Skip to content
61 changes: 61 additions & 0 deletions .github/workflows/build-and-test-skip.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
# Paired workflow for build-and-test.yml.
#
# When a PR only changes documentation, license metadata, or workflow files
# unrelated to the action's runtime (CodeQL, Dependabot, Renovate config),
# build-and-test.yml is skipped via its paths-ignore filter and would never
# report the `all-tests-passed` commit status that the repository ruleset
# requires for merge.
#
# This workflow runs in the inverse case (`paths:` is the inverse of
# `paths-ignore:` in build-and-test.yml) and reports `all-tests-passed`
# = success directly, satisfying the ruleset without invoking the full
# e2e suite. Both workflows share `name: Build & Test` so the status
# context name (`all-tests-passed`) is identical.
#
# If a PR mixes ignored and non-ignored paths, BOTH workflows run.
# The skip workflow finishes in seconds while the real workflow takes
# minutes, so the real run's status is the last write — the genuine
# result wins.

name: Build & Test

on:
pull_request:
branches:
- main
types:
- opened
- synchronize
- reopened
# Inverse of build-and-test.yml's paths-ignore. Keep the two lists
# identical when adding/removing entries.
paths:
- '**/*.md'
- 'LICENSE'
- 'LICENSES/**'
- 'REUSE.toml'
- 'renovate.json'
- '.gitignore'
- '.github/workflows/codeql.yml'
- '.github/codeql/**'
- '.github/dependabot.yml'
- '.github/CODEOWNERS'

concurrency:
group: ${{ github.workflow }}-skip-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

jobs:
all-tests-passed:
runs-on: ubuntu-latest
permissions:
statuses: write
steps:
- name: Mark all-tests-passed (no-op for non-runtime changes)
uses: myrotvorets/set-commit-status-action@master

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow or composite action Medium

Unpinned 3rd party Action 'Build & Test' step
Uses Step
uses 'myrotvorets/set-commit-status-action' with ref 'master', not a pinned commit hash
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
with:
token: ${{ secrets.GITHUB_TOKEN }}
status: success
sha: ${{ github.event.pull_request.head.sha }}
context: "all-tests-passed"
description: "Skipped — PR only changes docs/workflow metadata"
15 changes: 15 additions & 0 deletions .github/workflows/build-and-test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,21 @@ on:
- opened
- synchronize
- reopened
# Documentation- and workflow-only changes do not affect the runtime
# behaviour of the composite/JS actions in this repo. For those PRs the
# paired skip workflow (build-and-test-skip.yml) reports the required
# `all-tests-passed` status without burning ~5 minutes of e2e runtime.
paths-ignore:
- '**/*.md'
- 'LICENSE'
- 'LICENSES/**'
- 'REUSE.toml'
- 'renovate.json'
- '.gitignore'
- '.github/workflows/codeql.yml'
- '.github/codeql/**'
- '.github/dependabot.yml'
- '.github/CODEOWNERS'

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
Expand Down
Loading