Skip to content

NO-ISSUE: run PR CI suites on merge_group - #418

Merged
omer-vishlitzky merged 1 commit into
osac-project:mainfrom
minmzzhang:ci/mq-run-pr-ci
Aug 26, 2026
Merged

NO-ISSUE: run PR CI suites on merge_group#418
omer-vishlitzky merged 1 commit into
osac-project:mainfrom
minmzzhang:ci/mq-run-pr-ci

Conversation

@minmzzhang

@minmzzhang minmzzhang commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Trigger pre-commit, unit tests, and integration tests on merge_group so merge queue gets real pass/fail on the speculative SHA (fixes the checks_timed_out kick from github-config#191 / osac#375).
  • Apply the same docs-only path filter on merge_group as on pull_request (checkout + git diff, because dorny/paths-filter has no PR Files API there).
  • Point gitleaks at merge_group.base_sha / head_sha; keep the rotation comment PR-only (no issue number on merge_group).

Test plan

  • PR event still runs real pre-commit / unit / integration on this PR
  • After enqueue, merge-group SHA shows those jobs running (not missing); failure must block merge
  • Docs-only change still skips unit/integration (success); pre-commit still runs
  • Do not re-apply github-config required checks until this is on main

Summary by CodeRabbit

  • Chores
    • Updated automated integration and unit test workflows to support merge queue validation.
    • Improved change detection for pull requests and merge-group builds, ensuring relevant checks run consistently.
    • Updated pre-commit checks and secret scanning to work with merge-group revisions.
    • Limited rotation reminder comments to pull requests, reducing unnecessary notifications in other workflow runs.

Merge queue waits for checks on the speculative SHA. Without a
merge_group trigger those jobs never report, so GitHub kicks the PR
(checks_timed_out).
@openshift-ci-robot

Copy link
Copy Markdown

@minmzzhang: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

  • Trigger pre-commit, unit tests, and integration tests on merge_group so merge queue gets real pass/fail on the speculative SHA (fixes the checks_timed_out kick from github-config#191 / osac#375).
  • Apply the same docs-only path filter on merge_group as on pull_request (checkout + git diff, because dorny/paths-filter has no PR Files API there).
  • Point gitleaks at merge_group.base_sha / head_sha; keep the rotation comment PR-only (no issue number on merge_group).

Test plan

  • PR event still runs real pre-commit / unit / integration on this PR
  • After enqueue, merge-group SHA shows those jobs running (not missing); failure must block merge
  • Docs-only change still skips unit/integration (success); pre-commit still runs
  • Do not re-apply github-config required checks until this is on main

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Aug 20, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b261193e-d470-4990-ad22-0e0abfdaf2aa

📥 Commits

Reviewing files that changed from the base of the PR and between 2818548 and a185873.

📒 Files selected for processing (3)
  • .github/workflows/integration-tests.yml
  • .github/workflows/pre-commit.yaml
  • .github/workflows/unit-tests.yml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.


Walkthrough

The workflows now trigger on merge_group events. Integration and unit tests apply path filtering with full history. Pre-commit Gitleaks scans use pull-request or merge-group revisions, while rotation reminders remain pull-request-only.

Changes

Merge queue CI support

Layer / File(s) Summary
Merge-group path filtering
.github/workflows/integration-tests.yml, .github/workflows/unit-tests.yml
The integration-test and unit-test workflows support merge_group events. Their changes jobs use full repository history for path filtering and retain pull-request-specific gating.
Merge-group secret-scan revisions
.github/workflows/pre-commit.yaml
Gitleaks selects revisions from pull-request or merge-group metadata. The rotation reminder runs only after failed pull-request scans.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to a1858

This PR updates CI workflows to run required suites for merge-queue commits; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

Suggested reviewers: crystalchun, slintes, eliorerz

🚥 Pre-merge checks | ✅ 11
✅ Passed checks (11 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: running PR CI suites on merge_group events.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets ✅ Passed The PR changes only workflow controls and SHA references. Added lines contain no hardcoded credentials, private keys, credential URLs, or secret-named string assignments; the checkout SHA already e...
No-Weak-Crypto ✅ Passed The PR changes only three GitHub workflow files; added lines contain no MD5, SHA-1, DES, RC4, Blowfish, ECB, custom crypto, or secret-comparison logic.
No-Injection-Vectors ✅ Passed The diff only changes GitHub workflow triggers, path filtering, and quoted SHA arguments; it adds no SQL concatenation, shell=True, eval/exec, pickle.loads, unsafe yaml.load, os.system, or dangerou...
Container-Privileges ✅ Passed The PR diff only updates three GitHub Actions workflows; it adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root container/Kubernetes settings.
No-Sensitive-Data-In-Logs ✅ Passed The diff adds triggers, path filtering, checkout, and SHA fallbacks only. It adds no sensitive logging; existing hostname echoes are unchanged, and gitleaks retains --redact.
Ai-Attribution ✅ Passed The authored PR description and HEAD commit do not mention an AI tool; HEAD has no attribution trailers, so the conditional attribution check is not applicable.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@fullsend-ai-review

fullsend-ai-review Bot commented Aug 20, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:47 PM UTC · Completed 1:59 PM UTC

Commit: a185873 · View workflow run →

@fullsend-ai-review

Copy link
Copy Markdown

Review

Findings

High

  • [protected-path] .github/workflows/integration-tests.yml, .github/workflows/pre-commit.yaml, .github/workflows/unit-tests.yml — All three modified files reside under .github/, which is a protected governance path. The PR has no linked issue (uses the NO-ISSUE: prefix), providing insufficient traceability for changes to governance and infrastructure files. Human approval is required for protected-path changes regardless of the change's technical merit.
    Remediation: Link to an authorizing issue or obtain explicit human maintainer approval for these workflow changes.

