ac11afecf3
- issue-done/plan-issue-ready: env FORGEJO_API_TOKEN (GITHUB_TOKEN 403 em Issues) + fork guard (checkout de fork roda script do fork com o PAT — RCE) - forgejo-issue-transition: falha de flip vira exit 1 (job vermelho, nunca skip silencioso) - waitForChecks: exige o rollup CI (PR) / checks presente+verde (raça PR #52: snapshot com jobs não-agendados parecia verde); mergeable=false só conta como conflito após a cascata assentar; timeouts 30→45min (CLI) e 40→55min (workflow) - configure-branch-protection: contexto real CI (PR) / checks* (Forgejo casa por glob contra 'CI (PR) / checks (pull_request)'; literal 'checks' nunca casaria), idempotente GET→POST/PATCH, verificação pós-aplicação; decisão pura em scripts/lib/branch-protection.mjs - docs honestas (AGENT-OPS, agent-pr-workflow.mdc, CUTOVER-MAIN-ONLY, README) - testes: raça do rollup/rollup failure/mergeable pré-settle + branchProtection create/update/noop + glob real
44 lines
1.9 KiB
YAML
44 lines
1.9 KiB
YAML
# Safety net OPS18: when a PR merges to main with `Related #N`, promote Issues
|
|
# that are still awaiting their intention plan (`blocked` + docs/plans/ link)
|
|
# to `ready`. Idempotent with `pnpm agent:ready` (agent happy path).
|
|
#
|
|
# Does NOT run on open PRs — only after merge — so the claim race stays closed.
|
|
# Job is gated on Related # in the body so non-plan merges skip checkout/Node.
|
|
# Forgejo port (OPS50): script reads the PR via the Forgejo API (plain Node).
|
|
# OPS61: the job injects FORGEJO_API_TOKEN — the native GITHUB_TOKEN 403s on
|
|
# issue label writes (same silent-skip failure as issue-done-on-main-merge).
|
|
# Fork guard: on a merged fork PR the checkout pulls the fork's own script,
|
|
# which would run with the repo PAT (RCE — same class as
|
|
# agent-pr-ready-automerge.yml).
|
|
name: Promote plan-issue Related on main merge
|
|
|
|
on:
|
|
pull_request:
|
|
types: [closed]
|
|
branches: [main]
|
|
|
|
jobs:
|
|
plan-issue-ready:
|
|
if: >-
|
|
github.event.pull_request.merged == true &&
|
|
github.event.pull_request.head.repo.full_name == github.repository &&
|
|
(
|
|
contains(github.event.pull_request.body, 'Related #') ||
|
|
contains(github.event.pull_request.body, 'related #') ||
|
|
contains(github.event.pull_request.body, 'RELATED #')
|
|
)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
env:
|
|
FORGEJO_API_TOKEN: ${{ secrets.FORGEJO_API_TOKEN }}
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
# Script is plain Node (stdlib) — no pnpm. Disable
|
|
# package-manager-cache: setup-node@v5 defaults to true and looks for
|
|
# pnpm (packageManager in package.json) before pnpm/action-setup.
|
|
- uses: actions/setup-node@v5
|
|
with:
|
|
node-version: 24
|
|
package-manager-cache: false
|
|
- name: Promote Related #N awaiting plan → ready
|
|
run: node scripts/agent-promote-related-on-merge.mjs --pr "${{ github.event.pull_request.number }}"
|