Repository navigation
ci: nix-ci basic tier has no pull_request trigger — bin/-only PRs merge with zero basic checks #4932
Description
Problem
.github/ci-policy.md states the PR tier is the merge requirement and describes basic: proxy port fallbacks as the required context, and .github/workflows/nix-ci.yml's own header comment says the job "runs on every PR". The workflow's on: block, however, is:
on:
push:
branches: [main]
schedule:
- cron: "17 8 * * *"
workflow_dispatch:There is no pull_request trigger, so the basic tier never runs on a PR. A bin/-only PR therefore gets no basic-tier verification at all: the check rollup contains only CodeRabbit (neutral/skipping) and gh run list --branch <branch> returns no Actions runs.
Evidence
While landing PR #3487 (bin/provider-catalog-sync.mjs shape validation, bin/ + tests only):
gh run list --branch queue/5433-2827-catalogsync-shape→ only the two scheduledjules-daily-*push workflows, both failing in 0s; nonix cirun, before or after a fresh push to the branch.gh pr checks 3487→ onlyCodeRabbit skipping.gh pr view 3487 --json mergeable,mergeStateStatus→MERGEABLE CLEAN, so the merge proceeded without the required context ever being reported.- Local evidence stood in for CI:
node --test bin/provider-catalog-sync.test.mjs→ 35 pass / 0 fail.
This is the same class of gap as #4533 (mcpx PR test tier never triggers) and #3039 (host-eval not a required check), for the nix-ci basic tier.
Impact
Any PR touching only bin/, docs, or other paths outside the PR-triggered workflows (id, mcpx*, mod-tidy, opencode-config-guard, production-line-guard, repo-sweeper) merges unverified by Actions. The proxy-port-fallback check is exactly the guard for bin/*.mjs port defaults, i.e. the one job that should have run here.
Acceptance criteria
-
nix-ci.ymlgains apull_requesttrigger (with or without a paths filter that includesbin/**,.opencode/opencode.jsonc,home/common/default.nix, and the workflow itself). -
basic: proxy port fallbacksreports on abin/-only PR (verify with a scratch PR, not just by reading the YAML). -
ci-policy.md, the workflow comment, and the actual trigger agree; if a path filter is deliberate, the policy says which paths each basic-tier job covers. - Merge-queue behaviour is unchanged (the
merge_grouptrigger, if required by the ruleset, is preserved).
Activity
dezren39 commentedon Nov 3, 2026
Intake review
Acceptance criteria were already present in the body prose; this pass normalizes labels and records the review. Evidence is first-hand from PR #3487's landing (no nix ci run on the branch; merge proceeded CLEAN without the required context). Still live. Near-duplicate watch: #4940 covers the same missing
pull_requesttrigger focused on the requiredbasic: proxy port fallbackscontext — one workflow change should close both; whoever picks this up should check #4940's state first. Related older filings: #4533, #3039 (same gap class for other tiers). Risks: full-workflow pull_request triggers raise CI load; scope the trigger to the basic tier. Suggested approach: as #4940 — trigger-scope or split the basic tier, verify on a bin/-only PR.🤖 Agent note · filed
developing-today commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 8544 (triage, queued, priority 40) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03
dezren39 commentedon Nov 3, 2026
agent-note:v1
state: picked_up
worker: repo-worker-code
task: 8544
lane: aea12c82-c5af-4e5a-9b66-f8e360f87177
Picked up for current-main triage. Issue is open; cited PR #3487 is merged; related issue #4940 remains open. Next: inspect current main and compare issue scopes, then record routing, duplicate status, blockers, and ordering.
dezren39 commentedon Nov 3, 2026
agent-note:v1
state: superseded
worker: repo-worker-code
task: 8544
lane: aea12c82-c5af-4e5a-9b66-f8e360f87177
At current main 32d47f7,
.github/workflows/nix-ci.ymlstill has only push-to-main, schedule, and workflow_dispatch triggers; it has no pull_request trigger. The basic proxy-port-fallbacks job exists and.github/ci-policy.mdclassifies it as PR-tier, so the underlying gap remains live. PR #3487 is merged and documents the bin-only symptom; PR #4935 is merged but did not fix the trigger. No open related PR was found. Issue #4940 is open, priority/high, queue/queued, and tracked as task 8549; its intake review says the reports need one shared workflow fix, not independent PRs. Closing #4932 as superseded by #4940; task 8549 remains the route for the canonical report.