From 0a1b242fcf49c19a12c6c320496b1abdf0e5b140 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Sun, 28 Jun 2026 20:08:59 +0200 Subject: [PATCH] ci: actually auto-merge windows definition bot PRs Dispatch PR-tests with a PAT instead of github.token: a workflow run owned by GITHUB_TOKEN does not emit a downstream `workflow_run` event, so the chack-agent-pr-triage auto-merge job never fired for the bot PR. Also accept the UNSTABLE merge state (the bot PR's `action_required` pull_request run keeps it permanently UNSTABLE) and drop the explicit CI-master_test dispatch since the PAT squash-merge's push to master already triggers the release, avoiding a double release. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/chack-agent-pr-triage.yml | 47 ++++++++++--------- .../update_windows_version_definitions.yml | 15 +++++- 2 files changed, 39 insertions(+), 23 deletions(-) diff --git a/.github/workflows/chack-agent-pr-triage.yml b/.github/workflows/chack-agent-pr-triage.yml index 2933473..c3c7299 100644 --- a/.github/workflows/chack-agent-pr-triage.yml +++ b/.github/workflows/chack-agent-pr-triage.yml @@ -66,21 +66,34 @@ jobs: exit 0 fi + # Accept UNSTABLE in addition to CLEAN/HAS_HOOKS. When the bot opens the PR, GitHub + # also queues a `pull_request` PR-tests run that sits in `action_required` (it needs + # manual approval and never runs), which keeps the PR permanently UNSTABLE. The + # meaningful tests already passed: this job only runs when the dispatched PR-tests + # workflow_run concluded `success`, and the PR identity is strictly validated above. + # We still wait out the transient UNKNOWN state and refuse hard blockers + # (DIRTY/BLOCKED/BEHIND/DRAFT). for attempt in {1..12}; do - if [ "$merge_state" = "CLEAN" ] || [ "$merge_state" = "HAS_HOOKS" ]; then - break - fi + case "$merge_state" in + CLEAN|HAS_HOOKS|UNSTABLE) + break + ;; + esac echo "PR #$pr_number mergeStateStatus=$merge_state; waiting for GitHub to finish evaluating mergeability ($attempt/12)." sleep 10 merge_state="$(gh pr view "$pr_number" --json mergeStateStatus --jq .mergeStateStatus)" done - if [ "$merge_state" != "CLEAN" ] && [ "$merge_state" != "HAS_HOOKS" ]; then - echo "Refusing to merge PR #$pr_number because mergeStateStatus=$merge_state" - echo "should_merge=false" >> "$GITHUB_OUTPUT" - exit 0 - fi + case "$merge_state" in + CLEAN|HAS_HOOKS|UNSTABLE) + ;; + *) + echo "Refusing to merge PR #$pr_number because mergeStateStatus=$merge_state" + echo "should_merge=false" >> "$GITHUB_OUTPUT" + exit 0 + ;; + esac echo "should_merge=true" >> "$GITHUB_OUTPUT" echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT" @@ -107,19 +120,11 @@ jobs: -f commit_title="$COMMIT_TITLE")"; then merge_sha="$(jq -r '.sha // empty' <<<"$response")" echo "Merged trusted windows definitions bot PR #$PR_NUMBER as $merge_sha." - - for wait_attempt in {1..12}; do - master_sha="$(gh api "/repos/${{ github.repository }}/git/ref/heads/master" --jq .object.sha)" - if [ -z "$merge_sha" ] || [ "$master_sha" = "$merge_sha" ]; then - break - fi - - echo "Waiting for master to point at merge commit $merge_sha ($wait_attempt/12)." - sleep 5 - done - - gh workflow run CI-master_tests.yml --ref master - echo "Dispatched CI-master_test to build and publish the PEASS release." + # The squash-merge is performed with CHACK_AGENT_FIXER_TOKEN (a PAT, not + # GITHUB_TOKEN), so the resulting push to master triggers CI-master_test via its + # `push` trigger, which builds and publishes the PEASS release. We intentionally + # do NOT also dispatch CI-master_test here, to avoid publishing two releases for + # the same merge. exit 0 fi diff --git a/.github/workflows/update_windows_version_definitions.yml b/.github/workflows/update_windows_version_definitions.yml index 219a717..6a54fba 100644 --- a/.github/workflows/update_windows_version_definitions.yml +++ b/.github/workflows/update_windows_version_definitions.yml @@ -39,6 +39,7 @@ jobs: - name: Create validated update pull request env: GH_TOKEN: ${{ github.token }} + PR_TESTS_DISPATCH_TOKEN: ${{ secrets.CHACK_AGENT_FIXER_TOKEN }} run: | title="chore(winpeas): update windows version vulnerability definitions" branch="bot/update-windows-version-definitions" @@ -74,5 +75,15 @@ jobs: exit 1 fi - gh workflow run PR-tests.yml --ref "$branch" - echo "PR-tests dispatched for PR #$pr_number. The trusted workflow_run merge job will merge it and dispatch CI-master_test after tests pass." + # Dispatch PR-tests with a PAT instead of github.token. A workflow run that is + # owned by GITHUB_TOKEN does NOT emit a downstream `workflow_run` event, so a + # github.token-dispatched run never triggered the chack-agent-pr-triage auto-merge + # job. Dispatching with a PAT makes the run user-owned, so `workflow_run` fires and + # the trusted merge job runs once PR-tests pass. + if [ -z "$PR_TESTS_DISPATCH_TOKEN" ]; then + echo "CHACK_AGENT_FIXER_TOKEN is required to dispatch PR-tests so the auto-merge workflow_run event fires." + exit 1 + fi + + GH_TOKEN="$PR_TESTS_DISPATCH_TOKEN" gh workflow run PR-tests.yml --ref "$branch" + echo "PR-tests dispatched (via PAT) for PR #$pr_number. The trusted workflow_run merge job will merge it after tests pass."