microsoft / microsoft/hve-core
feat: extend gate-completeness checking to other aggregator workflows
- Dominant language
- Python
- Stars
- 1.5k
- Forks
- 301
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 92
Description
### Issue Description
`scripts/security/Test-PrValidationGate.ps1` currently validates only `.github/workflows/pr-validation.yml`'s aggregator gate completeness (every job present in `pr-validation-success`'s `needs:`). Extend the same "every job must be depended on by the aggregator gate" check to other multi-job aggregator workflows in the repo, so a regression can't silently slip through a different pipeline the same way it could have through `pr-validation.yml` before `gate-completeness-check` existed.
Candidate workflows to audit for an aggregator/gate job pattern:
* Release workflows (`release-stable.yml`, `release-prerelease.yml`, `release-stable-publish.yml`, `release-prerelease-prepare.yml`)
* `plugin-validation`-related workflows
* `eval-validation`-related workflows
For each, determine whether it has (or should have) an aggregator gate job, and if so, whether that gate's `needs:` list is complete. Either generalize `Test-PrValidationGate.ps1` to accept multiple workflow paths/gate job names, or confirm (with reasoning) that a given workflow doesn't need this pattern.
### Additional Context
**Precedent:** `scripts/security/Test-PrValidationGate.ps1` and the `gate-completeness-check` job in `pr-validation.yml`.
**Parent:** #2703
Contributor guide
Assessment
This issue has not been assessed yet.