enhance(actions): only create filtered-out workflow commit status for required contexts (#38371)

Follow #38237

#38237 posts "skipped" commit statuses for every workflow that is not
triggered due to a filter (e.g. `paths` or `branches`) mismatch.
However, for non-required workflows, creating "skipped" commit statuses
for them would generate a lot of noise.

To address this issue, this PR adds a check before creating commit
status:

- For the context that matches any required status check patterns, a
"skipped" commit status will be created. The `Required` label can inform
users that this status check is required, but has been skipped because
of a filter mismatch.
- For a non-required context, nothing will be created.

NOTE: Reducing noise is a best-effort approach and isn't entirely
accurate. When creating commit statuses, it is impossible to predict
which branch protection rule will take effect. Therefore, we have to
compare the commit status context against the required patterns from all
rules. If any rule matches, the context is considered "required".

services/actions/commit_status.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"slices"
 
 	actions_model "gitea.dev/models/actions"
 	"gitea.dev/models/db"
@@ -16,10 +17,12 @@ import (
 	actions_module "gitea.dev/modules/actions"
 	"gitea.dev/modules/actions/jobparser"
 	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/glob"
 	"gitea.dev/modules/log"
 	api "gitea.dev/modules/structs"
 	"gitea.dev/modules/util"
 	webhook_module "gitea.dev/modules/webhook"
+	pull_service "gitea.dev/services/pull"
 	commitstatus_service "gitea.dev/services/repository/commitstatus"
 )
 
@@ -153,12 +156,43 @@ func createCommitStatus(ctx context.Context, repo *repo_model.Repository, event,
 	return createWorkflowCommitStatus(ctx, repo, commitID, ctxName, run.WorkflowID, toCommitStatus(job.Status), targetURL, toCommitStatusDescription(job))
 }
 
+// getAllRequiredStatusContextGlobs returns the compiled globs of every status-check context required in the repo:
+// its protected branch rules' contexts and its required scoped workflows' patterns (see EffectiveRequiredContexts).
+func getAllRequiredStatusContextGlobs(ctx context.Context, repo *repo_model.Repository) ([]glob.Glob, error) {
+	rules, err := git_model.FindRepoProtectedBranchRules(ctx, repo.ID)
+	if err != nil {
+		return nil, fmt.Errorf("FindRepoProtectedBranchRules: %w", err)
+	}
+	required, err := pull_service.EffectiveRequiredContexts(ctx, repo, rules...)
+	if err != nil {
+		return nil, fmt.Errorf("EffectiveRequiredContexts: %w", err)
+	}
+	globs := make([]glob.Glob, 0, len(required))
+	for _, c := range required {
+		if gp, err := glob.Compile(c); err != nil {
+			log.Error("glob.Compile %q: %v", c, err)
+		} else {
+			globs = append(globs, gp)
+		}
+	}
+	return globs, nil
+}
+
 // CreateSkippedCommitStatusForFilteredWorkflow posts a skipped commit status for each job of a
 // workflow that matched the triggering event but was excluded by a branch/paths filter.
 // This lets a required status check tied to that context be satisfied without the workflow running.
+// Only contexts matching requiredGlobs are posted; a non-required context gets no skipped status.
 // No ActionRun is created, so the status has no target URL (there is no run/job to link to).
 // A non-empty scopedPrefix prefixes each context with its source repo, matching scoped runs.
-func CreateSkippedCommitStatusForFilteredWorkflow(ctx context.Context, repo *repo_model.Repository, event webhook_module.HookEventType, triggerEvent, workflowID string, content []byte, payload api.Payloader, scopedPrefix string) error {
+//
+// TODO: requiredGlobs over-approximates by including every protected branch rule's required contexts.
+// If possible, the set should be narrowed to the required contexts of a specific branch protection rule (and the contexts from required scoped workflows).
+// Currently, a `push` event must keep the repo-wide union since its future pull request base branch is unknown.
+func CreateSkippedCommitStatusForFilteredWorkflow(ctx context.Context, repo *repo_model.Repository, event webhook_module.HookEventType, triggerEvent, workflowID string, content []byte, payload api.Payloader, scopedPrefix string, requiredGlobs []glob.Glob) error {
+	if len(requiredGlobs) == 0 {
+		return nil // nothing is required, so no skipped status is needed
+	}
+
 	// Derive the status event name and target commit from the payload.
 	// TODO: this mirrors getCommitStatusEventNameAndCommitID, which derives the same from a persisted run. Should merge the logic if possible.
 	var statusEvent, commitID string
@@ -200,6 +234,10 @@ func CreateSkippedCommitStatusForFilteredWorkflow(ctx context.Context, repo *rep
 		if scopedPrefix != "" {
 			ctxName = actions_module.ScopedWorkflowStatusContextName(scopedPrefix, displayName, jobName, statusEvent)
 		}
+		// Only a required context needs the skipped status.
+		if !slices.ContainsFunc(requiredGlobs, func(gp glob.Glob) bool { return gp.Match(ctxName) }) {
+			continue
+		}
 		// "Skipped" mirrors toCommitStatusDescription for StatusSkipped.
 		if err := createWorkflowCommitStatus(ctx, repo, commitID, ctxName, workflowID, commitstatus.CommitStatusSkipped, "", "Skipped"); err != nil {
 			return err

