sixfold-space/madtea

SHA256

Fork 0

ci(drift): run drift on demand, and move the cron to the morning #533

Merged

hexajon merged 1 commit from issue-532-drift-dispatch-and-morning-cron into main

2026-09-16 21:11:50 +00:00

hexajon commented

2026-09-16 21:11:48 +00:00

Owner

Summary

Closes #532. Follow-up to #525 and PR #531.

The gap

drift.yml had three triggers and no way to start a run by hand. Its two cron-only jobs could therefore never be exercised on demand. git-matrix shipped in PR #531 without ever having executed, and its first run would also be the first time anything mounted madtea-gitcache. A mistake in the mount, the source build, or the signature check would have failed with nobody watching.

The cron also reported at the wrong end of the day. 17 4 * * * UTC is 22:17 local for me, so a red drift result landed late at night and was read the next morning at the earliest.

What changes

workflow_dispatch is now a trigger, and git-matrix runs on it as well as on schedule. The check can be started from the Actions tab instead of waiting a day.
The daily schedule moves from 17 4 * * * to 0 13 * * *, so the result lands at the start of the working day.

Actions cron is UTC only, so the local time shifts by an hour across a daylight-saving change: 07:00 in summer, 06:00 in winter. The comment says so, rather than leaving the reader to work it out.

Why dispatch is safe here

A dispatch needs write access on the repository, so it is a trusted event in the same class as push and schedule. The cache-mount expression already keys on != 'pull_request' and treats it as trusted, which stays correct.

forgejo-smoke is the one job worth checking before widening a trigger, because it needs a host Docker socket. It is gated on vars.RUN_FORGEJO_SMOKE == 'true' && github.event_name != 'pull_request', and a dispatch satisfies the second clause. The repository defines no Actions variables at all, so the first clause is false and that job stays skipped. It remains unreachable from a fork PR, which is the property its comment protects.

govulncheck stays cron-only. Widening it was not part of the ask, and ci.yml already runs it on every push and PR.

Verification

The workflow parses, and the gates resolve as intended:

triggers:      pull_request, push, schedule, workflow_dispatch
schedule:      0 13 * * *
govulncheck    if: github.event_name == 'schedule'
surface-diff   if: (always)
forgejo-smoke  if: vars.RUN_FORGEJO_SMOKE == 'true' && github.event_name != 'pull_request'
git-matrix     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'

I am triggering a dispatch run straight after this merges, which is the first real execution of the git matrix.

Closes #532

## Summary Closes #532. Follow-up to #525 and PR #531. ## The gap `drift.yml` had three triggers and no way to start a run by hand. Its two cron-only jobs could therefore never be exercised on demand. `git-matrix` shipped in PR #531 without ever having executed, and its first run would also be the first time anything mounted `madtea-gitcache`. A mistake in the mount, the source build, or the signature check would have failed with nobody watching. The cron also reported at the wrong end of the day. `17 4 * * *` UTC is 22:17 local for me, so a red drift result landed late at night and was read the next morning at the earliest. ## What changes - `workflow_dispatch` is now a trigger, and `git-matrix` runs on it as well as on `schedule`. The check can be started from the Actions tab instead of waiting a day. - The daily schedule moves from `17 4 * * *` to `0 13 * * *`, so the result lands at the start of the working day. Actions cron is UTC only, so the local time shifts by an hour across a daylight-saving change: 07:00 in summer, 06:00 in winter. The comment says so, rather than leaving the reader to work it out. ## Why dispatch is safe here A dispatch needs write access on the repository, so it is a trusted event in the same class as `push` and `schedule`. The cache-mount expression already keys on `!= 'pull_request'` and treats it as trusted, which stays correct. `forgejo-smoke` is the one job worth checking before widening a trigger, because it needs a host Docker socket. It is gated on `vars.RUN_FORGEJO_SMOKE == 'true' && github.event_name != 'pull_request'`, and a dispatch satisfies the second clause. The repository defines no Actions variables at all, so the first clause is false and that job stays skipped. It remains unreachable from a fork PR, which is the property its comment protects. `govulncheck` stays cron-only. Widening it was not part of the ask, and `ci.yml` already runs it on every push and PR. ## Verification The workflow parses, and the gates resolve as intended: triggers: pull_request, push, schedule, workflow_dispatch schedule: 0 13 * * * govulncheck if: github.event_name == 'schedule' surface-diff if: (always) forgejo-smoke if: vars.RUN_FORGEJO_SMOKE == 'true' && github.event_name != 'pull_request' git-matrix if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' I am triggering a dispatch run straight after this merges, which is the first real execution of the git matrix. Closes #532

hexajon added 1 commit

2026-09-16 21:11:48 +00:00

ci(drift): run drift on demand, and move the cron to the morning

ci / mcp-conformance (pull_request) Successful in 2m1s

Details

drift / govulncheck (pull_request) Has been skipped

Details

drift / forgejo-smoke (pull_request) Has been skipped

Details

drift / git-matrix (pull_request) Has been skipped

Details

drift / surface-diff (pull_request) Successful in 1m1s

Details

ci / mcp-conformance (push) Successful in 9s

Details

drift / govulncheck (push) Has been skipped

Details

drift / surface-diff (push) Successful in 3s

Details

drift / forgejo-smoke (push) Has been skipped

Details

drift / git-matrix (push) Has been skipped

Details

ci / gate (push) Successful in 9m57s

Details

ci / gate (pull_request) Successful in 19m16s

Details

8e1173e87b

Closes #532

hexajon merged commit 8e1173e87b into main

2026-09-16 21:11:50 +00:00

hexajon referenced this pull request

2026-09-17 02:42:09 +00:00

ci(drift): remove the git-matrix job #539

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea!533

No description provided.

Rows
Columns