Skip to content

fix(automerge): accept divergent osv check names in the reusable auto-merge gate #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
forkwright merged 1 commit into from
Jul 1, 2026
Merged

fix(automerge): accept divergent osv check names in the reusable auto-merge gate #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 16 additions & 11 deletions .github/workflows/dependabot-auto-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,22 +40,27 @@ jobs:
fi
failed=0
# WHY: endswith — reusable-workflow checks are named "caller-job / leaf-job".
# Any given leaf satisfies the check: repos report the same verification
# under divergent names (kanon inlines "osv scanner"; theatron/aletheia
# delegate and report "… osv scanner / osv-scan").
require_passed_check() {
local leaf="$1"
local bucket
bucket=$(gh pr checks "$PR_URL" --json name,bucket \
--jq "[.[] | select(.name | ascii_downcase | endswith(\"$leaf\"))][0].bucket")
if [ -z "$bucket" ] || [ "$bucket" = "null" ]; then
echo "::error::Required verification check ending '${leaf}' was not reported."; failed=1; return
fi
if [ "$bucket" != "pass" ]; then
echo "::error::Required verification check ending '${leaf}' finished in bucket '${bucket}'."; failed=1
fi
local bucket leaf
for leaf in "$@"; do
bucket=$(gh pr checks "$PR_URL" --json name,bucket \
--jq "[.[] | select(.name | ascii_downcase | endswith(\"$leaf\"))][0].bucket")
if [ -n "$bucket" ] && [ "$bucket" != "null" ]; then
if [ "$bucket" = "pass" ]; then
return 0
fi
echo "::error::Required verification check ending '${leaf}' finished in bucket '${bucket}'."; failed=1; return 0
fi
done
echo "::error::No required verification check ending in any of: $*."; failed=1
}
require_passed_check "gate-attestation"
require_passed_check "cargo deny"
require_passed_check "cargo audit"
require_passed_check "osv scanner"
require_passed_check "osv scanner" "osv-scan"
[ "$failed" -eq 0 ] || { echo "Real verification checks missing/unsuccessful." >&2; exit 1; }
echo "Required real verification checks passed."

Expand Down