Class: GhaRequiredStatusCheck

A status check that a ruleset requires to pass before a change reaches a ref it targets, named by the context a check run must report.

URI: gha:RequiredStatusCheck

 classDiagram
    class GhaRequiredStatusCheck
    click GhaRequiredStatusCheck href "../GhaRequiredStatusCheck/"
      GhaRequiredStatusCheck : check_context
        
      GhaRequiredStatusCheck : check_uri
        
      GhaRequiredStatusCheck : do_not_enforce_on_create
        
      GhaRequiredStatusCheck : emitted_by
        
          
    
        
        
        GhaRequiredStatusCheck --> "0..1" GhaWorkflow : emitted_by
        click GhaWorkflow href "../GhaWorkflow/"
    

        
      GhaRequiredStatusCheck : integration_id
        
      GhaRequiredStatusCheck : job_path
        
      GhaRequiredStatusCheck : skip_conditions
        
      GhaRequiredStatusCheck : strict_policy
        
      

Class Properties

Property	Value
Class URI	gha:RequiredStatusCheck

Slots

Name	Cardinality and Range	Description	Inheritance
check_uri	1 Uri	An identifier for the requirement	direct
check_context	1 String	The context a check run must report, the rule’s `required_status_checks[]	direct
integration_id	0..1 Integer	The GitHub App the check must come from, the rule’s integration_id; GitHub …	direct
strict_policy	0..1 Boolean	Whether a pull request must be tested against the latest code of the branch i…	direct
do_not_enforce_on_create	0..1 Boolean	Whether a branch may be created although the check would otherwise stop it, t…	direct
job_path	* GhaIdentifier	The ids of the jobs from the top-level workflow’s job to the job that reports…	direct
skip_conditions	* String	What in the workflow can skip the job that reports the check, each written as…	direct
emitted_by	0..1 GhaWorkflow	The top-level workflow whose job reports the check	direct

Usages

used by	used in	type	used
GhaDocument	required_checks	range	GhaRequiredStatusCheck
GhaRepositoryRuleset	requires_check	range	GhaRequiredStatusCheck

Comments

• GitHub Actions reports each job as a check run named after the job: its name, or its id when it has none. A job of a called workflow is named after the calling job and the called job, joined by a slash with a space on each side, as the otterdog documentation states (https://otterdog.readthedocs.io/en/latest/reference/organization/repository/status-check/). A matrix job’s check name adds its matrix values in parentheses.
• A job skipped by its own if, or because a job it needs failed or was skipped, reports success, so its required check passes without running. A path filter skips the whole run, and a calling job’s if or needs skips the call, which GitHub records under the caller’s name alone, so the required check stays pending and blocks the merge. skip_conditions records each of these.
• SLSA’s Source track lets an organization carry such a control into a Source Verification Summary Attestation as an ORG_SOURCE_ property, whose meaning the organization defines; slsa-framework’s source-tool emits one as GH_REQUIRED_CHECK_ followed by the check’s name.
• in-toto’s Test Result predicate is the shape of an attestation of what the check found, so it is a related term and not a close one.

See Also

• https://docs.github.com/en/rest/repos/rules
• https://docs.github.com/en/rest/checks/runs
• https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/about-status-checks
• https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/github-actions

Mappings

Mapping Type	Mapped Value
self	gha:RequiredStatusCheck
native	gha:GhaRequiredStatusCheck
related	in_toto:test-result/v0.1

LinkML Source

Direct

name: GhaRequiredStatusCheck
description: A status check that a ruleset requires to pass before a change reaches
  a ref it targets, named by the context a check run must report.
comments:
- 'GitHub Actions reports each job as a check run named after the job: its name, or
  its id when it has none. A job of a called workflow is named after the calling job
  and the called job, joined by a slash with a space on each side, as the otterdog
  documentation states (https://otterdog.readthedocs.io/en/latest/reference/organization/repository/status-check/).
  A matrix job''s check name adds its matrix values in parentheses.'
- A job skipped by its own `if`, or because a job it needs failed or was skipped,
  reports success, so its required check passes without running. A path filter skips
  the whole run, and a calling job's `if` or `needs` skips the call, which GitHub
  records under the caller's name alone, so the required check stays pending and blocks
  the merge. skip_conditions records each of these.
- SLSA's Source track lets an organization carry such a control into a Source Verification
  Summary Attestation as an ORG_SOURCE_ property, whose meaning the organization defines;
  slsa-framework's source-tool emits one as GH_REQUIRED_CHECK_ followed by the check's
  name.
- in-toto's Test Result predicate is the shape of an attestation of what the check
  found, so it is a related term and not a close one.
from_schema: https://w3id.org/lmodel/github-actions
see_also:
- https://docs.github.com/en/rest/repos/rules
- https://docs.github.com/en/rest/checks/runs
- https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/about-status-checks
- https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks
related_mappings:
- in_toto:test-result/v0.1
attributes:
  check_uri:
    name: check_uri
    description: An identifier for the requirement. GitHub gives a required check
      no address of its own; in a knowledge bundle the concept's `id` takes its place.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    identifier: true
    domain_of:
    - GhaRequiredStatusCheck
    range: uri
  check_context:
    name: check_context
    description: The context a check run must report, the rule's `required_status_checks[].context`.
      Named check_context because LOKF defines a context slot of its own.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    domain_of:
    - GhaRequiredStatusCheck
    required: true
    pattern: \S
  integration_id:
    name: integration_id
    description: The GitHub App the check must come from, the rule's `integration_id`;
      GitHub Actions is app 15368.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    domain_of:
    - GhaRequiredStatusCheck
    range: integer
    minimum_value: 1
  strict_policy:
    name: strict_policy
    description: Whether a pull request must be tested against the latest code of
      the branch it targets, the rule's `strict_required_status_checks_policy`.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    domain_of:
    - GhaRequiredStatusCheck
    range: boolean
  do_not_enforce_on_create:
    name: do_not_enforce_on_create
    description: Whether a branch may be created although the check would otherwise
      stop it, the rule's `do_not_enforce_on_create`.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    domain_of:
    - GhaRequiredStatusCheck
    range: boolean
  job_path:
    name: job_path
    description: 'The ids of the jobs from the top-level workflow''s job to the job
      that reports the check: one id for a job of the workflow itself, the calling
      job''s id first for a job of a called workflow.'
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    list_elements_ordered: true
    domain_of:
    - GhaRequiredStatusCheck
    range: gha_identifier
    multivalued: true
  skip_conditions:
    name: skip_conditions
    description: What in the workflow can skip the job that reports the check, each
      written as its key's path in the file, such as `on.pull_request.paths` or `jobs.test.if`.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    domain_of:
    - GhaRequiredStatusCheck
    multivalued: true
    pattern: ^(on|jobs)\.\S+$
  emitted_by:
    name: emitted_by
    description: The top-level workflow whose job reports the check.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    domain_of:
    - GhaRequiredStatusCheck
    range: GhaWorkflow
class_uri: gha:RequiredStatusCheck

Induced

name: GhaRequiredStatusCheck
description: A status check that a ruleset requires to pass before a change reaches
  a ref it targets, named by the context a check run must report.
comments:
- 'GitHub Actions reports each job as a check run named after the job: its name, or
  its id when it has none. A job of a called workflow is named after the calling job
  and the called job, joined by a slash with a space on each side, as the otterdog
  documentation states (https://otterdog.readthedocs.io/en/latest/reference/organization/repository/status-check/).
  A matrix job''s check name adds its matrix values in parentheses.'
- A job skipped by its own `if`, or because a job it needs failed or was skipped,
  reports success, so its required check passes without running. A path filter skips
  the whole run, and a calling job's `if` or `needs` skips the call, which GitHub
  records under the caller's name alone, so the required check stays pending and blocks
  the merge. skip_conditions records each of these.
- SLSA's Source track lets an organization carry such a control into a Source Verification
  Summary Attestation as an ORG_SOURCE_ property, whose meaning the organization defines;
  slsa-framework's source-tool emits one as GH_REQUIRED_CHECK_ followed by the check's
  name.
- in-toto's Test Result predicate is the shape of an attestation of what the check
  found, so it is a related term and not a close one.
from_schema: https://w3id.org/lmodel/github-actions
see_also:
- https://docs.github.com/en/rest/repos/rules
- https://docs.github.com/en/rest/checks/runs
- https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/about-status-checks
- https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks
related_mappings:
- in_toto:test-result/v0.1
attributes:
  check_uri:
    name: check_uri
    description: An identifier for the requirement. GitHub gives a required check
      no address of its own; in a knowledge bundle the concept's `id` takes its place.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    identifier: true
    owner: GhaRequiredStatusCheck
    domain_of:
    - GhaRequiredStatusCheck
    range: uri
    required: true
  check_context:
    name: check_context
    description: The context a check run must report, the rule's `required_status_checks[].context`.
      Named check_context because LOKF defines a context slot of its own.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    owner: GhaRequiredStatusCheck
    domain_of:
    - GhaRequiredStatusCheck
    range: string
    required: true
    pattern: \S
  integration_id:
    name: integration_id
    description: The GitHub App the check must come from, the rule's `integration_id`;
      GitHub Actions is app 15368.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    owner: GhaRequiredStatusCheck
    domain_of:
    - GhaRequiredStatusCheck
    range: integer
    minimum_value: 1
  strict_policy:
    name: strict_policy
    description: Whether a pull request must be tested against the latest code of
      the branch it targets, the rule's `strict_required_status_checks_policy`.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    owner: GhaRequiredStatusCheck
    domain_of:
    - GhaRequiredStatusCheck
    range: boolean
  do_not_enforce_on_create:
    name: do_not_enforce_on_create
    description: Whether a branch may be created although the check would otherwise
      stop it, the rule's `do_not_enforce_on_create`.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    owner: GhaRequiredStatusCheck
    domain_of:
    - GhaRequiredStatusCheck
    range: boolean
  job_path:
    name: job_path
    description: 'The ids of the jobs from the top-level workflow''s job to the job
      that reports the check: one id for a job of the workflow itself, the calling
      job''s id first for a job of a called workflow.'
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    list_elements_ordered: true
    owner: GhaRequiredStatusCheck
    domain_of:
    - GhaRequiredStatusCheck
    range: gha_identifier
    multivalued: true
  skip_conditions:
    name: skip_conditions
    description: What in the workflow can skip the job that reports the check, each
      written as its key's path in the file, such as `on.pull_request.paths` or `jobs.test.if`.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    owner: GhaRequiredStatusCheck
    domain_of:
    - GhaRequiredStatusCheck
    range: string
    multivalued: true
    pattern: ^(on|jobs)\.\S+$
  emitted_by:
    name: emitted_by
    description: The top-level workflow whose job reports the check.
    from_schema: https://w3id.org/lmodel/github-actions/github_actions_rules
    rank: 1000
    owner: GhaRequiredStatusCheck
    domain_of:
    - GhaRequiredStatusCheck
    range: GhaWorkflow
class_uri: gha:RequiredStatusCheck