Skip to content

docs(ci): add paths-filter self-test policy to ci-standards.md - #43

Open
jdwillmsen wants to merge 1 commit into
mainfrom
fix/jdwlabs-452-paths-filter-policy
Open

docs(ci): add paths-filter self-test policy to ci-standards.md#43
jdwillmsen wants to merge 1 commit into
mainfrom
fix/jdwlabs-452-paths-filter-policy

Conversation

@jdwillmsen

@jdwillmsen jdwillmsen commented Aug 28, 2026

Copy link
Copy Markdown
Member

Summary

  • Adds a new §6 to docs/ci-standards.md: the org-wide policy that an allowlist paths: filter must include the workflow's own .github/workflows/<file>.yml, with a documented-exception path for cases where self-testing on an edit wouldn't exercise anything real.
  • Updates the existing bootstrap.yml/terraform.yml blind-spot note in §1 to point at the fix (both now carry their own path — see the companion infrastructure PR).
  • Clarifies paths-ignore: denylists don't have this failure mode by construction (a workflow YAML change never matches **/*.md/docs/**) and calls out workflow_run-triggered workflows (update-pages.yml) as structurally out of scope for this policy rather than newly exempted.
  • Inventory swept across all 5 repos for paths:/paths-ignore: usage: the only two allowlist paths: filters missing their own path were infrastructure/terraform.yml and infrastructure/bootstrap.yml (fixed in the companion PR). apps, deployments, and platform only use paths-ignore: (doc-skip), which is not a blind spot.

Test plan

  • Read through the full rendered section for internal consistency with the rest of the document's style/structure
  • No CI to run — docs-only change; security-scan.yml's paths-ignore: ['**/*.md', 'docs/**'] means this PR itself won't trigger that scan, which is expected and correct per the policy this PR documents

Refs JDWLABS-452. Companion PR making the two mechanical fixes this policy is written against: jdwlabs/infrastructure#142

🤖 Generated with Claude Code

https://claude.ai/code/session_01TrYLd68mqFxfDFuqnPJCy7

Default going forward: an allowlist paths: filter includes the workflow's
own .github/workflows/<file>.yml path, so editing the workflow re-triggers
it. Exception path (written reason + forced-run procedure) is defined for
cases where self-testing wouldn't exercise anything real. paths-ignore:
denylists don't have this failure mode by construction and need no
change. workflow_run-triggered workflows are called out as structurally
out of scope for this policy, not newly exempted by it.

Closes the deliverable from JDWLABS-452, which also fixed the two real
instances found (infrastructure/terraform.yml, infrastructure/bootstrap.yml).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TrYLd68mqFxfDFuqnPJCy7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant