From 37e29ccf5b847cbef3bdd9205a09d390954b2d6a Mon Sep 17 00:00:00 2001 From: Saqib Date: Thu, 17 Sep 2026 13:02:21 +0530 Subject: [PATCH 1/2] ci: gate dev deploys on the provider suite Provider functional ran report-only while it was flaky against dev. After the sidebar, autosave and upload fixes in CivicDataSpace-test, three full provider runs passed with no retries, so a provider failure now rolls back the deploy like any other functional failure. --- .github/workflows/deploy-Dataspace.yml | 40 ++++---------------------- 1 file changed, 6 insertions(+), 34 deletions(-) diff --git a/.github/workflows/deploy-Dataspace.yml b/.github/workflows/deploy-Dataspace.yml index d58d89b6..90a638bd 100644 --- a/.github/workflows/deploy-Dataspace.yml +++ b/.github/workflows/deploy-Dataspace.yml @@ -214,9 +214,6 @@ jobs: with: suite: functional api_base_url: https://dev.api.civicdataspace.in - # Provider functional is flaky against dev, so it runs report-only in - # provider-functional-report instead of gating the deploy. - skip_provider: true secrets: HOME_URL_DEV: ${{ secrets.HOME_URL_DEV }} TEST_EMAIL_1: ${{ secrets.TEST_EMAIL_1 }} @@ -225,37 +222,13 @@ jobs: TEST_PASSWORD_2: ${{ secrets.TEST_PASSWORD_2 }} KEYCLOAK_CLIENT_SECRET: ${{ secrets.KEYCLOAK_CLIENT_SECRET }} - provider-functional-report: - name: Provider Functional (report-only) - needs: smoke-tests - # Report-only: promote and rollback do not list this job in needs, so its - # result never rolls back or blocks a dev deploy. Promote it to a gate - # once the provider suite is stable against dev. - if: github.ref_name != 'main' - uses: CivicDataLab/CivicDataSpace-test/.github/workflows/run-smoke.yml@CI - with: - suite: functional - only_provider: true - api_base_url: https://dev.api.civicdataspace.in - secrets: - HOME_URL_DEV: ${{ secrets.HOME_URL_DEV }} - TEST_EMAIL_1: ${{ secrets.TEST_EMAIL_1 }} - TEST_PASSWORD_1: ${{ secrets.TEST_PASSWORD_1 }} - TEST_EMAIL_2: ${{ secrets.TEST_EMAIL_2 }} - TEST_PASSWORD_2: ${{ secrets.TEST_PASSWORD_2 }} - # org_add_permission needs a token to check canAdd; without this every - # org-create test skips on both workers and the report is hollow. - KEYCLOAK_CLIENT_SECRET: ${{ secrets.KEYCLOAK_CLIENT_SECRET }} - # Only once the tests pass does this release become the thing a future # rollback would target -- on prod too, which used to be marked # last-known-good straight after deploy with no tests at all. promote: - # provider-functional-report is listed so this waits for every test to - # finish, but its result is deliberately not checked (report-only). - needs: [build-and-deploy, smoke-tests, functional-tests, provider-functional-report] - # Explicit gating results, not success()/!failure(): on main the functional - # jobs are skipped by design, and the provider job must not block. + needs: [build-and-deploy, smoke-tests, functional-tests] + # Explicit results, not success()/!failure(): on main the functional stage + # is skipped by design. if: >- ${{ !cancelled() && needs.build-and-deploy.result == 'success' && needs.smoke-tests.result == 'success' && @@ -275,10 +248,9 @@ jobs: script: echo "${{ needs.build-and-deploy.outputs.release }}" > /home/ubuntu/DataExchange/releases/.last_good rollback: - # Waits for the report-only provider job too, without checking its result. - needs: [build-and-deploy, smoke-tests, functional-tests, provider-functional-report] - # Explicit gating results, not failure(): failure() would also count the - # report-only provider job. + needs: [build-and-deploy, smoke-tests, functional-tests] + # Explicit results rather than failure(), so that a skipped functional stage + # on main never reads as a failure. if: >- ${{ !cancelled() && needs.build-and-deploy.result == 'success' && (needs.smoke-tests.result == 'failure' || needs.functional-tests.result == 'failure') }} From d85baeb228c1b7c76ef7f57a0aeede65866e8572 Mon Sep 17 00:00:00 2001 From: Saqib Date: Thu, 17 Sep 2026 13:02:21 +0530 Subject: [PATCH 2/2] ci: run the provider suite inside the PR gate's full suite It ran as a separate report-only job that branch protection ignored. Folding it into Full Suite makes a provider failure block the release PR. --- .github/workflows/pr-gate.yml | 20 -------------------- 1 file changed, 20 deletions(-) diff --git a/.github/workflows/pr-gate.yml b/.github/workflows/pr-gate.yml index f68c08a0..d11ea871 100644 --- a/.github/workflows/pr-gate.yml +++ b/.github/workflows/pr-gate.yml @@ -17,9 +17,6 @@ jobs: uses: CivicDataLab/CivicDataSpace-test/.github/workflows/run-smoke.yml@CI with: suite: full - # Provider is flaky against dev: it reports in provider-report below, which - # branch protection does not require. - skip_provider: true api_base_url: https://dev.api.civicdataspace.in secrets: HOME_URL_DEV: ${{ secrets.HOME_URL_DEV }} @@ -28,20 +25,3 @@ jobs: TEST_EMAIL_2: ${{ secrets.TEST_EMAIL_2 }} TEST_PASSWORD_2: ${{ secrets.TEST_PASSWORD_2 }} KEYCLOAK_CLIENT_SECRET: ${{ secrets.KEYCLOAK_CLIENT_SECRET }} - - provider-report: - name: Provider Full Suite (report-only) - uses: CivicDataLab/CivicDataSpace-test/.github/workflows/run-smoke.yml@CI - with: - suite: full - only_provider: true - api_base_url: https://dev.api.civicdataspace.in - secrets: - HOME_URL_DEV: ${{ secrets.HOME_URL_DEV }} - TEST_EMAIL_1: ${{ secrets.TEST_EMAIL_1 }} - TEST_PASSWORD_1: ${{ secrets.TEST_PASSWORD_1 }} - TEST_EMAIL_2: ${{ secrets.TEST_EMAIL_2 }} - TEST_PASSWORD_2: ${{ secrets.TEST_PASSWORD_2 }} - # org_add_permission needs a token to check canAdd; without this every - # org-create test skips on both workers and the report is hollow. - KEYCLOAK_CLIENT_SECRET: ${{ secrets.KEYCLOAK_CLIENT_SECRET }}