Main Red Alert #60
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Main Red Alert | |
| # A red main is invisible until someone else's PR inherits the failure. | |
| # That happened on 2026-08-02: a PR whose CI passed against an older base | |
| # merged and broke a lint gate added two hours earlier, main went red, and | |
| # nobody noticed until an unrelated PR failed on the same rule. Green CI on a | |
| # stale base is not evidence that main is green. | |
| # | |
| # This files (or updates) ONE issue the moment CI fails on main, and closes it | |
| # when main is green again — so "is main broken?" is answerable without | |
| # watching Actions. | |
| # | |
| # This workflow covers the PUSH path only. A CI run dispatched by the auto-merge | |
| # sweep emits no `workflow_run` event (GitHub suppresses it for runs created | |
| # with GITHUB_TOKEN), so that path calls the same script from ci.yml's post-main | |
| # job instead. The policy itself lives in scripts/ci/main-red-alert.sh so the | |
| # two paths cannot drift. | |
| on: | |
| workflow_run: | |
| workflows: ['CI'] | |
| branches: [main] | |
| types: [completed] | |
| permissions: | |
| issues: write | |
| actions: read | |
| jobs: | |
| alert: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: File or resolve the main-red issue | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| REPO: ${{ github.repository }} | |
| CONCLUSION: ${{ github.event.workflow_run.conclusion }} | |
| RUN_URL: ${{ github.event.workflow_run.html_url }} | |
| RUN_SHA: ${{ github.event.workflow_run.head_sha }} | |
| run: bash scripts/ci/main-red-alert.sh |