Skip to content

fix(keepalive): use skip input to control reusable workflow execution#111

Merged
stranske merged 1 commit intomainfrom
fix-keepalive-no-condition
Dec 24, 2025
Merged

fix(keepalive): use skip input to control reusable workflow execution#111
stranske merged 1 commit intomainfrom
fix-keepalive-no-condition

Conversation

@stranske
Copy link
Copy Markdown
Owner

@stranske stranske commented Dec 24, 2025

Problem

Reusable workflow jobs with if: conditions that depend on outputs from dependency jobs are not being created. GitHub Actions evaluates the condition at workflow startup before outputs are available.

Attempts that failed

  1. PR fix(keepalive): remove preflight dependency from run-codex job #109: Removed preflight dependency - job still not created
  2. PR fix(keepalive): use always() to ensure reusable workflow job is created #110: Used always() in condition - job still not created

Evidence

Run 20487293650 shows:

  • Evaluate outputs action: 'run', reason: 'ready'
  • Only 3 jobs created, missing Keepalive next task
  • referenced_workflows shows reusable workflow IS referenced
  • But job graph doesn't include it

Root Cause

GitHub Actions evaluates if: conditions for reusable workflow calls at a different time than regular jobs. The condition cannot use needs.*.outputs.* reliably because those are resolved before the dependent job runs.

Solution

Move the conditional logic INTO the reusable workflow:

  1. Add skip input to reusable-codex-run.yml:

    skip:
      description: 'If true, skip execution entirely'
      default: false
      type: boolean
  2. Add if: ```{{ inputs.skip }} to the codex job inside the reusable workflow

  3. Keepalive loop passes:

    with:
      skip: ${{ needs.evaluate.outputs.action != 'run' }}

This ensures the reusable workflow call is ALWAYS created in the job graph, while the actual execution is controlled by the skip input evaluated at runtime inside the reusable workflow.

Automated Status Summary

Scope

  • Scope section missing from source issue.

Tasks

  • Restrict triggers:
  • do not run agent workflows on forked PRs
  • avoid pull_request_target unless absolutely necessary
  • Ensure prompts are repo-owned:
  • use prompt-file from .github/codex/prompts/
  • build a small “context appendix” file that includes sanitized task text
  • Add allowlists:
  • allow-users / allow-bots in codex-action config
  • only repo collaborators can trigger
  • Add denylist behaviors:
  • Codex should not edit .github/workflows/** unless a special environment-approved mode is enabled
  • Codex should not touch secrets or tokens (explicit instruction + sandbox limits)
  • Add logging + red flags:
  • if prompt contains “ignore previous”, HTML comments, base64 blobs, etc, stop and require human

Acceptance criteria

  • - Malicious-looking issue text does not get passed verbatim into Codex execution.
  • - Agent workflows only run for trusted actors and trusted events.
  • Head SHA: 58da3fb
  • Latest Runs: ✅ success — Gate
  • Required: gate: ✅ success
  • | Workflow / Job | Result | Logs |
  • |----------------|--------|------|
  • | Agents PR meta manager | ❔ in progress | View run |
  • | CI Autofix Loop | ✅ success | View run |
  • | Gate | ✅ success | View run |
  • | Health 40 Sweep | ✅ success | View run |
  • | Health 44 Gate Branch Protection | ✅ success | View run |
  • | Health 45 Agents Guard | ✅ success | View run |
  • | Health 50 Security Scan | ✅ success | View run |
  • | Maint 52 Validate Workflows | ✅ success | View run |
  • | PR 11 - Minimal invariant CI | ✅ success | View run |
  • | Selftest CI | ✅ success | View run |
  • Head SHA: ea11578
  • Latest Runs: ✅ success — Gate
  • Required: gate: ✅ success
  • | Workflow / Job | Result | Logs |
  • |----------------|--------|------|
  • | Agents PR meta manager | ❔ in progress | View run |
  • | CI Autofix Loop | ✅ success | View run |
  • | Gate | ✅ success | View run |
  • | Health 40 Sweep | ✅ success | View run |
  • | Health 44 Gate Branch Protection | ✅ success | View run |
  • | Health 45 Agents Guard | ✅ success | View run |
  • | Health 50 Security Scan | ✅ success | View run |
  • | Maint 52 Validate Workflows | ✅ success | View run |
  • | PR 11 - Minimal invariant CI | ✅ success | View run |
  • | Selftest CI | ✅ success | View run |

