diff --git a/.github/workflows/chack-agent-pr-triage.yml b/.github/workflows/chack-agent-pr-triage.yml index 652dde2..5f07bc9 100644 --- a/.github/workflows/chack-agent-pr-triage.yml +++ b/.github/workflows/chack-agent-pr-triage.yml @@ -6,134 +6,11 @@ on: types: [completed] jobs: - auto_merge_windows_definition_bot_pr: - if: ${{ github.event.workflow_run.conclusion == 'success' }} - runs-on: ubuntu-latest - permissions: - actions: write - contents: write - pull-requests: write - - steps: - - name: Resolve and verify bot PR - id: bot_pr - env: - PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }} - HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} - GH_REPO: ${{ github.repository }} - GH_TOKEN: ${{ github.token }} - run: | - title="chore(winpeas): update windows version vulnerability definitions" - branch="bot/update-windows-version-definitions" - expected_file="build_lists/windows_version_exploits.json" - - pr_number="${PR_NUMBER}" - if [ -z "$pr_number" ] && [ -n "$HEAD_BRANCH" ]; then - pr_number="$(gh pr list --state open --head "$HEAD_BRANCH" --base master --json number --jq '.[0].number')" - fi - if [ -z "$pr_number" ]; then - echo "No pull request found for this workflow_run; skipping." - echo "should_merge=false" >> "$GITHUB_OUTPUT" - exit 0 - fi - - pr_json="$(gh pr view "$pr_number" --json title,baseRefName,headRefName,author,isCrossRepository,files,mergeStateStatus)" - pr_title="$(jq -r .title <<<"$pr_json")" - base_ref="$(jq -r .baseRefName <<<"$pr_json")" - head_ref="$(jq -r .headRefName <<<"$pr_json")" - author="$(jq -r .author.login <<<"$pr_json")" - is_cross_repository="$(jq -r .isCrossRepository <<<"$pr_json")" - merge_state="$(jq -r .mergeStateStatus <<<"$pr_json")" - files="$(jq -r '.files[].path' <<<"$pr_json")" - file_count="$(jq -r '.files | length' <<<"$pr_json")" - - if [ "$pr_title" != "$title" ] || - [ "$base_ref" != "master" ] || - [ "$head_ref" != "$branch" ] || - [ "$is_cross_repository" != "false" ] || - [ "$file_count" != "1" ] || - [ "$files" != "$expected_file" ]; then - echo "PR #$pr_number is not the trusted windows definitions bot PR; skipping." - echo "should_merge=false" >> "$GITHUB_OUTPUT" - exit 0 - fi - - if [ "$author" != "app/github-actions" ] && - [ "$author" != "github-actions" ] && - [ "$author" != "github-actions[bot]" ]; then - echo "PR #$pr_number is from unexpected author $author; skipping." - echo "should_merge=false" >> "$GITHUB_OUTPUT" - exit 0 - fi - - # Accept UNSTABLE in addition to CLEAN/HAS_HOOKS. When the bot opens the PR, GitHub - # also queues a `pull_request` PR-tests run that sits in `action_required` (it needs - # manual approval and never runs), which keeps the PR permanently UNSTABLE. The - # meaningful tests already passed: this job only runs when the dispatched PR-tests - # workflow_run concluded `success`, and the PR identity is strictly validated above. - # We still wait out the transient UNKNOWN state and refuse hard blockers - # (DIRTY/BLOCKED/BEHIND/DRAFT). - for attempt in {1..12}; do - case "$merge_state" in - CLEAN|HAS_HOOKS|UNSTABLE) - break - ;; - esac - - echo "PR #$pr_number mergeStateStatus=$merge_state; waiting for GitHub to finish evaluating mergeability ($attempt/12)." - sleep 10 - merge_state="$(gh pr view "$pr_number" --json mergeStateStatus --jq .mergeStateStatus)" - done - - case "$merge_state" in - CLEAN|HAS_HOOKS|UNSTABLE) - ;; - *) - echo "Refusing to merge PR #$pr_number because mergeStateStatus=$merge_state" - echo "should_merge=false" >> "$GITHUB_OUTPUT" - exit 0 - ;; - esac - - echo "should_merge=true" >> "$GITHUB_OUTPUT" - echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT" - echo "title=$title" >> "$GITHUB_OUTPUT" - - - name: Merge trusted bot PR - if: ${{ steps.bot_pr.outputs.should_merge == 'true' }} - env: - GH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }} - PR_NUMBER: ${{ steps.bot_pr.outputs.pr_number }} - COMMIT_TITLE: ${{ steps.bot_pr.outputs.title }} - run: | - if [ -z "$GH_TOKEN" ]; then - echo "CODEX_FIXER_TOKEN is required to merge this PR and dispatch the release workflow." - exit 1 - fi - - for attempt in {1..6}; do - if response="$(gh api \ - -X PUT \ - -H "Accept: application/vnd.github+json" \ - "/repos/${{ github.repository }}/pulls/${PR_NUMBER}/merge" \ - -f merge_method=squash \ - -f commit_title="$COMMIT_TITLE")"; then - merge_sha="$(jq -r '.sha // empty' <<<"$response")" - echo "Merged trusted windows definitions bot PR #$PR_NUMBER as $merge_sha." - # The squash-merge is performed with CODEX_FIXER_TOKEN (a PAT, not - # GITHUB_TOKEN), so the resulting push to master triggers CI-master_test via its - # `push` trigger, which builds and publishes the PEASS release. We intentionally - # do NOT also dispatch CI-master_test here, to avoid publishing two releases for - # the same merge. - exit 0 - fi - - echo "Merge attempt $attempt failed for PR #$PR_NUMBER; retrying." - sleep 10 - done - - echo "Failed to merge trusted windows definitions bot PR #$PR_NUMBER after retries." - exit 1 + # NOTE: The windows-definitions bot PR is built, waited on and merged inline by + # update_windows_version_definitions.yml (it dispatches PR-tests with github.token, polls + # that run, then squash-merges with the CODEX_FIXER_TOKEN PAT so the push to master triggers + # the release). It is intentionally NOT handled here: a github.token-dispatched run does not + # emit a `workflow_run` event, so a job here could never reliably fire for it. chack_agent_triage: if: ${{ github.event.workflow_run.conclusion == 'success' }} diff --git a/.github/workflows/update_windows_version_definitions.yml b/.github/workflows/update_windows_version_definitions.yml index 4a9bf10..aac2362 100644 --- a/.github/workflows/update_windows_version_definitions.yml +++ b/.github/workflows/update_windows_version_definitions.yml @@ -13,7 +13,7 @@ permissions: jobs: update-definitions: runs-on: ubuntu-latest - timeout-minutes: 60 + timeout-minutes: 90 steps: - name: Checkout @@ -39,7 +39,7 @@ jobs: - name: Create validated update pull request env: GH_TOKEN: ${{ github.token }} - PR_TESTS_DISPATCH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }} + MERGE_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }} run: | title="chore(winpeas): update windows version vulnerability definitions" branch="bot/update-windows-version-definitions" @@ -75,15 +75,74 @@ jobs: exit 1 fi - # Dispatch PR-tests with a PAT instead of github.token. A workflow run that is - # owned by GITHUB_TOKEN does NOT emit a downstream `workflow_run` event, so a - # github.token-dispatched run never triggered the chack-agent-pr-triage auto-merge - # job. Dispatching with a PAT makes the run user-owned, so `workflow_run` fires and - # the trusted merge job runs once PR-tests pass. - if [ -z "$PR_TESTS_DISPATCH_TOKEN" ]; then - echo "CODEX_FIXER_TOKEN is required to dispatch PR-tests so the auto-merge workflow_run event fires." + # Run the winPEAS PR-tests build for the bot branch, wait for it, and merge on + # success. We dispatch with github.token (this workflow has `actions: write`) and + # then poll the dispatched run directly, instead of relying on a cross-workflow + # `workflow_run` trigger: runs owned by GITHUB_TOKEN do not emit `workflow_run` + # events, and the auto-created `pull_request` PR-tests run for a bot-authored PR is + # held in `action_required`. The merge itself is done with a PAT (see below). + if [ -z "$MERGE_TOKEN" ]; then + echo "CODEX_FIXER_TOKEN (MERGE_TOKEN) is required to merge the validated bot PR." exit 1 fi - GH_TOKEN="$PR_TESTS_DISPATCH_TOKEN" gh workflow run PR-tests.yml --ref "$branch" - echo "PR-tests dispatched (via PAT) for PR #$pr_number. The trusted workflow_run merge job will merge it after tests pass." + dispatch_ts="$(date -u +%s)" + gh workflow run PR-tests.yml --ref "$branch" + echo "Dispatched PR-tests for $branch (PR #$pr_number); locating the run..." + + run_id="" + for attempt in $(seq 1 18); do + row="$(gh run list --workflow=PR-tests.yml --branch "$branch" --event workflow_dispatch \ + --limit 1 --json databaseId,createdAt --jq '.