services/actions/notifier_helper.go

@@ -396,10 +396,22 @@ func buildApproveAndInsertRun(
 	return nil
 }
 
-// handleFilteredWorkflows posts a skipped commit status for each workflow that matched the event but was excluded by a branch/paths filter.
+// handleFilteredWorkflows posts a skipped commit status for each filtered-out workflow whose context is a required status check;
+// a non-required one posts nothing, so it cannot leak into a pull request.
 func handleFilteredWorkflows(ctx context.Context, input *notifyInput, filteredWorkflows []*actions_module.DetectedWorkflow) {
+	if len(filteredWorkflows) == 0 {
+		return
+	}
+	requiredGlobs, err := getAllRequiredStatusContextGlobs(ctx, input.Repo)
+	if err != nil {
+		log.Error("repo %s: required status contexts: %v", input.Repo.RelativePath(), err)
+		return
+	}
+	if len(requiredGlobs) == 0 {
+		return
+	}
 	for _, dwf := range filteredWorkflows {
-		if err := CreateSkippedCommitStatusForFilteredWorkflow(ctx, input.Repo, input.Event, dwf.TriggerEvent.Name, dwf.EntryName, dwf.Content, input.Payload, ""); err != nil {
+		if err := CreateSkippedCommitStatusForFilteredWorkflow(ctx, input.Repo, input.Event, dwf.TriggerEvent.Name, dwf.EntryName, dwf.Content, input.Payload, "", requiredGlobs); err != nil {
 			log.Error("repo %s: skipped commit status for workflow %s: %v", input.Repo.RelativePath(), dwf.EntryName, err)
 			continue
 		}
@@ -653,6 +665,12 @@ func detectAndHandleScopedWorkflows(
 	isForkPullRequest := isForkPullRequestInput(input)
 	actionsConfig := input.Repo.MustGetUnit(ctx, unit_model.TypeActions).ActionsConfig()
 
+	// A filtered-out scoped workflow only posts a skipped status when its context is a required check.
+	requiredGlobs, err := getAllRequiredStatusContextGlobs(ctx, input.Repo)
+	if err != nil {
+		log.Error("scoped workflows: required status contexts for %s: %v", input.Repo.RelativePath(), err)
+	}
+
 	// The same source repo may be registered at both the owner and instance level; dedup
 	// the IDs and batch-load them in one query instead of one round-trip per source.
 	seen := make(container.Set[int64], len(sources))
@@ -696,14 +714,14 @@ func detectAndHandleScopedWorkflows(
 			}
 		}
 
-		// A filtered-out scoped workflow posts a skipped commit status.
-		if len(filtered) > 0 {
+		// A filtered-out scoped workflow posts a skipped commit status for its required-check contexts.
+		if len(filtered) > 0 && len(requiredGlobs) > 0 {
 			scopedPrefix := actions_model.ScopedStatusContextPrefix(ctx, sourceRepo.ID)
 			for _, dwf := range filtered {
 				if actions_model.ScopedWorkflowOptedOut(actionsConfig, sources, sourceRepo.ID, dwf.EntryName) {
 					continue
 				}
-				if err := CreateSkippedCommitStatusForFilteredWorkflow(ctx, input.Repo, input.Event, dwf.TriggerEvent.Name, dwf.EntryName, dwf.Content, input.Payload, scopedPrefix); err != nil {
+				if err := CreateSkippedCommitStatusForFilteredWorkflow(ctx, input.Repo, input.Event, dwf.TriggerEvent.Name, dwf.EntryName, dwf.Content, input.Payload, scopedPrefix, requiredGlobs); err != nil {
 					log.Error("scoped workflows: skipped commit status for source %s workflow %s: %v", sourceRepo.RelativePath(), dwf.EntryName, err)
 					continue
 				}
@@ -716,7 +734,7 @@ func detectAndHandleScopedWorkflows(
 