Head SHA: 42befd1
Latest Runs: ✅ success — Gate
Required: gate: ✅ success

Workflow / Job Result Logs
Agents PR meta manager ⏳ queued View run
CI Autofix Loop ✅ success View run
Copilot code review ❔ in progress View run
Gate ✅ success View run
Health 40 Sweep ✅ success View run
Health 44 Gate Branch Protection ✅ success View run
Health 45 Agents Guard ✅ success View run
Health 50 Security Scan ✅ success View run
Maint 52 Validate Workflows ✅ success View run
PR 11 - Minimal invariant CI ✅ success View run
Selftest CI ✅ success View run

…sable workflow

GitHub Actions does not properly evaluate job-level conditions for
reusable workflow calls when those conditions depend on outputs from
dependent jobs. The condition is evaluated at workflow startup time
before the outputs are available.

Solution: Always call the reusable workflow but pass a 'skip' input
that controls whether the job inside the reusable workflow runs:
- Added 'skip' input to reusable-codex-run.yml (default: false)
- Added 'if: !inputs.skip' to the codex job inside
- Keepalive loop passes skip: (action != 'run')

This ensures the job graph is always created, while actual execution
is controlled by the skip input which is evaluated at runtime.
Copilot AI review requested due to automatic review settings December 24, 2025 13:43
@stranske stranske temporarily deployed to agent-high-privilege December 24, 2025 13:43 — with GitHub Actions Inactive
@github-actions
Copy link
Copy Markdown
Contributor

Automated Status Summary

Head SHA: 355dae5
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / Enforce agents workflow protections
Required: core tests (3.11): ⏳ pending, core tests (3.12): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job Result Logs
(no jobs reported) ⏳ pending

Coverage Overview

  • Coverage history entries: 1

Coverage Trend

Metric Value
Current 77.97%
Baseline 0.00%
Delta +77.97%
Minimum 70.00%
Status ✅ Pass

Updated automatically; will refresh on subsequent CI/Docker completions.


Keepalive checklist

Scope

No scope information available

Tasks

  • No tasks defined

Acceptance criteria

  • No acceptance criteria defined

@stranske stranske merged commit a550453 into main Dec 24, 2025
111 checks passed
@stranske stranske deleted the fix-keepalive-no-condition branch December 24, 2025 13:44
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a GitHub Actions limitation where reusable workflow jobs with if conditions dependent on output values from previous jobs fail to be created in the workflow execution graph. The solution moves the conditional logic from the workflow call level into the reusable workflow itself using a skip input parameter.

Key Changes

  • Added a skip boolean input parameter to the reusable Codex workflow that controls whether the job executes
  • Removed the if condition from the run-codex job call in the keepalive loop workflow
  • The reusable workflow job is now always created in the workflow graph, but internal execution is controlled at runtime based on the skip parameter value

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
.github/workflows/reusable-codex-run.yml Added skip input parameter and if: !inputs.skip condition to the codex job to control execution from within the reusable workflow
.github/workflows/agents-keepalive-loop.yml Removed conditional if statement from run-codex job call and added skip parameter passing needs.evaluate.outputs.action != 'run'

The changes are minimal, focused, and correctly implement the described solution. The logic properly inverts the condition (skip when action is NOT 'run'), and the implementation follows GitHub Actions best practices for working around the reusable workflow evaluation timing issue.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants