feat: ignore test_and_release in PRs without code changes by robertolopezlopez · Pull Request #6974 · snyk/cli

robertolopezlopez · 2026-07-08T08:37:13Z

User description

Pull Request Submission Checklist

Follows CONTRIBUTING guidelines
Commit messages
are release-note ready, emphasizing
what was changed, not how.
Includes detailed description of changes
Contains risk assessment (Low | Medium | High)
Highlights breaking API changes (if applicable)
Links to automated tests covering new functionality
Includes manual testing instructions (if necessary)
Updates relevant GitBook documentation (PR link: ___)
Includes product update to be announced in the next stable release notes

What does this PR do?

It skips the test_and_release pipeline for changes which do not touch code nor dependencies. Keeps the previous behaviour for others.

Where should the reviewer start?

How should this be manually tested?

Right now the pipeline is running full in this PR.

After merge to main, there will be another PR showcasing the "light scenario".

What's the product update that needs to be communicated to CLI users?

PR Type

Enhancement

Description

Detect code changes vs. docs-only PRs.
Conditionally run full or lightweight CI.
Document new CI workflow behavior.

Diagram Walkthrough

flowchart LR
  A[CI Trigger] --> B{Detect Code Changes};
  B -- Code Changes Found --> C[Full CI Pipeline];
  B -- Docs-Only Changes --> D[Lightweight CI Pipeline];

File Walkthrough

Relevant files

Enhancement

7 files

agent.go `Changes required by linter, also failing in main branch`	+2/-4
has-code-changes.sh `New script to detect code changes`	+32/-0
is-docs-only-changes.sh `New script to identify documentation-only changes`	+24/-0
list-changed-files.sh `Helper script to list changed files`	+13/-0
config.yml `Implement CI job for detecting code changes`	+37/-2052
continue_config.yml `New file for full CI pipeline configuration`	+2054/-0
continue_config_light.yml `New file for lightweight CI pipeline configuration`	+14/-0

Bug fix

1 files

interactive_test.go `Changes required by linter, also failing in main branch`	+9/-3

Tests

2 files

test_has_code_changes.sh `Tests for code change detection script`	+76/-0
test_is_docs_only_changes.sh `Tests for documentation-only change detection`	+58/-0

Documentation

1 files

CONTRIBUTING.md `Document new CI pipeline behavior and logic`	+32/-0

Configuration changes

1 files

code-change-pathspecs.txt `Define pathspecs for code changes`	+15/-0

snyk-io · 2026-07-08T08:37:40Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

robertolopezlopez · 2026-07-08T11:33:50Z

/describe

snyk-pr-review-bot · 2026-07-08T11:36:38Z

PR Description updated to latest commit (506ea98)

graphite-app · 2026-07-08T11:50:15Z

+            if ./scripts/ci/has-code-changes.sh; then
+              echo '.circleci/continue_config.yml' > /tmp/continuation-config-path.txt
+            else
+              echo '.circleci/continue_config_light.yml' > /tmp/continuation-config-path.txt
            fi


Error handling bug: If has-code-changes.sh exits with error code 2 (e.g., when git merge-base fails due to insufficient fetch depth), the else branch executes and selects the lightweight config instead of failing the build. This silently masks errors and could run the wrong pipeline.

Impact: On older PR branches where the merge-base is beyond the 100-commit fetch depth (line 17), the detection will error but incorrectly proceed with lightweight config, skipping critical tests.

Fix:

set +e ./scripts/ci/has-code-changes.sh result=$? set -e if [ $result -eq 0 ]; then echo '.circleci/continue_config.yml' > /tmp/continuation-config-path.txt elif [ $result -eq 1 ]; then echo '.circleci/continue_config_light.yml' > /tmp/continuation-config-path.txt else echo "Error detecting code changes (exit $result)" >&2 exit 1 fi

Suggested change

if ./scripts/ci/has-code-changes.sh; then

echo '.circleci/continue_config.yml' > /tmp/continuation-config-path.txt

else

echo '.circleci/continue_config_light.yml' > /tmp/continuation-config-path.txt

fi

set +e

./scripts/ci/has-code-changes.sh

result=$?

set -e

if [ $result -eq 0 ]; then

echo '.circleci/continue_config.yml' > /tmp/continuation-config-path.txt

elif [ $result -eq 1 ]; then

echo '.circleci/continue_config_light.yml' > /tmp/continuation-config-path.txt

else

echo "Error detecting code changes (exit $result)" >&2

exit 1

fi

Spotted by Graphite

Is this helpful? React 👍 or 👎 to let us know.

graphite-app · 2026-07-13T15:15:44Z

+      - checkout:
+          fetch-depth: 0


Invalid checkout parameter. CircleCI's checkout step does not support a fetch-depth parameter (this is GitHub Actions syntax). This will either fail the job or be silently ignored, potentially causing insufficient git history for merge-base calculations.