[0] | [.databaseId, .createdAt] | @tsv')" + cid="$(printf '%s' "$row" | cut -f1)" + cts_iso="$(printf '%s' "$row" | cut -f2)" + if [ -n "$cid" ]; then + cts="$(date -u -d "$cts_iso" +%s 2>/dev/null || echo 0)" + if [ "$cts" -ge "$((dispatch_ts - 60))" ]; then + run_id="$cid" + break + fi + fi + sleep 10 + done + + if [ -z "$run_id" ]; then + echo "Could not locate the dispatched PR-tests run." + exit 1 + fi + echo "Watching PR-tests run $run_id until it completes..." + + status="" + conclusion="" + for attempt in $(seq 1 70); do + status="$(gh run view "$run_id" --json status --jq .status)" + if [ "$status" = "completed" ]; then + conclusion="$(gh run view "$run_id" --json conclusion --jq .conclusion)" + break + fi + sleep 30 + done + + if [ "$conclusion" != "success" ]; then + echo "PR-tests run $run_id did not pass (status=$status conclusion=$conclusion); not merging PR #$pr_number." + exit 1 + fi + echo "PR-tests passed. Squash-merging PR #$pr_number..." + + # Merge with the PAT (not github.token) so the resulting push to master triggers + # CI-master_test -> Publish_release. A github.token-authored merge would not. + for attempt in $(seq 1 6); do + if GH_TOKEN="$MERGE_TOKEN" gh api -X PUT \ + -H "Accept: application/vnd.github+json" \ + "/repos/${{ github.repository }}/pulls/${pr_number}/merge" \ + -f merge_method=squash \ + -f commit_title="$title"; then + echo "Merged windows definitions PR #$pr_number. CI-master_test will build and publish the release." + exit 0 + fi + echo "Merge attempt $attempt failed for PR #$pr_number; retrying." + sleep 10 + done + + echo "Failed to merge PR #$pr_number after retries." + exit 1 diff --git a/.github/workflows/zz-token-probe.yml b/.github/workflows/zz-token-probe.yml deleted file mode 100644 index ae7f891..0000000 --- a/.github/workflows/zz-token-probe.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: zz-token-probe - -on: - workflow_dispatch: - -jobs: - probe: - runs-on: ubuntu-latest - steps: - - name: Probe CODEX_FIXER_TOKEN contents/PR write - env: - TOK: ${{ secrets.CODEX_FIXER_TOKEN }} - REPO: ${{ github.repository }} - run: | - api() { curl -sS -o /tmp/out.json -w "%{http_code}" "$@"; } - master_sha="$(curl -sS -H "Authorization: token $TOK" "https://api.github.com/repos/$REPO/git/ref/heads/master" | jq -r .object.sha)" - echo "master sha: $master_sha" - - echo "--- Contents:write test (create ref) ---" - code="$(api -X POST -H "Authorization: token $TOK" \ - "https://api.github.com/repos/$REPO/git/refs" \ - -d "{\"ref\":\"refs/heads/zz-codex-write-test\",\"sha\":\"$master_sha\"}")" - echo "create ref HTTP: $code"; cat /tmp/out.json | jq -r '.message // empty' - - if [ "$code" = "201" ]; then - code="$(api -X DELETE -H "Authorization: token $TOK" \ - "https://api.github.com/repos/$REPO/git/refs/heads/zz-codex-write-test")" - echo "delete ref HTTP: $code" - fi - - echo "--- Pull requests:write test (no-op edit of PR #652 base->base) ---" - code="$(api -X PATCH -H "Authorization: token $TOK" \ - "https://api.github.com/repos/$REPO/pulls/652" \ - -d "{\"body\":\"Automated update of build_lists/windows_version_exploits.json (auto-merge pipeline test).\"}")" - echo "patch PR HTTP: $code"; cat /tmp/out.json | jq -r '.message // empty'