ci: keep both fail-safe paths from aborting instead of refusing

Two fixes from the fourth review on #844. Both are cases where a condition the
code intends to handle deliberately instead killed the step with no explanation.

Read the example matrix from the default branch, not from the verified head. A
Dependabot branch cut before this file existed 404s at its own head, and gh's
non-zero exit aborted the whole step under set -e with a bare "Not Found" rather
than the refusal every other unresolvable condition here gets. Reachable
immediately: confirmed a 404 against #842's current head, and all 69 open
Dependabot PRs branch from a main that predates the file. The default branch is
also the right source of truth — it is repository config, the examples-only guard
means the pull request cannot have changed it, and a pull_request workflow runs the
merge-ref copy, so it is the matrix the run actually used. A failed read or a
malformed file now refuses explicitly.

Stop the selector aborting when nothing under examples/ changed. `grep -oE` exits
1 on no match and pipefail turned that into a red Verify Examples with no
diagnostic, contradicting the fail-safe contract documented at the top of the
script. Reproduced with an empty diff, which is reachable for a stale pull request
whose change already landed through a duplicate. It now emits empty matrices and
exits 0, which the `if: ... != '[]'` guards and the auto-merge job's job-count
check already handle. grep is kept out of the pipeline so `|| true` tolerates only
its no-match status, and the empty case is explicit rather than relying on
`jq -R .` turning an empty string into [""].

Author: bnusunny

.github/scripts/select-examples.sh

@@ -51,8 +51,25 @@ if grep -qE '^(src/|layer/|Cargo\.toml$|Cargo\.lock$|\.github/workflows/examples
   exit 0
 fi
 
-# examples/<name>/... -> <name>
-names="$(grep -oE '^examples/[^/]+' <<<"$changed" | cut -d/ -f2 | sort -u | jq -R . | jq -sc .)"
+# examples/<name>/... -> <name>. grep exits 1 when nothing matches, which pipefail
+# would turn into an unexplained failure of this script — so tolerate that one status,
+# and only that one, by keeping grep out of the pipeline below.
+example_paths="$(grep -oE '^examples/[^/]+' <<<"$changed" || true)"
+
+# Reachable with an empty diff: a stale pull request whose change already landed
+# through a duplicate (#804 and #811 carry an identical update set), or a re-run after
+# the commit merged. "Select nothing" is the documented contract here, not "fail" —
+# the `if: ... != '[]'` guards in examples.yaml skip the test jobs, and the auto-merge
+# workflow refuses a run with no successful test job.
+if [[ -z "$example_paths" ]]; then
+  echo "No example changed: nothing to verify."
+  for kind in image zip stream; do
+    echo "$kind=[]" >>"$GITHUB_OUTPUT"
+  done
+  exit 0
+fi
+
+names="$(cut -d/ -f2 <<<"$example_paths" | sort -u | jq -R . | jq -sc .)"
 echo "Changed examples: $names"
 
 for kind in image zip stream; do

.github/workflows/dependabot-automerge.yaml

@@ -93,8 +93,24 @@ jobs:
           # example while never exercising the second. Require coverage for every
           # changed example, read at the verified commit.
           changed_examples=$(cut -d/ -f2 <<<"$files" | sort -u)
-          covered=$(gh api "repos/$REPO/contents/.github/example-matrix.json?ref=$HEAD_SHA" \
-            -H 'Accept: application/vnd.github.raw' -q '[.[][].name] | unique | .[]' | sort -u)
+
+          # Read the matrix from the default branch, not from $HEAD_SHA: a Dependabot
+          # branch cut before this file existed 404s at its own head, and gh's non-zero
+          # exit would abort the step with a bare "Not Found" instead of refusing
+          # deliberately like every other unresolvable condition here. The default
+          # branch is also the correct source of truth — this is repository config, the
+          # examples-only guard above means the pull request cannot have changed it, and
+          # a pull_request workflow runs the merge-ref copy anyway, so this is the matrix
+          # the run actually used.
+          if ! matrix_json=$(gh api "repos/$REPO/contents/.github/example-matrix.json" \
+              -H 'Accept: application/vnd.github.raw'); then
+            echo "Could not read .github/example-matrix.json; refusing to merge."
+            exit 0
+          fi
+          if ! covered=$(jq -r '[.[][].name] | unique | .[]' <<<"$matrix_json" | sort -u); then
+            echo "Could not parse .github/example-matrix.json; refusing to merge."
+            exit 0
+          fi
           uncovered=$(comm -23 <(printf '%s\n' "$changed_examples") <(printf '%s\n' "$covered") || true)
           if [[ -n "$uncovered" ]]; then
             echo "PR #$PR_NUMBER changes examples with no build-and-boot coverage:"