(grails-core) branch ci/policy-follow-ups updated: Wait for the rerun-tasks build before publishing the core

[ma...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

matrei pushed a commit to branch ci/policy-follow-ups
in repository https://gitbox.apache.org/repos/asf/grails-core.git


The following commit(s) were added to refs/heads/ci/policy-follow-ups by this push:
     new dbf938c01d Wait for the rerun-tasks build before publishing the core
dbf938c01d is described below

commit dbf938c01d7d1698379c86c9f764db03ff6d0b5a
Author: Mattias Reichel <ma...@gmail.com>
AuthorDate: Thu Oct 22 16:32:31 2026 +0200

    Wait for the rerun-tasks build before publishing the core
    
    publish did not need buildRerunTasks, so the core snapshot was published
    while that test job was still running, and even when it failed. A cancel
    in that window published the whole chain, although the concurrency
    comment says a cancel while tests are running publishes only the Gradle
    plugins. Add it to the needs of publish and to its explicit checks, and
    state in the publish comment and in AGENTS.md which jobs belong in the
    needs of publish and of publishGradle.
---
 .github/workflows/gradle.yml | 4 +++-
 AGENTS.md                    | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index 57ba3bb383..abad73b803 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -598,17 +598,19 @@ jobs:
           name: grails-gradle-artifacts.txt
           path: grails-gradle/build/grails-gradle-artifacts.txt
   publish:
-    needs: [ publishGradle, build, functional, security, securityConfig, redis, hibernate5Functional, mongodbFunctional ]
+    needs: [ publishGradle, build, buildRerunTasks, functional, security, securityConfig, redis, hibernate5Functional, mongodbFunctional ]
     # always() with explicit result checks, see the concurrency comment at the top. The results are checked
     # explicitly because the implicit success() check also covers the skipped test jobs upstream, which would
     # skip this job on a build-only run, and because a cancelled test job must not be published: the core of a
     # commit whose tests were cancelled never reaches the snapshot repository, although its Gradle plugins may.
+    # Every test job of this workflow belongs in these needs.
     if: >-
       ${{ always() &&
           github.repository_owner == 'apache' &&
           (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
           needs.publishGradle.result == 'success' &&
           (needs.build.result == 'success' || needs.build.result == 'skipped') &&
+          (needs.buildRerunTasks.result == 'success' || needs.buildRerunTasks.result == 'skipped') &&
           (needs.functional.result == 'success' || needs.functional.result == 'skipped') &&
           (needs.security.result == 'success' || needs.security.result == 'skipped') &&
           (needs.securityConfig.result == 'success' || needs.securityConfig.result == 'skipped') &&
diff --git a/AGENTS.md b/AGENTS.md
index 1032f07648..f04c628f98 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -256,7 +256,7 @@ GitHub-hosted runner time is shared with every other Apache project, so the work
 - The tests run by default only on the default branch and the release branches above it, and there a commit message starting with `[skip tests]` skips them. Everywhere else, that is on a release branch below the default (7.0.x, 7.1.x and 7.2.x while 8.0.x is the default) and on a pull request whose base is a side branch rather than a release branch, the tests run only on request: when the commit message starts with `[run tests]`, when the pull request carries the `run ci` label, or when  [...]
 - The jobs that run no tests (dependency validation, the build-without-tests steps, code style and build health) still run on every push to a release branch and on every non-draft pull request; RAT and CodeQL run on every push to a release branch and on every non-draft pull request into one, since their `pull_request` triggers list only release-branch bases. Only the `no ci` label, or a draft without `run ci`, stops them. The snapshot publish runs on every push to a release branch and on [...]
 - The publish jobs in `gradle.yml` (`publishGradle`, `publish`, `publishForge`, `verifyWrapper`, `docs`) run on `always()` and check the result of each job they need explicitly. The explicit checks are needed because the implicit `success()` check covers every job upstream, so a skipped test job would skip them although their own needs succeeded, which is what silently skipped the Forge and docs publish on every `[skip tests]` push. `always()` rather than `!cancelled()` because a newer p [...]
-- A workflow that gains a test job gets `needs: [ policy ]` and `if: ${{ needs.policy.outputs.run-tests == 'true' }}` on that job; a workflow that gains a non-test job copies the label-and-draft `if` from its sibling jobs.
+- A workflow that gains a test job gets `needs: [ policy ]` and `if: ${{ needs.policy.outputs.run-tests == 'true' }}` on that job; a workflow that gains a non-test job copies the label-and-draft `if` from its sibling jobs. In `gradle.yml`, a new test job also goes into the `needs` of `publish`, with a `success` or `skipped` check, and a new job that builds or validates without tests into those of `publishGradle`, with a `success` check; a job left out is not waited for, so a commit whose [...]
 
 ### Gradle caching