From 77c542295104d2555fd49c177aa2efcb648791e7 Mon Sep 17 00:00:00 2001 From: Bryan Van Deusen Date: Sun, 23 Aug 2026 16:52:59 -0400 Subject: [PATCH] ci: a failing lane must not publish an image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit build gated on lint + typecheck only, so run 4293 failed its test lane and pushed :dev and :09b5f87 regardless — the deployed server was running a build whose tests were red. The comment justified this by saying DB-backed testing happened manually against the dev image rather than on every push. That was true when it was written and stopped being true at 6f21db8, which added the integration lane. The reason went away; the exception didn't. Gate on test and integration too. A : image is the rollback unit for its commit (family rule 46) — one publishable from a failing run is not something you can roll back to. Co-Authored-By: Claude Opus 5 (1M context) --- .forgejo/workflows/ci.yml | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index 1899bc3..5b7c82e 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -193,8 +193,7 @@ jobs: # them ever executed by CI — and the schema the migrations build had never been # checked against the models that read it. # - # Runs for visibility and does NOT gate the build, matching the `test` lane and - # FabledScribe's equivalent job. + # Gates the build, along with every other lane — see the `build` job's `needs`. # # Job key stays separator-free ("integration") with no `name:` — rule 80. act_runner # derives the service-container name from the truncated job display name, and the @@ -261,10 +260,16 @@ jobs: build: name: Build & push image - # Build gates on lint + typecheck. The `test` job runs in parallel for - # visibility but does not block dev image builds (DB-backed integration - # testing happens against the dev image manually, not on every push). - needs: [gate, typecheck, lint] + # Every lane gates the build. This once stopped at lint + typecheck, on the + # reasoning that DB-backed testing happened manually against the dev image + # rather than on every push — true until 6f21db8 added the integration lane, + # and false since. + # + # What that gap cost: run 4293 failed `test` and published :dev and : + # anyway, so the deployed server ran a build whose test lane was red. An image + # tag is the rollback substrate (family rule 46); one that can be published + # from a failing run is not a substrate you can roll back TO. + needs: [gate, typecheck, lint, test, integration] if: needs.gate.outputs.build == 'true' runs-on: python-ci container: