From db8a7f5d15d63d6a0b92526826e52f2575e68d63 Mon Sep 17 00:00:00 2001 From: Chris Burns <29541485+ChrisJBurns@users.noreply.github.com> Date: Tue, 21 Apr 2026 22:17:01 +0100 Subject: [PATCH] Re-run api-compat on label changes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Applying the api-break-allowed label was intended to skip the CRD Schema Compatibility check via the `if:` guard added in #4991, but the workflow only triggered on the default pull_request types (opened, synchronize, reopened). Re-running the failed job from the Actions UI uses the original event payload, which still shows the labels as they were when the PR opened — so the skip condition missed and the job ran again. Add `labeled` and `unlabeled` to the pull_request types so label changes trigger a fresh workflow run with the current PR state. Include `unlabeled` so removing the label also re-evaluates: otherwise someone could apply-label, watch the check skip, remove-label, and merge without the check ever validating against the real state. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/api-compat.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/api-compat.yml b/.github/workflows/api-compat.yml index e9a5341bbb..577e6cbf59 100644 --- a/.github/workflows/api-compat.yml +++ b/.github/workflows/api-compat.yml @@ -10,6 +10,14 @@ name: API Compatibility on: pull_request: + # Include `labeled` and `unlabeled` so applying or removing + # `api-break-allowed` triggers a fresh workflow run. Without these, + # re-running the job from the UI uses the original event payload + # (which still has the old label set) and the skip condition misfires. + # Re-evaluating on `unlabeled` closes the gap where a user could + # apply the label, watch the check skip, then remove the label and + # merge without the check ever running against the current state. + types: [opened, synchronize, reopened, labeled, unlabeled] paths: - 'cmd/thv-operator/api/**' # files/crds is the source of truth — controller-gen emits here, and