From e608905e3b177231f34f9944c89f06cfeeee69bc Mon Sep 17 00:00:00 2001 From: Balaji Ganesan Date: Wed, 29 Jul 2026 15:50:11 -0700 Subject: [PATCH] fix(ci): stop failing PRs that touch only docker-host subtrees A pull request changing only a docker-host subtree failed the required Bazel check with no failing job in the run. The single matrix row that ran passed. detect splits its output into two lanes. Such a change produces build-container=[] with docker-host=[], but the build-container job was guarded on the combined `any` output rather than on its own matrix. `any` is true because a subtree was selected, so the job was asked to start with an empty matrix. GitHub cannot create a job from an empty matrix vector and resolves it to `failure` rather than `skipped`, so the aggregate result was failure while every row that existed succeeded. The gate then rejected it: the build-container branch accepted only `success`, while the docker branch immediately below already tolerated `skipped`. The asymmetry is what turned an empty lane into a red required check. Both halves are corrected. The job now guards on its own matrix, the way bazel-docker already does, and the gate tolerates `skipped` for it. That cannot hide a row that should have run: the job's condition is tied to its matrix being non-empty, so skipped means only that this lane had nothing to do, and the existing BAZEL_ANY check still catches the case where no subtree was selected. Co-authored-by: Balaji Ganesan Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/bazel.yml | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index 2dc0edfa5..106a5d133 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -331,7 +331,12 @@ jobs: bazel: name: bazel (${{ matrix.subtree.id }}) needs: detect - if: needs.detect.outputs.any == 'true' + # Guard on THIS lane's matrix, not the combined `any`. A change touching + # only docker-host subtrees leaves this matrix empty while `any` is still + # true; GitHub cannot create a job from an empty matrix vector and resolves + # it to `failure`, not `skipped`, which failed the required check on PRs + # that had nothing wrong with them. bazel-docker already guards this way. + if: needs.detect.outputs.matrix != '[]' runs-on: ubuntu-latest # Public EC2 Buildbarn cache (grpcs, bearer-token gated). The token is a # repo secret, so fork PRs (which never receive secrets) fall back to a @@ -938,8 +943,14 @@ jobs: exit 0 fi - if [ "${BAZEL_RESULT}" != "success" ]; then - echo "one or more Bazel matrix rows failed, were cancelled, or were skipped" + # `skipped` is legitimate here and means the build-container matrix was + # empty, i.e. every selected subtree runs in the docker-host lane. The + # job's `if` is tied to that matrix being non-empty, so skipped can + # only mean "nothing for this lane to do" -- it cannot hide a row that + # should have run. The BAZEL_ANY check above already catches the case + # where no subtree was selected at all. + if [ "${BAZEL_RESULT}" != "success" ] && [ "${BAZEL_RESULT}" != "skipped" ]; then + echo "one or more Bazel matrix rows failed or were cancelled" exit 1 fi