Skip to content

ci: path-filtered workflows now watch their own file - #49

Merged
acamarata merged 3 commits into
mainfrom
ci/workflows-watch-themselves
Aug 26, 2026
Merged

acamarata merged 3 commits into
mainfrom
ci/workflows-watch-themselves

Conversation

@acamarata

Copy link
Copy Markdown
Contributor

Problem

A workflow with a paths: filter that does not list itself cannot be triggered by an edit to itself.

You can break the workflow — a bad condition, a typo in a step, a wrong action version — and CI stays green. It only runs when some unrelated change happens to match the filter, so the failure surfaces later and gets attributed to the wrong commit.

Change

Adds the workflow file to every paths: block it owns, covering:

  • pull_request blocks, which are the ones that catch this before merge
  • push blocks
  • inline flow-array form (paths: [...]), not just block lists

Context

Same fix cli made in nself-org/cli#257. A sweep across the org found 33 affected workflows in 9 repos; this is that repo’s share. Residual after the sweep is 0.

Found while auditing for gates whose success condition is unreachable or trivially satisfiable.

Verification

Every workflow YAML in this repo still parses.

A workflow with a `paths:` filter that does not list itself cannot be
triggered by an edit to itself. You can break the workflow — a bad
condition, a typo in a step, a wrong action version — and CI stays green
until some unrelated change happens to match the filter and finally runs
it. The failure surfaces later, attributed to the wrong commit.

Adds the workflow file to every `paths:` block it owns, including
`pull_request` (the one that matters for catching this pre-merge) and
inline flow-array forms.

Same fix cli made in #257; this extends it to the rest of the org after a
sweep found 33 affected workflows across 9 repos.

Verified: every workflow YAML in this repo still parses.
@acamarata

Copy link
Copy Markdown
Contributor Author

Note on the red e2e check: it is not caused by this PR.

This diff is two lines, both paths: filters. It cannot affect a test.

What happened is that adding the workflow to its own paths: list made desktop-e2e.yml trigger for the first time in its history. Its filter is nclaw/desktop/**, and that directory does not exist in this repo (the real one is desktop/), so it had never matched anything and the suite had never run. The run it just produced fails at Install deps on both windows and macos.

Filed as #50 with the full detail, including why the one-line path fix is deliberately not in this PR: correcting it now would make a known-broken suite run on every desktop change and turn main red before anyone has decided to fix the suite.

e2e is not a required check on main (required: Gitleaks, Desktop Build Check), so this does not block the merge.

Every path in this workflow carried an 'nclaw/' prefix, a leftover from a
monorepo-relative layout that does not apply inside the nclaw repo. The
real directory is desktop/.

Consequences, all of which were invisible:

  paths filter      never matched, so the workflow had never run once
  working-directory failed to start the shell at all:
                      'No such file or directory' / 'The directory name
                      is invalid' on all three runners
  artifact path     would have uploaded nothing

The filter and the working directories were the same bug, so fixing the
filter alone would have made the suite run and immediately die. Both are
corrected together, along with the artifact path.

desktop/ has what the suite needs: package nclaw-desktop, an e2e script
(playwright test), playwright in devDependencies, and a pnpm-lock.yaml
for --frozen-lockfile.

Refs #50.
With the nclaw/ path prefix corrected, the suite finally reached Run E2E
and vite died on every runner:

  Failed to resolve import "@nself/observability" from "src/main.tsx"
  Failed to resolve import "@nself/auth-core" from "src/lib/auth.js"
  ... and @nself/graphql-client, @nself/i18n

Two causes, both structural.

pnpm-workspace.yaml globs '../packages/@nself/*' — the nself-org/packages
repo as a SIBLING directory — and desktop/package.json depends on five of
them as workspace:*. CI checked out only nclaw, so the sibling never
existed and those packages could never resolve. nclaw now checks out into
a subdir with nself-org/packages beside it, matching the layout the
workspace file already expects.

Install also has to run at the workspace ROOT. The lockfile is the root
pnpm-lock.yaml (~712 KB) covering every member; running pnpm install
inside desktop/ cannot link workspace siblings. Only the Playwright and
e2e steps stay in desktop/.

Verified all five packages exist and are public in nself-org/packages.

Refs #50.
@acamarata
acamarata merged commit 6b7a8dc into main Aug 26, 2026
16 of 19 checks passed
@acamarata
acamarata deleted the ci/workflows-watch-themselves branch August 26, 2026 21:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant