fix(ci): run go jobs when embedded assets change by skevetter · Pull Request #1492 · devsy-org/devsy

skevetter · 2026-10-15T06:46:13Z

Summary

The changes job's go filter in .github/workflows/pr-ci.yml was an allowlist of 12 entries. PRs that changed Go compile inputs outside it skipped every Go job, and ci-success still passed. This PR replaces the allowlist with directory-level entries and adds the missing inputs.

Part of the pr-ci.yml restructuring series (path filter correctness). Only the changes filter is edited.

Gap found

I checked the filter against go list -test -json for linux, darwin and windows, over the tracked tree at origin/main. The universe was 1937 files.

Covered by the old filter: 1920/1937. Missed:

Files	Reason
`providers/{apple,docker,kubernetes,microsandbox,podman,pro}/provider.yaml`	`go:embed` in `providers/providers.go`
`hack/pro/provider.yaml`	`go:embed` in `hack/pro/main.go`
`pkg/inject/inject.sh`	`go:embed` in `pkg/inject/inject.go`
`pkg/dockerfile/test_Dockerfile`	`go:embed` in `pkg/dockerfile/parse_test.go`
`cmd/workspace/up/testdata/sops-project-secrets.enc.yaml`	testdata read by tests
`pkg/secrets/testdata/sops-age.yaml`	testdata read by tests
`sites/docs-devsy-sh/public/install.sh`	read via `../../sites/...` by `hack/install_script/install_test.go`
`.golangci.yaml`, `.golangci-version`, `Taskfile.yml`, `mise.toml`, `mise.lock`	lint and toolchain config

Change

The go filter now has these entries:

**/*.go, main.go
cmd/**, pkg/**, providers/**, hack/**, e2e/**, **/testdata/**
sites/docs-devsy-sh/public/install.sh (single file, to avoid pulling in the docs site)
go.mod, go.sum, mise.toml, mise.lock, .golangci.yaml, .golangci-version, .goreleaser.yml, Taskfile.yml, THIRD_PARTY_LICENSES.md, .github/workflows/pr-ci.yml

The old entries hack/microsandbox/**, hack/provider_update_ci/**, hack/podman_ci/**, hack/licenses/** and hack/run-managed-policy-e2e.sh are covered by hack/**. Positive globs only. No negation.

Verification

Gap check, new filter: 1937/1937 covered, 0 missed.
Gap check, non-Go probe over desktop/, sites/, *.md, other workflows, package.json, biome.json, renovate.json, community.yaml, paseo.json and .pre-commit-config.yaml: no unintended hits. Five hits: .github/workflows/pr-ci.yml and THIRD_PARTY_LICENSES.md (intended), plus three .md files inside Go-owned trees (see below).
Glob semantics: checked with minimatch@10 (dot: true) against all 2654 tracked files. Every missed file above now matches, and the only non-Go-tree matches are the intended config, main.go, go.mod/go.sum, THIRD_PARTY_LICENSES.md, .github/workflows/pr-ci.yml and the install script.
YAML: the embedded filters string parses and its go list matches the intended list.
actionlint: no new findings. It reports one error at line ~937 (background: true on the free-disk-space step). That is on origin/main too and out of scope.
prek run --files .github/workflows/pr-ci.yml: all hooks passed.

Known over-triggers (safe direction)

e2e/README.md, e2e/tests/up/MICROSANDBOX.md and hack/ci/agent-skill-evaluation.md are docs inside Go-owned trees, so changes to them run Go CI. Directory-level matching is the trade-off. Excluding them needs negation globs, which I did not use.
hack/ci/validate-agent-skill.sh also runs Go CI when it changes.

Checker limitations

go list reports 166 files under the local Go build cache (cgo and generated). They are outside the repo and were skipped.
The checker only sees files Go tooling reports and the cross-tree read found by grep over *.go. It does not see files that a shell step reads at runtime (hack/ci/validate-agent-skill.sh is in hack/** anyway).

Summary by CodeRabbit

Chores
- CI now detects a broader range of Go source, test fixture, installation, and build configuration changes when determining whether Go-related checks should run. This improves coverage for changes across the project’s Go code and supporting files.

