Dependent Jobs Always Run When a Job in the Serial Group Fails

Overview

When using serial_group in a CircleCI workflow, a job failure within the group does not prevent downstream jobs that depend on the serial group lock from running. This can be surprising - dependent jobs appear to always execute regardless of whether the serial group job succeeded or failed.

The pipeline will still report as failed at the end, but the dependent jobs will have already run.

Root Cause

Serial groups work by acquiring and releasing a named lock. Internally, this is managed by a synthetic serial-end lock step that accepts all five terminal statuses: success, failure, canceled, unauthorized, and not run.

Because the lock release (serial-end) is always reached under any of these statuses, it is always considered "green" from a workflow dependency resolution perspective. Any job configured with requires: <serial-group-job> is effectively depending on the lock release — not on the success of the job itself — so it will always be unblocked and run

Solution

To prevent dependent jobs from running when a serial group job fails, move the job that downstream work requires out of the serial group. Jobs outside a serial group resolve their status normally — a failure will block dependent jobs as expected.

Keep in mind that a job outside a serial group will always run (it is not subject to serial lock concurrency controls), so structure your workflow accordingly.

For Example:

workflows:
  build-test:
    jobs:
      - test:
          serial_group: my-group   # Runs under serial lock; lock always releases
      - gate:                      # Outside serial group; failure blocks downstream
          requires:
            - test
      - deploy:
          requires:
            - gate                 # Only runs if 'gate' succeeds