From 448f798cc392aa405c5c5ea4b9da0837ec21315b Mon Sep 17 00:00:00 2001
From: Guy Korland <gkorland@gmail.com>
Date: Thu, 13 Aug 2026 14:05:59 +0300
Subject: [PATCH] fix(ci): harden the tracking-issue fallback in the shared
 reporter

Review of the rollout PRs raised two problems with the issue fallback, both
inherited from the copies this workflow replaced:

- The issue title was spliced into the `--jq` program, so a title containing a
  double quote broke the filter. Match it through the environment instead.
- Deduplication went through `gh issue list --search`, but the search index is
  only eventually consistent: two failures in quick succession each opened
  their own issue. Verified by running the workflow twice in a row, which
  produced duplicate issues. Filter by a `nightly-edge-failure` label instead,
  which goes through the GraphQL listing and sees the issue immediately.

Also document pinning callers to a commit SHA and passing the webhook secret
explicitly rather than `secrets: inherit`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../workflows/report-scheduled-failure.yml    | 26 +++++++++++++++----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/report-scheduled-failure.yml b/.github/workflows/report-scheduled-failure.yml
index 296bc6f..cc231f3 100644
--- a/.github/workflows/report-scheduled-failure.yml
+++ b/.github/workflows/report-scheduled-failure.yml
@@ -14,8 +14,14 @@
 #     if: ${{ always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure') }}
 #     permissions:
 #       issues: write  # required: a called workflow can only downgrade permissions
-#     uses: FalkorDB/.github/.github/workflows/report-scheduled-failure.yml@main
-#     secrets: inherit
+#     uses: FalkorDB/.github/.github/workflows/report-scheduled-failure.yml@<full commit sha>
+#     secrets:
+#       DRIVERS_GOOGLE_CHAT_WEBHOOK_URL: ${{ secrets.DRIVERS_GOOGLE_CHAT_WEBHOOK_URL }}
+#
+# Pin to a full commit SHA rather than a branch: `secrets: inherit` and mutable
+# refs together would let any later change here run with the caller's secrets.
+# Dependabot's github-actions ecosystem updates `jobs.<id>.uses` pins, so the
+# clients still get changes made here without hand-editing eight workflows.
 #
 # The `github` context always belongs to the caller, so the repository, workflow
 # name and run URL below are the calling repo's without being passed in.
@@ -71,6 +77,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
           TITLE: ${{ inputs.issue-title }}
+          LABEL: nightly-edge-failure
         run: |
           body=$(printf '%s\n' \
             "The daily \`$WORKFLOW\` run against \`falkordb/falkordb:edge\` failed." \
@@ -78,10 +85,19 @@ jobs:
             "$RUN_URL" \
             "" \
             "Set the \`DRIVERS_GOOGLE_CHAT_WEBHOOK_URL\` secret to receive this in Google Chat instead.")
-          number=$(gh issue list --state open --search "$TITLE in:title" --json number,title \
-            --jq "map(select(.title == \"$TITLE\")) | .[0].number // empty")
+          gh label create "$LABEL" --force \
+            --color d93f0b --description "Nightly CI run against falkordb/falkordb:edge is failing"
+          # Find the issue by label rather than `--search`: the search index is
+          # only eventually consistent, so two failures in quick succession
+          # would each open their own issue. Label filtering goes through the
+          # GraphQL listing instead and sees the issue immediately.
+          #
+          # The title is matched via the environment rather than spliced into
+          # the jq program, which a title containing a quote would break.
+          number=$(gh issue list --state open --label "$LABEL" --limit 100 \
+            --json number,title --jq 'map(select(.title == env.TITLE)) | .[0].number // empty')
           if [ -n "$number" ]; then
             gh issue comment "$number" --body "$body"
           else
-            gh issue create --title "$TITLE" --body "$body"
+            gh issue create --title "$TITLE" --body "$body" --label "$LABEL"
           fi