merge-queue-fail-fast.yml

name: Merge queue fail-fast

# Cancels a merge-queue entry's CI run the moment one of its jobs fails, so
# `ci-ok` (if: always()) reports failure in seconds instead of after the
# slowest e2e leg, and the queue evicts the entry and rebuilds the ones
# behind it ~40 minutes sooner. See scripts/merge-queue-fail-fast.py.
# Not a required check; it never fails.

on:
  merge_group:
    types: [checks_requested]

permissions: {}

jobs:
  watch:
    runs-on: ubuntu-latest
    timeout-minutes: 110
    permissions:
      actions: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        # Run the canceller as it is on the base branch, never the queued
        # PRs' copy: this job holds an actions:write token, so executing
        # merge-group-head bytes would hand that token to any queued PR.
        with:
          ref: ${{ github.event.merge_group.base_sha }}
          persist-credentials: false
          sparse-checkout: scripts/merge-queue-fail-fast.py
          sparse-checkout-cone-mode: false

      - name: Cancel the CI run on its first failed job
        env:
          GH_TOKEN: ${{ github.token }}
          HEAD_SHA: ${{ github.event.merge_group.head_sha }}
        # Until this workflow lands, the base branch has no canceller to run.
        run: |
          if [ ! -f scripts/merge-queue-fail-fast.py ]; then
            echo "scripts/merge-queue-fail-fast.py is not on the base branch yet; nothing to watch."
            exit 0
          fi
          python3 -B scripts/merge-queue-fail-fast.py