ci: always run required checks on pull requests

[ajy0127]

Why

Branch protection on main requires two status checks: Validate plugin and marketplace manifests and Validate contract fixtures against every schema. Both workflows had paths: filters on their pull_request triggers, so on any PR outside those paths the checks never run, never report, and GitHub blocks the merge forever. Every docs-only PR (#199, #200, #204) and the coverage bot's weekly PR (#205) needed an admin bypass to land today.

What changed

• Removed the paths: filter from the pull_request trigger in .github/workflows/validate-plugin-manifests.yml and .github/workflows/contract-test.yml, with a comment explaining why it must stay off. push triggers are untouched.
• CHANGELOG entry under [Unreleased] → Changed.

Both jobs finish in under a minute, so the cost of running them on every PR is negligible — and a marketplace/manifest regression can technically ride in on any PR, so unconditional validation is also strictly safer.

After this merges

• Docs-only and bot PRs merge normally once approved — no more admin bypasses.
• "Allow auto-merge" (Settings → General → Pull Requests) becomes worth enabling so green approved PRs land themselves.

Verified

• Both required check names (Validate plugin and marketplace manifests, Validate contract fixtures against every schema) are job name: fields, which this PR does not touch — branch protection keeps matching.
• This PR touches the workflow files themselves, so both checks run here and must pass.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Required validation and contract checks now run for every pull request, providing consistent status reporting regardless of which files changed.
  • Existing behavior for checks triggered by pushes to the main branch remains unchanged.

• Documentation

  • Updated the unreleased changelog to document the expanded pull-request checks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3ff72ae3-f905-40af-8006-e10ef6ce1ba9

📥 Commits

Reviewing files that changed from the base of the PR and between e98e63e and f77f26c.

📒 Files selected for processing (3)

• .github/workflows/contract-test.yml
• .github/workflows/validate-plugin-manifests.yml
• CHANGELOG.md

---

📝 Walkthrough

Walkthrough

The pull-request path filters were removed from the contract-test and plugin-manifest validation workflows. Both workflows now run for every pull request. The changelog documents this change.

Changes

Required CI check coverage

Layer / File(s)	Summary
Unfiltered pull request triggers .github/workflows/contract-test.yml, .github/workflows/validate-plugin-manifests.yml, CHANGELOG.md	Both required workflows run on every pull request. Existing push behavior remains unchanged. The changelog records the trigger changes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• GRCEngClub/claude-grc-engineering#209: Modifies the pull-request path-trigger configuration in the same two workflows.

Suggested reviewers: ethanolivertroy

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: required CI checks now run on every pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/always-run-required-checks

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

CI: always run required checks on all pull requests

⚙️ Configuration changes 📝 Documentation 🕐 10-20 Minutes

AI Description

• Remove PR path filters from required CI workflows so checks always report status.
• Prevent docs-only and bot PRs from being permanently blocked by branch protection.
• Document the CI behavior change in the changelog.

Diagram

graph TD
  PR["Pull Request"] --> GA["GitHub Actions"] --> CT["contract-test.yml"] --> RSC["Required status checks"] --> BP["Branch protection (main)"] --> MG["Merge gate"]
  GA --> VPM["validate-plugin-manifests.yml"] --> RSC
  PR --> CL["CHANGELOG.md"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Adjust branch protection to not require these checks

• ➕ Eliminates the "missing required check" deadlock without changing workflow triggers
• ➖ Reduces safety guarantees (regressions may merge without validation)
• ➖ Requires repo settings changes and ongoing coordination when checks evolve

2. Add a lightweight always-on wrapper workflow that calls reusable workflows

• ➕ Keeps expensive validations path-filtered while still reporting a required check on every PR
• ➕ Centralizes required-check reporting in one workflow name
• ➖ More moving parts (reusable workflows, indirection)
• ➖ Harder to reason about required-check semantics and failure modes

3. Use a single always-run workflow and conditional steps keyed off changed paths

• ➕ Always reports status while skipping work when irrelevant changes occur
• ➕ Avoids the GitHub behavior where path-filtered workflows don’t report at all
• ➖ More YAML complexity (path detection, conditions)
• ➖ Adds maintenance burden vs. simply running two sub-minute jobs

Recommendation: Keep the PR’s approach (remove pull_request path filters). It’s the simplest, most reliable fix for the required-check deadlock and preserves branch-protection safety. Given both workflows complete quickly, always running them is an acceptable cost and avoids subtle "no status reported" GitHub behavior.

Files changed (3) +10 / -14

Documentation (1) +4 / -0

CHANGELOG.mdDocument always-on required CI checks +4/-0

Document always-on required CI checks

• Adds an Unreleased → Changed entry explaining that required CI workflows now run on every PR to prevent merges being blocked by missing statuses.

CHANGELOG.md

Other (2) +6 / -14

contract-test.ymlRun contract-test required check on every PR +3/-5

Run contract-test required check on every PR

• Removes the pull_request 'paths:' filter so the workflow always triggers and reports status. Adds a comment documenting why path filters must remain off for required checks.

.github/workflows/contract-test.yml

validate-plugin-manifests.ymlRun manifest validation required check on every PR +3/-9

Run manifest validation required check on every PR

• Removes the pull_request 'paths:' filter so the required check always runs and reports on all pull requests. Adds an explanatory comment; push trigger behavior is unchanged.

.github/workflows/validate-plugin-manifests.yml

[greptile-apps]

Greptile Summary

This PR fixes a GitHub Actions branch-protection deadlock: both required status checks (Validate plugin and marketplace manifests and Validate contract fixtures against every schema) had paths: filters on their pull_request triggers. When a PR didn't touch those paths, the checks were silently skipped — never reporting a status — leaving the PR permanently unmergeable without an admin bypass.

• contract-test.yml and validate-plugin-manifests.yml: Removed paths: from the pull_request trigger only; push triggers are untouched (the manifests workflow still filters on push to main, the contract-test workflow already ran unconditionally on push to main). Explanatory comments are included to prevent the filter from being re-added.
• CHANGELOG.md: Added a "Changed" entry under [Unreleased] accurately describing the fix.

Confidence Score: 5/5

• Safe to merge — the change is a minimal, well-scoped removal of path filters from pull_request triggers with no functional logic touched.
• Both workflows only drop the paths: key from their pull_request stanza; everything else — job steps, concurrency settings, push triggers with their existing filters — is left exactly as it was. The fix directly matches the stated root cause and is the standard GitHub Actions solution for this class of required-check misconfiguration.
• No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/contract-test.yml	Removed paths: filter from the pull_request trigger so this required status check now reports on every PR; push trigger (branches: [main], no paths filter) is unchanged.
.github/workflows/validate-plugin-manifests.yml	Removed paths: filter from the pull_request trigger only; the push trigger retains its paths: filter (selective main-branch runs), giving the correct asymmetric behavior.
CHANGELOG.md	Added a well-placed "Changed" entry under [Unreleased] describing the required-check fix; changelog structure (Added → Changed → Removed) follows Keep a Changelog conventions.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[PR opened] --> B{Does PR touch\nworkflow paths?}

    subgraph BEFORE["Before this PR"]
        B -->|Yes| C[Workflow runs\nand reports ✅]
        B -->|No| D[Workflow skipped\n— no status reported ❌]
        D --> E[Required check\nnever satisfied]
        E --> F[PR blocked\nforever 🚫]
        F --> G[Admin bypass\nneeded]
    end

    subgraph AFTER["After this PR"]
        B2[PR opened] --> C2[Workflow always\nruns on every PR ✅]
        C2 --> D2[Required check\nreports pass/fail]
        D2 --> E2[PR merges normally\nonce approved ✅]
    end

Loading

_{Reviews (2): Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." | Re-trigger Greptile}

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[ethanolivertroy]

Approving — CI policy fix, all checks green. Merging per maintainer directive.

[ethanolivertroy]

Approved. Branch is behind main (now that #203 is merged) and needs a rebase. @ajy0127 — please rebase ci/always-run-required-checks onto main, or grant maintainers write access so this can be auto-rebased.