ci: Skip test suite when no code files changed #5889
3 issues
High
Tests on master/release/major branches can be incorrectly skipped - `.github/workflows/test-integrations-ai.yml:51`
The PR description states 'Pushes to master/release//major/ branches always run the full suite', but the test job's if condition (line 51) only checks needs.changes.outputs.has_code_changes == 'true' without considering the branch. This means pushes to protected branches that contain only non-code changes (e.g., a merge commit touching only docs) will skip tests, violating the stated requirement. The condition should include a bypass for push events to these protected branches.
Also found at:
.github/workflows/ci.yml:44.github/workflows/test-integrations-agents.yml:51.github/workflows/test-integrations-cloud.yml:51.github/workflows/test-integrations-common.yml:51.github/workflows/test-integrations-dbs.yml:51.github/workflows/test-integrations-gevent.yml:51.github/workflows/test-integrations-graphql.yml:51.github/workflows/test-integrations-mcp.yml:51.github/workflows/test-integrations-network.yml:51.github/workflows/test-integrations-tasks.yml:51.github/workflows/test-integrations-web-1.yml:51.github/workflows/test-integrations-web-2.yml:51.github/workflows/test-integrations-flags.yml:51scripts/split_tox_gh_actions/templates/base.jinja:36-56
Tests on protected branches not always running as documented - `.github/workflows/test-integrations-ai-workflow.yml:51`
The PR description states 'Pushes to master/release//major/ branches always run the full suite', but the implementation does not include this behavior. The changes job unconditionally runs dorny/paths-filter for all events, including push events on protected branches. For push events, the filter compares against the previous commit, so if a push to master only modifies documentation files, tests will be skipped. This violates the stated requirement and could allow untested code to reach production branches.
Also found at:
.github/workflows/test-integrations-ai.yml:51.github/workflows/test-integrations-graphql.yml:51.github/workflows/test-integrations-misc.yml:51.github/workflows/test-integrations-tasks.yml:51.github/workflows/test-integrations-web-2.yml:51scripts/split_tox_gh_actions/templates/base.jinja:36-56.github/workflows/ci.yml:44-45.github/workflows/test-integrations-common.yml:51.github/workflows/test-integrations-flags.yml:51.github/workflows/test-integrations-gevent.yml:51.github/workflows/test-integrations-network.yml:51.github/workflows/test-integrations-web-1.yml:51scripts/split_tox_gh_actions/templates/test_group.jinja:3
Medium
Gate job does not handle 'cancelled' status for changes job, potentially allowing bypass - `.github/workflows/test-integrations-graphql.yml:122-124`
The check_required_tests gate job checks for needs.changes.result == 'failure' but not 'cancelled'. In GitHub Actions, job results can be success, failure, cancelled, or skipped. If the changes job is cancelled (e.g., due to infrastructure issues or edge cases), the gate condition needs.changes.result == 'failure' would be false, and since test-graphql would be skipped (its dependency didn't complete successfully), the second condition also evaluates to false. This allows the gate to pass without tests running.
4 skills analyzed
| Skill | Findings | Duration | Cost |
|---|---|---|---|
| code-review | 1 | 4m 41s | $4.68 |
| find-bugs | 2 | 10m | $6.81 |
| skill-scanner | 0 | 11m 47s | $2.24 |
| security-review | 0 | 14m 14s | $3.56 |
Duration: 40m 43s · Tokens: 10.2M in / 164.8k out · Cost: $17.34 (+extraction: $0.03, +merge: $0.01, +fix_gate: $0.01, +dedup: $0.01)