Skip to content

fix(#2432): retry merge on 409 after updating PR branch#64

Closed
guyoron1 wants to merge 167 commits into
mainfrom
mirror/2434-2432-merge-409-retry
Closed

fix(#2432): retry merge on 409 after updating PR branch#64
guyoron1 wants to merge 167 commits into
mainfrom
mirror/2434-2432-merge-409-retry

Conversation

@guyoron1

Copy link
Copy Markdown
Owner

Mirror of upstream fullsend-ai#2434

When merging an enrollment PR, a 409 conflict can occur if the branch is behind. This fix retries the merge after updating the PR branch, handling the race condition gracefully.

ifireball and others added 30 commits June 10, 2026 16:18
Introduce --vendor to install vendored binaries, reusable workflows,
actions, and agent content. Vendored upstream mirror content is committed
under .defaults/ (same layout as runtime sparse checkout); layered installs
fetch fullsend-ai/fullsend@v0 into .defaults when the marker file is absent.

Reusable workflows use inline workspace preparation and reference infra
from ./.defaults/, matching the pre-vendor layered design. Thin callers
render local reusable paths when --vendor is set.

--fullsend-source pins the source tree for both content and binary
cross-compile; --fullsend-binary remains an explicit ELF override.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Write vendor-manifest.yaml on --vendor installs so cleanup and analyze work
without a local fullsend checkout. Workflows analyze stays embed-only;
vendor layer reports presence, manifest alignment, and optional source
alignment via admin analyze --fullsend-source.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Consolidate thin-stage caller registry, reuse resolved source root for
binary vendoring, reject oversized tar members during extraction, restore
workflows scope comment, fix testing-workflows prose, and introduce
InstallFiles as the canonical collector return type.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Re-add the full download_test.go suite and append extractSourceTree size
limit coverage.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Delete vendored paths atomically via forge.DeleteFiles, reuse resolved
source root for cross-compile, preserve extracted file modes, and tighten
WouldFix deduplication to exact path matches.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Document intentional breaking change: old flag callers should use --vendor;
only known usage was e2e, already updated in this branch.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Document VendorBinaryLayer legacy naming, restore Uninstall/Analyze
comments, and use Title Case for stale-cleanup progress messages.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Batch binary, content, and manifest in one CommitFiles call; validate
manifest version on read; trim leading slash in extractSourceTree; wrap
DeleteFiles ref PATCH in retryOnTransient.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Use the existing blob mode from the recursive tree and set type blob
so deletion entries match GitHub Trees API expectations.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Guard against regressions in delete-entry construction per review.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

# Conflicts:
#	internal/forge/fake.go
#	internal/forge/forge.go

Signed-off-by: Barak Korren <bkorren@redhat.com>
Encode CommitFiles tree entries as base64 to preserve ELF binaries,
add tar extract containment check, consolidate stale cleanup with a
manifest/binary quick-check, and deduplicate cleanup between CLI and layer.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

# Conflicts:
#	action.yml
#	docs/guides/dev/testing-workflows.md

Signed-off-by: Barak Korren <bkorren@redhat.com>
Clarify removed distribution-mode artifacts, drop e2e vendor line, and
document action.yml source-build fallback.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Empty commit to re-dispatch review; prior synchronize dispatch was cancelled.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep enumerateVendoredPaths aligned with CollectVendoredAssets after
main added the composite action (fullsend-ai#2106); fixes CI parity test.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
…t dispatch

GitHub Actions may return 422 when repo-maintenance is dispatched immediately
after a separate vendor CommitFiles on a fresh .fullsend repo. Merge scaffold
and vendored assets into one atomic commit and retry dispatch on indexing lag.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
…nance

Poll GitHub until repo-maintenance.yml is active before dispatch, re-touch
config.yaml after scaffold so the push trigger can run enrollment when
dispatch is still rejected, and fall back to awaiting a push-triggered run.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
…nary

Tree entries with encoding:base64 stored base64 text literally on GitHub,
corrupting YAML workflows and vendor-manifest.yaml. Restore UTF-8 inline
content for text and upload binary via the Git Blob API instead.