The changes job's go filter was an allowlist of 12 entries. PRs touching Go compile inputs outside it skipped all Go CI while ci-success passed: - go:embed targets: providers/*/provider.yaml, hack/pro/provider.yaml, pkg/inject/inject.sh, pkg/dockerfile/test_Dockerfile - testdata read by tests: cmd/workspace/up/testdata, pkg/secrets/testdata - test input read via relative path: sites/docs-devsy-sh/public/install.sh (hack/install_script) - build config: .golangci.yaml, .golangci-version, Taskfile.yml, mise.toml, mise.lock Replace the allowlist with directory-level entries for cmd, pkg, providers, hack, e2e, plus **/testdata/**. Positive globs only; no negation. Docs, desktop and most of sites/ still do not trigger Go CI.

netlify · 2026-10-15T06:46:19Z

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	`61d842b`
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6ad076b9ac34d1b203cac2c4

coderabbitai · 2026-10-15T06:46:22Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 9ab1d8a2-f6cc-48ff-a45c-c2b38243acd2

📥 Commits

Reviewing files that changed from the base of the PR and between 7d04a47 and 61d842b.

📒 Files selected for processing: 1

.github/workflows/pr-ci.yml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📝 Walkthrough

The pull request updates the Go path filter in the pull request CI workflow. Changes to additional Go sources, directories, scripts, and configuration files now trigger Go jobs.

Changes: Go CI path filtering

Layer / File(s)	Summary
Update Go job path filters `.github/workflows/pr-ci.yml`	The `go` path filter adds Go-related paths and configuration files. It replaces selected explicit `hack` paths with broader directory filters.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 61d84

The updated filter covers the inspected Go-related inputs, with no identified current change that would skip Go checks. The PR is mergeable subject to normal checks.

### Architecture Summary

Architecture risk: 🔵 Low · up to 61d84

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

observed — Modified behavior in .github/workflows/pr-ci.yml: The go path filter adds main.go, broad coverage for Go-related trees and test fixtures, the install script, and toolchain, lint, and task configuration files. It replaces explicit filters for selected hack paths with directory-level filters, so changes under cmd/**, pkg/**, providers/**, and hack/** now trigger Go jobs; the existing Go-source, module, release, e2e, license, and workflow filters remain.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the CI path-filter fix and identifies embedded assets as a key missed input that should trigger Go jobs. It is specific and related to the main change.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

✨ Simplify code

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 zizmor (1.30.1)

.github/workflows/pr-ci.yml

INFO zizmor: 🌈 zizmor v1.30.1
WARN audit:audit{input=Workflow(file://.github/workflows/pr-ci.yml)}: zizmor::audit::unsound_ternary: couldn't parse expression: matrix.provider-mode || ''parity''
fatal: no audit was performed
'template-injection' audit failed on file://.github/workflows/pr-ci.yml

Caused by:
0: error in 'template-injection' audit
1: failed to locate subfeature 'Subfeature { after: 143, fragment: Regex(Regex("matrix\.provider\-mode\s+\|\|\s+'parity'")) }' in feature ''"${RUNNER_TEMP}/devsy-ci-microsandbox" run --label "${{ matrix.label }}" --expected-count "${{ matrix.expected-spec-count }}" --provider-mode "${{ matrix.provider-mode || ''parity'' }}"''

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

netlify · 2026-10-15T06:46:25Z

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	`61d842b`
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6ad076b92d2380aa4f45ecb0

mergify · 2026-10-15T08:16:16Z

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

skevetter · 2026-10-15T09:35:09Z

@coderabbitai review

coderabbitai · 2026-10-15T09:35:19Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

github-actions Bot added the size/s label Oct 15, 2026

skevetter marked this pull request as ready for review October 15, 2026 08:15

Navigation Menu

Repository navigation

fix(ci): run go jobs when embedded assets change - #1492

fix(ci): run go jobs when embedded assets change#1492
skevetter wants to merge 1 commit into
mainfrom
fix/ci-go-path-filter-coverage

skevetter commented Oct 15, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

netlify Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

mergify Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

skevetter commented Oct 15, 2026

Uh oh!

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

skevetter commented Oct 15, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Gap found

Change

Verification

Known over-triggers (safe direction)

Checker limitations

Summary by CodeRabbit

Uh oh!

netlify Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for devsydev canceled.

Uh oh!

coderabbitai Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for images-devsy-sh canceled.

Uh oh!

mergify Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

skevetter commented Oct 15, 2026

Uh oh!

coderabbitai Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

skevetter commented Oct 15, 2026 •

edited by coderabbitai Bot

Loading

netlify Bot commented Oct 15, 2026 •

edited

Loading

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

netlify Bot commented Oct 15, 2026 •

edited

Loading

mergify Bot commented Oct 15, 2026 •

edited

Loading

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading