Repository navigation
CI: macOS lane doesn't trigger on .minimal/minimal.toml, so guest-kernel bumps merge without a VM boot #897
Description
Summary
ci-macos.yml's path filter does not include .minimal/minimal.toml, so a change to the upstream pin — which selects the guest kernel, rootfs and libkrun — does not trigger the macOS VM lane. ci-linux-kvm.yml already lists it (line 71); macOS does not.
The macOS lane consumes that file. Its own comment says so: "guest kernel + rootfs against the repo's own .minimal/minimal.toml" (ci-macos.yml:75). It just isn't triggered by it.
Why it matters
This is the exact hole that let gominimal/minimal#869 reach users. The guest kernel moved 6.12.43 -> 6.12.94 (gominimal/pkgs#311) crossing a release that turned a silent condition into a fatal connection reset, and nothing booted a macOS VM to notice. HVF is the platform where the guest kernel and libkrun interact, so it is the wrong lane to skip.
gominimal/minimal#881 — a kernel-moving pin bump — did run the macOS e2e, but only because it incidentally also edited crates/minvmd/README.md, which matches crates/minvmd/**. A pure pin bump would have merged with no macOS VM boot at all.
Fix
Add .minimal/minimal.toml to the macos filter in ci-macos.yml, matching the KVM lane.
Note
.github/workflows/ is CODEOWNER-gated, so this needs a human with that access; it cannot be sent as an ordinary PR.
Activity
gominimal-aw-bot commentedon Jul 22, 2026
Routing triage — #897
Kind: bug · Route: patch →
gominimal/minimal· Confidence: 0.92The
changesjob inci-macos.yml(gominimal/minimal) usesdorny/paths-filterfor in-workflow path scoping but itsmacosfilter omits.minimal/minimal.toml. A pure pin bump to the guest kernel, rootfs, or libkrun version produceschanges.outputs.macos == 'false'and silently skips all macOS VM jobs on HVF.Evidence
.github/workflows/ci-macos.ymland.github/workflows/ci-linux-kvm.ymldirectly fromgominimal/minimalmain. The KVM lane'skvmfilter includes.minimal/minimal.toml; the macOS lane'smacosfilter does not. Gap directly observed in source.- ".minimal/minimal.toml"to themacosfilter block in.github/workflows/ci-macos.yml, alongsiderust-toolchain.tomlandvendor/libkrun/**. Single file, single line..github/workflows/is CODEOWNER-gated; the fixer agent can open the PR, but a maintainer must approv 8000 e and merge it.gominimal/inbox(only this issue). No prior tracking issue ingominimal/minimalmatches this gap. Related:gominimal/minimal#712(open PR — CI lane migration work, distinct from this filter entry)..minimal/minimal.tomlentry specifically.patch → gominimal/minimaloutcomes for prior bugs in this repo; no correction recorded that would redirect this issue.gominimal/minimalisroute: allow,sdd: true, withinmax_patch_files: 5.[inbox-route:decision]
{"schema":"inbox-route/v1","issue":336,"issue_node_id":"I_kwDOSUhdos8AAAABJsMQcw","dry_run":false,"kind":"bug","route":"patch","confidence":0.92,"targets":[{"repo":"gominimal/minimal","reason":"both ci-macos.yml and ci-linux-kvm.yml confirmed in this repo; the missing .minimal/minimal.toml path entry is directly visible in the macos filter block"}],"labels":["kind:bug","priority:should-have"],"patch":{"target_ref":"main","brief":"The changes job in .github/workflows/ci-macos.yml uses dorny/paths-filter to scope the macOS VM lane but its macos filter block omits .minimal/minimal.toml. The ci-linux-kvm.yml kvm filter already includes this path. Add - \".minimal/minimal.toml\" to the macos filter block in the changes job, alongside rust-toolchain.toml and vendor/libkrun/**. The .github/workflows/ directory is CODEOWNER-gated, so a maintainer must approve and merge the resulting PR.","files":[".github/workflows/ci-macos.yml"]},"work_issue":{"title":"bug: ci-macos.yml changes filter missing .minimal/minimal.toml, skipping macOS VM lane on pin bumps","body":"## Summary\nThe `changes` job in `.github/workflows/ci-macos.yml` uses `dorny/paths-filter` to gate expensive macOS VM jobs, but the `macos` filter does not include `.minimal/minimal.toml`. A change that only bumps the guest kernel, rootfs, or libkrun pin produces `changes.outputs.macos == 'false'` and skips all macOS VM jobs, so the pin lands without a VM boot on HVF.