ci: skip the gate on main when its merge request passed on the same commit #513

Merged

project_1_bot_05dcee5cd59f879ab35191d664847a9d merged 2 commits from ci/reuse-gate-on-main into main

2026-10-13 13:22:00 +00:00

project_1_bot_05dcee5cd59f879ab35191d664847a9d commented

2026-10-13 12:21:50 +00:00

(Migrated from gitlab.core-project.space)

Summary

The project merges by fast-forward only, so main's new head is the exact commit its merge request's pipeline tested. Even so, main reran the whole gate before production.

push to main
  reuse-gate (.pre)  →  infra/gitlab/ci/reuse-gate.mjs
    GET /repository/commits/:sha/merge_requests     # job-token endpoint
    for each merged MR whose head is :sha
      GET /merge_requests/:iid → head_pipeline     # job-token endpoint
      if head_pipeline.sha == :sha and status == success
        GATE_PASSED_IN=<pipeline id>   (dotenv)
    anything else, API errors included → nothing written, gate runs
  checks, front-test, e2e    →  exit 0 in before_script when GATE_PASSED_IN is set
  build-workspace, build-image, production  →  unchanged

Maintainers can still push to main directly, so the job asks the API rather than assuming every commit came through a merge request. No access token is stored. Decision logged in infra/gitlab/DECISIONS.md, "CI speed-up".

Evidence

Before: pipeline 8 (main, after !507): 329 s, including 160 s of e2e that its merge request had just run on the same commit.

Script, against a mock of the two endpoints:

green      -> [GATE_PASSED_IN=7] Pipeline 7 of !507 passed on aaaa…, so the gate is skipped.
failed     -> [] No merged merge request passed on aaaa…, so the gate runs.
otherHead  -> [] No merged merge request passed on aaaa…, so the gate runs.
directPush -> [] No merged merge request passed on aaaa…, so the gate runs.
apiDown    -> [] GET /repository/commits/aaaa…/merge_requests answered 403, so the gate runs.

Real data: main's head 258e265c is !507's head, and its head_pipeline 7 is success on that SHA.
After: reuse-gate runs only on main, so this MR's pipeline proves only that the gate still runs normally on an MR. The real proof is the first main pipeline after merge, which I'll report with its job durations.

Merge Danger

Door: two-way

The revert is one commit, and the script fails open.

Blast Radius: production

production now follows a gate verified by the merge request's pipeline, not by a rerun on main. That holds only while merges are fast-forward with "pipeline must succeed". If merge_method changes to merge commits, the merged commit's SHA is no MR's head, so the gate runs again; nothing silently skips.

## Summary The project merges by fast-forward only, so `main`'s new head is the exact commit its merge request's pipeline tested. Even so, `main` reran the whole gate before `production`. ```text push to main reuse-gate (.pre) → infra/gitlab/ci/reuse-gate.mjs GET /repository/commits/:sha/merge_requests # job-token endpoint for each merged MR whose head is :sha GET /merge_requests/:iid → head_pipeline # job-token endpoint if head_pipeline.sha == :sha and status == success GATE_PASSED_IN=<pipeline id> (dotenv) anything else, API errors included → nothing written, gate runs checks, front-test, e2e → exit 0 in before_script when GATE_PASSED_IN is set build-workspace, build-image, production → unchanged ``` Maintainers can still push to `main` directly, so the job asks the API rather than assuming every commit came through a merge request. No access token is stored. Decision logged in `infra/gitlab/DECISIONS.md`, "CI speed-up". ## Evidence - **Before:** pipeline 8 (`main`, after !507): 329 s, including 160 s of `e2e` that its merge request had just run on the same commit. - **Script, against a mock of the two endpoints:** ```text green -> [GATE_PASSED_IN=7] Pipeline 7 of !507 passed on aaaa…, so the gate is skipped. failed -> [] No merged merge request passed on aaaa…, so the gate runs. otherHead -> [] No merged merge request passed on aaaa…, so the gate runs. directPush -> [] No merged merge request passed on aaaa…, so the gate runs. apiDown -> [] GET /repository/commits/aaaa…/merge_requests answered 403, so the gate runs. ``` - **Real data:** `main`'s head `258e265c` is !507's head, and its `head_pipeline` 7 is `success` on that SHA. - **After:** `reuse-gate` runs only on `main`, so this MR's pipeline proves only that the gate still runs normally on an MR. The real proof is the first `main` pipeline after merge, which I'll report with its job durations. ## Merge Danger **Door:** two-way The revert is one commit, and the script fails open. **Blast Radius:** production `production` now follows a gate verified by the merge request's pipeline, not by a rerun on `main`. That holds only while merges are fast-forward with "pipeline must succeed". If `merge_method` changes to merge commits, the merged commit's SHA is no MR's head, so the gate runs again; nothing silently skips.

root commented

2026-10-13 12:43:27 +00:00

(Migrated from gitlab.core-project.space)

added 3 commits

3a65fbb1...b88b2982 - 2 commits from branch main
1c7df3a2 - ci: skip the gate on main when its merge request passed on the same commit

Compare with previous version

added 3 commits <ul><li>3a65fbb1...b88b2982 - 2 commits from branch <code>main</code></li><li>1c7df3a2 - ci: skip the gate on main when its merge request passed on the same commit</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/13/diffs?diff_id=47&start_sha=3a65fbb13efb0de192ca3b5bb9480cfd3ded7df1)

project_1_bot_05dcee5cd59f879ab35191d664847a9d commented

2026-10-13 12:48:29 +00:00

(Migrated from gitlab.core-project.space)

added 3 commits

1c7df3a2...9bd3ffd6 - 2 commits from branch main
ee0ba1ac - ci: skip the gate on main when its merge request passed on the same commit

Compare with previous version

added 3 commits <ul><li>1c7df3a2...9bd3ffd6 - 2 commits from branch <code>main</code></li><li>ee0ba1ac - ci: skip the gate on main when its merge request passed on the same commit</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/13/diffs?diff_id=61&start_sha=1c7df3a2acba7509af0f767e2d05633b9e08dd37)

project_1_bot_05dcee5cd59f879ab35191d664847a9d commented

2026-10-13 12:51:27 +00:00

(Migrated from gitlab.core-project.space)

added 2 commits

a84b494b - 1 commit from branch main
6521e096 - ci: skip the gate on main when its merge request passed on the same commit

Compare with previous version

added 2 commits <ul><li>a84b494b - 1 commit from branch <code>main</code></li><li>6521e096 - ci: skip the gate on main when its merge request passed on the same commit</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/13/diffs?diff_id=64&start_sha=ee0ba1ac55826fec3d4c36f7afaae63da6afa848)

project_1_bot_05dcee5cd59f879ab35191d664847a9d commented

2026-10-13 12:55:09 +00:00

(Migrated from gitlab.core-project.space)

added 2 commits

4f61cf6b - ci: run the front's tests in one job rather than three shards
6e37a388 - ci: skip the gate on main when its merge request passed on the same commit

Compare with previous version

added 2 commits <ul><li>4f61cf6b - ci: run the front's tests in one job rather than three shards</li><li>6e37a388 - ci: skip the gate on main when its merge request passed on the same commit</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/13/diffs?diff_id=65&start_sha=6521e0966ff5bee2887c60b4a8df8c004ba7d063)

root (Migrated from gitlab.core-project.space) merged commit into main

2026-10-13 13:22:01 +00:00