From 6a5f28abcd61a525fbcf81108dc8fbd020b44de1 Mon Sep 17 00:00:00 2001 From: David McKay Date: Fri, 21 Aug 2026 15:35:51 -0700 Subject: [PATCH] Run the container-boot check only when a PR is a merge candidate The image job builds the image and boots it, about fourteen minutes. It ran on every pull request and every push to one, while the four checks beside it finish in seconds. That is the bill: the slow job fired on work that was nowhere near merge. It now runs on a pull request only when an admin adds the `full-ci` label, which is the point at which the PR is actually a candidate to merge. On main and through the release workflow_call it still always runs, so nothing reaches a release without having booted. verify already treats a skipped job as a pass, so an unlabelled PR goes green on the cheap checks and the slow one waits until someone means it. --- .github/workflows/ci.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 14225907..4e65f550 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -130,6 +130,15 @@ jobs: image: name: image runs-on: ubuntu-latest + # The only slow job: it builds the container and boots it, ~14 minutes. The four checks above are + # seconds and stay on every push, because they catch most things cheaply. This one is the cost, so + # on a pull request it runs only when an admin adds the `full-ci` label — the point at which the PR + # is actually a merge candidate. On main and through the release workflow_call it always runs, so + # nothing reaches a release without it. `verify` treats a skipped job as passing, so an unlabelled + # PR is green on the cheap checks alone. + if: >- + github.event_name != 'pull_request' || + contains(github.event.pull_request.labels.*.name, 'full-ci') steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: