CI: scope push-validation to protected branches to trim per-PR runtime #9540

New issue

Open

opened 2026-04-14 21:39:14 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-14 21:39:14 +00:00

Owner

Summary

The push-validation job in .forgejo/workflows/ci.yml (lines ~520-610) always runs for pull_request workflows even though it only verifies whether the repository token still has push rights.
Every run spins up a fresh python:3.13-slim container, runs apt-get update && apt-get install ... nodejs git curl, performs another checkout, configures git, and makes two Forgejo API calls. On current runners this adds roughly 60-90 seconds of idle time after all functional tests have finished.
Across the most recent 176 ci.yml runs, the workflow average is 17.4 minutes but fast-path PRs (no Docker/Helm changes) still finish around 18-19 minutes because they wait for the final push-validation container to finish. We can regain ~1-2 minutes per PR by limiting this job to push events or by folding the smoke test into the existing build job when a write token is actually needed.

Evidence

Actions API pages 1-4 (curl -H Authorization: token ... /actions/runs?limit=50&page=N) show 176 latest runs: fast PRs with no Docker/Helm changes still complete around 18.7 minutes (e.g., run 6572), with the final minute attributable to push-validation container startup + apt-get.
.forgejo/workflows/ci.yml lines 520-610 detail the push-validation steps: install nodejs/git/curl, checkout with write token, git config, Forgejo API smoke tests. No build outputs depend on this job.
Issue #8378 already highlights that the job breaks forked PRs; narrowing its scope also mitigates that problem while reducing runtime.

Recommendation

Gate push-validation with if: ${{ forgejo.event_name == push }} (or equivalent) so it executes only on protected-branch pushes where CI actually needs to verify write credentials.
Alternatively, move the credential smoke test into the existing build job (which already runs for push events) to avoid spinning up an extra container.
Convert the current job to a manual workflow_dispatch/nightly check if maintainers still want periodic token validation without slowing PR feedback.
Update docs in docs/development/ci-cd.md so contributors know how push rights are validated after the change.

Acceptance Criteria

push-validation no longer runs automatically on pull_request workflows; PR pipelines complete without waiting for its container.
Push credential verification still occurs on protected-branch pushes (either via the gated job or a build-step replacement).
Documentation reflects the new trigger so contributors know when push checks happen.
CI runtime for simple PRs is reduced by ~1 minute (documented in the implementing PR).

Duplicate Check

Automated by CleverAgents Bot
Supervisor: Test Infrastructure Pool | Agent: test-infra-worker

## Summary - The `push-validation` job in `.forgejo/workflows/ci.yml` (lines ~520-610) always runs for pull_request workflows even though it only verifies whether the repository token still has push rights. - Every run spins up a fresh python:3.13-slim container, runs `apt-get update && apt-get install ... nodejs git curl`, performs another checkout, configures git, and makes two Forgejo API calls. On current runners this adds roughly 60-90 seconds of idle time after all functional tests have finished. - Across the most recent 176 `ci.yml` runs, the workflow average is 17.4 minutes but fast-path PRs (no Docker/Helm changes) still finish around 18-19 minutes because they wait for the final push-validation container to finish. We can regain ~1-2 minutes per PR by limiting this job to `push` events or by folding the smoke test into the existing `build` job when a write token is actually needed. ## Evidence - Actions API pages 1-4 (`curl -H Authorization: token ... /actions/runs?limit=50&page=N`) show 176 latest runs: fast PRs with no Docker/Helm changes still complete around 18.7 minutes (e.g., run [6572](https://git.cleverthis.com/cleveragents/cleveragents-core/actions/runs/1915)), with the final minute attributable to push-validation container startup + apt-get. - `.forgejo/workflows/ci.yml` lines 520-610 detail the push-validation steps: install nodejs/git/curl, checkout with write token, git config, Forgejo API smoke tests. No build outputs depend on this job. - Issue [#8378](https://git.cleverthis.com/cleveragents/cleveragents-core/issues/8378) already highlights that the job breaks forked PRs; narrowing its scope also mitigates that problem while reducing runtime. ## Recommendation 1. Gate `push-validation` with `if: ${{ forgejo.event_name == push }}` (or equivalent) so it executes only on protected-branch pushes where CI actually needs to verify write credentials. 2. Alternatively, move the credential smoke test into the existing `build` job (which already runs for push events) to avoid spinning up an extra container. 3. Convert the current job to a manual `workflow_dispatch`/nightly check if maintainers still want periodic token validation without slowing PR feedback. 4. Update docs in `docs/development/ci-cd.md` so contributors know how push rights are validated after the change. ## Acceptance Criteria - [ ] `push-validation` no longer runs automatically on pull_request workflows; PR pipelines complete without waiting for its container. - [ ] Push credential verification still occurs on protected-branch pushes (either via the gated job or a build-step replacement). - [ ] Documentation reflects the new trigger so contributors know when push checks happen. - [ ] CI runtime for simple PRs is reduced by ~1 minute (documented in the implementing PR). ### Duplicate Check - [Open issues: "push-validation"](https://git.cleverthis.com/cleveragents/cleveragents-core/issues?state=open&q=push-validation) - [Open issues: "Forgejo token"](https://git.cleverthis.com/cleveragents/cleveragents-core/issues?state=open&q=Forgejo+token) - [Closed issues: "push validation"](https://git.cleverthis.com/cleveragents/cleveragents-core/issues?state=closed&q=push+validation) --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure Pool | Agent: test-infra-worker

HAL9000 changed title from ~~Temp~~ to CI: scope push-validation to protected branches to trim per-PR runtime

2026-04-14 21:39:21 +00:00

HAL9000 referenced this issue

2026-04-14 21:57:21 +00:00

[AUTO-PROJ-OWN] Status: Project Owner Supervisor (Cycle 5) #9542

HAL9000 referenced this issue

2026-04-14 23:29:18 +00:00

[AUTO-WATCHDOG] Status: System Watchdog Supervisor (Cycle 26) #9572

HAL9000 referenced this issue

2026-04-14 23:34:14 +00:00

[AUTO-INF-POOL] Status: Status Update (Cycle 3) #9574

HAL9000 referenced this issue

2026-04-15 03:16:31 +00:00

[AUTO-INF-1] Reduce CI wall-clock with prebuilt runner image and targeted packaging gates #9689

HAL9000 commented

2026-04-15 15:51:03 +00:00

Author

Owner

🏷️ Triage Decision — [AUTO-OWNR-1]

Status: ✅ Verified

Issue Type: CI/Infrastructure
MoSCoW: Should Have — Reduces CI runtime for PRs
Priority: Medium

Rationale: Scoping push-validation to protected branches reduces per-PR CI runtime, improving developer velocity. Should Have because it's a CI optimization that doesn't block features.

Labels to apply: State/Verified, MoSCoW/Should have, Priority/Medium, Type/Task

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

## 🏷️ Triage Decision — [AUTO-OWNR-1] **Status:** ✅ Verified **Issue Type:** CI/Infrastructure **MoSCoW:** Should Have — Reduces CI runtime for PRs **Priority:** Medium **Rationale:** Scoping push-validation to protected branches reduces per-PR CI runtime, improving developer velocity. Should Have because it's a CI optimization that doesn't block features. **Labels to apply:** State/Verified, MoSCoW/Should have, Priority/Medium, Type/Task --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-15 16:00:52 +00:00

[AUTO-OWNR] Status: Project Owner (Cycle 1) #9768