fix(governance): a REQUIRED check must never be skippable - #654
Conversation
`governance / Validate Hypatia Baseline` is a required status check across the
estate, and the job carried a job-level guard:
if: needs.workflow-staleness.outputs.has_baseline == 'true'
A skipped job never satisfies a required context. So any repo without a
`.hypatia-baseline.json` was blocked FOREVER, by construction — not by a
failure anyone could fix by making CI pass, because the check could not be
satisfied at all.
MEASURED across five repos: standards and hypatia ship a baseline (job runs);
rsr-template-repo, a2ml-ecosystem and scaffoldia do NOT (job skips). That is
why rsr-template-repo#43 sits at BLOCKED with the context reported as
"skipped" while none of its eight failing checks is even required.
The fix is not to add empty baseline files to ~300 minted repos. That treats
the symptom, and it would make this job — which clones and builds the Hypatia
escript — run on every PR estate-wide purely to validate nothing.
Instead the job now ALWAYS runs, and the eight expensive steps carry the guard
individually. A repo with no baseline executes a single echo and reports
success; a repo with one behaves exactly as before. Cheap AND satisfiable,
where it was previously cheap XOR satisfiable.
Structure verified by parsing the YAML: no job-level `if`, 9 steps, 8 guarded
on has_baseline == 'true', 1 always-pass arm on != 'true', every step
conditional — so exactly one arm executes.
Deliberately NOT bundled into the path-contract PR (#651): different concern,
and this one changes behaviour for every repo that calls the reusable workflow.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 51 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR successfully resolves a governance issue where repositories without a Hypatia baseline were failing branch protection checks because a required job was being skipped. The implementation shifts the execution logic so that the job always runs, while individual expensive steps are gated by the presence of a baseline. A fallback step ensures the job completes successfully when no baseline is detected.
Codacy analysis indicates the PR is up to standards, with no new quality issues or complexity increases. The transition from job-level guards to step-level guards correctly fulfills the requirements for mandatory status checks.
Test suggestions
- Execute workflow in a repository WITH a .hypatia-baseline.json file: all 8 validation steps should run.
- Execute workflow in a repository WITHOUT a .hypatia-baseline.json file: 8 validation steps should skip, and the 'No baseline to validate' step should run and pass.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
1 participant
The defect
governance / Validate Hypatia Baselineis a required status check across the estate, and the job carried a job-level guard:A skipped job never satisfies a required context. So any repo without a
.hypatia-baseline.jsonwas blocked forever, by construction — not by a failure anyone could fix by making CI pass, because the check could not be satisfied at all.Measured
standardshypatiarsr-template-repoa2ml-ecosystemscaffoldiaThat's why hyperpolymath/rsr-template-repo#43 sits at
BLOCKEDwith this context reportedskipped, while none of its eight failing checks is even required.Why not just add baseline files
Adding an empty
[]baseline to ~300 minted repos treats the symptom, and it would make this job — which clones and builds the Hypatia escript — run on every PR estate-wide purely to validate nothing.The fix
The job now always runs; the eight expensive steps carry the guard individually. A repo with no baseline executes a single
echoand reports success. A repo with one behaves exactly as before.Cheap and satisfiable, where it was previously cheap xor satisfiable.
Structure verified by parsing the YAML: no job-level
if, 9 steps, 8 guarded on== 'true', 1 always-pass arm on!= 'true', every step conditional — so exactly one arm executes.Deliberately not bundled into #651: different concern, and this changes behaviour for every repo calling the reusable workflow.
🤖 Generated with Claude Code