[ci] Fail required gates closed on cancellations - #3514
Open
joshlf wants to merge 1 commit into
Open
Conversation
This was referenced Jul 31, 2026
joshlf
force-pushed
the
Grlosy5kwxiwxexwdtdxzx7i2ezmymtrq
branch
from
July 31, 2026 23:23
305a98b to
72c863c
Compare
joshlf
force-pushed
the
G25sqrb3x2qf3c2e26jcymmrjhitfoijb
branch
from
July 31, 2026 23:23
8ebcaa5 to
f0716f1
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## Grlosy5kwxiwxexwdtdxzx7i2ezmymtrq #3514 +/- ##
==================================================================
Coverage 91.85% 91.85%
==================================================================
Files 20 20
Lines 6093 6093
==================================================================
Hits 5597 5597
Misses 496 496 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
joshlf
force-pushed
the
Grlosy5kwxiwxexwdtdxzx7i2ezmymtrq
branch
from
July 31, 2026 23:39
72c863c to
e166a02
Compare
joshlf
force-pushed
the
G25sqrb3x2qf3c2e26jcymmrjhitfoijb
branch
from
July 31, 2026 23:39
f0716f1 to
d04c064
Compare
joshlf
force-pushed
the
Grlosy5kwxiwxexwdtdxzx7i2ezmymtrq
branch
from
July 31, 2026 23:45
e166a02 to
43998f3
Compare
joshlf
force-pushed
the
G25sqrb3x2qf3c2e26jcymmrjhitfoijb
branch
from
July 31, 2026 23:45
d04c064 to
42b7a55
Compare
joshlf
force-pushed
the
Grlosy5kwxiwxexwdtdxzx7i2ezmymtrq
branch
from
August 1, 2026 00:04
43998f3 to
df82b8b
Compare
joshlf
force-pushed
the
G25sqrb3x2qf3c2e26jcymmrjhitfoijb
branch
from
August 1, 2026 00:04
42b7a55 to
5093546
Compare
The required sentinels used `failure()`, which is false when an upstream job is cancelled or skipped. GitHub treats a skipped required job as a successful check, so those results could silently satisfy branch protection. Run each sentinel with `always()` and inspect every `needs` result in a shared, tested action. Require success by default, reject workflow cancellation and unknown states, and make intentional skips an explicit policy naming an existing dependency. Strengthen the structural checker to require an exact dependency set, `always()`, and exactly one shared result checker invocation. This makes new jobs and conditions fail closed until their gate policy is updated. gherrit-pr-id: G25sqrb3x2qf3c2e26jcymmrjhitfoijb
joshlf
force-pushed
the
Grlosy5kwxiwxexwdtdxzx7i2ezmymtrq
branch
from
August 1, 2026 00:08
df82b8b to
a06310f
Compare
joshlf
force-pushed
the
G25sqrb3x2qf3c2e26jcymmrjhitfoijb
branch
from
August 1, 2026 00:08
5093546 to
1d9867a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The required sentinels used
failure(), which is false when an upstreamjob is cancelled or skipped. GitHub treats a skipped required job as a
successful check, so those results could silently satisfy branch
protection.
Run each sentinel with
always()and inspect everyneedsresult in ashared, tested action. Require success by default, reject workflow
cancellation and unknown states, and make intentional skips an explicit
policy naming an existing dependency.
Strengthen the structural checker to require an exact dependency set,
always(), and exactly one shared result checker invocation. This makesnew jobs and conditions fail closed until their gate policy is updated.
Latest Update: v7 — Compare vs v6
📚 Full Patch History
Links show the diff between the row version and the column version.
⬇️ Download this PR
Branch
git fetch origin refs/heads/G25sqrb3x2qf3c2e26jcymmrjhitfoijb && git checkout -b pr-G25sqrb3x2qf3c2e26jcymmrjhitfoijb FETCH_HEADCheckout
git fetch origin refs/heads/G25sqrb3x2qf3c2e26jcymmrjhitfoijb && git checkout FETCH_HEADCherry Pick
git fetch origin refs/heads/G25sqrb3x2qf3c2e26jcymmrjhitfoijb && git cherry-pick FETCH_HEADPull
Stacked PRs enabled by GHerrit.