mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-09-30 22:03:14 +00:00
9acf071ae4
Some checks are pending
Build & publish app artifacts / Publish + deploy (dev) (push) Waiting to run
Build & publish app artifacts / Publish + deploy (prod) (push) Waiting to run
CI / Lint (push) Waiting to run
CI / Format check (push) Waiting to run
CI / Unit tests (push) Waiting to run
CI / Playwright E2E (push) Waiting to run
The nightly promote fast-forwards main to a fully-green dev HEAD, but the push (as github-actions[bot]) is rejected by the main ruleset: it requires PRs + a status check and the default token is not a bypass actor, so a direct ref push can never land regardless of fast-forwardability. The prior comment claiming protection 'only rejects non-FF' was wrong. Mint a GitHub App installation token (actions/create-github-app-token, SHA-pinned) and push with it; the App must be added to the main ruleset's bypass actors out-of-band. The promoted commit already passed every check on dev (gated by check-dev-green.sh), so re-gating it via a PR on main is redundant. Also fix a gate self-poison: a stale failed 'promote' check-run from a prior run on the same dev HEAD blocked every subsequent gate run (it was excluded only by the current run_id). Exclude prior promote check-runs too, scoped to name=='promote' AND a /actions/runs/ details_url so an external app cannot hide a real failing check by naming it 'promote'; the positive REQUIRED_CHECKS allow-list stays authoritative. Gates: GPT-4.1 cross-review APPROVE (no security regression). Unit-tested: stale promote ignored -> PASS; real failure / external promote / missing required check -> BLOCK. shellcheck clean (also fixed a pre-existing SC2295 on the run_id match).
101 lines
4.3 KiB
Bash
Executable file
101 lines
4.3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Promotion gate: refuse to promote a dev HEAD that is not fully green.
|
|
#
|
|
# Reads check-runs on stdin — one
|
|
# name<US>status<US>conclusion<US>details_url
|
|
# per line, fields separated by ASCII Unit Separator (0x1F) — so it is unit-testable
|
|
# WITHOUT GitHub. promote-dev-to-prod.yml pipes the live `gh api .../check-runs`
|
|
# output in. 0x1F (not TAB) is used deliberately: TAB is IFS-whitespace, so an empty
|
|
# conclusion (every in_progress check has a null conclusion) would collapse and shift
|
|
# the columns — which would make the promote run fail to exclude itself. 0x1F is
|
|
# non-whitespace, so `read` preserves empty fields and the columns stay aligned.
|
|
#
|
|
# A dev HEAD is promotable ONLY when BOTH hold:
|
|
# 1. every present check-run is completed with a passing conclusion
|
|
# (success/neutral/skipped); any pending/failed/cancelled/timed_out check BLOCKS.
|
|
# 2. every check named in REQUIRED_CHECKS is present AND concluded "success".
|
|
# This positive allow-list is what stops a partial-signal promotion — e.g. a
|
|
# commit pushed with [skip ci] (no CI check-runs) that still carries one
|
|
# unrelated green check, or a required check silently renamed/dropped. The gate
|
|
# FAILS SAFE: a missing required check blocks rather than promotes.
|
|
#
|
|
# Self-exclusion: the promotion workflow's OWN in-progress check-run is dropped by
|
|
# EXCLUDE_RUN_ID (its github.run_id, matched in the check-run details_url) — an
|
|
# unforgeable identity, NOT a mutable check name. A check that merely happens to be
|
|
# named "promote" can no longer hide a real failing/required check.
|
|
set -euo pipefail
|
|
|
|
EXCLUDE_RUN_ID="${EXCLUDE_RUN_ID:-}"
|
|
# Name of the promotion workflow's own check-run (its job id). STALE check-runs from
|
|
# prior FAILED promote runs on the same dev HEAD are dropped in the loop so they don't
|
|
# self-poison the "every present check must be green" rule. Configurable so a job
|
|
# rename doesn't silently break the exclusion.
|
|
PROMOTE_CHECK_NAME="${PROMOTE_CHECK_NAME:-promote}"
|
|
# Mandatory checks (one per line). Defaults to the CI suite, which runs on
|
|
# every push to dev (see ci.yml). Keep in sync with those job names; if a name
|
|
# drifts the gate blocks (fails safe) until the list is updated.
|
|
REQUIRED_CHECKS="${REQUIRED_CHECKS:-Lint
|
|
Format check
|
|
Unit tests
|
|
Playwright E2E}"
|
|
|
|
declare -A GREEN
|
|
seen=0
|
|
bad=0
|
|
while IFS=$'\037' read -r name status conclusion details_url; do
|
|
[ -n "${name:-}" ] || continue
|
|
# drop the promotion run's own check-run by run id (never by name).
|
|
if [ -n "${EXCLUDE_RUN_ID}" ] && \
|
|
[ "${details_url}" != "${details_url#*/runs/"${EXCLUDE_RUN_ID}"/}" ]; then
|
|
continue
|
|
fi
|
|
# Also drop ANY check-run from the promotion workflow itself — not just THIS run
|
|
# (above) but STALE ones left by prior FAILED promote runs on the same dev HEAD,
|
|
# which would otherwise self-poison this gate forever (the failure check-run is
|
|
# immutable on the commit). Scoped to name==PROMOTE_CHECK_NAME AND a GitHub Actions
|
|
# run URL (details_url under /actions/runs/) so an EXTERNAL app cannot hide a real
|
|
# failing check by naming it "promote". The positive REQUIRED_CHECKS allow-list
|
|
# below is the authoritative signal regardless — "promote" is never a required check.
|
|
if [ "${name}" = "${PROMOTE_CHECK_NAME}" ] && \
|
|
[ "${details_url}" != "${details_url#*/actions/runs/}" ]; then
|
|
continue
|
|
fi
|
|
seen=$((seen + 1))
|
|
if [ "${status}" != "completed" ]; then
|
|
echo "BLOCK: check '${name}' is '${status}' (not completed)" >&2
|
|
bad=1
|
|
continue
|
|
fi
|
|
case "${conclusion}" in
|
|
success)
|
|
GREEN["${name}"]=1
|
|
echo "ok: ${name} (success)" ;;
|
|
neutral | skipped)
|
|
echo "ok: ${name} (${conclusion})" ;;
|
|
*)
|
|
echo "BLOCK: check '${name}' concluded '${conclusion:-<none>}'" >&2
|
|
bad=1 ;;
|
|
esac
|
|
done
|
|
|
|
if [ "${seen}" -eq 0 ]; then
|
|
echo "BLOCK: no check-runs found for this commit — refusing to promote an unverified dev HEAD" >&2
|
|
exit 1
|
|
fi
|
|
|
|
missing=0
|
|
while IFS= read -r req; do
|
|
[ -n "${req}" ] || continue
|
|
if [ -z "${GREEN[${req}]:-}" ]; then
|
|
echo "BLOCK: required check '${req}' is missing or not successful on dev HEAD" >&2
|
|
missing=1
|
|
fi
|
|
done <<EOF
|
|
${REQUIRED_CHECKS}
|
|
EOF
|
|
|
|
if [ "${bad}" -ne 0 ] || [ "${missing}" -ne 0 ]; then
|
|
echo "BLOCK: dev HEAD is not promotable (see reasons above)" >&2
|
|
exit 1
|
|
fi
|
|
echo "PASS: ${seen} check(s) present, all green; all required checks present + successful."
|