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Design for a new `prerequisites` triage action that replaces `blocked`.
The agent can now express both existing blockers and new issues that need
to be created upstream before progress can happen. Includes allowlist
configuration for cross-repo issue creation and a degraded path when
targets are not authorized.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
…nd-ai#401)

Seven-task plan covering config structs, JSON schema, agent prompt,
post-script, user docs, and caller updates. TDD approach with exact
file paths and code blocks.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
Add CreateIssuesConfig and AllowTargets types to both OrgConfig and
PerRepoConfig. NewOrgConfig populates defaults with the org and
fullsend-ai/fullsend. NewPerRepoConfig populates with the target repo
and fullsend-ai/fullsend.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
…ues (fullsend-ai#401)

Pass org name and target repo to config constructors so create_issues
defaults are populated at install time.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
)

Replace the blocked action and blocked_by field with a prerequisites
action containing existing[] and create[] arrays. At least one array
must be non-empty.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
…pt (fullsend-ai#401)

The triage agent can now recommend creating upstream issues via the
prerequisites action's create array, in addition to referencing existing
blockers. Adds hard constraint against emitting sufficient when
prerequisites exist.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
…d-ai#401)

Update triage agent docs to explain the new prerequisites action and the
create_issues.allow_targets configuration surface.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
…#401)

Replace the blocked handler with prerequisites. The post-script reads
the create_issues allowlist from config.yaml, creates permitted upstream
issues via gh, and includes collapsed draft bodies for disallowed or
failed creates so humans can file them manually.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
…ullsend-ai#401)

The agent prompt referenced a nonexistent `prerequisites` label when
checking for prior blockers — the post-script actually applies the
`blocked` label. Also removed unused SOURCE_ORG variable from
post-triage.sh.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
…end-ai#401)

Replace the four blocked-action test cases with five prerequisites-action
test cases that exercise the new schema (existing[], create[], allowlist
validation). Set up GITHUB_WORKSPACE with a config.yaml fixture and add
a mock gh issue-create handler that returns a fake URL.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
ralphbean added 11 commits June 18, 2026 11:16
…i#1706)

Same shape as triage-result.schema.json. The field is optional --
when omitted the post-script skips label processing.

Assisted-by: Claude claude-opus-4-6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
…-ai#1706)

Validate agent-recommended labels against a control-label guard list,
check label existence, append reason to review body, and apply
mutations via the GitHub labels API after posting.

Mirrors the label_actions processing in post-triage.sh.

Assisted-by: Claude claude-opus-4-6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
…1706)

Add issue-labels to the harness skills list and agent definition.
Document when and how to invoke the skill during review, and add
label_actions to the pipeline mode output docs.

Assisted-by: Claude claude-opus-4-6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
Add issue-labels skill section to review agent docs, update the
built-in skills table, and align triage docs example with the
generalized skill language.

Assisted-by: Claude claude-opus-4-6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
)

- Revert triage.md example wording to stay issue-specific (triage
  agent doesn't process PRs)
- Add trap for LABEL_MODIFIED_RESULT temp file cleanup in post-review.sh
- Add integration tests for label_actions processing in
  post-review-test.sh (10 cases covering: applied, control-label
  refused, nonexistent skipped, invalid chars refused, remove,
  multiple add, all-refused no body append, absent, request-changes)

Assisted-by: Claude claude-opus-4-6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
The test helpers intentionally export variables inside subshells for
isolation. Shellcheck flags these as accidental — disable the warnings.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
Sanitize LA_LABEL and LA_ACTION after jq -r extraction by stripping
newlines, carriage returns, and GHA workflow command delimiters (::).
This prevents command injection via crafted label names that embed
GHA workflow commands after a JSON-decoded newline.

Replace per-tempfile trap EXIT handlers with a CLEANUP_FILES array
and a single composed trap. Bash traps don't compose — the second
trap was silently replacing the first, leaking MODIFIED_RESULT when
both protected-path downgrade and label_actions processing fired.

Assisted-by: Claude claude-opus-4-6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
…-agent-labels

feat: review agent applies contextual labels via issue-labels skill (fullsend-ai#1706)
…script-diagnostic-errors

fix(fullsend-ai#2393): add diagnostic stderr output to post-script failure paths
When MergeChangeProposal gets a 409 "Head branch is out of date", call
GitHub's update-branch endpoint to sync the PR branch with the base,
wait briefly, then retry the merge. Up to 3 attempts before giving up.
Non-409 errors are still returned immediately.

