Skip to content

ci: host-eval job (#705) runs in the merge queue but is not a required check — it cannot gate a merge #3039

Open

Description

@dezren39

Problem

PR #3025 (for #705) adds the basic: NixOS host evaluation job to nix-ci.yml, but the job cannot actually gate a merge:

Evidence

  • .github/workflows/nix-ci.yml on main: on: = push[main], merge_group, schedule, workflow_dispatch (verified 2026-10-31).
  • .github/ci-policy.md § "Merge queue": "The queue enforces the same required check as branch protection — basic: proxy port fallbacks".
  • PR ci(nix-ci): add PR-tier NixOS host evaluation job (#705) #3025 Codex review (P2, comment 4431469149) independently flagged the missing PR feedback; disposition recorded on that thread.

Acceptance criteria

  • basic: NixOS host evaluation is added to the required status checks enforced by the main: merge queue pilot ruleset (and branch protection, if it diverges), OR a documented decision records that host-eval stays advisory with main-tier detection as the accepted control.
  • .github/ci-policy.md merge-requirement section updated to match the outcome.
  • A merge-group run with a deliberately broken host config (e.g. fix(amd): quote KRdp service name so it is one systemd unit #701's quoting reverted) is shown to eject / block, if the required-check route is taken.

Filed by queue worker lane C from task 4048 / PR #3025 verification.

Activity

  1. added
    kind/ciCI/CD pipelines, workflows, and build automation
    priority/normalOrdinary priority (the default)
    area/ciCI/CD pipelines, workflows, and build automation (area)
    on Oct 31, 2026
  2. added
    queue/queuedHas a queued task in the Supabase agent queue
    source/creatorFiled by the new-issue-creator job
    task/triageQueue packet kind: verify, reproduce, and route this item
    on Nov 3, 2026
  3. developing-today commented on Nov 3, 2026

    @developing-today
    Contributor

    agent-note:v1
    state: triaged (coverage pass)
    Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
    Found via: coverage pass 2026-11-03

  4. added
    work/assignedQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    and removed
    queue/queuedHas a queued task in the Supabase agent queue
    on Nov 3, 2026
  5. developing-today commented on Nov 3, 2026

    @developing-today
    Contributor

    🤖 Agent note · picked up

  6. developing-today commented on Nov 3, 2026

    @developing-today
    Contributor

    🤖 Agent note · done (triage verdict: STILL LIVE in substance, premise SUPERSEDED — routed as a docs-decision fix)

    Evidence (fresh, 2026-11-03, main 77f911fbfc5):

    • PR ci(nix-ci): add PR-tier NixOS host evaluation job (#705) #3025 is MERGED (2026-10-31) and the basic: NixOS host evaluation job exists in .github/workflows/nix-ci.yml (line 53) — the job itself landed.
    • But the gating premise changed after filing: commit 285e425b7 (2026-11-02, "ci: no PR triggers — workflows run on main push, schedule, or manual dispatch only") removed the merge_group/pull_request triggers. On current main nix-ci.yml runs on push[main], schedule, and workflow_dispatch only — host-eval does not run in the merge queue at all now, so it still cannot gate a merge, for a stronger reason than the one filed.
    • .github/ci-policy.md (§ Merge queue, lines 47–60) is stale against that policy: it still says the queue enforces basic: proxy port fallbacks and that "nix ci also runs on merge_group events".
    • Verification limit: gh api repos/developing-today/code/rulesets and branches/main/protection return empty for the worker token, so the ruleset's current required-check list could not be read directly this run.

    Routing — follow-up queue task 8675 enqueued (small_fix, docs-only, dedupe repo-health:v1:fix:developing-today/code:issue:3039): take acceptance route (b) — update .github/ci-policy.md to record that host-eval stays advisory under the 2026-11-02 main-only CI policy, naming the accepted main-tier controls (host-eval on push-to-main; ci-fix dispatch on host-eval failure, commit 43807e56f; main-broken.yml), and reconcile the merge-queue section with the current triggers; then close #3039 on that record.
    Explicitly NOT routed: acceptance route (a) — adding host-eval to the ruleset's required checks — reverses Drew's 2026-11-02 main-only CI order and needs repo-admin access this token lacks. That is a Drew decision, not a worker fix; if it is ever wanted, task 8675's worker escalates rather than implements.

    This triage (task 8008) completes as triaged.
    (Note: posted via the developing.today GitHub App — the user-token content-creation secondary rate limit is still active this shift.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area/ciCI/CD pipelines, workflows, and build automation (area)kind/ciCI/CD pipelines, workflows, and build automationpriority/normalOrdinary priority (the default)source/creatorFiled by the new-issue-creator jobtask/triageQueue packet kind: verify, reproduce, and route this item

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions