ethernet
7aecab56db
The CI run stayed in progress until its last job ended. Two advisory jobs set that time: the review-comment poller (40 minutes) and the Docker image build (45 minutes). Neither job was required to merge. GitHub refuses `gh run rerun` on a run that is in progress. Thus a reviewer who added the `ci-reviewed` label had to wait for the two slow jobs, and label-rerun.yml carried a 2100-second wait loop for this reason. The fast required jobs were ready long before. Each slow job now runs in its own workflow: - docker.yml owns its `pull_request` trigger and does its own change detection. The new `detect` job runs the same composite action with the same condition that ci.yml applied, so a tests-only PR still skips the build. The `workflow_call` trigger is gone. - ci-review-comment.yml starts on `workflow_run` when CI starts. It reads the workflow and the scripts from the default branch, which is the trust boundary that the old job got from its `ref: default_branch` checkout. The poller reads job results through the API, so it can report on a run that it does not belong to. `WATCH_WORKFLOWS` names sibling workflows for the same commit, and `select_watched_runs` keeps the newest run for each name. Thus the comment still shows the Docker results. The list is newline-separated, because a workflow name can contain a comma. The poller always exits 0 now. It reports on the CI run from a different run, so a failed CI job is not a failure of the poller. The CI run has its own gate for that. Also correct a parse error in label-rerun.yml. STATUS came from the already truncated RUN_ID, so its value was the run id and never "completed". Thus the wait branch always ran. ci.yml no longer needs `packages: write`, because the image build has left.
88 lines
3.3 KiB
YAML
88 lines
3.3 KiB
YAML
name: Label rerun
|
|
|
|
# When the ``ci-reviewed`` label is added to a PR, rerun all failed jobs in
|
|
# the latest CI run. This re-evaluates ``review-labels`` (which now sees the
|
|
# label) and GitHub reruns the dependent ``all-checks-pass`` gate.
|
|
#
|
|
# ``gh run rerun`` only works on a completed run. Thus this waits when the
|
|
# run is still in progress. The wait is now short. The two slowest jobs are
|
|
# the 40-minute comment poller and the 45-minute image build. Each one moved
|
|
# to its own workflow, so a CI run ends when its required jobs end.
|
|
#
|
|
# The review comment updates without help. The poller in
|
|
# ci-review-comment.yml watches the CI run through the API. It gets the
|
|
# rerun results.
|
|
|
|
on:
|
|
pull_request:
|
|
types: [labeled]
|
|
|
|
permissions:
|
|
actions: write
|
|
pull-requests: read
|
|
|
|
concurrency:
|
|
group: label-rerun-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
rerun-review-labels:
|
|
name: Rerun review-labels job
|
|
if: github.event.label.name == 'ci-reviewed'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 40
|
|
steps:
|
|
- name: Wait for CI run to finish, then rerun failed jobs
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
REPO: ${{ github.repository }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
run: |
|
|
set -uo pipefail
|
|
|
|
# Find the latest CI run for this PR's head SHA.
|
|
RUN_INFO=$(gh run list \
|
|
--repo "$REPO" \
|
|
--commit "$HEAD_SHA" \
|
|
--workflow ci.yml \
|
|
--limit 1 \
|
|
--json databaseId,status \
|
|
--jq '.[0] | "\(.databaseId) \(.status)"' 2>/dev/null || true)
|
|
|
|
if [ -z "$RUN_INFO" ]; then
|
|
echo "No CI run found for this PR — nothing to rerun."
|
|
exit 0
|
|
fi
|
|
|
|
# Split "RUN_ID STATUS" into two vars. Read STATUS from RUN_INFO,
|
|
# not from the truncated RUN_ID. Both values came from the same
|
|
# var before, which made STATUS the run id. Thus the wait branch
|
|
# always ran.
|
|
RUN_ID="${RUN_INFO%% *}"
|
|
STATUS="${RUN_INFO##* }"
|
|
|
|
echo "Latest CI run: $RUN_ID (status: $STATUS)"
|
|
|
|
# If the run is still in progress, wait for it to finish.
|
|
# gh run rerun only works on completed runs — if we try while it's
|
|
# running, GitHub rejects with "cannot be rerun; This workflow is
|
|
# already running".
|
|
if [ "$STATUS" != "completed" ]; then
|
|
echo "Run is $STATUS — waiting for completion (this may take a while)..."
|
|
# gh run watch --exit-status exits non-zero if the run fails,
|
|
# which is expected (the label gate fails). Don't let that kill
|
|
# the workflow — we WANT to rerun failed jobs.
|
|
timeout 2100 gh run watch "$RUN_ID" --repo "$REPO" --interval 15 || true
|
|
|
|
# Verify it's actually completed now.
|
|
STATUS=$(gh run view "$RUN_ID" --repo "$REPO" --json status --jq '.status' 2>/dev/null || echo "unknown")
|
|
if [ "$STATUS" != "completed" ]; then
|
|
echo "Run is still $STATUS after wait — giving up."
|
|
exit 0
|
|
fi
|
|
fi
|
|
|
|
echo "Run completed. Rerunning all failed jobs..."
|
|
gh run rerun "$RUN_ID" --repo "$REPO" --failed || true
|
|
echo "Done. GitHub will rerun review-labels and all dependent jobs."
|