Labels: PR modifies GitHub Actions workflow files under .github/workflows/


Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

@fullsend-ai-review fullsend-ai-review Bot added the github_actions Pull requests that update GitHub Actions code label Aug 20, 2026
@omer-vishlitzky
omer-vishlitzky dismissed fullsend-ai-review[bot]’s stale review August 20, 2026 14:00

Auto-dismissed: only Prow labels gate merging

@minmzzhang

Copy link
Copy Markdown
Contributor Author

/retest

@github-actions

Copy link
Copy Markdown

Re-triggered failed runs:

  • label-gate (#32377484702)
  • label-gate (#32376164066)
  • label-gate (#32376160612)
  • label-gate (#32376157382)
  • E2E BMaaS Full Install (#32376157788)

@openshift-ci

openshift-ci Bot commented Aug 26, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eliorerz, minmzzhang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [eliorerz,minmzzhang]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@omer-vishlitzky
omer-vishlitzky added this pull request to the merge queue Aug 26, 2026
Merged via the queue into osac-project:main with commit d913486 Aug 26, 2026
124 of 134 checks passed
@minmzzhang
minmzzhang deleted the ci/mq-run-pr-ci branch August 26, 2026 18:58
eliorerz added a commit to eliorerz/osac that referenced this pull request Sep 2, 2026
…ests/pre-commit

PR osac-project#418 correctly runs the full Unit Tests and Integration Tests suites
on merge_group -- that behavior is unchanged here and stays exactly as
osac-project#418 intended. The actual problem is narrower: none of unit-tests.yml,
integration-tests.yml, or pre-commit.yaml cancel a stale run when
GitHub's merge queue rebases a PR onto a new ephemeral
gh-readonly-queue ref, which happens routinely as normal merge-queue
behavior. Every rebase spawns a brand-new full run of these 3
workflows for that PR; the previous run for the now-superseded ref
keeps consuming a runner until it finishes naturally. Confirmed live:
13 concurrent Unit Tests runs and 10 concurrent Integration Tests runs
against only 4 active merge-queue slots (max_entries_to_build: 4, via
the rulesets API) -- consistent with a handful of PRs each stacking up
multiple stale, uncancelled reruns from repeated rebases. Also
confirmed this repo's actual hosted-runner concurrency (~30-40 in use)
is nowhere near the plan's 180-job ceiling, so a hard concurrency
limit is not the bottleneck -- the queue stalls because cheap,
load-bearing jobs (label-gate, auto-queue, Slash Command) get starved
behind piles of stale heavy runs, not because of a runner cap.

integration-tests.yml already had a concurrency block, but it keyed
non-PR events on github.sha (the merge-preview commit), which changes
on every rebase -- so the group itself changed every rebase and could
never collapse a prior run even with cancel-in-progress true.
unit-tests.yml and pre-commit.yaml had no concurrency block at all.

Fix: key the concurrency group on something that stays stable across
rebases of the same PR. github.ref_name for a merge_group event is
GitHub's ephemeral gh-readonly-queue/<base>/pr-<number>-<sha> ref --
the pr-<number> segment is constant across rebases; only the trailing
sha changes. Verified this directly against this repo's own run
history (gh api repos/osac-project/osac/actions/runs?event=merge_group):
PR osac-project#503 was requeued at gh-readonly-queue/main/pr-503-b2986acb...61 and
.../pr-503-f05965f9...53 sixteen minutes apart; PR osac-project#307 similarly at
.../pr-307-18b1c7ed...58 and .../pr-307-0c86346b...c1 -- both pairs
extract to the identical "pr-503"/"pr-307" via `grep -oE 'pr-[0-9]+'`
despite the trailing sha differing every time.

Workflow-level `concurrency:` blocks are evaluated before any job
runs and can't reference a computed value, so this can't be done as a
single top-of-file block. Instead, each file computes the key once (in
the existing `changes` job for unit-tests.yml/integration-tests.yml;
in a new tiny `concurrency-key` job for pre-commit.yaml, which has no
`changes` job) and each actual test-execution job gets its own
job-level `concurrency:` block referencing that computed output --
job-level blocks can reference `needs.*.outputs.*`.

Nothing from the previously-closed osac-project#544 approach is reintroduced: no
compile-check job, no gating the heavy test jobs off of merge_group.
Test execution behavior (what runs, on what trigger, with what
coverage) is completely unchanged on all 3 files -- this only cancels
superseded/stale runs of the same PR's own prior queue entry.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved github_actions Pull requests that update GitHub Actions code jira/valid-reference lgtm

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants