Skip to content

ci: Skip test suite when no code files changed #5889

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
stephanie-anderson wants to merge 5 commits into
base: master
Choose a base branch
from
Draft

ci: Skip test suite when no code files changed #5889

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
51f78f1
ci: Skip test suite when no code files changed
stephanie-anderson Mar 26, 2026
349e6a5
ci: Address warden review feedback
stephanie-anderson Mar 26, 2026
ec091a1
ci: Also skip tests on push when no code files changed
stephanie-anderson Mar 26, 2026
02cada1
ci: Handle cancelled state in gate job conditions
stephanie-anderson Mar 27, 2026
0aea038
ci: Add gate job to ci.yml for required status checks
stephanie-anderson Mar 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,31 @@
${{ github.workspace }}/dist-serverless

jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ github.event_name != 'pull_request' || steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
if: github.event_name == 'pull_request'
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- '.github/workflows/**'

Check warning on line 40 in .github/workflows/ci.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

Path filter excludes requirements*.txt files, allowing test bypass 

The `changes` job filters for code changes but does not include `requirements*.txt` files in its patterns. The root-level files like `requirements-testing.txt`, `requirements-linting.txt`, `requirements-docs.txt`, and `requirements-aws-lambda-layer.txt` are used by tox.ini and Makefile. A PR that only modifies these dependency files would skip all CI tests, potentially allowing vulnerable dependencies to be merged without validation.

lint:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'
name: Lint Sources
runs-on: ubuntu-latest
timeout-minutes: 10
Expand All @@ -33,6 +57,8 @@
tox -e linters

build_lambda_layer:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'
name: Build Package
runs-on: ubuntu-latest
timeout-minutes: 10
Expand Down Expand Up @@ -62,6 +88,8 @@
if-no-files-found: 'error'

docs:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'
name: Build SDK API Doc
runs-on: ubuntu-latest
timeout-minutes: 10
Expand Down
27 changes: 25 additions & 2 deletions .github/workflows/test-integrations-agents.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ github.event_name != 'pull_request' || steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
if: github.event_name == 'pull_request'
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- '.github/workflows/**'

Check warning on line 48 in .github/workflows/test-integrations-agents.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

[8PR-B4R] Path filter excludes requirements*.txt files, allowing test bypass (additional location) 

The `changes` job filters for code changes but does not include `requirements*.txt` files in its patterns. The root-level files like `requirements-testing.txt`, `requirements-linting.txt`, `requirements-docs.txt`, and `requirements-aws-lambda-layer.txt` are used by tox.ini and Makefile. A PR that only modifies these dependency files would skip all CI tests, potentially allowing vulnerable dependencies to be merged without validation.
test-agents:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'
name: Agents
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -82,12 +105,12 @@
verbose: true
check_required_tests:
name: All Agents tests passed
needs: test-agents
needs: [changes, test-agents]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-agents.result != 'success'
if: needs.test-agents.result != 'success' && needs.test-agents.result != 'skipped'
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
27 changes: 25 additions & 2 deletions .github/workflows/test-integrations-ai-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ github.event_name != 'pull_request' || steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
if: github.event_name == 'pull_request'
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- '.github/workflows/**'
test-ai_workflow:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'
name: AI Workflow
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -86,12 +109,12 @@
verbose: true
check_required_tests:
name: All AI Workflow tests passed
needs: test-ai_workflow
needs: [changes, test-ai_workflow]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-ai_workflow.result != 'success'
if: needs.test-ai_workflow.result != 'success' && needs.test-ai_workflow.result != 'skipped'

Check warning on line 118 in .github/workflows/test-integrations-ai-workflow.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

Gate check ignores changes job failures, allowing untested code to pass CI 

The `check_required_tests` job depends on both `changes` and `test-ai_workflow` but only validates the test job result. If the `changes` job fails (e.g., checkout error, paths-filter action error, network issues), the `test-ai_workflow` job will be skipped due to its dependency failure. Since the gate check now accepts `skipped` as valid, the CI will pass without running any tests. This could allow untested code to be merged when the change detection mechanism itself fails.
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
27 changes: 25 additions & 2 deletions .github/workflows/test-integrations-ai.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ github.event_name != 'pull_request' || steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
if: github.event_name == 'pull_request'
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- '.github/workflows/**'
test-ai:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'
name: AI
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -102,12 +125,12 @@
verbose: true
check_required_tests:
name: All AI tests passed
needs: test-ai
needs: [changes, test-ai]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-ai.result != 'success'
if: needs.test-ai.result != 'success' && needs.test-ai.result != 'skipped'

Check warning on line 134 in .github/workflows/test-integrations-ai.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

[XEN-AHW] Gate check ignores changes job failures, allowing untested code to pass CI (additional location) 

The `check_required_tests` job depends on both `changes` and `test-ai_workflow` but only validates the test job result. If the `changes` job fails (e.g., checkout error, paths-filter action error, network issues), the `test-ai_workflow` job will be skipped due to its dependency failure. Since the gate check now accepts `skipped` as valid, the CI will pass without running any tests. This could allow untested code to be merged when the change detection mechanism itself fails.
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
27 changes: 25 additions & 2 deletions .github/workflows/test-integrations-cloud.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@ env:
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ github.event_name != 'pull_request' || steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
if: github.event_name == 'pull_request'
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- '.github/workflows/**'
test-cloud:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'
name: Cloud
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -98,12 +121,12 @@ jobs:
verbose: true
check_required_tests:
name: All Cloud tests passed
needs: test-cloud
needs: [changes, test-cloud]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-cloud.result != 'success'
if: needs.test-cloud.result != 'success' && needs.test-cloud.result != 'skipped'
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
27 changes: 25 additions & 2 deletions .github/workflows/test-integrations-common.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ github.event_name != 'pull_request' || steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
if: github.event_name == 'pull_request'
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- '.github/workflows/**'
test-common:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'
name: Common
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -78,12 +101,12 @@
verbose: true
check_required_tests:
name: All Common tests passed
needs: test-common
needs: [changes, test-common]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-common.result != 'success'
if: needs.test-common.result != 'success' && needs.test-common.result != 'skipped'

Check warning on line 110 in .github/workflows/test-integrations-common.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

[XEN-AHW] Gate check ignores changes job failures, allowing untested code to pass CI (additional location) 

The `check_required_tests` job depends on both `changes` and `test-ai_workflow` but only validates the test job result. If the `changes` job fails (e.g., checkout error, paths-filter action error, network issues), the `test-ai_workflow` job will be skipped due to its dependency failure. Since the gate check now accepts `skipped` as valid, the CI will pass without running any tests. This could allow untested code to be merged when the change detection mechanism itself fails.
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
27 changes: 25 additions & 2 deletions .github/workflows/test-integrations-dbs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ github.event_name != 'pull_request' || steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
if: github.event_name == 'pull_request'
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- '.github/workflows/**'
test-dbs:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'
name: DBs
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -118,12 +141,12 @@
verbose: true
check_required_tests:
name: All DBs tests passed
needs: test-dbs
needs: [changes, test-dbs]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-dbs.result != 'success'
if: needs.test-dbs.result != 'success' && needs.test-dbs.result != 'skipped'

Check warning on line 150 in .github/workflows/test-integrations-dbs.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

[XEN-AHW] Gate check ignores changes job failures, allowing untested code to pass CI (additional location) 

The `check_required_tests` job depends on both `changes` and `test-ai_workflow` but only validates the test job result. If the `changes` job fails (e.g., checkout error, paths-filter action error, network issues), the `test-ai_workflow` job will be skipped due to its dependency failure. Since the gate check now accepts `skipped` as valid, the CI will pass without running any tests. This could allow untested code to be merged when the change detection mechanism itself fails.
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
27 changes: 25 additions & 2 deletions .github/workflows/test-integrations-flags.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,30 @@ env:
CACHED_BUILD_PATHS: |
${{ github.workspace }}/dist-serverless
jobs:
changes:
runs-on: ubuntu-22.04
outputs:
has_code_changes: ${{ github.event_name != 'pull_request' || steps.changes.outputs.has_code_changes }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: changes
if: github.event_name == 'pull_request'
with:
filters: |
has_code_changes:
- 'sentry_sdk/**'
- 'tests/**'
- 'scripts/**'
- '**/*.py'
- '**/*.cfg'
- '**/*.toml'
- '**/*.ini'
- 'Makefile'
- '.github/workflows/**'
test-flags:
needs: changes
if: needs.changes.outputs.has_code_changes == 'true'
name: Flags
timeout-minutes: 30
runs-on: ${{ matrix.os }}
Expand Down Expand Up @@ -90,12 +113,12 @@ jobs:
verbose: true
check_required_tests:
name: All Flags tests passed
needs: test-flags
needs: [changes, test-flags]
# Always run this, even if a dependent job failed
if: always()
runs-on: ubuntu-22.04
steps:
- name: Check for failures
if: needs.test-flags.result != 'success'
if: needs.test-flags.result != 'success' && needs.test-flags.result != 'skipped'
run: |
echo "One of the dependent jobs has failed. You may need to re-run it." && exit 1
Loading
Loading