Closes fullsend-ai#2432

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
@guyoron1

Copy link
Copy Markdown
Owner Author

/fs-qf

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 21, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 12:18 PM UTC · Completed 12:38 PM UTC
Commit: 1cf60b6 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 21, 2026

Copy link
Copy Markdown

Review

Findings

Medium

  • [scope-creep] — The PR title fix(#2432): retry merge on 409 after updating PR branch implies a targeted bug fix, but this is a bulk upstream synchronization containing 159 files with 15,837 additions and 2,261 deletions. While fork syncs are a standard workflow, the title should accurately reflect the scope. Consider retitling to chore: sync fork with upstream fullsend-ai/fullsend.

  • [commit-message-violation] — The fix: prefix is reserved for user-visible bug fixes per COMMITS.md. A bulk upstream sync should use chore:. If this fork uses GoReleaser for releases, the incorrect prefix would pollute the Bug Fixes section of release notes.

  • [architectural-coherence] — 159 files spanning forge abstraction, enrollment, CLI, vendor content, review/triage pipelines, and ADRs in a single PR prevents meaningful per-change review. For future syncs, consider history-preserving methods (e.g., git merge upstream/main) that maintain individual upstream commits.

  • [protected-path] — This PR modifies many protected paths: .github/ (workflows, scripts), AGENTS.md, CLAUDE.md (removed), .pre-commit-config.yaml, skills/, action.yml, images/, and internal/scaffold/fullsend-repo/{scripts,schemas,skills,harness,agents}/. Human approval is required for protected-path changes regardless of context. The post-review enforcement mechanism will ensure this.

  • [breaking-cli] action.yml — The status-token input is removed and replaced with mint-url. Consumer workflows in enrolled repositories that currently pass status-token: will have that input silently ignored by GitHub Actions. This is a breaking change — ensure all enrolled repos are updated as part of the upstream sync migration.

Low

Previous run

Review

Reason: stale-head

The review agent reviewed commit 8a8a5d7805758ad41db342e30a632c0e3d79de9f but the PR HEAD is now 4ae4cfa49160a4b16bbb5ad273e7b635b538ee8d. This review was discarded to avoid approving unreviewed code.

Previous run (2)

Review

Reason: stale-head

The review agent reviewed commit fd6cbd9373f64f45ad121e8e9be20146b3c2581a but the PR HEAD is now d5259f25b01d016466c2c2ccc3f1d2139acb63c7. This review was discarded to avoid approving unreviewed code.

@fullsend-ai-review

Copy link
Copy Markdown

/fs-review

…[skip ci]

- Restructured to Section I/II format with review checklists
- Added P0/P1/P2 priority classifications to all 9 scenarios
- Added Risks section (3 risks with mitigations)
- Added Test Strategy table with Y/N/NA classifications
- Clarified dual-PR relationship in Scope
- Removed standard tools from Test Environment

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@fullsend-ai-review

fullsend-ai-review Bot commented Jun 21, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 12:41 PM UTC · Completed 1:22 PM UTC
Commit: 1cf60b6 · View workflow run →

QualityFlow and others added 5 commits June 21, 2026 12:46
…[skip ci]

Resolved 5 major and 2 minor findings:
- Added patterns and code_structure fields to all 9 scenarios
- Removed related_prs from document_metadata (content policy)
- Added strings and errors to import list (code gen readiness)
- Added explicit cleanup steps for httptest scenarios

Score: 79 → 95 | Major findings: 5 → 0

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Generated 8 Go test functions from STD YAML covering MergeChangeProposal
retry-on-409 behavior: happy path, 409 retry, non-409 passthrough,
retry exhaustion, context cancellation, update-branch failure resilience,
and forge.Client interface compliance (LiveClient + FakeClient).
Replaces intermediate pipeline artifacts with organized test files.

Total: 2 test files → qf-tests/fullsend-aiGH-2432/
Jira: fullsend-aiGH-2432
[skip ci]
@github-actions

Copy link
Copy Markdown

QualityFlow Pipeline Summary

Stage Agent Status
1 STP Builder
2 STP Reviewer
3 STP Refiner
4 STD Builder
5 STD Reviewer
6 STD Refiner
7 Test Generator

Test Output

Language Count Location
Go 2 files qf-tests/GH-2432/go/

Issue: GH-2432


Generated by QualityFlow

@fullsend-ai-review

Copy link
Copy Markdown

/fs-review

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 21, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:25 PM UTC · Completed 1:40 PM UTC
Commit: 1cf60b6 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Jun 21, 2026
@guyoron1 guyoron1 closed this Jun 21, 2026
@guyoron1 guyoron1 deleted the mirror/2434-2432-merge-409-retry branch June 21, 2026 14:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

requires-manual-review Review requires human judgment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants