From 965b9f263a6340979a6fe6e0d3a55bd7aed16e14 Mon Sep 17 00:00:00 2001 From: "Adam Perry @ OpenAI" Date: Tue, 11 Aug 2026 18:19:40 +0000 Subject: [PATCH] Run required CI against pull request merge commits (#38051) ## Why Checking only the pull request head can miss conflicts with changes already on `main`. ## What changed Remove explicit pull request head refs from required workflow checkouts so GitHub Actions checks out the synthetic merge commit by default. Keep the blocking gate on the same combined revision as the child workflows it evaluates, and document the merge-commit policy in the workflow README. GitOrigin-RevId: dc357caa5dc43f46b9b9a0edea6ee560b4fe8efb --- .github/workflows/README.md | 3 +++ .github/workflows/bazel.yml | 5 ----- .github/workflows/blob-size-policy.yml | 1 - .github/workflows/blocking-ci.yml | 11 ++--------- .github/workflows/cargo-deny.yml | 1 - .github/workflows/codespell.yml | 1 - .github/workflows/repo-checks.yml | 1 - .github/workflows/rust-ci.yml | 5 ----- .github/workflows/sdk.yml | 2 -- .github/workflows/v8-canary.yml | 8 +++----- 10 files changed, 8 insertions(+), 30 deletions(-) diff --git a/.github/workflows/README.md b/.github/workflows/README.md index b2403b749c..70445ab593 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -4,6 +4,9 @@ The workflows in this directory are split so that pull requests get fast, review ## Pull Requests +- Required checks run against GitHub's synthetic merge commit, not the pull + request head alone. This includes changes already on `main` and catches + conflicts before they reach the branch. - `bazel.yml` is the main pre-merge verification path for Rust code. It runs Bazel `test` and Bazel `clippy` on the supported Bazel targets, including the generated Rust test binaries needed to lint inline `#[cfg(test)]` diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index 4197da9cb0..568086a93d 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -54,7 +54,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - name: Prepare Bazel CI @@ -154,7 +153,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - name: Test BuildBuddy Bazel wrapper @@ -272,7 +270,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - name: Prepare Bazel CI @@ -365,7 +362,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - name: Prepare Bazel CI @@ -465,7 +461,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - name: Prepare Bazel CI diff --git a/.github/workflows/blob-size-policy.yml b/.github/workflows/blob-size-policy.yml index 176f368938..f80fb0e4b3 100644 --- a/.github/workflows/blob-size-policy.yml +++ b/.github/workflows/blob-size-policy.yml @@ -15,7 +15,6 @@ jobs: mode: audit - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/blocking-ci.yml b/.github/workflows/blocking-ci.yml index fe66fdd509..c6f00555a3 100644 --- a/.github/workflows/blocking-ci.yml +++ b/.github/workflows/blocking-ci.yml @@ -60,17 +60,10 @@ jobs: - sdk runs-on: ubuntu-24.04 steps: - # Keep the helper on the same revision as the caller and child workflows. - # CI workflow uploads are restricted, so this repository does not need a - # separate trusted-base checkout for the terminal policy step. Using the - # PR head also lets the introducing PR exercise a newly added helper. - # - # During the initial rollout, PR branches created before - # check_ci_results.py exists must rebase onto main before this gate can - # run. + # Keep the helper on the same combined revision as the child workflows so + # the merge gate evaluates the exact candidate they validated. - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - name: Require successful dependencies diff --git a/.github/workflows/cargo-deny.yml b/.github/workflows/cargo-deny.yml index ccbf80e12f..0f8ebae902 100644 --- a/.github/workflows/cargo-deny.yml +++ b/.github/workflows/cargo-deny.yml @@ -13,7 +13,6 @@ jobs: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - uses: ./.github/actions/setup-ci diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index a1751c8d29..996b3deddb 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -17,7 +17,6 @@ jobs: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - name: Annotate locations with typos uses: codespell-project/codespell-problem-matcher@b80729f885d32f78a716c2f107b4db1025001c42 # v1.1.0 diff --git a/.github/workflows/repo-checks.yml b/.github/workflows/repo-checks.yml index 6c82ebcd0c..fe297b2742 100644 --- a/.github/workflows/repo-checks.yml +++ b/.github/workflows/repo-checks.yml @@ -13,7 +13,6 @@ jobs: - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - uses: ./.github/actions/setup-ci diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 01d51aac0e..3702bece29 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -16,7 +16,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} fetch-depth: 0 persist-credentials: false - name: Detect changed paths (no external action) @@ -69,7 +68,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - uses: ./.github/actions/setup-ci - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0 @@ -95,7 +93,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - uses: ./.github/actions/setup-ci - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0 @@ -120,7 +117,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - uses: ./.github/actions/setup-ci - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0 @@ -207,7 +203,6 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 if: ${{ steps.argument_comment_lint_gate.outputs.run == 'true' }} with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - name: Run argument comment lint on codex-rs via Bazel if: ${{ steps.argument_comment_lint_gate.outputs.run == 'true' }} diff --git a/.github/workflows/sdk.yml b/.github/workflows/sdk.yml index 0c6bb8993e..f2e8fc7e12 100644 --- a/.github/workflows/sdk.yml +++ b/.github/workflows/sdk.yml @@ -13,7 +13,6 @@ jobs: - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - name: Test Python SDK @@ -55,7 +54,6 @@ jobs: - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - name: Install Linux bwrap build dependencies diff --git a/.github/workflows/v8-canary.yml b/.github/workflows/v8-canary.yml index 97610cd318..b804086389 100644 --- a/.github/workflows/v8-canary.yml +++ b/.github/workflows/v8-canary.yml @@ -17,9 +17,9 @@ jobs: metadata: runs-on: ubuntu-latest outputs: - # A stale PR head can contain the old detector, which does not emit this - # output. Missing must mean "run" so older branches cannot silently skip - # the expensive V8 coverage while reporting success. + # Older revisions can contain a detector that does not emit this output. + # Missing must mean "run" so they cannot silently skip the expensive V8 + # coverage while reporting success. canary_required: ${{ steps.changes.outputs.canary_required || 'true' }} v8_version: ${{ steps.v8_version.outputs.version }} windows_source_required: ${{ steps.changes.outputs.windows_source_required }} @@ -27,7 +27,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} fetch-depth: 0 persist-credentials: false @@ -173,7 +172,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false - name: Set up Bazel