From 508dee4f59fa26da5ff20408f8e649a63e440012 Mon Sep 17 00:00:00 2001 From: Vito Sansevero Date: Wed, 28 Oct 2026 04:27:53 -0700 Subject: [PATCH] docs(ci): ruleset edit keeps every rule and integration id; find merge-queue runs --- TESTING.md | 28 +++++++++++++++++++++++++--- tests/vendor/ci-workflow.test.mjs | 1 + 2 files changed, 26 insertions(+), 3 deletions(-) diff --git a/TESTING.md b/TESTING.md index 91d31c3c..dca69a15 100644 --- a/TESTING.md +++ b/TESTING.md @@ -273,6 +273,12 @@ gh run view --json jobs # shows a job that alr gh run view --job --log-failed # that job's failed log, at once ``` +Windows, macOS, Python 3.13/3.14, real ComfyUI and Firefox/WebKit failures +first show up in the merge queue, on the merge-group commit rather than the +pushed one. Find that run with `gh run list --event merge_group --workflow test.yml` +(or `viewerjs-check.yml`) and match its head branch +(`gh-readonly-queue/main/pr--...`). + Start fixing as soon as a failed log shows the cause, but push the fix only after the run for that commit has finished: pull-request runs use `cancel-in-progress`, so a push cancels the running jobs and can hide a second failure. @@ -523,6 +529,8 @@ Before changing paths, SQLite, streams, restore or cleanup: ceilings, never a short wall clock (#242). - Run native Windows CI early for these changes: pull requests run only Linux, so start the full matrix on the branch with `gh workflow run test.yml --ref `. + That run reports the same check names on the PR head, and a red one can hold + the PR out of the queue until it is fixed. Include a Windows impact and evidence note in the PR. All nine OS/Python combinations (they run again in the merge queue) and every applicable exact-head check must pass before merge. Portable `ntpath`/`PureWindowsPath` @@ -573,9 +581,23 @@ gh api repos/ComfyAssets/ComfyUI_PromptManager/rulesets/25960526 \ | jq '.rules[] | select(.type == "required_status_checks") | [.parameters.required_status_checks[].context]' ``` -To change the set, PUT the ruleset's `rules` back with the edited -`required_status_checks` (`gh api --method PUT .../rulesets/25960526 --input `). -Update the manifest whenever required job names change. Keep the frontend check +A PUT replaces the whole `rules` array, so edit the current ruleset in place. +Keep the `deletion`, `non_fast_forward` and `merge_queue` rules, and give every +context `integration_id` 15368 (GitHub Actions), so no other integration can +post a required check. Save the current ruleset first; it is the rollback: + +```sh +gh api repos/ComfyAssets/ComfyUI_PromptManager/rulesets/25960526 > ruleset-before.json +jq '{name, target, enforcement, conditions, bypass_actors, rules: [.rules[] + | if .type == "required_status_checks" + then .parameters.required_status_checks = [$ARGS.positional[] | {context: ., integration_id: 15368}] + else . end]}' ruleset-before.json --args "py3.12 on ubuntu-latest" "..." > ruleset-new.json +gh api --method PUT repos/ComfyAssets/ComfyUI_PromptManager/rulesets/25960526 --input ruleset-new.json +``` + +Afterwards, read it back. Check that the `merge_queue` rule is still there and +that every context keeps its `integration_id`. Update the manifest whenever +required job names change. Keep the frontend check free of path filters so a required check is never silently skipped. ## Unified workspace diff --git a/tests/vendor/ci-workflow.test.mjs b/tests/vendor/ci-workflow.test.mjs index e9dde1a4..1407a4e3 100644 --- a/tests/vendor/ci-workflow.test.mjs +++ b/tests/vendor/ci-workflow.test.mjs @@ -346,6 +346,7 @@ test('the CI workflows run on pull_request, merge_group and push without path fi } assert.doesNotMatch(text, /^ {4}paths(-ignore)?:/m, `${name} has no path filter that would leave a required check pending`); } + assert.doesNotMatch(jobs(readWorkflow('code-quality.yml')).get('security'), /^ {4}if:/m, 'bandit runs on every event'); }); test('every required check reports on a pull request and the gates carry the full matrix', () => {