From 93c9b909e69dea9da74ad4489a24f491ab3ecb36 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Tue, 30 Jun 2026 14:42:50 +0200 Subject: [PATCH] ci: auto-merge trusted generated PRs --- .github/workflows/chack-agent-pr-triage.yml | 48 ++++++++++++++++----- 1 file changed, 38 insertions(+), 10 deletions(-) diff --git a/.github/workflows/chack-agent-pr-triage.yml b/.github/workflows/chack-agent-pr-triage.yml index 5f07bc9..821c6e1 100644 --- a/.github/workflows/chack-agent-pr-triage.yml +++ b/.github/workflows/chack-agent-pr-triage.yml @@ -29,6 +29,8 @@ jobs: head_ref: ${{ steps.gate.outputs.head_ref }} base_sha: ${{ steps.gate.outputs.base_sha }} head_sha: ${{ steps.gate.outputs.head_sha }} + trusted_automerge: ${{ steps.gate.outputs.trusted_automerge }} + trusted_automerge_reason: ${{ steps.gate.outputs.trusted_automerge_reason }} decision: ${{ steps.parse.outputs.decision }} message: ${{ steps.parse.outputs.message }} @@ -66,6 +68,25 @@ jobs: head_ref="$(gh pr view "$pr_number" --json headRefName --jq .headRefName)" base_sha="$(gh pr view "$pr_number" --json baseRefOid --jq .baseRefOid)" head_sha="$(gh pr view "$pr_number" --json headRefOid --jq .headRefOid)" + trusted_automerge=false + trusted_automerge_reason="" + + if [ "$base_ref" = "master" ] || [ "$base_ref" = "main" ]; then + case "$head_ref:$pr_title" in + chack-agent/ci-master-fix-[0-9]*:"Fix CI-master_test failure (run #"*")") + trusted_automerge=true + trusted_automerge_reason="trusted CI-master Chack Agent fix PR" + ;; + autoimprover/linpeas/[0-9]*:"autoimprover: simplify linpeas checks") + trusted_automerge=true + trusted_automerge_reason="trusted HackTricks-Feed linPEAS autoimprover PR" + ;; + autoimprover/winpeas/[0-9]*:"autoimprover: simplify winpeas checks") + trusted_automerge=true + trusted_automerge_reason="trusted HackTricks-Feed winPEAS autoimprover PR" + ;; + esac + fi echo "should_run=true" >> "$GITHUB_OUTPUT" echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT" @@ -79,35 +100,37 @@ jobs: echo "head_ref=$head_ref" >> "$GITHUB_OUTPUT" echo "base_sha=$base_sha" >> "$GITHUB_OUTPUT" echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT" + echo "trusted_automerge=$trusted_automerge" >> "$GITHUB_OUTPUT" + echo "trusted_automerge_reason=$trusted_automerge_reason" >> "$GITHUB_OUTPUT" - name: Checkout PR merge ref uses: actions/checkout@v5 with: ref: refs/pull/${{ steps.gate.outputs.pr_number }}/merge - if: ${{ steps.gate.outputs.should_run == 'true' }} + if: ${{ steps.gate.outputs.should_run == 'true' && steps.gate.outputs.trusted_automerge != 'true' }} - name: Pre-fetch base and head refs - if: ${{ steps.gate.outputs.should_run == 'true' }} + if: ${{ steps.gate.outputs.should_run == 'true' && steps.gate.outputs.trusted_automerge != 'true' }} run: | git fetch --no-tags origin \ ${{ steps.gate.outputs.base_ref }} \ +refs/pull/${{ steps.gate.outputs.pr_number }}/head - name: Set up Node.js for Codex - if: ${{ steps.gate.outputs.should_run == 'true' }} + if: ${{ steps.gate.outputs.should_run == 'true' && steps.gate.outputs.trusted_automerge != 'true' }} uses: actions/setup-node@v5 with: node-version: "20" - name: Install Codex CLI - if: ${{ steps.gate.outputs.should_run == 'true' }} + if: ${{ steps.gate.outputs.should_run == 'true' && steps.gate.outputs.trusted_automerge != 'true' }} run: | npm install -g @openai/codex codex --version - name: Run Chack Agent id: run_chack - if: ${{ steps.gate.outputs.should_run == 'true' }} + if: ${{ steps.gate.outputs.should_run == 'true' && steps.gate.outputs.trusted_automerge != 'true' }} uses: carlospolop/chack-agent@master with: provider: codex @@ -151,7 +174,7 @@ jobs: - name: Parse Chack Agent decision id: parse - if: ${{ steps.gate.outputs.should_run == 'true' }} + if: ${{ steps.gate.outputs.should_run == 'true' && steps.gate.outputs.trusted_automerge != 'true' }} env: CHACK_MESSAGE: ${{ steps.run_chack.outputs.final-message }} run: | @@ -181,17 +204,22 @@ jobs: merge_or_comment: runs-on: ubuntu-latest needs: chack_agent_triage - if: ${{ github.event.workflow_run.conclusion == 'success' && needs.chack_agent_triage.outputs.should_run == 'true' && needs.chack_agent_triage.outputs.decision != '' }} + if: ${{ github.event.workflow_run.conclusion == 'success' && needs.chack_agent_triage.outputs.should_run == 'true' && (needs.chack_agent_triage.outputs.trusted_automerge == 'true' || needs.chack_agent_triage.outputs.decision != '') }} permissions: contents: write pull-requests: write steps: - name: Merge PR when approved - if: ${{ needs.chack_agent_triage.outputs.decision == 'merge' }} + if: ${{ needs.chack_agent_triage.outputs.trusted_automerge == 'true' || needs.chack_agent_triage.outputs.decision == 'merge' }} env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN || github.token }} PR_NUMBER: ${{ needs.chack_agent_triage.outputs.pr_number }} + TRUSTED_AUTOMERGE: ${{ needs.chack_agent_triage.outputs.trusted_automerge }} + TRUSTED_AUTOMERGE_REASON: ${{ needs.chack_agent_triage.outputs.trusted_automerge_reason }} run: | + if [ "$TRUSTED_AUTOMERGE" = "true" ]; then + echo "Auto-merging trusted generated PR #${PR_NUMBER}: ${TRUSTED_AUTOMERGE_REASON}" + fi gh api \ -X PUT \ -H "Accept: application/vnd.github+json" \ @@ -200,7 +228,7 @@ jobs: -f commit_title="Auto-merge PR #${PR_NUMBER} (Chack Agent)" - name: Comment with doubts - if: ${{ needs.chack_agent_triage.outputs.decision == 'comment' }} + if: ${{ needs.chack_agent_triage.outputs.trusted_automerge != 'true' && needs.chack_agent_triage.outputs.decision == 'comment' }} uses: actions/github-script@v7 env: PR_NUMBER: ${{ needs.chack_agent_triage.outputs.pr_number }}