Skip to content

feat: CI summary check, path filters, TS backend coverage, SHA pinning - #565

Merged
levoski1 merged 1 commit into
WHEELBACK:mainfrom
xreme-coder:feature/ci-improvements-492-490-493-491
Aug 31, 2026
Merged

feat: CI summary check, path filters, TS backend coverage, SHA pinning#565
levoski1 merged 1 commit into
WHEELBACK:mainfrom
xreme-coder:feature/ci-improvements-492-490-493-491

Conversation

@xreme-coder

@xreme-coder xreme-coder commented Aug 31, 2026

Copy link
Copy Markdown

Summary

This PR addresses four related CI/CD improvements in a single cohesive change.
All modifications are confined to .github/workflows/, .github/dependabot.yml,
and CONTRIBUTING.md.

⚠️ DO NOT TEST — implementation only, per issue guidelines.

Closes

Closes #492
Closes #490
Closes #493
Closes #491

Changes

#492 — Single required status check (ci-summary.yml)

Problem: Branch protection had to enumerate every individual job by name.
Renaming any job would silently break the required-check gate.

Solution: New .github/workflows/ci-summary.yml aggregates all other CI
workflows via needs: and exposes a single stable job name — all-checks-passed
— for branch protection. All leaf workflows received a workflow_call: trigger
so they can be called by the summary workflow.

Branch protection change required: Replace the existing multi-item list with
the single entry all-checks-passed. Future workflows only need to be added to
ci-summary.yml; branch protection settings never need to change again.

CONTRIBUTING.md updated to document the new pattern and list the checks that
feed into the aggregator.

#490 — Path filters on ci-contracts.yml

Problem: Every PR — including docs-only and frontend-only changes — paid the
full contract build/test cost.

Solution: Added paths: filter scoped to:

  • COMEBACKHERE-contracts/**
  • contracts/**
  • abis/**

The workflow now skips entirely when none of those paths are touched. The
workflow_call: trigger (added for #492) is path-filter-exempt by design, so
the summary workflow can still invoke it unconditionally on every PR.

#493 — backend-tests.yml covers both backend trees

Problem: The original workflow only ran tests against the Rust contracts/
tree. The TypeScript comebackhere-backend/ tree had no dedicated CI coverage.

Solution: Added a ts-backend job to backend-tests.yml that:

  1. Checks out the repo
  2. Sets up Node.js 20
  3. Caches node_modules
  4. Runs npm ci
  5. Runs npx tsc --noEmit (type check)
  6. Runs npm test

Existing jobs renamed for clarity (unit → rust / unit tests, integration
→ rust / integration tests) to distinguish them from the new TS job.

#491 — Pin all third-party GitHub Actions to commit SHAs

Problem: Floating version tags (e.g. actions/checkout@v4) can be silently
redirected to malicious commits in a supply-chain attack.

Solution: Every uses: reference across all workflow files was replaced with
the corresponding full 40-character commit SHA. The version string is preserved
as a comment for human readability.

Action Tag Pinned SHA
actions/checkout v4.2.2 11bd71901bbe5b1630ceea73d27597364c9af683
actions/setup-node v4.4.0 49933ea5288caeca8642d1e84afbd3f7d6820020
actions/cache v4.2.3 5a3ec84eff668545956fd18022155c47e93e2684
actions/setup-python v5.6.0 a26af69be951a213d495a4c3e4e4022e16d87065
actions/upload-artifact v4.6.2 ea165f8d65b6e75b540449e92b4886f43607fa02
actions/github-script v7.0.1 60a0d83039c74a4aee543508d2ffcb1c3799cdea
actions-rust-lang/setup-rust-toolchain v1.11.0 9399c7bb15d4c7d47b27263d024f0a4978346ba4
taiki-e/install-action v2.49.0 e03236526ace47fa2e04bebcfc6da471ebd4690c
dtolnay/rust-toolchain stable 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772

Added .github/dependabot.yml with a github-actions ecosystem entry
(weekly, Mondays) to keep pinned SHAs updated automatically as new releases
are published. Also includes npm and Cargo entries for the full dependency graph.

