(magpie) branch main updated: ci(zizmor): run on every pull request, so stacked PRs get the required check (#1440)

[po...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/magpie.git


The following commit(s) were added to refs/heads/main by this push:
     new 5834326f ci(zizmor): run on every pull request, so stacked PRs get the required check (#1440)
5834326f is described below

commit 5834326f1b2478219e64018aeff196ce8611eee7
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Mon Sep 28 01:32:15 2026 +0200

    ci(zizmor): run on every pull request, so stacked PRs get the required check (#1440)
    
    zizmor's `pull_request` trigger filtered on `branches: [main]`, which
    matches the PR's base branch. A stacked PR is based on the branch of
    the PR below it, so zizmor never ran there, and because `zizmor` is a
    required status check the PR waited on it indefinitely. prek and
    tests-ok have no such filter and already run on stacked PRs.
    
    Retargeting to main after the lower PR merges does not help either:
    that is an `edited` event, which the workflow does not listen for.
    
    The `push` trigger keeps its `main` filter.
    
    Generated-by: Claude Code (Opus 5.5)
---
 .github/workflows/zizmor.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index c0e49efd..2c5ecdc9 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -22,7 +22,9 @@ on:  # yamllint disable-line rule:truthy
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    # No `branches:` filter: it matches the PR's *base* branch, so a stacked
+    # PR (based on the branch of the PR below it) never ran zizmor and sat on
+    # the required `zizmor` check forever.
     # `ready_for_review` is not in the default set (opened / synchronize /
     # reopened). It is here so that marking a draft ready starts the checks —
     # which is what makes the draft PR from `bump-dev-version.yml` usable, since