Skip to content

Make gated sync PRs mergeable: regenerate the caller changelog and dispatch its required CI #122

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
unbraind merged 6 commits into from
Oct 14, 2026
Merged

Make gated sync PRs mergeable: regenerate the caller changelog and dispatch its required CI #122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7f7ff43
fix: regenerate gated sync changelogs and dispatch caller CI
unbraind Oct 14, 2026
35d652b
fix: reject out-of-scope gated sync changes
unbraind Oct 14, 2026
5dfab16
Give the c8 coverage merge an 8 GiB heap
unbraind Oct 14, 2026
5658d6c
Merge remote-tracking branch 'origin/main' into fix/sync-pr-ci-and-ch…
unbraind Oct 14, 2026
d96a0e5
Run the heap-flag test against an isolated coverage fixture
unbraind Oct 14, 2026
1409880
Discard changelog drift when gated sync has no tracker changes
unbraind Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions .agents/pm/features/pm-github-wrmt.toon
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
id: pm-github-wrmt
title: Regenerate caller changelogs and dispatch required CI for gated sync PRs
description: "Make gated sync reviews independently mergeable with an overridable caller npm script, a final privacy scan including CHANGELOG.md, and explicit caller CI workflow dispatch after PR creation or update. Fleet adoption remains tracked by pm-github-aiok."
type: Feature
status: in_progress
priority: 2
tags[1]: changelog-unreleased
created_at: "2026-10-14T11:43:07.998Z"
updated_at: "2026-10-14T18:53:48.691Z"
author: codex-agent
comments[20]{created_at,author,text}:
"2026-10-14T11:43:26.402Z",codex-agent,"Measured fleet use: pm-gantt-chart#142 was blocked because bot PR workflows ended action_required and imported closed issues changed the generated changelog. Plan: run caller post-import command, stage CHANGELOG.md with tracker data, scan an explicit combined diff before health and publication, then dispatch configured caller workflows on the pushed branch. Test with real local git repositories and HTTP fixtures; record behavioural revert proofs. No duplicate feature found; fleet rollout is separate in pm-github-aiok."
"2026-10-14T11:48:40.689Z",codex-agent,"Implemented post-import-run and ci-workflows with documented defaults, actions: write, combined tracker/changelog diff scanning, dispatch after successful PR publication, and approval-required run URL notices. Typecheck, test compilation, lint, and generated changelog check pass. Initial linked whole-file run exceeded the runner default 120-second budget; link the focused workflow regressions with an explicit 900-second command budget. Required release gates retain unchanged thresholds and internal import deadlines."
"2026-10-14T11:53:36.296Z",codex-agent,"Focused workflow regressions: 4/4 pass, zero failures/cancellations/skips/todo. Behavioural revert proofs (workflow shell only, unchanged tests): removing the post-import execution fails the published changelog assertion (0/1 pass); excluding CHANGELOG.md from the explicit final diff fails because the secret-bearing local sync succeeds (0/1 pass); removing gh workflow run fails for missing dispatch receipts (0/1 pass). All changes restored. Fixtures use real git repositories, bare remotes, the packed candidate with the pinned host CLI, and local HTTP responses; no live GitHub test writes."
"2026-10-14T12:04:50.070Z",codex-agent,"The complete standalone workflow/import-gate suite passed 34/34 with zero failures, cancellations, skips, or todo, including the native Bun repeat-import deadlines. The final linked focused run (pm test pm-github-wrmt --run --progress) passed 4/4 with an explicit 900-second command budget and no failures/cancellations/skips/todo. Strict health with merge-driver verification passed; one pre-existing advisory covers four stale in-progress items. Full isolated npm and Bun release gates remain required before delivery."
"2026-10-14T12:21:35.364Z",codex-agent,"Initial isolated npm gate: 583/584 tests passed; the sole failure was the canonical publish-attestation auditor rejecting opaque Bash execution of a caller command. Keep that safety gate unchanged. Final input is post-import-script, default changelog:full, invoked through explicit npm run --if-present with a validated script name; callers override the npm script name or disable with an empty string. Updated fixtures use caller package scripts, including failing and secret-generating scripts. Typecheck, lint and attestation verification pass; repeat focused tests, revert proofs and both isolated release gates on this final design."
"2026-10-14T12:27:24.824Z",codex-agent,"Final named-script design: linked pm test run passed 5/5, with zero failures/cancellations/skips/todo. Four behavioural reverts with unchanged tests each failed (0/1, exit 1): remove npm script execution -> stale published changelog; exclude CHANGELOG.md from final diff -> synthetic secret reaches local push; remove gh workflow run -> missing dispatch receipts; remove script-name validation -> raw-command input succeeds. Restored all changes. Canonical attestation check passes without exceptions or threshold changes. Repeating both full release gates under isolated HOME, unset PM_PATH/PM_AUTHOR, and disabled global/system git config."
