microsoft / microsoft/hve-core

feat: extend gate-completeness checking to other aggregator workflows

Open
#2,707 0 comments 1 reaction 1 assignee Claimed by @chalew101 View on GitHub
Dominant language
Python
Stars
1.5k
Forks
301
Avg merge
3d 3h
Merged PRs (30d)
92

Description

### Issue Description

`scripts/security/Test-PrValidationGate.ps1` currently validates only `.github/workflows/pr-validation.yml`'s aggregator gate completeness (every job present in `pr-validation-success`'s `needs:`). Extend the same "every job must be depended on by the aggregator gate" check to other multi-job aggregator workflows in the repo, so a regression can't silently slip through a different pipeline the same way it could have through `pr-validation.yml` before `gate-completeness-check` existed.

Candidate workflows to audit for an aggregator/gate job pattern:

* Release workflows (`release-stable.yml`, `release-prerelease.yml`, `release-stable-publish.yml`, `release-prerelease-prepare.yml`)
* `plugin-validation`-related workflows
* `eval-validation`-related workflows

For each, determine whether it has (or should have) an aggregator gate job, and if so, whether that gate's `needs:` list is complete. Either generalize `Test-PrValidationGate.ps1` to accept multiple workflow paths/gate job names, or confirm (with reasoning) that a given workflow doesn't need this pattern.

### Additional Context

**Precedent:** `scripts/security/Test-PrValidationGate.ps1` and the `gate-completeness-check` job in `pr-validation.yml`.

**Parent:** #2703

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.