CI: make the required checks reportable, narrow Docker, cover backend deps - #13
Merged
Merged
Conversation
Required status checks and path filters do not mix: a required check whose workflow is filtered out never reports, and GitHub blocks the PR at "Expected — waiting for status" forever. With Frontend, Backend, Contract and Docker required on main, that would have stalled every backend-only sync PR (no frontend/** changes) and every docs-only PR. Dropping the filters costs about a minute per job and makes the gates real: nothing merges, automatically or otherwise, until the full suite passes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011texLkDBELWbXsBf6San3M
The two jobs asserted the same three endpoints, once against uvicorn and once through nginx. Docker now makes a single request: reaching /health under /api proves the image runs and the proxy strips the prefix, which is all this job is for. The endpoints themselves stay the Contract workflow's job, where they are asserted once. Verified against the real compose stack: frontend served, /api/health returns ok through nginx. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011texLkDBELWbXsBf6San3M
The dependency graph already scans backend/uv.lock (the "Graph Update: uv in /backend" runs), but PRs need an explicit ecosystem entry, and the backend package sits in a subdirectory so it needs its own. Routine bumps here are largely redundant — a template sync regenerates uv.lock by re-resolving to the newest allowed versions — but they are harmless, and the same entry is what surfaces vulnerable transitive dependencies as PRs between syncs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011texLkDBELWbXsBf6San3M
albertotb
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three small CI/automation changes, now that
mainrequiresfrontend,backend,contractanddocker.1. Drop the
paths:filters so the required checks always reportA required check whose workflow is filtered out never reports, so GitHub parks the PR at "Expected — waiting for status" indefinitely. With all four required, that would have stalled every backend-only sync PR (no
frontend/**changes →Frontendnever runs) — precisely the PRs the gating exists for — and every docs-only PR. All four now run on every PR and push tomain: ~1 minute per job, in exchange for gates that actually gate.2. Narrow the Docker check to the wiring
ContractandDockerwere asserting the same three endpoints, once against uvicorn and once through nginx.Dockernow makes a single request: reaching/healthunder/apiproves the image runs and the proxy strips the prefix, which is all this job is for. The endpoints themselves stayContract's job, asserted once. Verified against the real compose stack — frontend served,/api/health→{"status":"ok"}through nginx.3. Dependabot entry for the backend
The dependency graph already scans
backend/uv.lock(visible asGraph Update: uv in /backendruns), but turning alerts into PRs needs an explicit ecosystem entry, and the package sits in a subdirectory so it needs its owndirectory: /backend.Routine bumps here are largely redundant — a template sync regenerates
uv.lockby re-resolving to the newest allowed versions, so it carries security fixes forward on its own — but they're harmless, and the same entry is what surfaces vulnerable dependencies between syncs. If the churn is unwelcome,open-pull-requests-limit: 0on that entry suppresses routine version PRs while leaving security ones; worth checking against how your org config produces them before flipping it.🤖 Generated with Claude Code
https://claude.ai/code/session_011texLkDBELWbXsBf6San3M