"2026-10-14T12:47:18.176Z",codex-agent,"Final isolated npm release:check passed (exit 0): 584/584 tests, zero failures/cancellations/skips/todo; full coverage gate passed at unchanged four 100-percent thresholds; source duplication zero; privacy, docstrings, typecheck, build, lint, production audit, pack, changelog check and canonical publish attestation all passed. Next gate is isolated bun run release:check on unchanged implementation."
"2026-10-14T13:10:16.298Z",codex-agent,"Final isolated bun run release:check passed (exit 0): 584/584 tests, zero failures/cancellations/skips/todo. Both npm and Bun measured 12 authored modules with 9584/9584 lines and statements, 234/234 functions, and 2557/2557 branches: exact 100/100/100/100, no skipped source. Both release gates passed typecheck, build, docstrings, lint, zero duplication, privacy, production audit (zero vulnerabilities), pack, changelog check and canonical attestation at unchanged thresholds. Final linked workflow regressions passed 5/5; all four behavioural reverts failed as expected. Delivery is the fix/sync-pr-ci-and-changelog review branch; callers must repin the workflow and package release, grant actions: write and expose matching required checks via workflow_dispatch. Release the claim without closing this Feature; the orchestrator verifies and closes it."
"2026-10-14T13:47:16.164Z",codex-agent,"CodeRabbit round 1: confirmed fail-open publication when caller post-import scripts change paths outside the final privacy scan. Plan: explicit tracker and CHANGELOG.md scope, complete NUL-delimited status checks after post-import and immediately before commit, exact commit diff rescanning, restricted commit pathspec, and real Git adversarial tests with a behavioural revert proof."
"2026-10-14T13:58:52.217Z",codex-agent,"Implemented SDK-resolved scope, complete NUL-delimited status enumeration including rename sources, exact file-list staging and privacy rescanning, and commit --only with literal NUL pathspecs. The allowlist and setup-file restoration policy are documented in README.md. Added six caller-scope cases, five late-change cases, and an independent commit-pathspec bypass control using real Git repositories and local bare remotes. Caller fixture dependency and runtime ignores now match normal package checkouts."
"2026-10-14T14:04:37.784Z",codex-agent,"Positive workflow controls passed 3/3: clean tracker plus changelog publication and repeat update; install-only settings never committed; restricted commit excludes unrelated staged content when scope checks are bypassed. Scope-only behavioural revert in an isolated checkout failed the unchanged regression (0/1, exit 1): the staged-extra caller returned success and pushed a sync branch. The explicit commit pathspec independently prevented the extra file from being included. Running a second revert to reproduce the original unrestricted-commit leak; full isolated release gates and linked regressions remain in progress."
"2026-10-14T14:07:36.027Z",codex-agent,"Second behavioural revert confirmed the original leak: keeping the unchanged bypass-control test and restoring the unrestricted git commit failed (0/1, exit 1) because git cat-file found extra.txt on the bare remote sync branch (status 0 instead of expected 128). Scope-only revert also pushed a sync branch and failed its unchanged no-publication regression. Both safeguards and tests remain restored in the package worktree; only an isolated proof checkout was mutated."
"2026-10-14T14:19:52.798Z",codex-agent,"Final linked regression run passed 4/4 with zero failures, cancellations, skips or todo: six caller out-of-scope cases each failed closed with no remote change, five late-change cases each blocked publication, clean tracker plus changelog publication and repeat update passed, and restricted commit excluded unrelated staged data when checks were bypassed. Exact command: node --test --test-name-pattern=\"caller post-import changes|publication rechecks|restricted commit|pushes only a clean\" test/import-gate.test.ts. Ran via pm test pm-github-wrmt --run --only-last --progress with the linked 1800-second budget. Automatic test-result recording is disabled by repository policy; this comment preserves the verified result without changing that policy."
"2026-10-14T14:30:05.372Z",codex-agent,"Initial isolated npm release:check completed all 587/587 tests with zero failures/cancellations/skips/todo, then failed during c8 coverage aggregation at Node's default 4 GiB heap. No release gate is claimed passed from that attempt. Re-run both complete release commands with NODE_OPTIONS=--max-old-space-size=12288, preserving identity isolation, source inventory and all four 100-percent coverage thresholds. Linked regressions and both behavioural revert proofs already passed."
"2026-10-14T14:33:41.625Z",codex-agent,"Default-heap coverage aggregation follow-up is pm-github-vhi6 (open, no implementation changes in this security fix). The initial full test suite passed 587/587 before c8 ran out of heap; complete npm and Bun release gates are being rerun with a larger process heap and unchanged identity isolation, source scope and thresholds."
