refactor(ci): drive ci-success from needs

[skevetter]

What

ci-success no longer lists each required job twice. needs: is the single list of jobs. The 40-line hand-written check_result function and its per-job call lines are replaced by one step that reads toJSON(needs) through env: and checks it with jq + bash.

• Always-required jobs (changes precommit lint agent-skill) are named in one commented list in the script. success is required for them.
• Every other needed job is go-gated by default: skipped is allowed only when GO_CHANGES != "true".
• Adding a job to needs: is now checked with no script edit.
• Error messages, if: always(), and exit semantics are unchanged. needs: membership and other jobs are untouched.
• GO_CHANGES and NEEDS go through env:, not ${{ }} interpolation into the script body.
• If jq fails to parse NEEDS, the step exits non-zero (fail closed). rows= assignment under the default bash -eo pipefail shell.

Verification

Run body extracted from pr-ci.yml (via YAML parse) and run in a throwaway harness under bash --noprofile --norc -eo pipefail. Old function was run against the same inputs, with needs.<job>.result mapped to variables. Same exit code and same message set in every case. Run on jq 1.7.1 and jq 1.8.2 with identical output.

#	Case	go	New exit	New output	Old exit	Parity
1	all success	true	0	(none)	0	same
2	go-gated jobs skipped, always-required success	false	0	(none)	0	same
3	go-gated build-cli skipped	true	1	::error::build-cli ended with result=skipped unexpectedly	1	same
4	always-required lint skipped	false	1	::error::lint ended with result=skipped unexpectedly	1	same
5a	integration-tests failure	true	1	::error::integration-tests ended with result=failure	1	same
5b	unit-tests cancelled	true	1	::error::unit-tests ended with result=cancelled	1	same
5c	gated licenses failure, go=false	false	1	::error::licenses ended with result=failure	1	same
6	multiple: unit-tests failure, lint cancelled, agent-skill skipped	false	1	all 3 reported	1	same
7	malformed NEEDS	true	5 (jq error)	jq parse error	n/a	fail closed
8	extra needed job brand-new skipped, no script edit	true / false	1 / 0	error with go=true only	n/a	new only

Other checks:

• YAML parses (Ruby YAML.load_file; check-yaml hook passes).
• prek run --files .github/workflows/pr-ci.yml: actionlint hook passes (with the repo's existing background ignore); check-yaml passes.
• shellcheck on the extracted body, using the repo's -e list: clean.
• Commit is signed (U: good signature, key not in local trust store).
• CI on this PR runs the Go jobs and exercises the real gate.

Note: toJSON key order is GitHub-defined. The new step prints errors in that order. The old function printed them in fixed order. Messages are the same set; only order can differ.

CodeRabbit

coderabbit review --agent --committed --base-commit 7d04a4732 completed: 0 findings, 1 reviewed file.

Part of the pr-ci.yml restructuring series (gate)

Summary by CodeRabbit

• Chores
  • Updated pull request checks to consistently evaluate required jobs and jobs gated by Go changes.
  • Skipped jobs now fail validation when they are required or when Go changes are present; other job failures continue to fail validation.
  • Newly included jobs are automatically considered by the checks.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	cf14f97
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6ad07639ac34d1b203ca7417

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 99e7bf04-fccf-4fba-9eb1-b03c3eeec74f

📥 Commits

Reviewing files that changed from the base of the PR and between 7d04a47 and cf14f97.

📒 Files selected for processing: 1

• .github/workflows/pr-ci.yml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📝 Walkthrough

The ci-success workflow check now evaluates every job listed in needs. It always requires changes, precommit, lint, and agent-skill to run. Other jobs can be skipped only when GO_CHANGES is not "true".

Changes: CI result validation

Layer / File(s)	Summary
Evaluate CI job results .github/workflows/pr-ci.yml	ci-success checks all results in needs. It fails for unsuccessful jobs and for skipped jobs that are always required or when GO_CHANGES is "true".

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Refactor

Merge Risk: ⚪ Minimal · up to cf14f

The CI gate checks the listed jobs under their intended skip rules. No issue requiring a fix before merge was found.

### Architecture Summary

Architecture risk: 🔵 Low · up to cf14f

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/pr-ci.yml: ci-success replaces its helper and fixed list of result checks with iteration over all needs results. It always requires changes, precommit, lint, and agent-skill to run; other dependencies may be skipped only when GO_CHANGES is not "true". Any result other than success, or an impermissible skipped, sets the final status to failure.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: refactoring the ci-success check to use needs as its source of jobs.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 zizmor (1.30.1)

.github/workflows/pr-ci.yml

INFO zizmor: 🌈 zizmor v1.30.1
WARN audit:audit{input=Workflow(file://.github/workflows/pr-ci.yml)}: zizmor::audit::unsound_ternary: couldn't parse expression: matrix.provider-mode || ''parity''
fatal: no audit was performed
'template-injection' audit failed on file://.github/workflows/pr-ci.yml

Caused by:
0: error in 'template-injection' audit
1: failed to locate subfeature 'Subfeature { after: 143, fragment: Regex(Regex("matrix\.provider\-mode\s+\|\|\s+'parity'")) }' in feature ''"${RUNNER_TEMP}/devsy-ci-microsandbox" run --label "${{ matrix.label }}" --expected-count "${{ matrix.expected-spec-count }}" --provider-mode "${{ matrix.provider-mode || ''parity'' }}"''

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	cf14f97
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6ad076398bdd7f34514da7ef

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.