Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 46 additions & 1 deletion .github/workflows/ci.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,45 @@ env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true # TODO: Remove on 2026/06/02

jobs:
determine_changes:
name: Determine changes
runs-on: ubuntu-latest
outputs:
# Flag that is raised when any rust code is changed.
rust_code: ${{ steps.check_rust_code.outputs.changed }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false

- name: Determine merge base
id: merge_base
run: |
sha=$(git merge-base HEAD "origin/${BASE_REF}")
echo "sha=${sha}" >> "$GITHUB_OUTPUT"
env:
BASE_REF: ${{ github.event.pull_request.base.ref || 'main' }}

- name: Check if there was any code related change
id: check_rust_code
run: |
if git diff --quiet "${MERGE_BASE}...HEAD" -- \
':Cargo.toml' \
':Cargo.lock' \
':rust-toolchain.toml' \
':.cargo/config.toml' \
':crates/**' \
':src/**' \
':.github/workflows/ci.yaml' \
; then
echo "changed=false" >> "$GITHUB_OUTPUT"
else
echo "changed=true" >> "$GITHUB_OUTPUT"
fi
Comment thread
coderabbitai[bot] marked this conversation as resolved.
env:
MERGE_BASE: ${{ steps.merge_base.outputs.sha }}

rust_tests:
if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip:ci') }}
env:
Expand Down Expand Up @@ -120,9 +159,15 @@ jobs:
if: runner.os == 'Linux'

cargo_check:
if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip:ci') }}
name: cargo check
runs-on: ${{ matrix.os }}
needs:
- determine_changes
if: |
(
!contains(github.event.pull_request.labels.*.name, 'skip:ci') &&
needs.determine_changes.outputs.rust_code == 'true'
) || github.ref == 'refs/heads/main'
Comment on lines +166 to +170

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

cargo_check may be silently skipped on main if determine_changes fails

GitHub Actions implicitly wraps any job if expression with success() when no explicit status-check function is present. "A default status check of success() is applied unless you include one of these functions." This means the effective condition is:

success() && ( (…skip:ci check… && rust_code == 'true') || github.ref == 'refs/heads/main' )

If determine_changes fails (e.g., git merge-base cannot resolve origin/${BASE_REF}), success() evaluates to false and the entire expression short-circuits — so cargo_check is silently skipped even on refs/heads/main, defeating the intent of the unconditional escape hatch. The fix is to guard only the main branch arm with an explicit status-check:

🛠️ Proposed fix
-    if: |
-      (
-        !contains(github.event.pull_request.labels.*.name, 'skip:ci') &&
-        needs.determine_changes.outputs.rust_code == 'true'
-      ) || github.ref == 'refs/heads/main'
+    if: |
+      (
+        needs.determine_changes.result == 'success' &&
+        !contains(github.event.pull_request.labels.*.name, 'skip:ci') &&
+        needs.determine_changes.outputs.rust_code == 'true'
+      ) || (
+        !failure() && !cancelled() &&
+        github.ref == 'refs/heads/main'
+      )
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yaml around lines 164 - 168, The current job
if-expression is inadvertently wrapped by GitHub Actions' default success()
which can make cargo_check skip on refs/heads/main if determine_changes fails;
update the condition so it includes an explicit status-check only on the
main-branch arm (e.g., change the main clause to "github.ref ==
'refs/heads/main' && always()") so the presence of a status function prevents
the implicit success() wrapping while leaving the existing
determine_changes-based arm unchanged; target the if in the cargo_check job and
modify the expression that references needs.determine_changes.outputs.rust_code
and github.ref.

strategy:
matrix:
include:
Expand Down
Loading