Repository navigation
ci: the required PR-tier check (basic: proxy port fallbacks) never runs on pull requests — nix-ci has no pull_request trigger #4940
Description
Problem
.github/ci-policy.md says the basic-validation (PR) tier is the only merge requirement, and that basic: proxy port fallbacks is the required status context branch protection and the merge queue enforce. But the workflow that defines it — .github/workflows/nix-ci.yml — has no pull_request trigger:
on:
push:
branches: [main]
schedule:
- cron: "17 8 * * *"
workflow_dispatch:So on an ordinary PR the job never starts, and the PR shows only bot reviewers. Observed on PR #4935 (bin/antigravity-direct.mjs only): statusCheckRollup was [CodeRabbit NEUTRAL] with mergeStateStatus: CLEAN — no basic: context at all, neither pending nor absent-but-required.
Why it matters
- The policy's stated merge gate cannot run on the thing it is meant to gate. A PR that breaks proxy-port fallbacks (the exact failure codex-proxy: PR #431's {env:CODEX_PROXY_PORT} baseURL has no fallback — opencode outside a home-manager shell gets an empty port #434/codex-proxy follow-up from PR #431: single-source the agy-proxy, clef-proxy and antigravity-ls-proxy ports too #435 built this job for) merges with a clean state.
- The merge-queue note in the same doc says
nix cialso runs onmerge_groupevents "which is why" the queue can validate a combined head — that trigger is absent too, so the queue's validation is also unproven. - A worker following "CI-first verification" cannot distinguish "check green" from "check never ran" from
gh pr viewoutput; both read as no failing check.
Suggested fix
Add pull_request: (and merge_group:) to nix-ci.yml's triggers for the proxy-port-fallbacks job, or split that job into its own workflow with a pull_request trigger if the rest of nix ci is deliberately main-only (host-eval and full flake checks are the expensive parts). The job is pure bash/grep with a 5-minute timeout, so it belongs on every PR.
Evidence
.github/workflows/nix-ci.yml:1-9— triggers..github/ci-policy.md"Merge requirement" and "Merge queue (pilot, 2026-10-29)".- PR fix(antigravity-direct): parse ANTIGRAVITY_DIRECT_PORT and _TIMEOUT_MS through the house helpers (#2823) #4935:
gh pr view 4935 --json statusCheckRollup→ CodeRabbit only; merged 2026-11-03T13:59:30Z withmergeStateStatus: CLEAN.
Found while landing #2823 (queue task 8037, repo-health-code-pilot, lane 02cafe76-eafd-4d0b-aaa6-2b7a737d68dc).
Acceptance criteria
.github/workflows/nix-ci.yml(or a split workflow) runs theproxy-port-fallbacksjob onpull_requestevents, so a PR's statusCheckRollup contains thebasic: proxy port fallbackscontext.- The
merge_grouptrigger is present (or the ci-policy doc is corrected where it claims it), so the merge queue's combined-head validation actually runs. - Verified on a real PR after the change: the basic context appears (pending → success/failure) instead of being absent.
Activity
dezren39 commentedon Nov 3, 2026
Intake review
Evidence in the issue is direct: the workflow's
on:block (push-to-main + schedule + dispatch only) versus the policy doc's claim, plus PR #4935's rollup showing no basic context. Still live: no merged PR references this issue. Near-duplicate watch: #4932 (filed 10 minutes earlier) covers the same missing trigger from the bin/-only-PR angle — the two should be fixed by one workflow change and cross-checked, not worked as two independent fixes. Risks: adding pull_request to the whole nix-ci workflow could multiply CI cost; the issue's suggested split (the one required job in its own PR-triggered workflow) is the cheaper shape. Suggested approach: split or trigger-scope the proxy-port-fallbacks job, then verify on a throwaway PR.🤖 Agent note · filed
developing-today commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 8549 (triage, queued, priority 50) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03
dezren39 commentedon Nov 3, 2026
Concrete confirmation on PR #5184 (code#5099,
pm-stack/opencode-usage-export): immediately after opening,gh pr checks 5184reported only CodeRabbit asskipping;gh run list --branch queue/8765-5099-usage-export-realpathreturned no workflow runs. I also checked the affected-package workflows:.github/workflows/pm-stack-tests.ymland.github/workflows/pm-aggregator-tests.ymlare push-to-main + workflow_dispatch only, so the policy class-2 affected-package test tier does not run for this PR either. The targeted Node test was run locally (6/6 pass). This is a concrete example of the existing trigger gap, not a regression introduced by #5184.10 remaining items
dezren39 commentedon Nov 4, 2026
agent-note:v1
event: triaged; follow-up queued
task: 8549 (repo-health-code-pilot; worker repo-worker-code; OpenChamber scheduled lane aea12c82-c5af-4e5a-9b66-f8e360f87177)
verdict: the required PR-tier check is still absent from pull_request and merge_group runs at current origin/main 8331a77. #4932 is CLOSED as superseded by this canonical issue; no competing open PR exists. PR #5184 currently has only CodeRabbit NEUTRAL in its status rollup.
action: fix is scoped and enqueued as small_fix task 9339: dedicated lightweight workflow for the proxy-port-fallbacks script on pull_request + merge_group, preserving
basic: proxy port fallbacks, without starting expensive Nix checks on every PR. Acceptance requires confirming the check on a real PR and merge-group run.labels: queue/queued + status/needs-triage now reflect follow-up task 9339; this claim work/assigned, queue/claimed, and status/in-progress were removed. No files changed by this triage.
dezren39 commentedon Nov 4, 2026
🤖 Agent note · picked up
basic: proxy port fallbacks) never runs on pull requests — nix-ci has no pull_request trigger #4940 OPEN; ci: nix-ci basic tier has no pull_request trigger — bin/-only PRs merge with zero basic checks #4932 CLOSED as superseded; no open PR matches ci: the required PR-tier check (basic: proxy port fallbacks) never runs on pull requests — nix-ci has no pull_request trigger #4940. PR fix(pm-stack): handle symlinked usage-export entry points #5184 is unrelated and Drew-authored, so it will not be touched.dezren39 commentedon Nov 4, 2026
agent-note:v1
state: pr_opened
queue: repo-health-code-pilot
task: 9339 (worker repo-worker-code; lane 262eb403-3347-4a7c-ba6b-e7bc263ca853)
artifact: PR #5361 #5361 (commit a2db675)
checks: pull_request check basic: proxy port fallbacks is present in the PR status rollup and currently QUEUED; CodeRabbit is NEUTRAL.
next: do not merge until the PR check is green and the merge_group run is verified; park if CI remains pending after the five-minute poll window.
dezren39 commentedon Nov 4, 2026
agent-note:v1 — task 9339 done (lane code-n, resumed from prior attempt's
targeted_tests_passedcheckpoint).1dc88149c21852da9214a3ae28efae902de6c1f8(2026-11-04T10:22:09Z); this issue auto-closed as COMPLETED viaCloses #4940.basic: proxy port fallbacks— SUCCESS, run https://github.com/developing-today/code/actions/runs/41799042236a2db6752:has_any_findings: false.merge_grouprun was generated for it. The merged.github/workflows/proxy-port-fallbacks.ymlcarries themerge_group: [checks_requested]trigger alongsidepull_request, so the first queued merge will produce the same context; the trigger + job name were verified in the merged diff and by actionlint.git diff --checkpass.