Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 7 additions & 18 deletions template/.github/workflows/ci.yaml.jinja
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ jobs:
needs:
- get-values
- check-skip-duplicate
- lint
if: needs.check-skip-duplicate.outputs.should-run == 'true'
permissions:
id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
Expand All @@ -72,7 +73,7 @@ jobs:
AWS_ACCOUNT_ID: "{% endraw %}{{ aws_production_account_id }}{% raw %}"
SHOW_PREVIEW_COMMENT_ON_PR: ${{ github.event_name == 'pull_request' }}

required-check:
workflow-summary:
runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
timeout-minutes: {% endraw %}{{ gha_short_timeout_minutes }}{% raw %}
needs:
Expand All @@ -81,21 +82,9 @@ jobs:
- check-skip-duplicate
- pulumi-workflow
permissions:
statuses: write # needed for updating status on Dependabot PRs
statuses: write # needed for updating status on PRs
if: always()
steps:
- name: Set status for duplicate detection
if: needs.check-skip-duplicate.outputs.should-run != 'true'
env:
GH_TOKEN: ${{ github.token }}
run: |
gh api \
-X POST -H "Accept: application/vnd.github.v3+json" \
"/repos/${{ github.repository }}/statuses/${{ github.sha }}" \
-f state=pending -f context="required-check" -f description="⏭️ Workflow skipped due to duplicate detection"
echo "⏭️ Workflow was skipped due to duplicate detection - status set to pending to block merge"
exit 0

- name: fail if prior job failure
run: |
failure_pattern="^(failure|cancelled)$"
Expand All @@ -109,15 +98,15 @@ jobs:
fi
echo "✅ All jobs completed successfully or were skipped"

- name: Mark required-check as succeeded
if: needs.check-skip-duplicate.outputs.should-run == 'true'
- name: Mark the required-check as succeeded so the PR can be merged
if: ${{ github.event_name == 'pull_request' }}
Copy link

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The condition syntax if: ${{ github.event_name == 'pull_request' }} is inconsistent with the rest of the file, which uses the simpler if: syntax without wrapping the expression in ${{ }} (see lines 44, 59, 86, 113). For consistency, this should be written as if: github.event_name == 'pull_request'.

Copilot uses AI. Check for mistakes.
env:
GH_TOKEN: ${{ github.token }}
run: |
gh api \
-X POST -H "Accept: application/vnd.github.v3+json" \
"/repos/${{ github.repository }}/statuses/${{ github.sha }}" \
-f state=success -f context="required-check" -f description="✅ All required checks passed" \
"${{ github.event.pull_request.statuses_url }}" \
Copy link

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The use of github.event.pull_request.statuses_url is inconsistent with line 119, which uses the explicit path format /repos/${{ github.repository }}/statuses/{sha}. While both approaches should work with gh api, using a consistent format throughout the file would improve maintainability. Consider using "/repos/${{ github.repository }}/statuses/${{ github.event.pull_request.head.sha }}" instead to match the pattern on line 119.

Suggested change
"${{ github.event.pull_request.statuses_url }}" \
"/repos/${{ github.repository }}/statuses/${{ github.event.pull_request.head.sha }}" \

Copilot uses AI. Check for mistakes.
-f state=success -f context="required-check" -f description="✅ All required checks passed in the job triggered by pull_request" \
Copy link

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The description text "✅ All required checks passed in the job triggered by pull_request" is unnecessarily verbose. The phrase "in the job triggered by pull_request" doesn't add meaningful information. Consider simplifying to "✅ All required checks passed" to match the clarity of the description on line 120.

Suggested change
-f state=success -f context="required-check" -f description="✅ All required checks passed in the job triggered by pull_request" \
-f state=success -f context="required-check" -f description="✅ All required checks passed" \

Copilot uses AI. Check for mistakes.
-f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"

- name: Mark updated Dependabot commit of devcontainer hash as succeeded
Expand Down