ci: terminal 'all legs green' aggregate per platform — the branch-protection gate - #19
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+379
to
+396
| name: all legs green | ||
| needs: [compute, build] | ||
| if: ${{ always() && !cancelled() && !inputs.audit }} | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Gate on the legs | ||
| run: | | ||
| set -euo pipefail | ||
| echo "compute: ${{ needs.compute.result }} (run=${{ needs.compute.outputs.run }}, legs=${{ needs.compute.outputs.leg_count }})" | ||
| echo "build: ${{ needs.build.result }}" | ||
| if [ "${{ needs.compute.result }}" != "success" ]; then | ||
| echo "::error::the contract/matrix computation failed" | ||
| exit 1 | ||
| fi | ||
| if [ "${{ needs.compute.outputs.run }}" = "true" ] && [ "${{ needs.build.result }}" != "success" ]; then | ||
| echo "::error::not every ${{ inputs.platform }} leg succeeded: ${{ needs.build.result }}" | ||
| exit 1 | ||
| fi |
ronaldtse
force-pushed
the
ci/verify-gate
branch
from
September 13, 2026 23:21
58fb04e to
b940a74
Compare
…tool listing The example drops TEBAKO_PKG_HOST_ID so the signer detects the runner's host, but the canned tool listing ships the linux-gnu-x86_64 tebako-pkg asset: on a linux runner the gate FINDS its tool and never raises. The example now passes an empty listing, so the detection path raises with the runner's own host id on every platform.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a terminal
verifyjob ("all legs green") to_build-platform.yml, after the build matrix. Each platform caller surfaces it as a stable check name:windows / all legs green,linux-gnu / all legs green,linux-musl / all legs green,macos / all legs green.Why
The build legs are a dynamic matrix — their check names shift with every catalog version bump, so branch protection cannot pin them. Without required checks, a PR with auto-merge armed merges the moment it is mergeable, while the build matrix is still running (observed on the v0.2.0 release PR). The aggregate gives protection one stable name per platform; green requires the contract/matrix computation plus every emitted leg. Audit-mode runs (publish.yml) skip it.
After merge
Enable branch protection on main requiring the four
… / all legs greenchecks plus the lint job, so armed auto-merge waits for real green.Also in this PR
A fix for the host-dependent signer spec that landed red on main: the "names the detected host id" example dropped
TEBAKO_PKG_HOST_ID(so the signer detects the runner's host) while the canned tool listing ships the linux-gnu-x86_64 asset — on linux runners the gate finds its tool and never raises. The example now passes an empty tool listing, making the detection-path raise host-independent (bundle exec rspec: 20 examples, 0 failures).