Job incorrectly runs after failure of needed job with rules: when: always set

Summary

When a job has rules: when: always set, it will run even if a needed job fails.

As an example for triage purposes, this could result in code being deployed to production after a test job fails.

Steps to reproduce

1. Create 2 jobs, with a needs relationship between the 2nd and 1st jobs
2. Add a rule to the jobs that evaluate to when: always
3. Make the 1st job fail
4. Observe that the 2nd job still runs

Example Project

Example project
Direct link to failed pipeline

What is the current bug behavior?

A job that 'needs' a job that fails will still run, instead of stopping after the failure.

What is the expected correct behavior?

After a job fails, jobs that depend on it should not run.

Relevant logs and/or screenshots

Example .gitlab-ci.yml

stages:
  - test
  - deploy

.rules-def:
    rules:
        - when: always

failed-test:
    stage: test
    extends: [.rules-def]
    script:
        - exit 1

should-not-run-1:
    stage: deploy
    extends: [.rules-def]
    needs: 
        - failed-test
    script:
        - echo "This should not run"

should-not-run-2:
    stage: deploy
    extends: [.rules-def]
    needs:
        - failed-test
    script:
        - echo "This should not run either"

Output of checks

This bug happens on Gitlab.com

Results of GitLab environment info

Expand for output related to GitLab environment info

(For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check

(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)
(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)
(we will only investigate if the tests are passing)

Possible fixes

I'm unable to add labels for some reason, so tagging @dnldnz and @jheimbuck_gl for triage purposes

thanks @craigbehnke

@dnldnz - I think this is working as intended. needs: only requires the job has finished, not passed. I haven't tried it but adding allow_failure: false to the first job could be a workaround for this.

@dhershkovitch i'm thinking about needs: the correct way right?

@jheimbuck_gl I just tried adding allow_failure: false to the failing job as well as all jobs, and in both scenarios the pipeline's behavior did not change from that described in the issue.

@jheimbuck_gl I figured it out -- the fault is mine on this one. My mistake was that my rule definition specified 'always' instead of 'on_success'. It behaves as expected when I correct this.

Thank you for taking a look at it.

glad you got it sorted out @craigbehnke!

changed milestone to %Backlog

added Category:Continuous Integration grouppipeline execution typebug labels

closed