CODEX_FIXER_TOKEN is a fine-grained PAT with Contents/Pull-requests write but NOT
Actions:write, so it cannot create a workflow_dispatch event; and a github.token
-dispatched run never emits a workflow_run event to drive the triage merge job. So
neither half of the old cross-workflow design could work.
Instead, update_windows_version_definitions.yml now dispatches PR-tests with
github.token (this workflow already has actions:write), polls that run directly,
and on success squash-merges the PR with the CODEX_FIXER_TOKEN PAT so the push to
master triggers CI-master_test -> Publish_release. Remove the now-dead
auto_merge_windows_definition_bot_pr job from chack-agent-pr-triage.yml and the
temporary token probe. Bump the job timeout to 90m to cover the inline wait.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The workflows referenced a secret (CHACK_AGENT_FIXER_TOKEN) that does not exist
in the repo, so it resolved to empty and the windows-definitions auto-merge could
neither dispatch PR-tests nor merge. Point every reference at the existing
CODEX_FIXER_TOKEN PAT (fine-grained, admin on the repo) instead. Remove the
temporary token probe.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Dispatch PR-tests with a PAT instead of github.token: a workflow run owned
by GITHUB_TOKEN does not emit a downstream `workflow_run` event, so the
chack-agent-pr-triage auto-merge job never fired for the bot PR. Also accept
the UNSTABLE merge state (the bot PR's `action_required` pull_request run
keeps it permanently UNSTABLE) and drop the explicit CI-master_test dispatch
since the PAT squash-merge's push to master already triggers the release,
avoiding a double release.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The PATH-derived portion of writeVB uses `sed 's/:/$|^/g'` to turn the
colon-separated PATH into an alternation regex. This produces patterns like
`^/usr/bin$|^/sbin$|^/bin` where every entry except the last gets a trailing
`$` anchor — making it an exact match on the directory name itself rather than
a prefix match on files inside it.
On modern merged-/usr distributions (Debian 10+, Ubuntu 20.04+, Fedora 17+,
Arch) `/bin` is a symlink to `usr/bin`, so `find /` returns `/usr/bin/bash`
rather than `/bin/bash`. The pattern `^/usr/bin$` does not match
`/usr/bin/bash` (the `$` prevents it), so a writable bash binary falls through
to the lower-severity writeB coloring (plain RED) instead of the 95% PE vector
RED/YELLOW.
Add explicit patterns for the common shell interpreters and env so they are
always flagged as 95% PE vectors regardless of PATH ordering or /usr-merge
layout:
/bin/bash /usr/bin/bash
/bin/sh /usr/bin/sh
/bin/dash /usr/bin/dash
/bin/zsh /usr/bin/zsh
/usr/bin/env
Co-authored-by: s1d3r <s1d3r@users.noreply.github.com>
kkreiju