\n\n## Expected behavior\n`.minimal/minimal.toml` should appear in the `macos` filter in the `changes` job, matching the `kvm` filter in `ci-linux-kvm.yml` which already lists it.\n\n## Actual behavior\nA pure pin bump touching only `.minimal/minimal.toml` skips the macOS lane entirely. The lane only fires if the commit also touches another listed path (e.g., `crates/minvmd/**`).\n\n## Reproduction\nOpen a PR that modifies only `.minimal/minimal.toml`. Observe that `changes.outputs.macos` is `'false'` and the `artifacts`, `unit`, and `e2e` jobs are all skipped.\n\n## Scope notes\nSingle-line fix: add `- \".minimal/minimal.toml\"` to the `macos` filter block in `.github/workflows/ci-macos.yml`, alongside `rust-toolchain.toml` and `vendor/libkrun/**`. `.github/workflows/` is CODEOWNER-gated; a maintainer with that access must approve the PR.\n\n<!-- SDD command vocabulary. Do not edit this footer. -->\n\nThis issue is the tracking issue for this work. A maintainer with write\naccess starts the SDD pipeline by commenting `/spec` on this issue or by\nflipping the `sdd:spec` label.\n\nSteer the pipeline with these comment commands. Each is gated to commenters\nwith write access to the repository.\n\n| Command | Where | Effect |\n|---|---|---|\n| `/spec` | this tracking issue | re-run `sdd-spec` to draft or revise the spec |\n| `/fastpath` | this tracking issue | confirm a single-session change; `sdd-spec` produces a stub spec PR and an execution plan comment in one run (ADR 0012) |\n| `/triage` | this tracking issue, after the spec PR is merged | start `sdd-triage` phase A (architecture) |\n| `/approve` | this tracking issue | full path: confirm the proposed plan so `sdd-triage` creates the Unit and task sub-issues. Fast path: dispatch the execution plan against `sdd-execute-{tier}` |\n| `/dispatch` | this tracking issue (full path only) | arm the cascade across the task tree |\n| `/revise <note>` | a spec, architecture, or implementation PR, or this tracking issue | re-run the owning agent with the note as an added instruction |\n| `/execute` | a task sub-issue | run `sdd-execute` for that task ahead of the schedule |\n\nMerging the spec PR advances to the architecture phase; merging the\narchitecture PR advances to a plan-comment phase, where `sdd-triage` posts\nthe proposed plan as one comment on this tracking issue. When an agent needs\na human decision it applies the `needs-human` label and posts one comment;\nclear the label once you have answered and the agent resumes."},"related":[{"repo":"gominimal/minimal","number":712,"relation":"related"}],"rationale":"Both workflow files were read directly from gominimal/minimal main. ci-linux-kvm.yml includes .minimal/minimal.toml in its kvm filter; ci-macos.yml does not include it in the macos filter. The issue describes this exact gap and its real-world consequence (a kernel pin bump merging without a macOS VM boot on HVF). No duplicate found in gominimal/inbox and no prior tracking issue in gominimal/minimal. Distillery shows active CI migration work (minimal#712, open) but it is distinct from this specific gap. The fix is one line in one file; 0.92 confidence from direct file confirmation."}gominimal-aw-bot commentedon Jul 22, 2026
[inbox-route:ledger]
Routed from gominimal/inbox#336 by inbox-route (https://github.com/gominimal/inbox/actions/runs/29889758557)
Routing-Key: inbox-route/I_kwDOSUhdos8AAAABJsMQcw
Route: patch
Patch-Dispatched: https://github.com/gominimal/inbox/actions/runs/29889758557
gominimal-aw-bot commentedon Jul 22, 2026
[inbox-patch:handoff]
inbox-patch did not produce a verified fix PR for this issue — the agent run finished without creating one (agent result: success).
Run: https://github.com/gominimal/inbox/actions/runs/29890569479
Manual retry:
jessie-minimal commentedon Jul 23, 2026
needs verification whether it's fixed.
fix(ci): boot the macOS VM lane on guest-pin bumps (#935)