Fix:

- checkout - run: name: Fetch full history command: git fetch --unshallow || true

Suggested change

- checkout:

fetch-depth: 0

- checkout

- run:

name: Fetch full history

command: git fetch --unshallow || true

Spotted by Graphite

Is this helpful? React 👍 or 👎 to let us know.

snyk-pr-review-bot · 2026-07-13T16:06:10Z

PR Reviewer Guide 🔍

🧪 PR contains tests
🔒 No security concerns identified
⚡ Recommended focus areas for review Loss of Pipeline Parameters 🔴 [critical] The PR removes the `parameters` block from the main `.circleci/config.yml` file. In CircleCI's dynamic configuration (`setup: true`), any parameters passed via the CircleCI API or the Web UI must be declared in the initial configuration file. By removing them, it is no longer possible to trigger the pipeline with overrides (e.g., `go_version`, `cli_download_base_url`), which is critical for SRE ad-hoc builds and troubleshooting. version: 2.1 setup: true orbs: continuation: circleci/continuation@1 jobs: detect-code-changes: executor: continuation/default steps: - checkout: fetch-depth: 0 - run: name: Select continuation config command: \| BASE_BRANCH="$(./scripts/ci/resolve-base-branch.sh)" git fetch origin "$BASE_BRANCH" --depth=100 export BASE_REF="origin/${BASE_BRANCH}" set +e ./scripts/ci/has-code-changes.sh code=$? set -e if [ "$code" -eq 1 ]; then echo '.circleci/continue_config_light.yml' > /tmp/continuation-config-path.txt else echo '.circleci/continue_config.yml' > /tmp/continuation-config-path.txt fi cat /tmp/continuation-config-path.txt - run: name: Continue pipeline command: ./scripts/ci/continue-pipeline.sh workflows: setup: jobs: - detect-code-changes: context: - go-private-modules Broad YAML Bypass 🟠 [major] The logic in `has-code-changes.sh` automatically treats all `.yml` and `.yaml` files outside the `.circleci/` directory as lightweight changes. This creates a safety gap for critical configuration files like `cliv2/.golangci.yaml` (linting rules). A PR that disables linter checks or modifies build-related YAML will incorrectly skip the full CI suite, including the `code-analysis` job. .yml\|.yaml) LIGHT_CHANGED="${LIGHT_CHANGED}"$'\n'"${file}" ;; Shallow Fetch Risk 🟡 [minor] The `detect-code-changes` job fetches the base branch with a hardcoded depth of 100. If a PR branch was branched from a commit that is older than the last 100 commits on the base branch, `git merge-base` will fail to find a common ancestor. This will cause the script to error out, defaulting the PR to a full pipeline, which reduces the efficiency of the new routing logic. git fetch origin "$BASE_BRANCH" --depth=100
📚 Repository Context Analyzed This review considered 27 relevant code sections from 13 files (average relevance: 0.50) release-scripts/upload-artifacts.sh (lines 1-199) scripts/format/prettier-changes.sh (lines 1-27) release-scripts/skip-deployment.sh (lines 1-20) CLAUDE.md (2 segments, lines 116-259) release-scripts/determine-release-channel.sh (lines 1-36) release-scripts/next-version.sh (lines 1-47) release-scripts/write-ls-protocol-version.go (lines 1-298) ... and 6 more file(s)
🤖 Repository instructions applied (from `AGENTS.md`)

PeterSchafer · 2026-07-13T16:15:10Z

+workflows:
+  light_test_and_release:
+    jobs:
+      - prodsec/secrets-scan:


Suggestion: Please make this pipeline run the same checks as we do for docs-only branches here.

PeterSchafer · 2026-07-13T16:16:51Z

@@ -0,0 +1,2080 @@
+version: 2.1


Question: Can we freely name these files? If so, I would recommend to name them more descriptively.

PeterSchafer · 2026-07-13T16:21:06Z

+          channel: cli-alerts
+          trusted-branch: main
+
+      - docs-only-check:


Question: Isn't this superseded by your changes?

PeterSchafer · 2026-07-13T16:26:29Z

+  repo_path="${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}"
+fi
+
+token="${GITHUB_TOKEN:-${GITHUB_PRIVATE_TOKEN:-${HAMMERHEAD_GITHUB_PAT:-}}}"


Issue: Why do we send tokens here?

Question: Why do we generally need to interact with the github API.

PeterSchafer · 2026-07-13T16:29:30Z

+fi
+
+mkdir -p /tmp/circleci
+jq -Rs '.' "$CONFIG_PATH" > /tmp/circleci/config-string.json


Question: Isn't there a circleci cli function to do all of this? all the manually crafted API calls seems like quite some unnecessary maintenance burden?

