CI: docs-only gate, all-checks-passed, single-source PG list

[jnasbyupgrade]

Stacked on #29 (phase 3: load-mode switching). General CI infrastructure, independent of U&U testing itself - split out as its own step rather than folded into whichever phase happened to add a new job, per the "one step at a time" approach for this whole series. Landing it here (before the next phase adds the most expensive job, a real pg_upgrade matrix) is when the docs-only skip starts actually paying for itself.

What changed

• changes job: computes the real per-push diff (handles both branch pushes and PR synchronize events, fails safe to "not docs-only" on any ambiguity) and exposes docs_only; test (which covers both the fresh-install matrix and, in the same job, the in-place update path - there's no separate extension-update-test job) and pg-tle-test both gate on it. Always triggers itself unconditionally (no workflow-level paths-ignore, which would leave a required all-checks-passed check stuck Pending on doc-only pushes).
• Same job derives the supported-PostgreSQL-major list from a single NEWEST/FLOOR pair, consumed by both test and pg-tle-test via fromJSON - they read the same list and can't silently drift apart; a new major is now a one-line change instead of an edit in both matrices.
• all-checks-passed: one stable required-status-check name (matrix jobs produce names like "🐘 PostgreSQL 14 (schema none)" that change with the matrix), with a self-check that its own needs list can't silently omit a newly-added job.

No functional test changes - CI-only.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fe4ebaf2-661f-4d91-b27f-10bf460c1be2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jnasbyupgrade]

Closing/reopening to force a fresh CI dispatch - the current head commit never got a workflow run triggered at all (checked via the Actions API, not just slow queueing).

[github-actions]

Claude Code is working…

I'll analyze this and get back to you.

View job run

[github-actions]

Claude finished @jnasbyupgrade's task in 3m 33s —— View job

---

Claude's Review

• Gather context (PR body, diff, changed files)
• Read full .github/workflows/ci.yml and trace the new gating/matrix logic
• Cross-check actual CI run for this commit
• Post review feedback

Summary

This is a well-reasoned, heavily-commented CI change, and it's already been exercised end-to-end: run 31130839307 on the current head commit is green, including all-checks-passed and its self-check step that verifies its own needs: list stays in sync with the job list.

I traced through the trickier parts by hand and didn't find a correctness bug:

• The changes job's BASE/HEAD selection (synchronize vs. opened/reopened vs. push) and its fail-safe-to-docs_only=false defaults look correct for every branch, including the all-zeros-SHA new-branch case and a failed git diff.
• The pg: ${{ github.event.pull_request.draft && ... || ... }} matrix expression correctly falls through to the full supported_pg list for both non-draft PRs and plain push events (where github.event.pull_request is absent/null), and reduces to [newest_pg] only for a draft PR — verified against GitHub Actions' JS-like truthy &&/|| short-circuit semantics.
• all-checks-passed's pass/fail check correctly treats skipped as OK and only fails on failure/cancelled.

Two minor, non-blocking observations:

1. PR description vs. diff mismatch: the description says test/extension-update-test/pg-tle-test all gate on docs_only, but there's no extension-update-test job in this diff — the update-path assertions live inside test's own "Update 0.9.6 -> current and run the suite" step (.github/workflows/ci.yml:239-240), matching the job's own comment block. Likely just stale wording from planning; worth a quick tweak to the PR body so it doesn't confuse future readers of the merge commit message.
2. Untested code paths: the run that just went green exercised the "non-draft PR, full base...head diff" path only. The docs_only=true skip path, the synchronize before/after diff path, and the draft-PR matrix reduction haven't been exercised by an actual workflow run yet. Since all-checks-passed is meant to become a required status check, it'd be worth deliberately triggering each of those once (e.g. a docs-only commit, and toggling draft) before leaning on it in branch protection — a subtle miss in any of those would otherwise show up as a stuck-Pending or incorrectly-passing required check rather than a loud failure.

No functional/application code changed (CI-only, as stated), so no test suite implications beyond the workflow itself.