Repository navigation
Close fork CI pull requests that change jobs running in gated runs - #75827
Merged
Merged
Conversation
potiuk
requested review from
amoghrajesh,
ashb,
bugraoz93,
choo121600,
ephraimbuddy,
gopidesupavan,
jason810496,
jedcunningham,
jscheffl and
vatsrahul1001
as code owners
October 27, 2026 22:01
1 task done
Contributor
|
The re-run of the jobs stopped by EC2 Spot interruptions finished: attempt 2 failed. |
potiuk
force-pushed
the
fork-ci-gate-protect-ci-passed
branch
from
October 28, 2026 03:16
ce10e70 to
2d08a53
Compare
In a run the gate leaves to fork CI, the gate succeeds and only build-info is skipped, so a job still runs in apache/airflow when its if calls a status check function or all the jobs it needs run. ci-passed is one of them, and it reports the CI passed check the merge ruleset requires. The gate protection only compared which jobs do not depend on the gate, so a gated pull request could change ci-passed, or add a job that needs only the gate, and report CI passed without any CI. GitHub also treats a skipped required check as passed, so renaming any job that is skipped in a gated run to CI passed satisfies the ruleset as well. Job names are therefore part of the gate too. The changed files of a pull request are also listed as it is when listed, so a retarget to a base without the gate while the check ran could close a pull request that should be released to project CI, which is never looked at again once closed. Generated-by: Claude Opus 5
potiuk
force-pushed
the
fork-ci-gate-protect-ci-passed
branch
from
October 30, 2026 16:40
2d08a53 to
c7de0ef
Compare
vatsrahul1001
approved these changes
Oct 30, 2026
Contributor
|
Hi maintainer, this PR was merged without a milestone set.
|
Contributor
Backport successfully created: v3-4-testNote: As of Merging PRs targeted for Airflow 3.X In matter of doubt please ask in #release-management Slack channel.
|
vatsrahul1001
pushed a commit
that referenced
this pull request
Oct 30, 2026
…ated runs (#75827) (#76058) In a run the gate leaves to fork CI, the gate succeeds and only build-info is skipped, so a job still runs in apache/airflow when its if calls a status check function or all the jobs it needs run. ci-passed is one of them, and it reports the CI passed check the merge ruleset requires. The gate protection only compared which jobs do not depend on the gate, so a gated pull request could change ci-passed, or add a job that needs only the gate, and report CI passed without any CI. GitHub also treats a skipped required check as passed, so renaming any job that is skipped in a gated run to CI passed satisfies the ruleset as well. Job names are therefore part of the gate too. The changed files of a pull request are also listed as it is when listed, so a retarget to a base without the gate while the check ran could close a pull request that should be released to project CI, which is never looked at again once closed. (cherry picked from commit 460f7a0) Generated-by: Claude Opus 5 Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
vatsrahul1001
pushed a commit
that referenced
this pull request
Oct 30, 2026
…ated runs (#75827) (#76058) In a run the gate leaves to fork CI, the gate succeeds and only build-info is skipped, so a job still runs in apache/airflow when its if calls a status check function or all the jobs it needs run. ci-passed is one of them, and it reports the CI passed check the merge ruleset requires. The gate protection only compared which jobs do not depend on the gate, so a gated pull request could change ci-passed, or add a job that needs only the gate, and report CI passed without any CI. GitHub also treats a skipped required check as passed, so renaming any job that is skipped in a gated run to CI passed satisfies the ruleset as well. Job names are therefore part of the gate too. The changed files of a pull request are also listed as it is when listed, so a retarget to a base without the gate while the check ran could close a pull request that should be released to project CI, which is never looked at again once closed. (cherry picked from commit 460f7a0) Generated-by: Claude Opus 5 Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #74909, which closes a gated pull request that changes the fork CI gate. Two gaps let such a pull request still get
CI passedwithout CI, and one could close a pull request by mistake.build-infois skipped. A job still runs when itsifcallsalways(),success(),failure()orcancelled()(in any case), or when all the jobs it needs run. Onmainthese arecheck-run-needed,check-timed-out-jobs,ci-passed,finalize-testsandnotify-slack. Only which jobs do not depend on the gate was compared, so a pull request could renameci-passed, or add a job needing only the gate, and reportCI passed. Their whole definitions are now part of the gate.CI passedsatisfies the merge ruleset as well. Thenameof every job is now part of the gate, with itsstrategywhen the name is an expression. A gated pull request that renames any job is closed; a maintainer can release it withuse project ci.ci-amd.ymlwith YAML aliases (whichci-amd.ymldoes not use, and which can expand exponentially when compared), or one the comparison fails on, counts as a gate change.Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Claude Opus 5) following the guidelines
🤖 Generated with Claude Code