Repository navigation
ci: guard every pull_request job on the skip-ci label - #4
Conversation
Org standard (vybava docs/skip-ci.md): a PR labelled skip-ci runs nothing — each job of every pull_request-triggered workflow carries if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'skip-ci') push, schedule and workflow_dispatch runs are untouched. Generated by `vybava skipci apply`; `vybava skipci check` is the drift check.
|
🐉 eve review — ✅ APPROVE · 0 findings
|
![eve-bot-lovinka[bot]](https://avatars.githubusercontent.com/in/4092731?s=60&v=4){kind=small}
There was a problem hiding this comment.
🐉 eve review — ✅ Approved
873671e· 0 actionable findings · 1 confirmed held below the floor · view run ↗
ℹ️ Held below the floor — 1 confirmed finding fell under this repo's severity/confidence floor and went to the bench, not the PR. Lower the floor in
.eve-review.ymlto see them.
ℹ️ Claims vs diff — Claim c1 'Every job of every pull_request-triggered workflow carries the job-level condition `githu…' is not supported: .github/workflows/pull-request-ci.yml (permissions) shows only a permissions addition, not job-level skip-ci conditions.
Claim c3 'The guard is job-level so a labelled PR's checks read skipped, which required-status rule…' is not supported: .github/workflows/pull-request-ci.yml (permissions) contains no reported job-level guard or skipped-check change.
4 claims could not be checked from the diff (c2, c6, c7, c8).
Why this exists
Only FixIt honours the
skip-cilabel today; here a PR that must land without CI (a docs or hotfix trail,prm --admin) still burns a full run and the merge waits on it. Eve'seve-ignorelabel already exists in every repo — this is its CI twin.Approach
Every job of every
pull_request-triggered workflow (1 jobs, 1 files) carries one job-level condition:github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'skip-ci'). Job-level, so a labelled PR's checks read skipped (which required-status rules count as passing) instead of pending forever; nolabeledtrigger, so an unrelated label never restarts CI. Push, schedule and dispatch runs are untouched. Applied byvybava skipci apply(1 edits), drift-checked byvybava skipci check; jobs already off pull_request, or downstream of a guarded job, were left as they are.Intent
A PR labelled
skip-ciruns no job in this repo and lands withprm --admin; an unlabelled PR runs exactly what it ran before.Links
e13d455d-aefe-4e14-affd-db93fc6a49edBlockers & risks
None.
Verification
vybava skipci checkis clean on this branch; this PR's own CI run proves the YAML still parses and that an unlabelled PR runs every job as before (the guard evaluates true). Not covered: askip-ci-labelled PR was not exercised in this repo.