[frederic-tingaud-sonarsource]

Part of CLP-910.

A test suite that does not run when its dependencies change is not much better
than one that cannot fail. Several suites here exercise shared/ and
test-fixtures/jira/, but their triggers only watch their own action directory,
so a change to the shared code did not rerun them.

shared/** was watched by one suite out of seven

These all import jira_common or path_utils, and none of them listed
shared/**:

• test-create-jira-release-ticket
• test-create-jira-version
• test-get-jira-release-notes
• test-release-jira-version
• test-resolve-ktlo-epic
• test-update-release-ticket-status

Only test-create-integration-ticket had it. Added to both the pull_request
and push filters of the other six.

The KTLO fixture filter was too narrow

test-resolve-ktlo-epic watched two specific files:

      - 'test-fixtures/jira/setup_ktlo.py'
      - 'test-fixtures/jira/cleanup_ktlo.py'

but both of those import jira_client.py, and the job installs
test-fixtures/jira/requirements.txt. A change to either would not have rerun
it. Replaced with test-fixtures/jira/**.

Nothing caught this later either

test-all.yml runs only on push to master and on dispatch — there is no
pull_request trigger — so a PR editing shared/jira_common.py ran two suites
and the other six only broke after merge. It was also missing five suites
entirely, so master did not cover them either. All five are now wired in:

Suite	Notes
test-bump-version	had no workflow_call trigger, so it could not be called at all — added
test-jira-fixtures	contents: read, id-token: write
test-notify-failure	id-token: write, actions: read
test-resolve-ktlo-epic	contents: read, id-token: write
test-update-plugins-deployer	no extra permissions

I did not add a pull_request trigger to test-all.yml. The path filters
are what the PR-time gap actually needed, and running all 22 suites on every PR
is a much bigger change than this ticket calls for.

One thing to decide before merging

test-resolve-ktlo-epic's integration-test hits the Jira sandbox and, unlike
test-jira-fixtures, it has no continue-on-error. Wiring it into
test-all.yml therefore creates a new way for master to go red on sandbox
flakiness rather than on a real regression. I have included it because leaving
suites out of "Test All Actions" is the gap being fixed, but it is a one-line
removal if you would rather not take that exposure — or a reason to give that
job the same continue-on-error treatment its sibling already has.

Verification

Checked mechanically rather than by eye, after the change:

• Every test-*.yml on disk is now referenced by test-all.yml (none missing).
• Every workflow test-all.yml calls declares workflow_call (none missing) —
  this is what caught test-bump-version.
• Every action whose Python imports jira_common/path_utils now has
  shared/** in both its pull_request and push filters.
• All test workflows still parse.

The one remaining gap is sonar-update-center-release: it imports shared/
and has no test workflow at all, so there is no trigger to fix. Out of scope
here, but worth a ticket.

🤖 Generated with Claude Code

[hashicorp-vault-sonar-prod]

CLP-1110

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Workflow triggers now run additional suites and Jira sandbox integration on master.

Adds path filters to six Jira test suites to watch shared/** changes, broadens the KTLO fixture filter from two specific files to test-fixtures/jira/**, and wires five previously uncalled test workflows into test-all.yml. Fixes the issue where dependent test suites did not rerun when shared code and fixtures changed, and resolves duplicate runs on master pushes. No issues found.

✅ 1 closed

✅ Quality: New test-all entries run twice on master pushes

📄 .github/workflows/test-all.yml:69-83 📄 .github/workflows/test-bump-version.yml:4-6 📄 .github/workflows/test-resolve-ktlo-epic.yml:11-19
Most suites already in test-all.yml have push limited to branch-*, so on master they only run through Test All. The ones added here keep their own push: master triggers. test-bump-version has push: branches: [master] with no path filter, so after this change it runs twice on every push to master. test-resolve-ktlo-epic and test-jira-fixtures (both hit the sandbox) and test-update-plugins-deployer also run twice whenever a master push matches their paths. Now that test-resolve-ktlo-epic watches shared/** and test-fixtures/jira/** too, that happens more often. This doubles the sandbox-flakiness exposure the description warns about for the non-continue-on-error KTLO integration job. Consider switching these suites' push branches to branch-* like their siblings, or dropping master from their push triggers now that Test All covers master.

Verification Rules 3/3 met

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners
✅ Internal artifact registries
✅ Repository license compliance

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}