ac11afecf3
- issue-done/plan-issue-ready: env FORGEJO_API_TOKEN (GITHUB_TOKEN 403 em Issues) + fork guard (checkout de fork roda script do fork com o PAT — RCE) - forgejo-issue-transition: falha de flip vira exit 1 (job vermelho, nunca skip silencioso) - waitForChecks: exige o rollup CI (PR) / checks presente+verde (raça PR #52: snapshot com jobs não-agendados parecia verde); mergeable=false só conta como conflito após a cascata assentar; timeouts 30→45min (CLI) e 40→55min (workflow) - configure-branch-protection: contexto real CI (PR) / checks* (Forgejo casa por glob contra 'CI (PR) / checks (pull_request)'; literal 'checks' nunca casaria), idempotente GET→POST/PATCH, verificação pós-aplicação; decisão pura em scripts/lib/branch-protection.mjs - docs honestas (AGENT-OPS, agent-pr-workflow.mdc, CUTOVER-MAIN-ONLY, README) - testes: raça do rollup/rollup failure/mergeable pré-settle + branchProtection create/update/noop + glob real
30 lines
1.4 KiB
YAML
30 lines
1.4 KiB
YAML
# Main merge flips claimed issues to done + in-prod.
|
|
# Forgejo port (OPS50): the gh loop became scripts/forgejo-issue-transition.mjs
|
|
# (plain Node, reads the PR body from the API itself).
|
|
# OPS61: the job injects FORGEJO_API_TOKEN — the native GITHUB_TOKEN 403s on
|
|
# issue label writes, and the flip was silently skipped (script logged the 403
|
|
# and the job still ended success). The fork guard is the same class as
|
|
# agent-pr-ready-automerge.yml: on a merged fork PR the checkout pulls the
|
|
# fork's own script, which would run with the repo PAT (RCE).
|
|
name: Main merge flips claimed issues to done + in-prod
|
|
|
|
on:
|
|
pull_request:
|
|
types: [closed]
|
|
|
|
jobs:
|
|
issue-done:
|
|
if: github.event.pull_request.base.ref == 'main' && github.event.pull_request.merged == true && github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
FORGEJO_API_TOKEN: ${{ secrets.FORGEJO_API_TOKEN }}
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
# Script is plain Node (stdlib) — no pnpm. Disable package-manager-cache:
|
|
# setup-node@v5 defaults to true and looks for pnpm before pnpm/action-setup.
|
|
- uses: actions/setup-node@v5
|
|
with:
|
|
node-version: 24
|
|
package-manager-cache: false
|
|
- name: Flip Closes/Fixes #N issues to done and in-prod
|
|
run: node scripts/forgejo-issue-transition.mjs --pr "${{ github.event.pull_request.number }}"
|