Files changed

File Issues addressed
.github/workflows/ci-summary.yml #492 (new file)
.github/workflows/ci.yml #491, #492
.github/workflows/ci-contracts.yml #490, #491, #492
.github/workflows/ci-abi-metadata.yml #491, #492
.github/workflows/ci-abi-snapshots.yml #491, #492
.github/workflows/ci-coverage.yml #491, #492
.github/workflows/ci-error-docs.yml #491, #492
.github/workflows/ci-post-deploy-verify.yml #491
.github/workflows/lint-docs.yml #491, #492
.github/workflows/backend-tests.yml #491, #492, #493
.github/dependabot.yml #491 (new file)
CONTRIBUTING.md #492

@xreme-coder
feat: add aggregated CI summary status check, path filters, backend T…
17c6de6 
…S coverage, and SHA pinning

Closes WHEELBACK#492
Closes WHEELBACK#490
Closes WHEELBACK#493
Closes WHEELBACK#491

⚠️  DO NOT TEST — implementation only, per issue guidelines.

Changes:

feat(WHEELBACK#492): add ci-summary.yml as the single required status check
- New .github/workflows/ci-summary.yml fans in all CI workflows via
  needs: and exposes a stable all-checks-passed job name for branch
  protection. Branch protection now needs only that one entry instead
  of listing every individual job.
- Added workflow_call: trigger to ci.yml, ci-contracts.yml,
  ci-abi-metadata.yml, ci-abi-snapshots.yml, ci-coverage.yml,
  ci-error-docs.yml, lint-docs.yml, and backend-tests.yml so they
  can be called by ci-summary.yml.
- Updated CONTRIBUTING.md: replaced the brittle multi-item required
  status checks list with a single all-checks-passed entry and
  documented the fan-in pattern.

feat(WHEELBACK#490): add path filters to ci-contracts.yml
- Added paths: filter scoped to COMEBACKHERE-contracts/**, contracts/**,
  and abis/** so the full contract build/test cycle is skipped on
  docs-only or frontend-only PRs.

fix(WHEELBACK#493): backend-tests.yml now covers both backend trees
- Added ts-backend job to backend-tests.yml that runs npm ci, tsc
  --noEmit, and npm test inside comebackhere-backend/, covering the
  TypeScript backend tree that was previously untested in CI.
- Renamed existing jobs to clarify they target the Rust contracts/ tree.

chore(WHEELBACK#491): pin all third-party GitHub Actions to commit SHAs
- Replaced @vn floating tags with pinned commit SHAs across every
  workflow file. Version comments (# vX.Y.Z) are preserved for
  human readability.
  actions/checkout              v4.2.2  -> 11bd71901bbe5b1630ceea73d27597364c9af683
  actions/setup-node            v4.4.0  -> 49933ea5288caeca8642d1e84afbd3f7d6820020
  actions/cache                 v4.2.3  -> 5a3ec84eff668545956fd18022155c47e93e2684
  actions/setup-python          v5.6.0  -> a26af69be951a213d495a4c3e4e4022e16d87065
  actions/upload-artifact       v4.6.2  -> ea165f8d65b6e75b540449e92b4886f43607fa02
  actions/github-script         v7.0.1  -> 60a0d83039c74a4aee543508d2ffcb1c3799cdea
  actions-rust-lang/setup-rust  v1.11.0 -> 9399c7bb15d4c7d47b27263d024f0a4978346ba4
  taiki-e/install-action        v2.49.0 -> e03236526ace47fa2e04bebcfc6da471ebd4690c
  dtolnay/rust-toolchain        stable  -> 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
- Added .github/dependabot.yml with github-actions ecosystem entry
  (weekly cadence) to keep pinned SHAs updated automatically.
@drips-wave

drips-wave Bot commented Aug 31, 2026

Copy link
Copy Markdown

@xreme-coder Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@levoski1
levoski1 merged commit e202113 into WHEELBACK:main Aug 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment