Skip to content

ci(dry-run): add skip_smoke for a direct build → VirusTotal pass #1490

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DeusData merged 1 commit into from
Aug 7, 2026
+22 −6
Merged

ci(dry-run): add skip_smoke for a direct build → VirusTotal pass #1490

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 22 additions & 6 deletions .github/workflows/dry-run.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,18 @@
# back clean one day and flagged the next, which is precisely why finding out
# during a dry run is worth the wait.
#
# Two independent skips, because they answer different questions:
# skip_builds no artifacts at all — "do lint and tests pass?"
# skip_virustotal build + smoke + soak, no scan — "do the archives pass CI?"
# The second exists because the scan costs API quota and polls for up to two
# hours, which is pure noise while iterating on a build or smoke failure.
# The skips are independent because they answer different questions:
# skip_builds no artifacts at all "do lint and tests pass?"
# skip_smoke build + scan, no smoke "does this diff scan red?"
# skip_virustotal build + smoke + soak, no scan "do the archives pass CI?"
#
# skip_virustotal exists because the scan costs API quota and polls for up to
# two hours, which is pure noise while iterating on a build or smoke failure.
#
# skip_smoke is the opposite trip: go straight from build to VirusTotal when the
# question is only whether a diff turns the scan red. Smoke is in the VirusTotal
# job's needs, so without this a smoke failure would withhold exactly the answer
# such a run was dispatched to get.
name: Dry Run

on:
Expand All @@ -35,6 +42,10 @@ on:
description: 'Skip build + smoke (also skips VirusTotal — nothing to scan)'
type: boolean
default: false
skip_smoke:
description: 'Skip smoke (build straight to VirusTotal)'
type: boolean
default: false
skip_virustotal:
description: 'Skip VirusTotal scan (still builds + smokes the archives)'
type: boolean
Expand Down Expand Up @@ -86,7 +97,7 @@ jobs:
# (including the macos-15-intel darwin-amd64 binary) is blocking now, so a
# failed/missing platform binary correctly stops smoke — see _build.yml.
smoke:
if: ${{ inputs.skip_builds != true && !cancelled() && needs.build.result != 'failure' && needs.build.result != 'skipped' }}
if: ${{ inputs.skip_builds != true && inputs.skip_smoke != true && !cancelled() && needs.build.result != 'failure' && needs.build.result != 'skipped' }}
needs: [build]
uses: ./.github/workflows/_smoke.yml
with:
Expand All @@ -112,6 +123,11 @@ jobs:
# take up to two hours) and the one most likely to be waiting on someone
# else's queue, so it must not delay the feedback that is actually about our
# code.
#
# It needs smoke and soak only so it runs LAST, not because it depends on
# them: a skipped smoke or soak leaves the scan reachable (result 'skipped',
# which is not 'failure'), while a FAILED one withholds it — if the artifacts
# are broken, a verdict on them is not worth two hours of polling.
virustotal:
if: ${{ inputs.skip_builds != true && inputs.skip_virustotal != true && !cancelled() && needs.build.result == 'success' && needs.smoke.result != 'failure' && needs.soak.result != 'failure' }}
needs: [build, smoke, soak]
Expand Down
Loading