 // detectScopedWorkflowsForSource detects the scoped workflows from the source repo at its default branch.
 // detected are the workflows to run; filtered matched the event but were excluded by a branch/paths
-// filter and post a skipped commit status.
+// filter, and later post a skipped commit status only for a required-check context.
 func detectScopedWorkflowsForSource(
 	ctx context.Context,
 	input *notifyInput,

services/pull/commit_status.go

@@ -156,11 +156,16 @@ func GetPullRequestCommitStatusState(ctx context.Context, pr *issues_model.PullR
 	return MergeRequiredContextsCommitStatus(commitStatuses, requiredContexts), nil
 }
 
-// EffectiveRequiredContexts returns the required status-check contexts for a PR head:
+// EffectiveRequiredContexts returns the required status-check contexts to enforce, drawn from:
 //  1. every required scoped workflow's status-check patterns effective for the repo (always)
-//  2. the branch protection's own configured contexts, only when its status check is enabled
-func EffectiveRequiredContexts(ctx context.Context, repo *repo_model.Repository, pb *git_model.ProtectedBranch) ([]string, error) {
-	if pb == nil {
+//  2. each given protected branch rule's own configured contexts, only when that rule's status check is enabled
+//
+// Passing no rule or a single nil rule yields nothing, not even scoped patterns.
+// A single rule yields that rule's effective contexts.
+// Passing several rules unions their effective contexts; this is used when the governing rule is not yet known.
+func EffectiveRequiredContexts(ctx context.Context, repo *repo_model.Repository, pbs ...*git_model.ProtectedBranch) ([]string, error) {
+	// No protection rule in effect: nothing is required.
+	if len(pbs) == 0 || (len(pbs) == 1 && pbs[0] == nil) {
 		return nil, nil
 	}
 
@@ -169,36 +174,28 @@ func EffectiveRequiredContexts(ctx context.Context, repo *repo_model.Repository,
 		return nil, fmt.Errorf("GetEffectiveScopedWorkflowSources: %w", err)
 	}
 
+	required := make(container.Set[string])
+
 	// Every required scoped workflow's admin-authored status-check patterns, matched must-present-and-pass:
 	// a required scoped check that posts no matching status blocks the merge.
-	seen := make(container.Set[string])
-	var scoped []string
 	for _, source := range sources {
 		for _, cfg := range source.WorkflowConfigs {
 			if !cfg.Required {
 				continue
 			}
-			for _, p := range cfg.Patterns {
-				if seen.Add(p) {
-					scoped = append(scoped, p)
-				}
-			}
+			required.AddMultiple(cfg.Patterns...)
 		}
 	}
 
-	slices.Sort(scoped) // sort for stable output
-
-	// With the branch protection's own status check disabled, only the required scoped checks (mandated by the owner or instance admin) gate the merge.
-	if !pb.EnableStatusCheck {
-		return scoped, nil
-	}
-
-	// Status check enabled: the rule's configured contexts, then the scoped patterns not already among them.
-	required := slices.Clone(pb.StatusCheckContexts)
-	for _, p := range scoped {
-		if !slices.Contains(pb.StatusCheckContexts, p) {
-			required = append(required, p)
+	// Union the configured contexts of every rule whose own status check is enabled (a disabled rule contributes none)
+	for _, pb := range pbs {
+		if pb == nil || !pb.EnableStatusCheck {
+			continue
 		}
+		required.AddMultiple(pb.StatusCheckContexts...)
 	}
-	return required, nil
+
+	values := required.Values()
+	slices.Sort(values) // stable output
+	return values, nil
 }

services/pull/commit_status_test.go

@@ -153,4 +153,14 @@ func TestEffectiveRequiredContexts(t *testing.T) {
 			"org/src: ci.yaml / lint (pull_request)",
 		}, got)
 	})
+
+	t.Run("several rules union their enabled contexts, deduplicated; a disabled rule contributes none", func(t *testing.T) {
+		noSourceRepo := &repo_model.Repository{ID: consumer.ID, OwnerID: 99999} // no scoped sources, so only the rules' contexts gate
+		a := &git_model.ProtectedBranch{EnableStatusCheck: true, StatusCheckContexts: []string{"a/check", "shared/check"}}
+		b := &git_model.ProtectedBranch{EnableStatusCheck: true, StatusCheckContexts: []string{"b/check", "shared/check"}}
+		off := &git_model.ProtectedBranch{EnableStatusCheck: false, StatusCheckContexts: []string{"off/check"}}
+		got, err := EffectiveRequiredContexts(t.Context(), noSourceRepo, a, b, off)
+		require.NoError(t, err)
+		assert.ElementsMatch(t, []string{"a/check", "b/check", "shared/check"}, got)
+	})
 }