Gated CI Workflows for Empty Patches#2636
Conversation
- Added `verify-changes` gate job to `ci.yml`, `deploy.yml`, and `codeql.yml` - Gated heavy jobs behind `has_changes` output to save runner minutes - Consolidated `security.yml` and `conflict-check.yml` into `ci.yml` - Implemented `block-empty-jules-patches.yml` as global PR-closing failsafe - Fixed `actions/checkout` version hallucinations across modified workflows - Validated all workflow changes with `actionlint`
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
🚀 Deployment Details (Last updated: Jun 19, 2026, 3:14 PM PST) 🚀 Pushed to gh-pages; publish in progress
|
🐙 GitHub Models Code Review
Reviewing: PR #2636 Model: gpt-4.1 Code Review FeedbackAll previously identified HIGH severity issues have been resolved in this diff. Here is a line-by-line confirmation: 1. Incorrect diff target for empty patch detection (
|
- Refined `verify-changes` gate logic to use base-branch comparison for PRs. - Updated all workflows to use `fetch-depth: 0` for accurate diff detection. - Fixed `$GITHUB_OUTPUT` syntax and standardized `actions/checkout` to `@v4`. - Consolidated security and merge-conflict checks into the main `ci.yml`. - Maintained scheduled scan integrity in `codeql.yml`. - Deployed a global `block-empty-jules-patches.yml` failsafe to auto-close empty PRs.
- Refined `verify-changes` logic to use base-branch comparison (`...`) for PRs. - Standardized `actions/checkout` to `@v4` and ensured `fetch-depth: 0`. - Fixed `actionlint`/`shellcheck` violations by double-quoting variables. - Consolidated security and merge-conflict checks into the main gated `ci.yml`. - Deployed a global `block-empty-jules-patches.yml` to auto-close empty PRs. - Maintained scheduled scan integrity in `codeql.yml`.
|
- Created `reusable-gate.yml` to centralize CI gating logic and enforce DRY principles. - Refactored `ci.yml`, `deploy.yml`, and `codeql.yml` to utilize the reusable gate. - Re-architected `block-empty-jules-patches.yml` to depend on the reusable gate for policy enforcement (auto-closing PRs). - Secured shell scripts against injection by utilizing environment variables for context data. - Added defensive checks for single-commit histories and explicit base-branch fetching. - Standardized `actions/checkout` to `@v4` and ensured `fetch-depth: 0` for all gated workflows. - Validated the complete workflow suite with `actionlint`.
- Centralized gating logic into `.github/workflows/reusable-gate.yml`. - Refactored `ci.yml`, `deploy.yml`, and `codeql.yml` to utilize the reusable gate. - Refined `push` logic to use `github.event.before` for accurate multi-commit diffing. - Implemented robust `pull_request` diffing against base branches (`...HEAD`). - Deployed `block-empty-jules-patches.yml` as a global auto-closing PR failsafe. - Secured shell scripts by utilizing environment variables for GitHub context data. - Maintained `actions/checkout@v6` as per explicit repository requirement. - Consolidated security scans and conflict checks into the main gated pipeline. - Validated all workflow enhancements with `actionlint`.
🤖 AI Technical AuditANTI-AI-SLOPThe consolidation of FINAL RECOMMENDATIONApproved with Minor Changes Review automatically published via RepoAuditor. |
- Centralized gating logic into `.github/workflows/reusable-gate.yml`. - Refactored `ci.yml`, `deploy.yml`, and `codeql.yml` to utilize the reusable gate. - Re-architected `block-empty-jules-patches.yml` to utilize the centralized gate logic for PR closure. - Leaner implementation of `verify-changes` logic to minimize overhead. - Secured shell scripts by utilizing environment variables for GitHub context data. - Maintained `actions/checkout@v6` as per explicit repository requirement. - Consolidated security and merge-conflict checks into the main gated pipeline. - Validated the complete workflow suite with `actionlint`.
|
Closing this PR/issue as it is fully consolidated and subsumed by PR #2659. |
Problem Statement
The current CI strategy does not efficiently skip heavy checks (linting, tests, security, deployment) when a commit contains no actual code changes relative to its parent, leading to wasted CI cycles and resource usage.
Goal
Implement an optimized CI strategy that skips heavy checks for commits with no code changes, thereby improving CI efficiency and resource utilization.
Non-Goals
None.
Proposed Approach
verify-changesjob to all primary workflows that usesgit diff --quiet HEAD~1 HEADto detect empty patches.ci.ymlto centralize gated validation.block-empty-jules-patches.ymlto automatically comment on and close Pull Requests that contain zero changes.actions/checkoutto@v4across touched files to fix invalid versioning.Alternatives Considered
None.
Architectural Impact
These changes will satisfy the repository's No-Op Protection Policy and optimize runner usage for both human and AI-generated patches.
Scope
The scope includes the implementation of the proposed CI optimizations across all primary workflows in the repository.
UNDERSTAND THE ISSUE
The current system executes all heavy checks regardless of whether the commits contain actual changes, leading to inefficiencies.
DETERMINE APPROACH
The approach involves creating a gate job to check for code changes and modifying existing workflows to conditionally execute based on this check.
SPECIFY SCOPE
The implementation will focus on adding the
verify-changesjob, updating downstream jobs, consolidating workflows, creating the failsafe, and standardizing versioning.DEFINITION OF DONE
verify-changesjob is implemented and correctly detects empty patches.verify-changesjob.ci.yml.block-empty-jules-patches.ymlis created and operational.actions/checkoutis standardized to@v4across all touched files.