PeterSchafer · 2026-07-13T16:36:47Z

These changes are quite massive for a performance improvement. Is there are chance to reduce these and focus on the minimum necessary? Also did you consider aspects around stability of the pipeline since this PR adds additional API calls etc which will now be required every time the pipeline runs.

robertolopezlopez force-pushed the feat/CLI-1625 branch 3 times, most recently from 4944ced to 5c91d33 Compare July 8, 2026 09:23

robertolopezlopez changed the title ~~Feat/cli 1625~~ feat: ignore test_and_release in PRs without code changes Jul 8, 2026

robertolopezlopez force-pushed the feat/CLI-1625 branch from 5d2253f to 506ea98 Compare July 8, 2026 11:33

robertolopezlopez force-pushed the feat/CLI-1625 branch from 506ea98 to 75e5ac5 Compare July 8, 2026 11:39

robertolopezlopez marked this pull request as ready for review July 8, 2026 11:46

robertolopezlopez requested a review from a team as a code owner July 8, 2026 11:46

This comment has been minimized.

Sign in to view

graphite-app Bot reviewed Jul 8, 2026

View reviewed changes

danskmt reviewed Jul 8, 2026

View reviewed changes

Comment thread cliv2/internal/persona/agent/agent.go

danskmt reviewed Jul 8, 2026

View reviewed changes

Comment thread cliv2/internal/persona/interactive/interactive_test.go Outdated

danskmt reviewed Jul 8, 2026

View reviewed changes

Comment thread scripts/ci/list-changed-files.sh

danskmt reviewed Jul 8, 2026

View reviewed changes

Comment thread scripts/ci/is-docs-only-changes.sh Outdated

robertolopezlopez force-pushed the feat/CLI-1625 branch from 75e5ac5 to 80ad6e1 Compare July 8, 2026 13:55

This comment has been minimized.

Sign in to view

robertolopezlopez commented Jul 13, 2026

View reviewed changes

Comment thread scripts/ci/code-change-pathspecs.txt Outdated

mattdolan-snyk reviewed Jul 13, 2026

View reviewed changes

Comment thread scripts/ci/code-change-pathspecs.txt Outdated

robertolopezlopez commented Jul 13, 2026

View reviewed changes

Comment thread .circleci/continue_config_light.yml Outdated

robertolopezlopez force-pushed the feat/CLI-1625 branch from 80ad6e1 to a9fde9d Compare July 13, 2026 13:59

This comment has been minimized.

Sign in to view

robertolopezlopez force-pushed the feat/CLI-1625 branch from 2c11b2d to 05687e1 Compare July 13, 2026 15:06

This comment has been minimized.

Sign in to view

robertolopezlopez force-pushed the feat/CLI-1625 branch from 05687e1 to 8159563 Compare July 13, 2026 15:11

graphite-app Bot reviewed Jul 13, 2026

View reviewed changes

robertolopezlopez force-pushed the feat/CLI-1625 branch from 8159563 to b9437b7 Compare July 13, 2026 15:22

This comment has been minimized.

Sign in to view

robertolopezlopez force-pushed the feat/CLI-1625 branch from b9437b7 to 48c474d Compare July 13, 2026 15:29

This comment has been minimized.

Sign in to view

robertolopezlopez force-pushed the feat/CLI-1625 branch from 48c474d to 8afd504 Compare July 13, 2026 15:43

This comment has been minimized.

Sign in to view

robertolopezlopez force-pushed the feat/CLI-1625 branch from 8afd504 to 28df1f4 Compare July 13, 2026 15:48

feat: ignore test_and_release in PRs without code changes

c9e161a

robertolopezlopez force-pushed the feat/CLI-1625 branch from 28df1f4 to c9e161a Compare July 13, 2026 16:03

PeterSchafer reviewed Jul 13, 2026

View reviewed changes

Uh oh!

Conversation

robertolopezlopez commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Pull Request Submission Checklist

What does this PR do?

Where should the reviewer start?

How should this be manually tested?

What's the product update that needs to be communicated to CLI users?

PR Type

Description

Diagram Walkthrough

File Walkthrough

Uh oh!

snyk-io Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

robertolopezlopez commented Jul 8, 2026

Uh oh!

snyk-pr-review-bot Bot commented Jul 8, 2026

Uh oh!

This comment has been minimized.

graphite-app Bot Jul 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

graphite-app Bot Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

snyk-pr-review-bot Bot commented Jul 13, 2026

PR Reviewer Guide 🔍

Uh oh!

PeterSchafer Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

PeterSchafer Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

PeterSchafer Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

PeterSchafer Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

PeterSchafer Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

PeterSchafer Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

PeterSchafer commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

robertolopezlopez commented Jul 8, 2026 •

edited

Loading

snyk-io Bot commented Jul 8, 2026 •

edited

Loading