GitNexus/.github
Gergo Magyar 8674b2b453 ci: cascade quality gate, centralize change detection, prune scope-parity matrix
Add a `paths-changes` job to ci.yml that runs `dorny/paths-filter@v3`
ONCE per CI run and exposes three outputs to the four reusable
sub-workflows via `with:`:

  - web (e2e gate)
  - shared-resolution (forces full parity matrix)
  - changed-languages (JSON array of language slugs to run parity for)

Tier the four sub-workflows so cheap quality checks gate the expensive
tier. `quality` failure now auto-skips `tests`, `e2e`, and
`scope-parity` via `needs: quality` + `if: needs.quality.result ==
'success'`. The `ci-status` aggregator surfaces the originating failure
first so cascade-skipped downstream results don't produce misleading
secondary errors. The aggregator now also includes `paths-changes` in
its `needs:` so a transient filter API failure surfaces with the
correct error, not a fake "Quality jobs failed".

`shared-resolution` is the OR of six independent signals — any change
that could regress any language's parity forces the full matrix:

  - shared-ingestion   (gitnexus/src/core/ingestion/** minus languages/)
  - shared-types       (gitnexus-shared/**)
  - shared-parser-infra (gitnexus/src/core/tree-sitter/**)
  - shared-test-harness (resolver helpers + gitnexus/test/helpers/**)
  - shared-pipeline    (ci.yml, ci-quality.yml, ci-scope-parity.yml,
                        setup-gitnexus action, discovery script)
  - shared-config      (package.json, package-lock.json, vitest.config,
                        tsconfig)

`predicate-quantifier: 'every'` is required for the shared-ingestion
negation to actually exclude (dorny/paths-filter#184); the other
filters use default OR semantics. Both filter steps carry
`continue-on-error: true` so a transient REST API blip falls back to
the conservative full-battery posture rather than blocking the PR.

In `ci-scope-parity.yml`, the discover job intersects MIGRATED_LANGUAGES
with `changed-languages` using strict equality (`IN(.slug; $changed[])`,
not `inside()` which would substring-match `c` against `cpp`). When
`shared-resolution-changed=true` the full matrix runs. The discover
step validates both its own script output and the caller-supplied
`changed-languages` input as JSON arrays before passing them through
`jq --argjson`, so malformed input fails loud at the discover step
instead of producing `fromJSON('')` matrix crashes downstream. An
empty filtered matrix is handled by `if: needs.discover.outputs.languages != '[]'`
on the parity job; the outer workflow conclusion stays `success`.

`ci-e2e.yml` drops its in-workflow `check-changes` job and consumes the
centralized `web-changed` input.

`save-pr-meta` and `ci-status` switch from `if: always()` to
`if: ${{ !cancelled() }}` so user-initiated workflow cancellation
actually cancels them (actions/runner#491).

Dead backward-compat hyphenated artifact copies in `save-pr-meta`
removed — verified the `ci-report.yml` on main reads only
underscore-named files.

Conservative `'true'` defaults on every input for non-PR callers
(release-candidate.yml, publish.yml via workflow_call): the full
battery still runs on every push to main and every release.

Adds `GITHUB_STEP_SUMMARY` lines in both `paths-changes` and the
scope-parity `discover` step so reviewers and agents can see why a
tier was pruned vs. ran without scraping logs.
2026-05-14 17:27:16 +01:00
..
actions fix(security): Pin Docker Node base images, remove runtime package-manager CVE surface, verify Trivy on PRs, and harden Dependabot policy (#1455) 2026-05-09 16:55:31 +01:00
ISSUE_TEMPLATE docs: agent development framework, GitHub templates, eval refactor (#479) 2026-03-25 06:48:41 +00:00
scripts fix(security): close URL/regex/tag-filter sanitization cluster (U7) (#1330) 2026-05-08 07:11:29 +01:00
workflows ci: cascade quality gate, centralize change detection, prune scope-parity matrix 2026-05-14 17:27:16 +01:00
dependabot.yml fix(security): Pin Docker Node base images, remove runtime package-manager CVE surface, verify Trivy on PRs, and harden Dependabot policy (#1455) 2026-05-09 16:55:31 +01:00
FUNDING.yml process maps and funding.yml 2026-01-28 13:14:16 +05:30
PULL_REQUEST_TEMPLATE.md docs: agent development framework, GitHub templates, eval refactor (#479) 2026-03-25 06:48:41 +00:00
release-drafter.yml ci: standardize workflow concurrency and automate release-note labeling (#837) 2026-04-15 13:24:53 +01:00
release.yml feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
zizmor.yml ci: add fork-safe PR autofix pipeline (#1446) 2026-05-09 13:35:04 +01:00