task(CI): make ketryx report job run only on main

[na66im]

No description provided.

[Copilot]

Pull request overview

This PR restricts the Ketryx report job to run only on the main branch by adding a ref check to the job's conditional statement.

Changes:

• Add github.ref == 'refs/heads/main' condition to the ketryx_report_and_check job

Comments suppressed due to low confidence (1)

.github/workflows/ci-cd.yml:142

• The condition includes checks for github.event.pull_request.labels.*.name (lines 141-142), but the job is now restricted to run only when github.ref == 'refs/heads/main' (line 136). Since the main branch context is not a pull request, these label checks will never be meaningful and github.event.pull_request will be null/undefined. This creates dead code in the condition and could potentially cause unexpected behavior. Consider removing the pull request label checks since this job only runs on the main branch, not on pull requests.

      github.ref == 'refs/heads/main' &&
      github.actor != 'dependabot[bot]' &&
      (!contains(needs.get-commit-message.outputs.commit_message, 'skip:ci')) &&
      (!contains(needs.get-commit-message.outputs.commit_message, 'build:native:only')) &&
      !(github.ref_type == 'branch' && startsWith(needs.get-commit-message.outputs.commit_message, 'Bump version:')) &&
      (!contains(github.event.pull_request.labels.*.name, 'skip:ci')) &&
      (!contains(github.event.pull_request.labels.*.name, 'build:native:only'))

[sentry]

Bug: The new condition on ketryx_report_and_check will cause it to be skipped on tag pushes, which in turn will skip the package_publish and docker_publish jobs.
_{Severity: CRITICAL}

Suggested Fix

The condition for the ketryx_report_and_check job should be updated to also run on tag pushes. A possible fix is to change the condition to github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') to allow the job to run for both main branch pushes and version tag pushes.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/workflows/ci-cd.yml#L136

Potential issue: The `ketryx_report_and_check` job's new condition `github.ref ==
'refs/heads/main'` restricts it to run only on pushes to the `main` branch. However, the
`package_publish` and `docker_publish` jobs, which are triggered by version tags (e.g.,
`v1.2.3`), depend on `ketryx_report_and_check`. When a version tag is pushed,
`ketryx_report_and_check` will be skipped because the ref does not match `main`. Since
the dependent publish jobs do not use an `always()` condition, they will also be
skipped, silently breaking the release process and preventing new packages and Docker
images from being published.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

❌ Your project status has failed because the head coverage (62.01%) is below the target coverage (70.00%). You can increase the head coverage or adjust the target coverage.

❗ There is a different number of reports uploaded between BASE (6b66c8f) and HEAD (427e211). Click for more details.

HEAD has 10 uploads less than BASE

Flag	BASE (6b66c8f)	HEAD (427e211)
	11	1

see 20 files with indirect coverage changes

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud