From acbf977311b1feffbc4d438b1ed5f175604b5fb8 Mon Sep 17 00:00:00 2001 From: "lightning-it-shared-assets-sync[bot]" <307342877+lightning-it-shared-assets-sync[bot]@users.noreply.github.com> Date: Sat, 22 Aug 2026 10:43:07 +0000 Subject: [PATCH] chore: sync repository quality assets Shared-Assets-Source-SHA: 2a07745e7717872d1ead88b1f56623ef39bff56c Shared-Assets-Source-Run: 32568334988 Shared-Assets-Source-Attempt: 1 Shared-Assets-Sync-App-ID: 4351516 --- .github/workflows/copilot-review-refresh.yml | 10 ++- .github/workflows/copilot-review.yml | 65 +++++++++++--------- .github/workflows/current-revision-rerun.yml | 5 +- 3 files changed, 43 insertions(+), 37 deletions(-) diff --git a/.github/workflows/copilot-review-refresh.yml b/.github/workflows/copilot-review-refresh.yml index fb0decc..edb6424 100644 --- a/.github/workflows/copilot-review-refresh.yml +++ b/.github/workflows/copilot-review-refresh.yml @@ -196,9 +196,8 @@ jobs: test("^mlx90-current-revision:managed-sync:v6:" + $pr + ":[1-9][0-9]*:" + $base + ":" + $head + "$"))) or - (($author == "lightning-it-release-automation[bot]" - or ($repository == "lightning-it/.github" - and $author == "lightning-it-shared-assets-sync[bot]")) + (($repository == "lightning-it/.github" + and $author == "lightning-it-shared-assets-sync[bot]") and ($check.external_id | test("^mlx90-current-revision:ancestry-backmerge:v6:" + $pr + ":[1-9][0-9]*:" + $base + ":" + $head + "$"))) @@ -214,9 +213,8 @@ jobs: test("^mlx90-current-revision:copilot:v5:[1-9][0-9]*:" + $base + ":" + $head + "$"))) or - (($author == "lightning-it-release-automation[bot]" - or ($repository == "lightning-it/.github" - and $author == "lightning-it-shared-assets-sync[bot]")) + (($repository == "lightning-it/.github" + and $author == "lightning-it-shared-assets-sync[bot]") and ($check.external_id | test("^mlx90-current-revision:ancestry-backmerge:v5:" + "[1-9][0-9]*:" + $base + ":" + $head + "$"))) diff --git a/.github/workflows/copilot-review.yml b/.github/workflows/copilot-review.yml index 9a631f2..3fe998c 100644 --- a/.github/workflows/copilot-review.yml +++ b/.github/workflows/copilot-review.yml @@ -200,24 +200,12 @@ jobs: github.event_name == 'pull_request_target' && github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.user.login != 'lightning-it-release-automation[bot]' && (github.event.action == 'edited' || - (((github.event.action == 'opened' || + github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened' || - github.event.action == 'ready_for_review') && - github.event.pull_request.user.login != 'lightning-it-release-automation[bot]') || - ((github.event.action == 'opened' || - github.event.action == 'synchronize' || - github.event.action == 'reopened' || - github.event.action == 'ready_for_review') && - github.event.pull_request.user.login == 'lightning-it-release-automation[bot]' && - github.event.pull_request.base.ref == 'develop' && - startsWith(github.event.pull_request.head.ref, 'backmerge/') && - endsWith(github.event.pull_request.head.ref, '-main') && - startsWith( - github.event.pull_request.title, - 'chore(governance): record main ancestry before ' - )))) + github.event.action == 'ready_for_review') # Serialize every producer for this PR. Different event actions may overlap # at workflow level so the one-time Copilot request is never cancelled, but # no two verifier jobs may invalidate or publish the neutral check at once. @@ -241,7 +229,7 @@ jobs: EVENT_BASE_REF: ${{ github.event.pull_request.base.ref }} EVENT_BODY: ${{ github.event.pull_request.body }} EVENT_TITLE: ${{ github.event.pull_request.title }} - EVENT_UPDATED_AT: ${{ github.event.pull_request.updated_at }} + EVENT_EDITED_AT: ${{ github.event.pull_request.updated_at }} GH_TOKEN: ${{ github.token }} HEAD_SHA: ${{ github.event.pull_request.head.sha }} HEAD_REF: ${{ github.event.pull_request.head.ref }} @@ -280,6 +268,34 @@ jobs: [[ "${BASE_SHA}" =~ ^[0-9a-f]{40}$ ]] [[ "${HEAD_SHA}" =~ ^[0-9a-f]{40}$ ]] [[ "${PR_NUMBER}" =~ ^[1-9][0-9]*$ ]] + # For an edited webhook, REST updated_at is the event's edit + # revision. Bind it to GraphQL lastEditedAt because unrelated + # comments and reviews may advance only the live REST updated_at. + [[ "${EVENT_EDITED_AT}" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]] + owner="${REPOSITORY%%/*}" + repository="${REPOSITORY#*/}" + read -r -d '' query <<'GRAPHQL' || true + query($owner: String!, $repository: String!, $number: Int!) { + repository(owner: $owner, name: $repository) { + pullRequest(number: $number) { + number + lastEditedAt + } + } + } + GRAPHQL + metadata="$(api_read graphql \ + -f query="${query}" \ + -F owner="${owner}" \ + -F repository="${repository}" \ + -F number="${PR_NUMBER}")" + jq -e \ + --arg edited_at "${EVENT_EDITED_AT}" \ + --argjson number "${PR_NUMBER}" ' + ((.errors // []) | length) == 0 + and .data.repository.pullRequest.number == $number + and .data.repository.pullRequest.lastEditedAt == $edited_at + ' <<<"${metadata}" >/dev/null pr="$(api_read "repos/${REPOSITORY}/pulls/${PR_NUMBER}")" jq -e \ --arg base_ref "${EVENT_BASE_REF}" \ @@ -288,11 +304,9 @@ jobs: --arg head_ref "${HEAD_REF}" \ --arg head_sha "${HEAD_SHA}" \ --arg repository "${REPOSITORY}" \ - --arg title "${EVENT_TITLE}" \ - --arg updated_at "${EVENT_UPDATED_AT}" ' + --arg title "${EVENT_TITLE}" ' .state == "open" and .draft == false - and .updated_at == $updated_at and .title == $title and (.body // "") == $body and .base.ref == $base_ref @@ -534,9 +548,8 @@ jobs: <<<"${live_pr}" >/dev/null; then trusted=true trusted_kind=repository-quality - elif { [ "${PR_AUTHOR}" = "lightning-it-release-automation[bot]" ] \ - || { [ "${REPOSITORY}" = "lightning-it/.github" ] \ - && [ "${PR_AUTHOR}" = "lightning-it-shared-assets-sync[bot]" ]; }; } \ + elif [ "${REPOSITORY}" = "lightning-it/.github" ] \ + && [ "${PR_AUTHOR}" = "lightning-it-shared-assets-sync[bot]" ] \ && [ "${PR_HEAD_REPO}" = "${REPOSITORY}" ] \ && [[ "${PR_HEAD}" == backmerge/*-main ]] \ && [ "${PR_BASE}" = "develop" ] \ @@ -1197,12 +1210,8 @@ jobs: external_kind="managed-sync" result_title="Current revision managed distribution exemption passed" elif [ "${TRUSTED_KIND}" = ancestry-backmerge ]; then - if [ "${author}" = 'lightning-it-release-automation[bot]' ]; then - : - else - test "${REPOSITORY}" = "lightning-it/.github" - test "${author}" = 'lightning-it-shared-assets-sync[bot]' - fi + test "${REPOSITORY}" = "lightning-it/.github" + test "${author}" = 'lightning-it-shared-assets-sync[bot]' test "${TRUSTED_KIND}" = ancestry-backmerge test "${base_ref}" = develop [[ "${EVENT_HEAD_REF}" == backmerge/*-main ]] diff --git a/.github/workflows/current-revision-rerun.yml b/.github/workflows/current-revision-rerun.yml index 24556a0..d631c33 100644 --- a/.github/workflows/current-revision-rerun.yml +++ b/.github/workflows/current-revision-rerun.yml @@ -178,9 +178,8 @@ jobs: ' <<<"${producer}" >/dev/null else if [ "${external_kind}" = ancestry-backmerge ]; then - test "${author}" = 'lightning-it-release-automation[bot]' \ - || { test "${REPOSITORY}" = 'lightning-it/.github' \ - && test "${author}" = 'lightning-it-shared-assets-sync[bot]'; } + test "${REPOSITORY}" = 'lightning-it/.github' + test "${author}" = 'lightning-it-shared-assets-sync[bot]' test "$(jq -r .review_path <<<"${neutral_summary}")" = \ 'deterministic evidence-bound ancestry exemption' elif [ "${external_kind}" = managed-sync ]; then