: nps verify.dockerfile - - - name: Verify JavaScript - if: ${{ steps.filter.outputs.js == 'true' }} - run: nps verify.js - - - name: Verify JSON - if: ${{ steps.filter.outputs.json == 'true' }} - run: nps verify.json - - - name: Verify Liquid - if: ${{ steps.filter.outputs.liquid == 'true' }} - run: nps verify.liquid - - - name: Verify Markdown - if: ${{ steps.filter.outputs.md == 'true' }} - run: nps verify.md - - - name: Verify TOML - if: ${{ steps.filter.outputs.toml == 'true' }} - run: nps verify.toml - - - name: Verify TypeScript - if: ${{ steps.filter.outputs.ts == 'true' }} - run: nps verify.ts - - - name: Verify YAML - if: ${{ steps.filter.outputs.yaml == 'true' }} - run: nps verify.yaml - - # Only run tests if the PR touches behavior-related files. On main - # everything runs, since nothing else checks what landed. + # Everything, on every pull request, rather than a per-language subset + # chosen by which files changed. + # + # The subset was chosen by a paths filter, and the tasks that belong to + # no language -- spelling, filenames, file modes, EditorConfig, the unit + # tests -- sat behind the same gate as the ones that do. A pull request + # touching only Markdown skipped all five, so a misspelling could land + # green and turn main red on the push that followed it, which is the one + # place nothing is watching. + # + # Filtering bought six seconds: an 18-second run against a 24-second one, + # both of them mostly checkout, node and install. That is not worth a + # class of change that passes review and breaks the branch it lands on. - name: Test - if: ${{ github.event_name == 'push' || steps.filter.outputs.js == 'true' || steps.filter.outputs.json == 'true' || steps.filter.outputs.ts == 'true' }} # verify.validForEC fetches the editorconfig-checker binary from the # GitHub API on first use, and node_modules is new on every run here. # Unauthenticated that is 60 requests an hour shared with every other