From bdf9f681759116233358b462fccc128e19641e09 Mon Sep 17 00:00:00 2001 From: ops-ci-01 Date: Wed, 19 Aug 2026 17:45:24 -0500 Subject: [PATCH 1/3] docs(ci): state the measured push-CI model in ci.yml's when-comment The old comment said push CI is restricted to "protected branches (main)", which implied next lacked post-merge verification. next is protected and the default branch since 2026-08-19, and it is not unverified: publish.yml's verify step runs the complete mandatory set on every push to next, mirroring this pipeline step-for-step (enforced by verify-release.test.mjs). The postgres run and push-ci status context it does not re-run duplicate pre-merge coverage, since PR CI tests the merge ref whose tree equals the squash commit. Measured 2026-08-19: the 21 most recent push events on next each ran exactly one pipeline (publish), zero ci. No behavior change. --- .woodpecker/ci.yml | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml index 35acff9e..ac68ef1f 100644 --- a/.woodpecker/ci.yml +++ b/.woodpecker/ci.yml @@ -7,11 +7,20 @@ variables: - &enable_pnpm 'corepack enable' when: - # PR + manual CI run on any branch — the pull_request pipeline is the merge gate. - # push CI is restricted to protected branches (main) so a feature-branch push no - # longer fires a redundant SECOND pipeline alongside its PR pipeline. This ~halves - # CI load on the storage-constrained runner with zero loss of gating (branch - # protection requires no push/ci status context; main still gets full push CI). + # PR + manual CI run on any branch: the pull_request pipeline is the merge + # gate (required status check on next; next is protected and the DEFAULT + # branch since 2026-08-19). + # Push CI runs on main only. next deliberately runs NO push ci: post-merge + # verification on next is carried by publish.yml's `verify` step + # (pnpm verify:release), which mirrors this pipeline's complete mandatory + # set step-for-step, enforced by scripts/verify-release.test.mjs. The two + # things push-to-next does not re-run, the postgres-path test and a + # push-ci status context, duplicate pre-merge coverage: PR CI tests the + # merge ref, whose tree equals the landed squash commit. Measured + # 2026-08-19: the 21 most recent push events on next each ran exactly one + # pipeline (publish), zero ci. + # Keeping push ci off next also avoids a redundant second full-suite run + # per merge on the storage-constrained runner. - event: [pull_request, manual] - event: push branch: main -- 2.54.0 From 781a1fddc5c4b9d5dae6643218eef70e1ab60f54 Mon Sep 17 00:00:00 2001 From: ops-ci-01 Date: Wed, 19 Aug 2026 18:41:48 -0500 Subject: [PATCH 2/3] docs(ci): soften protection parenthetical to the measurable claim rev-code-01 review id 215: the branch-protection API is admin-gated for seat tokens, so 'required status check' cannot be evidenced inline; the comment states only what carries its own evidence. Protection and default-branch status are API-readable and stay. --- .woodpecker/ci.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml index ac68ef1f..13b5e05f 100644 --- a/.woodpecker/ci.yml +++ b/.woodpecker/ci.yml @@ -8,8 +8,7 @@ variables: when: # PR + manual CI run on any branch: the pull_request pipeline is the merge - # gate (required status check on next; next is protected and the DEFAULT - # branch since 2026-08-19). + # gate (next is protected and the default branch since 2026-08-19). # Push CI runs on main only. next deliberately runs NO push ci: post-merge # verification on next is carried by publish.yml's `verify` step # (pnpm verify:release), which mirrors this pipeline's complete mandatory -- 2.54.0 From ce633b4d50cc957d6ba5ee4b961b6d1dba8c51e6 Mon Sep 17 00:00:00 2001 From: ops-ci-01 Date: Wed, 19 Aug 2026 19:14:40 -0500 Subject: [PATCH 3/3] docs(ci): correct the merge-ref claim; PR CI tests the head tree My own comment asserted 'PR CI tests the merge ref, whose tree equals the landed squash commit' - never measured. Pipeline API refs show pull_request runs execute refs/pull/N/head (2542, 2545): the head tree, not a merge ref. If next advances between run and merge, the landed tree differs from the tested one; that residual is what publish verify re-covers post-merge (full verify:release on the push, PGlite path). Same evidence discipline this PR exists to enforce; the claim is corrected to what was measured. --- .woodpecker/ci.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml index 13b5e05f..f5fc7729 100644 --- a/.woodpecker/ci.yml +++ b/.woodpecker/ci.yml @@ -12,12 +12,12 @@ when: # Push CI runs on main only. next deliberately runs NO push ci: post-merge # verification on next is carried by publish.yml's `verify` step # (pnpm verify:release), which mirrors this pipeline's complete mandatory - # set step-for-step, enforced by scripts/verify-release.test.mjs. The two - # things push-to-next does not re-run, the postgres-path test and a - # push-ci status context, duplicate pre-merge coverage: PR CI tests the - # merge ref, whose tree equals the landed squash commit. Measured - # 2026-08-19: the 21 most recent push events on next each ran exactly one - # pipeline (publish), zero ci. + # set step-for-step, enforced by scripts/verify-release.test.mjs. PR CI + # tests the PR HEAD tree (refs/pull/N/head, measured 2026-08-19), not a + # merge ref, so if next advances before a merge the landed tree differs + # from the tested one; publish verify re-runs the full set on the landed + # tree (PGlite path). Measured 2026-08-19: the 21 most recent push events + # on next each ran exactly one pipeline (publish), zero ci. # Keeping push ci off next also avoids a redundant second full-suite run # per merge on the storage-constrained runner. - event: [pull_request, manual] -- 2.54.0