Repository navigation
[PRODENG-3758] Fix pr.yml zero-job failures: drop paths-ignore - #667
Conversation
pr.yml set both paths and paths-ignore on the same pull_request trigger,
which GitHub's docs explicitly disallow ("You cannot use both the paths
and paths-ignore filters for the same event in a workflow"). This made
GitHub reject the whole workflow file at parse time before scheduling any
job, producing "likely failed because of a workflow file issue" with zero
jobs and zero check-runs on every run.
Confirmed via full run history (218 runs) that every pr.yml run has failed
this way since paths-ignore was introduced in #615 (2026-03-26). A prior
fix (removing both paths and paths-ignore) was authored the same day but
never merged into main.
This keeps the paths include filter and drops only paths-ignore.
Signed-off-by: James Nesbitt <jnesbitt@mirantis.com>
test/integration/integration_test.go's TestMain provisions real AWS infrastructure (Terraform VPC/subnets/node groups) and does a real Product.Apply cluster install -- the same category of work as the label-gated smoke tests, not a lightweight component-level test. Unlike smoke-tests.yaml, this job had no AWS credentials wired in, no label gate, and ran on ubuntu-latest (no instance profile). It unconditionally attempted a real terraform apply with no way to authenticate, hanging on AWS SDK/Terraform credential-discovery retries until the 20-minute go test timeout killed it. This was invisible for 6 months because pr.yml never scheduled any jobs until the paths-ignore fix in this same branch. Per user direction, the launchpad integration test should not run in GHA at all. `make integration-test` remains available for local/manual use. Signed-off-by: James Nesbitt <jnesbitt@mirantis.com>
The lint job's "make lint" step assumed golangci-lint was already on PATH, but the arc-runner-set-mirantis-public runner image has no Go tooling pre-installed beyond what actions/setup-go supplies per workflow. The job failed unconditionally with "golangci-lint: No such file or directory" once pr.yml could actually schedule jobs again (see prior commits in this branch). golangci-lint's own official action installs and runs the binary in one step, the same pattern security-scan already uses for govulncheck (go install golang.org/x/vuln/cmd/govulncheck@latest). Filed and closed Mirantis/arc#44: baking golangci-lint into the shared runner image isn't the right fix since nothing else on that image is pre-baked either (Go itself comes from actions/setup-go); this belongs in the consuming workflow. version: v2.13 matches this repo's .golangci.yml schema version ("2"). Signed-off-by: James Nesbitt <jnesbitt@mirantis.com>
000ac20 to
5c8c40e
Compare
…urns pkg/product/mke/config/hosts.go had two gofumpt-flagged 'return (x)' statements with unnecessary parens (Find, Index). Pre-existing on main, never caught before because pr.yml's lint job couldn't run at all until the fixes earlier in this branch. golangci-lint-action's summary output only surfaced one of the two; confirmed both via 'gofumpt -d' directly. make lint now reports 0 issues. Signed-off-by: James Nesbitt <jnesbitt@mirantis.com>
v3.21.4 migrated pkg/provenance from golang.org/x/crypto/openpgp to the maintained github.com/ProtonMail/go-crypto/openpgp fork (matching helm/helm#32463, backported from dev-v3 per helm/helm#32361). Confirmed via go mod why that this was the only path pulling x/crypto/openpgp into launchpad's build (pkg/helm -> helm.sh/helm/v3/pkg/action -> helm.sh/helm/v3/pkg/provenance -> x/crypto/openpgp), and that launchpad has no direct import of the package itself. govulncheck ./... now reports 0 reachable vulnerabilities (previously 1: GO-2026-5932, "Fixed in: N/A", the one advisory left unresolved after the earlier x/crypto/x/mod/grpc bump in #666). make security-scan exits 0. Kept to the v3.21.x patch line rather than v3.22.0, which would likely force a k8s.io/* dependency bump unrelated to this fix; a version bump to v3.22 can be considered separately once these CI fixes are merged. Signed-off-by: James Nesbitt <jnesbitt@mirantis.com>
|
Summary of everything applied on this branch, in order: 1. Fixed the actual zero-job bug. 2. Removed the 3. Fixed the 4. Fixed the lint findings that surfaced. With 5. Fixed the last Net effect: Written by AI: claude-sonnet-5 |
What
Drop
paths-ignorefrompr.yml'spull_requesttrigger, and remove theintegration-testjob.Why
pr.ymlset bothpathsandpaths-ignoreon the samepull_requesttrigger, which GitHub explicitly disallows ("You cannot use both thepathsandpaths-ignorefilters for the same event in a workflow"). This made GitHub reject the entire workflow file at parse time before scheduling any job — every run showed "likely failed because of a workflow file issue" with zero jobs and zero check-runs.Once jobs could actually schedule,
integration-testwas exposed as broken:test/integration/integration_test.goprovisions real AWS infrastructure and does a real clusterApply, the same category of work as the label-gated smoke tests, but with no AWS credentials wired in and no label gate. It hung on credential-discovery retries until the 20-minute test timeout. The launchpad integration test should not run in GHA.How
paths-ignoreblock, keptpathsas-ispr.ymlrun has failed this way sincepaths-ignorewas introduced in Migrate to gha only #615 (2026-03-26); a prior fix existed but was never merged intomainarc-runner-set-mirantis-publicrunner group as the cause (it's healthy, confirmed via a live successful smoke-modern job on the same label)integration-testjob entirely;make integration-testremains available for local/manual useTesting
pr.ymlnow scheduleslint/unit-test/security-scan(previously zero jobs scheduled at all)Links
Checklist