Make a pass-job by nstarman · Pull Request #18686 · astropy/astropy

nstarman · 2025-10-06T22:09:40Z

Following https://learn.scientific-python.org/development/guides/gha-basic/#pass-job

@pllim I think this means we can change most of the CI pass requirements to just this job.

By checking this box, the PR author has requested that maintainers do NOT use the "Squash and Merge" button. Maintainers should respect this when possible; however, the final decision is at the discretion of the maintainer that merges the PR.

Co-authored-by: nstarman <8949649+nstarman@users.noreply.github.com>

github-actions · 2025-10-06T22:09:51Z

Thank you for your contribution to Astropy! 🌌 This checklist is meant to remind the package maintainers who will review this pull request of some common things to look for.

Do the proposed changes actually accomplish desired goals?
Do the proposed changes follow the Astropy coding guidelines?
Are tests added/updated as required? If so, do they follow the Astropy testing guidelines?
Are docs added/updated as required? If so, do they follow the Astropy documentation guidelines?
Is rebase and/or squash necessary? If so, please provide the author with appropriate instructions. Also see instructions for rebase and squash.
Did the CI pass? If no, are the failures related? If you need to run daily and weekly cron jobs as part of the PR, please apply the "Extra CI" label. Codestyle issues can be fixed by the bot.
Is a change log needed? If yes, did the change log check pass? If no, add the "no-changelog-entry-needed" label. If this is a manual backport, use the "skip-changelog-checks" label unless special changelog handling is necessary.
Is this a big PR that makes a "What's new?" entry worthwhile and if so, is (1) a "what's new" entry included in this PR and (2) the "whatsnew-needed" label applied?
At the time of adding the milestone, if the milestone set requires a backport to release branch(es), apply the appropriate "backport-X.Y.x" label(s) before merge.

github-actions · 2025-10-06T22:09:52Z

👋 Thank you for your draft pull request! Do you know that you can use [ci skip] or [skip ci] in your commit messages to skip running continuous integration tests until you are ready?

neutrinoceros

I like the idea, so approving. However we'll need someone with owner privileges to sign off, so I'm not merging yet.

pllim · 2025-10-07T14:56:25Z

+    if: always()
+    steps:
+      - name: All required jobs passed
+        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # release/v1


Yet another custom workflow. What if it breaks in the future? I need to ponder the pros and cons.

So a really simple example of this in action (pun?) is scientific-python/cookie#647 .

Theoretically, this gives anyone with write access (not just repo admin) to change the rules. I cannot decide if this is pro or con. Right now we only update rules when we bump Python (because Python version is tied into job name). But if anyone can push such rule change at any time during dev cycle, it is going to introduce inconsistency to the process.

Con: At a glance, if it fails, you cannot know which failed job is actually required without diving into the log.

Theoretically, this gives anyone with write access (not just repo admin) to change the rules. I cannot decide if this is pro or con.

I think that's a pro: sure, this means anyone can "cheat" the system, but, critically, they cannot do so stealthily. Any rule change would be met with skepticism from reviewers, except, perhaps, in the rather exceptional case that it's done with valid reasons.

Add @pllim as a code-owner and others to be code owners of the CI file? https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
Guarantees eyes on changes to the CI.

No need. I watch the repo. Also, PR only needs one approval from anyone to merge. Only take one careless dev.

Yes, but how is our current system better at shielding us against mistakes ?

The current system limit the mistake to repo admin. This new workflow opens up mistake points to all possible people who able to merge a PR.

I would feel more comfortable if we can test it out first in one of the affiliated packages or something.

Coordinated or affiliated? Or I've put this in https://github.com/GalacticDynamics/unxt

It works great in unxt. The one drawback I've noticed is that you can't see which jobs are required to pass. It is easily inferable since fail-fast is on, so if a test is failing and the CI hasn't stopped, then it's not required to pass :p. But still worth mentioning as it's the one small annoyance that I've found.

pllim

Pondering

github-actions · 2026-03-06T05:57:21Z

Hi humans 👋 - this pull request hasn't had any new commits for approximately 4 months. I plan to close this in 30 days if the pull request doesn't have any new commits by then.

In lieu of a stalled pull request, please consider closing this and open an issue instead if a reminder is needed to revisit in the future. Maintainers may also choose to add keep-open label to keep this PR open but it is discouraged unless absolutely necessary.

If this PR still needs to be reviewed, as an author, you can rebase it to reset the clock.

If you believe I commented on this pull request incorrectly, please report this here.

nstarman · 2026-03-06T16:42:22Z

@pllim we can achieve the current level of protection using a GH action

CODEOWNERS (requests reviews for files):

   .github/workflows/CI.yml   @astropy/ci-team
   astropy/cosmology/*                     @astropy/cosmology-team

Branch protection rule — disable "Require review from Code Owners" globally. (I think that's already the current setting)
Write a GitHub Action that acts as a required status check:

The action inspects whether .github/workflows/CI.yml was modified in the PR
If yes, it checks whether someone from @astropy/ci-team has approved
If no, it passes automatically
Make this check a required status check in branch protection

Then we can have a pass-job (as recommended by scientific-python) and ensure that only those with the right permissions can merge modifications to CI.
Having a pass job should mean:

Besides making it much easier to add and remove jobs, it also means that adding a new required job won’t make all of your past, merged PRs change from a green checkmark to an orange “pending” symbol (since there are new requirements that they didn’t pass).

pllim · 2026-03-06T17:45:24Z

@nstarman I think your proof-of-concept should be deployed to a smaller repo first to prove that it works as intended before we roll it out here. It is a lot of hassle to set this up, and then undo it if it does not really work as expected. Thanks.

github-actions · 2026-04-05T06:09:46Z

I'm going to close this pull request as per my previous message. If you think what is being added/fixed here is still important, please remember to open an issue to keep track of it. Thanks!

If this is the first time I am commenting on this issue, or if you believe I closed this issue incorrectly, please report this here.

Copilot AI and others added 2 commits October 6, 2025 21:56

Initial plan

2cf3504

Add CI status step with re-actors/alls-green

d85568f

Co-authored-by: nstarman <8949649+nstarman@users.noreply.github.com>

nstarman added this to the v7.2.0 milestone Oct 6, 2025

github-actions Bot added the testing label Oct 6, 2025

nstarman added the no-changelog-entry-needed label Oct 6, 2025

nstarman commented Oct 6, 2025

View reviewed changes

Comment thread .github/workflows/ci_workflows.yml Outdated

change to using commit hash

d26f012

nstarman marked this pull request as ready for review October 6, 2025 22:54

nstarman requested a review from neutrinoceros as a code owner October 6, 2025 22:54

neutrinoceros approved these changes Oct 7, 2025

View reviewed changes

pllim reviewed Oct 7, 2025

View reviewed changes

pllim requested changes Oct 7, 2025

View reviewed changes

astrofrog modified the milestones: v7.2.0, v8.0.0 Nov 3, 2025

github-actions Bot added the Close? Tell stale bot that this issue/PR is stale label Mar 6, 2026

github-actions Bot added the closed-by-bot Closed by stale bot label Apr 5, 2026

github-actions Bot closed this Apr 5, 2026

Uh oh!

Conversation

nstarman commented Oct 6, 2025

Uh oh!

github-actions Bot commented Oct 6, 2025

Uh oh!

github-actions Bot commented Oct 6, 2025

Uh oh!

Uh oh!

neutrinoceros left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nstarman Nov 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pllim left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Mar 6, 2026

Uh oh!

nstarman commented Mar 6, 2026

Uh oh!

pllim commented Mar 6, 2026

Uh oh!

github-actions Bot commented Apr 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

nstarman Nov 14, 2025 •

edited

Loading