From ac253c27376fd42a9cc11b0d1beedb3dab2df7d9 Mon Sep 17 00:00:00 2001 From: Francisco Solla Date: Mon, 17 Aug 2026 21:54:07 -0300 Subject: [PATCH 1/3] =?UTF-8?q?docs:=20sem=20branch=20protection=20server-?= =?UTF-8?q?side=20(automerge=20=C3=A9=20o=20gate=20=E2=80=94=20espelha=20t?= =?UTF-8?q?eqo)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .forgejo/workflows/ci.yml | 6 ++++-- AGENTS.md | 5 +++++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index db42d7b..a4337e8 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -1,8 +1,10 @@ name: CI # PR gate + post-merge verifier + deploy: -# - PRs (feature → main) rodam `checks` (lint + build + e2e) — o branch -# protection em `main` exige o status `checks` para merge. +# - PRs (feature → main) rodam `checks` (lint + build + e2e). O merge é +# gated pelo script de auto-merge (`pr.mjs --automerge` / +# `forgejo-pr-automerge.mjs`), que espera `checks` green — sem branch +# protection server-side (espelha o teqo). # - Push em `main` (merge dos PRs) roda `checks` de novo e depois `deploy` # (rsync do dist/ para o homeserver). Deploy é gated em `checks`. # diff --git a/AGENTS.md b/AGENTS.md index 155008c..cfd6747 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -75,6 +75,11 @@ Ciclo completo (detalhes nas skills `plan-issue` / `work-issue`): - `plan-issue-ready-on-main-merge.yml` — PRs com `Related #N` promovem `blocked` → `ready` (`scripts/agent-promote-related-on-merge.mjs`). - `agent-pr-ready-automerge.yml` — marca Ready e mergea quando `checks` ficar green (safety net do auto-merge). +**Sem branch protection server-side em `main`** (espelha o teqo): o gate de merge é o +próprio script de auto-merge (`pr.mjs --automerge` / `forgejo-pr-automerge.mjs`), +que espera os status checks ficarem green antes de mergear; o deploy é gated pelo +`needs: checks` do `ci.yml`. + **e2e só no CI** — nunca rode `bun run test:e2e` local como parte do fluxo normal. ## Regras de entrega -- 2.45.2 From 8bc6ea05369ef9e8b38617c3e44c661cfda3e2cf Mon Sep 17 00:00:00 2001 From: Francisco Solla Date: Mon, 17 Aug 2026 22:05:35 -0300 Subject: [PATCH 2/3] =?UTF-8?q?debug:=20token=20GITHUB=5FTOKEN=20no=20runn?= =?UTF-8?q?er=20(tempor=C3=A1rio)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .forgejo/workflows/debug-token.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 .forgejo/workflows/debug-token.yml diff --git a/.forgejo/workflows/debug-token.yml b/.forgejo/workflows/debug-token.yml new file mode 100644 index 0000000..75833de --- /dev/null +++ b/.forgejo/workflows/debug-token.yml @@ -0,0 +1,24 @@ +name: Debug token + +on: + workflow_dispatch: + push: + branches: [OPS1-setup-workflow-teqo] + +jobs: + debug: + runs-on: host + timeout-minutes: 5 + steps: + - name: Quem é o GITHUB_TOKEN + run: | + echo "GITHUB_TOKEN user:" + curl -s -H "Authorization: token $GITHUB_TOKEN" https://git.solla.dev/api/v1/user + echo + echo "Permissões no repo:" + curl -s -H "Authorization: token $GITHUB_TOKEN" "https://git.solla.dev/api/v1/repos/amana/iara-pwa" + echo + echo "Tentando criar label (escrita):" + curl -s -o /dev/null -w "%{http_code}\n" -X POST -H "Authorization: token $GITHUB_TOKEN" -H "Content-Type: application/json" "https://git.solla.dev/api/v1/repos/amana/iara-pwa/labels" -d '{"name":"debug-token-test","color":"ff0000"}' + echo "Tentando remover label:" + curl -s -o /dev/null -w "%{http_code}\n" -X DELETE -H "Authorization: token $GITHUB_TOKEN" "https://git.solla.dev/api/v1/repos/amana/iara-pwa/labels/debug-token-test" -- 2.45.2 From c4f6dd159f21930eae67482df97f9a263bb8d657 Mon Sep 17 00:00:00 2001 From: Francisco Solla Date: Mon, 17 Aug 2026 22:08:39 -0300 Subject: [PATCH 3/3] =?UTF-8?q?fix:=20automerge=20safety=20net=20s=C3=B3?= =?UTF-8?q?=20para=20agent/*=20(espelha=20teqo=20=E2=80=94=20GITHUB=5FTOKE?= =?UTF-8?q?N=20n=C3=A3o=20mergea=20em=20repo=20de=20org);=20remove=20workf?= =?UTF-8?q?low=20de=20debug?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../workflows/agent-pr-ready-automerge.yml | 17 +++++++++---- .forgejo/workflows/debug-token.yml | 24 ------------------- 2 files changed, 12 insertions(+), 29 deletions(-) delete mode 100644 .forgejo/workflows/debug-token.yml diff --git a/.forgejo/workflows/agent-pr-ready-automerge.yml b/.forgejo/workflows/agent-pr-ready-automerge.yml index 42f739f..eb28312 100644 --- a/.forgejo/workflows/agent-pr-ready-automerge.yml +++ b/.forgejo/workflows/agent-pr-ready-automerge.yml @@ -1,7 +1,12 @@ -# Safety net: PRs de entrega (feature → main) devem ser Ready + auto-merge. -# Cobre o caso de um agente esquecer de armar o merge. Roda -# scripts/forgejo-pr-automerge.mjs (plain Node): marca draft → ready, espera o -# status check `checks` (branch protection em main) e mergea por rebase. +# Safety net (espelha o teqo): PRs de branch `agent/*` → main devem ser Ready + +# auto-merge. PRs humanos não passam por aqui — o merge deles é feito pelo +# agente local via `bun run pr -- --automerge` (com o PAT do usuário, que tem +# permissão de merge; o usuário sintético `forgejo-actions` do GITHUB_TOKEN não +# consegue mergear em repos de org). +# +# Roda scripts/forgejo-pr-automerge.mjs (plain Node): marca draft → ready, espera +# o contexto `checks` ficar green (ignorando o próprio status do job) e mergea +# por rebase. name: Agent PR Ready + auto-merge @@ -12,7 +17,9 @@ on: jobs: ready-automerge: - if: github.event.pull_request.state == 'open' + if: >- + github.event.pull_request.state == 'open' && + startsWith(github.event.pull_request.head.ref, 'agent/') runs-on: host timeout-minutes: 40 steps: diff --git a/.forgejo/workflows/debug-token.yml b/.forgejo/workflows/debug-token.yml deleted file mode 100644 index 75833de..0000000 --- a/.forgejo/workflows/debug-token.yml +++ /dev/null @@ -1,24 +0,0 @@ -name: Debug token - -on: - workflow_dispatch: - push: - branches: [OPS1-setup-workflow-teqo] - -jobs: - debug: - runs-on: host - timeout-minutes: 5 - steps: - - name: Quem é o GITHUB_TOKEN - run: | - echo "GITHUB_TOKEN user:" - curl -s -H "Authorization: token $GITHUB_TOKEN" https://git.solla.dev/api/v1/user - echo - echo "Permissões no repo:" - curl -s -H "Authorization: token $GITHUB_TOKEN" "https://git.solla.dev/api/v1/repos/amana/iara-pwa" - echo - echo "Tentando criar label (escrita):" - curl -s -o /dev/null -w "%{http_code}\n" -X POST -H "Authorization: token $GITHUB_TOKEN" -H "Content-Type: application/json" "https://git.solla.dev/api/v1/repos/amana/iara-pwa/labels" -d '{"name":"debug-token-test","color":"ff0000"}' - echo "Tentando remover label:" - curl -s -o /dev/null -w "%{http_code}\n" -X DELETE -H "Authorization: token $GITHUB_TOKEN" "https://git.solla.dev/api/v1/repos/amana/iara-pwa/labels/debug-token-test" -- 2.45.2