"2026-10-14T15:04:26.288Z",codex-agent,"Final acceptance: complete npm run release:check and bun run release:check each passed (exit 0), 587/587 tests with zero failures/cancellations/skips/todo. Both used env -u PM_PATH -u PM_AUTHOR, fresh HOME, GIT_CONFIG_GLOBAL=/dev/null, GIT_CONFIG_NOSYSTEM=1, plus NODE_OPTIONS=--max-old-space-size=12288 after the documented default-heap aggregation failure. All 11 release checks passed at unchanged thresholds: typecheck, build, docstrings, lint, duplication, privacy, coverage, production audit, pack, changelog and attestation. Exact coverage: 12 authored modules, 9584/9584 lines and statements, 234/234 functions, 2557/2557 branches; no skipped source. Both stored linked commands passed via pm test pm-github-wrmt --run --progress with the pinned CLI on PATH: 5/5 and 4/4 test executions, zero failures/cancellations/skips/todo. Both isolated behavioural reverts failed as expected (0/1 each): removing scope checks pushed a sync branch; restoring unrestricted commit published extra.txt. Existing history is preserved; default-heap/CI resource acceptance remains open in pm-github-vhi6. No thread replies, bot commands, release or merge."
"2026-10-14T18:25:45.155Z",codex-agent,"Round 3: a no-op gated import must discard regenerated CHANGELOG.md drift, emit a notice that the caller changelog:check owns it, close an owned open sync PR, and exit successfully. Add real-git pipeline regressions for stale changelog no-op and tracker-plus-changelog publication, then prove the old behavior fails and run isolated npm and Bun release gates."
"2026-10-14T18:29:30.272Z",codex-agent,"Implemented tracker-only no-op detection before publication. Regenerated changelog drift is restored from HEAD (or removed when absent from HEAD), a notice delegates drift to caller changelog:check, and the existing owned-PR closure exits successfully. Focused direct and pinned pm linked runs each passed 6/6 tests, zero failures/cancellations/skips/todo, including stale and newly generated changelogs, clean checkout, no push/dispatch, own/fork PR handling, and tracker-plus-changelog publication. Behavioural revert: restored only the workflow to its previous implementation, retaining the new tests; the stale-changelog regression failed 0/1, exit 1, with the original no-item-link error. Fixed workflow restored. Run complete npm and Bun release gates with identity isolation and unchanged thresholds."
"2026-10-14T18:53:20.471Z",codex-agent,"Final round-3 acceptance: env -u PM_PATH -u PM_AUTHOR HOME=$(mktemp -d) GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 npm run release:check and the same isolated prefix with bun run release:check each passed exit 0: all 11 checks, 590/590 tests, zero failures/cancellations/skips/todo. Exact coverage across 12 authored modules: 9592/9592 lines and statements, 234/234 functions, 2557/2557 branches, no skipped source. Production audit: zero vulnerabilities; source duplication: zero. No added NODE_OPTIONS override. Focused direct test and pm test pm-github-wrmt --run --only-last --progress each passed 6/6; the linked command is stored on this item. Reverting only the workflow reproduced the stale-changelog failure (0/1, exit 1, original no-item-link error); fix restored. Changelog drift is restored or removed on no-op with a notice; owned stale PR closure is preserved; tracker-plus-changelog publication remains passing. README documents ownership by caller changelog:check. No out-of-scope defect or PM CLI bug found. Leave item in progress and release claim for orchestrator verification; no review replies, bot commands, release or merge."
"2026-10-14T18:53:48.691Z",codex-agent,"Final post-write changelog regeneration and changelog:check passed; output was unchanged. Strict pm health with required merge drivers passed exit 0, with the existing stale-in-progress advisory only. History changes are append-only. Claim is released and item remains in_progress for orchestrator verification. Commit the explicit workflow, regression test, README and paired tracker item/history paths as SteveBot, then audit the committed Git objects and push the existing PR branch."
files[2]{path,scope}:
.github/workflows/pm-github-sync.yml,project
test/import-gate.test.ts,project
tests[3]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,source_ref}}:
"node --test --test-name-pattern=\"the executable reusable workflow pushes only a clean|post-import changelog findings|post-import script can|dispatch handles|workflow input shell diagnoses\" test/import-gate.test.ts",project,900,codex-agent,"2026-10-14T12:21:43.966Z",local_mutation,fix/sync-pr-ci-and-changelog
"node --test --test-name-pattern=\"caller post-import changes|publication rechecks|restricted commit|pushes only a clean\" test/import-gate.test.ts",project,1800,codex-agent,"2026-10-14T13:58:56.773Z",local_mutation,fix/sync-pr-ci-and-changelog
"node --test --test-name-pattern=\"no-op import discards|pushes only a clean import|no-change run|install-only settings\" test/import-gate.test.ts",project,600,codex-agent,"2026-10-14T18:27:01.453Z",local_mutation,fix/sync-pr-ci-and-changelog
docs[3]{path,scope}:
CHANGELOG.md,project
docs/sync-workflow-caller.yml,project
README.md,project
body: ""
Loading
Loading