Skip to content

ci: Skip test suite when no code files changed #5889

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
stephanie-anderson wants to merge 5 commits into
base: master
Choose a base branch
from
Draft

ci: Skip test suite when no code files changed #5889

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
51f78f1
ci: Skip test suite when no code files changed
stephanie-anderson Mar 26, 2026
349e6a5
ci: Address warden review feedback
stephanie-anderson Mar 26, 2026
ec091a1
ci: Also skip tests on push when no code files changed
stephanie-anderson Mar 26, 2026
02cada1
ci: Handle cancelled state in gate job conditions
stephanie-anderson Mar 27, 2026
0aea038
ci: Add gate job to ci.yml for required status checks
stephanie-anderson Mar 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,32 @@
${{ github.workspace }}/dist-serverless

jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- 'requirements*.txt'
- '.github/workflows/**'

lint:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'

Check failure on line 44 in .github/workflows/ci.yml

View check run for this annotation

@sentry/warden / warden: code-review

[G7J-P8F] Tests on master/release/major branches can be incorrectly skipped (additional location) 

The PR description states 'Pushes to master/release/**/major/** branches always run the full suite', but the test job's `if` condition (line 51) only checks `needs.changes.outputs.has_code_changes == 'true'` without considering the branch. This means pushes to protected branches that contain only non-code changes (e.g., a merge commit touching only docs) will skip tests, violating the stated requirement. The condition should include a bypass for push events to these protected branches.
name: Lint Sources

Check failure on line 45 in .github/workflows/ci.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

[RLU-RV4] Tests on protected branches not always running as documented (additional location) 

The PR description states 'Pushes to master/release/**/major/** branches always run the full suite', but the implementation does not include this behavior. The `changes` job unconditionally runs `dorny/paths-filter` for all events, including push events on protected branches. For push events, the filter compares against the previous commit, so if a push to `master` only modifies documentation files, tests will be skipped. This violates the stated requirement and could allow untested code to reach production branches.
runs-on: ubuntu-latest
timeout-minutes: 10

Expand All @@ -33,6 +57,8 @@
tox -e linters

build_lambda_layer:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'
name: Build Package
runs-on: ubuntu-latest
timeout-minutes: 10
Expand Down Expand Up @@ -62,6 +88,8 @@
if-no-files-found: 'error'

docs:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'
name: Build SDK API Doc
runs-on: ubuntu-latest
timeout-minutes: 10
Expand Down
29 changes: 27 additions & 2 deletions .github/workflows/test-integrations-agents.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- 'requirements*.txt'
- '.github/workflows/**'
test-agents:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'

Check failure on line 51 in .github/workflows/test-integrations-agents.yml

View check run for this annotation

@sentry/warden / warden: code-review

[G7J-P8F] Tests on master/release/major branches can be incorrectly skipped (additional location) 

The PR description states 'Pushes to master/release/**/major/** branches always run the full suite', but the test job's `if` condition (line 51) only checks `needs.changes.outputs.has_code_changes == 'true'` without considering the branch. This means pushes to protected branches that contain only non-code changes (e.g., a merge commit touching only docs) will skip tests, violating the stated requirement. The condition should include a bypass for push events to these protected branches.
name: Agents
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -82,12 +105,14 @@
verbose: true
check_required_tests:
name: All Agents tests passed
needs: test-agents
needs: [changes, test-agents]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-agents.result != 'success'
if: |
needs.changes.result == 'failure' ||
(needs.test-agents.result != 'success' && needs.test-agents.result != 'skipped')
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
29 changes: 27 additions & 2 deletions .github/workflows/test-integrations-ai-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- 'requirements*.txt'
- '.github/workflows/**'
test-ai_workflow:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'

Check failure on line 51 in .github/workflows/test-integrations-ai-workflow.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

Tests on protected branches not always running as documented 

The PR description states 'Pushes to master/release/**/major/** branches always run the full suite', but the implementation does not include this behavior. The `changes` job unconditionally runs `dorny/paths-filter` for all events, including push events on protected branches. For push events, the filter compares against the previous commit, so if a push to `master` only modifies documentation files, tests will be skipped. This violates the stated requirement and could allow untested code to reach production branches.
name: AI Workflow
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -86,12 +109,14 @@
verbose: true
check_required_tests:
name: All AI Workflow tests passed
needs: test-ai_workflow
needs: [changes, test-ai_workflow]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-ai_workflow.result != 'success'
if: |
needs.changes.result == 'failure' ||
(needs.test-ai_workflow.result != 'success' && needs.test-ai_workflow.result != 'skipped')
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
29 changes: 27 additions & 2 deletions .github/workflows/test-integrations-ai.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- 'requirements*.txt'
- '.github/workflows/**'
test-ai:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'

Check failure on line 51 in .github/workflows/test-integrations-ai.yml

View check run for this annotation

@sentry/warden / warden: code-review

Tests on master/release/major branches can be incorrectly skipped 

The PR description states 'Pushes to master/release/**/major/** branches always run the full suite', but the test job's `if` condition (line 51) only checks `needs.changes.outputs.has_code_changes == 'true'` without considering the branch. This means pushes to protected branches that contain only non-code changes (e.g., a merge commit touching only docs) will skip tests, violating the stated requirement. The condition should include a bypass for push events to these protected branches.

Check failure on line 51 in .github/workflows/test-integrations-ai.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

[RLU-RV4] Tests on protected branches not always running as documented (additional location) 

The PR description states 'Pushes to master/release/**/major/** branches always run the full suite', but the implementation does not include this behavior. The `changes` job unconditionally runs `dorny/paths-filter` for all events, including push events on protected branches. For push events, the filter compares against the previous commit, so if a push to `master` only modifies documentation files, tests will be skipped. This violates the stated requirement and could allow untested code to reach production branches.
name: AI
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -102,12 +125,14 @@
verbose: true
check_required_tests:
name: All AI tests passed
needs: test-ai
needs: [changes, test-ai]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-ai.result != 'success'
if: |
needs.changes.result == 'failure' ||
(needs.test-ai.result != 'success' && needs.test-ai.result != 'skipped')
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
29 changes: 27 additions & 2 deletions .github/workflows/test-integrations-cloud.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- 'requirements*.txt'
- '.github/workflows/**'
test-cloud:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'

Check failure on line 51 in .github/workflows/test-integrations-cloud.yml

View check run for this annotation

@sentry/warden / warden: code-review

[G7J-P8F] Tests on master/release/major branches can be incorrectly skipped (additional location) 

The PR description states 'Pushes to master/release/**/major/** branches always run the full suite', but the test job's `if` condition (line 51) only checks `needs.changes.outputs.has_code_changes == 'true'` without considering the branch. This means pushes to protected branches that contain only non-code changes (e.g., a merge commit touching only docs) will skip tests, violating the stated requirement. The condition should include a bypass for push events to these protected branches.
name: Cloud
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -98,12 +121,14 @@
verbose: true
check_required_tests:
name: All Cloud tests passed
needs: test-cloud
needs: [changes, test-cloud]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-cloud.result != 'success'
if: |
needs.changes.result == 'failure' ||
(needs.test-cloud.result != 'success' && needs.test-cloud.result != 'skipped')
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
29 changes: 27 additions & 2 deletions .github/workflows/test-integrations-common.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- 'requirements*.txt'
- '.github/workflows/**'
test-common:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'

Check failure on line 51 in .github/workflows/test-integrations-common.yml

View check run for this annotation

@sentry/warden / warden: code-review

[G7J-P8F] Tests on master/release/major branches can be incorrectly skipped (additional location) 

The PR description states 'Pushes to master/release/**/major/** branches always run the full suite', but the test job's `if` condition (line 51) only checks `needs.changes.outputs.has_code_changes == 'true'` without considering the branch. This means pushes to protected branches that contain only non-code changes (e.g., a merge commit touching only docs) will skip tests, violating the stated requirement. The condition should include a bypass for push events to these protected branches.

Check failure on line 51 in .github/workflows/test-integrations-common.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

[RLU-RV4] Tests on protected branches not always running as documented (additional location) 

The PR description states 'Pushes to master/release/**/major/** branches always run the full suite', but the implementation does not include this behavior. The `changes` job unconditionally runs `dorny/paths-filter` for all events, including push events on protected branches. For push events, the filter compares against the previous commit, so if a push to `master` only modifies documentation files, tests will be skipped. This violates the stated requirement and could allow untested code to reach production branches.
name: Common
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -78,12 +101,14 @@
verbose: true
check_required_tests:
name: All Common tests passed
needs: test-common
needs: [changes, test-common]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-common.result != 'success'
if: |
needs.changes.result == 'failure' ||
(needs.test-common.result != 'success' && needs.test-common.result != 'skipped')
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
29 changes: 27 additions & 2 deletions .github/workflows/test-integrations-dbs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- 'requirements*.txt'
- '.github/workflows/**'
test-dbs:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'

Check failure on line 51 in .github/workflows/test-integrations-dbs.yml

View check run for this annotation

@sentry/warden / warden: code-review

[G7J-P8F] Tests on master/release/major branches can be incorrectly skipped (additional location) 

The PR description states 'Pushes to master/release/**/major/** branches always run the full suite', but the test job's `if` condition (line 51) only checks `needs.changes.outputs.has_code_changes == 'true'` without considering the branch. This means pushes to protected branches that contain only non-code changes (e.g., a merge commit touching only docs) will skip tests, violating the stated requirement. The condition should include a bypass for push events to these protected branches.
name: DBs
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -118,12 +141,14 @@
verbose: true
check_required_tests:
name: All DBs tests passed
needs: test-dbs
needs: [changes, test-dbs]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-dbs.result != 'success'
if: |
needs.changes.result == 'failure' ||
(needs.test-dbs.result != 'success' && needs.test-dbs.result != 'skipped')
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
29 changes: 27 additions & 2 deletions .github/workflows/test-integrations-flags.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- 'requirements*.txt'
- '.github/workflows/**'
test-flags:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'

Check failure on line 51 in .github/workflows/test-integrations-flags.yml

View check run for this annotation

@sentry/warden / warden: code-review

[G7J-P8F] Tests on master/release/major branches can be incorrectly skipped (additional location) 

The PR description states 'Pushes to master/release/**/major/** branches always run the full suite', but the test job's `if` condition (line 51) only checks `needs.changes.outputs.has_code_changes == 'true'` without considering the branch. This means pushes to protected branches that contain only non-code changes (e.g., a merge commit touching only docs) will skip tests, violating the stated requirement. The condition should include a bypass for push events to these protected branches.

Check failure on line 51 in .github/workflows/test-integrations-flags.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

[RLU-RV4] Tests on protected branches not always running as documented (additional location) 

The PR description states 'Pushes to master/release/**/major/** branches always run the full suite', but the implementation does not include this behavior. The `changes` job unconditionally runs `dorny/paths-filter` for all events, including push events on protected branches. For push events, the filter compares against the previous commit, so if a push to `master` only modifies documentation files, tests will be skipped. This violates the stated requirement and could allow untested code to reach production branches.
name: Flags
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -90,12 +113,14 @@
verbose: true
check_required_tests:
name: All Flags tests passed
needs: test-flags
needs: [changes, test-flags]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-flags.result != 'success'
if: |
needs.changes.result == 'failure' ||
(needs.test-flags.result != 'success' && needs.test-flags.result != 'skipped')
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
Loading
Loading