fixup! tools: prefilter commit queue metadata

Author: panva

.github/workflows/commit-queue.yml

@@ -22,13 +22,13 @@ permissions:
   contents: read
 
 jobs:
-  get_mergeable_prs:
+  get_candidate_prs:
     permissions:
       pull-requests: read
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     outputs:
-      numbers: ${{ steps.get_mergeable_prs.outputs.numbers }}
+      candidates: ${{ steps.get_candidate_prs.outputs.candidates }}
     steps:
       - name: Get Pull Request Candidates
         id: get_candidate_prs
@@ -55,36 +55,48 @@ jobs:
           echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
+  commitQueue:
+    needs: get_candidate_prs
+    if: needs.get_candidate_prs.outputs.candidates != ''
+    runs-on: ubuntu-slim
+    steps:
+      # Install dependencies
       - name: Install Node.js
-        if: steps.get_candidate_prs.outputs.candidates != ''
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Install @node-core/utils
-        if: steps.get_candidate_prs.outputs.candidates != ''
         run: npm install -g @node-core/utils
 
+      - name: Set variables
+        run: |
+          echo "REPOSITORY=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)" >> "$GITHUB_ENV"
+
+      - name: Configure @node-core/utils
+        run: |
+          ncu-config set branch "${GITHUB_REF_NAME}"
+          ncu-config set upstream origin
+          ncu-config set username "$USERNAME"
+          ncu-config set token "$GITHUB_TOKEN"
+          ncu-config set jenkins_token "$JENKINS_TOKEN"
+          ncu-config set repo "${REPOSITORY}"
+          ncu-config set owner "${GITHUB_REPOSITORY_OWNER}"
+        env:
+          USERNAME: ${{ secrets.JENKINS_USER }}
+          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
+
       - name: Filter Pull Requests
-        if: steps.get_candidate_prs.outputs.candidates != ''
         id: get_mergeable_prs
         run: |
           fail_selector() {
             echo "$1"
             exit 1
           }
 
-          repository="${GITHUB_REPOSITORY#*/}"
           readme="${RUNNER_TEMP}/README.md"
           readme_base64="${RUNNER_TEMP}/README.md.base64"
 
-          ncu-config set branch "${GITHUB_REF_NAME}"
-          ncu-config set username "$USERNAME"
-          ncu-config set token "$GITHUB_TOKEN"
-          ncu-config set jenkins_token "$JENKINS_TOKEN"
-          ncu-config set repo "$repository"
-          ncu-config set owner "${GITHUB_REPOSITORY_OWNER}"
-
           if ! gh api "repos/${GITHUB_REPOSITORY}/contents/README.md?ref=${GITHUB_REF_NAME}" \
                   --jq '.content' > "$readme_base64"; then
             fail_selector "failed to download README.md"
@@ -101,7 +113,7 @@ jobs:
             output="${RUNNER_TEMP}/metadata-${pr}.txt"
             if git node metadata "$pr" \
                     --owner "$GITHUB_REPOSITORY_OWNER" \
-                    --repo "$repository" \
+                    --repo "$REPOSITORY" \
                     --readme "$readme" \
                     --json > "$metadata" 2> "$output"; then
               metadata_status=0
@@ -148,50 +160,20 @@ jobs:
           numbers=$(echo "$numbers" | xargs)
           echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
         env:
-          CANDIDATES: ${{ steps.get_candidate_prs.outputs.candidates }}
-          USERNAME: ${{ secrets.JENKINS_USER }}
+          CANDIDATES: ${{ needs.get_candidate_prs.outputs.candidates }}
           GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
-          JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
-  commitQueue:
-    needs: get_mergeable_prs
-    if: needs.get_mergeable_prs.outputs.numbers != ''
-    runs-on: ubuntu-slim
-    steps:
+
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        if: steps.get_mergeable_prs.outputs.numbers != ''
         with:
           # A personal token is required because pushing with GITHUB_TOKEN will
           # prevent commits from running CI after they land. It needs
           # to be set here because `checkout` configures GitHub authentication
           # for push as well.
           token: ${{ secrets.GH_USER_TOKEN }}
 
-      # Install dependencies
-      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-      - name: Install @node-core/utils
-        run: npm install -g @node-core/utils
-
-      - name: Set variables
-        run: |
-          echo "REPOSITORY=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)" >> "$GITHUB_ENV"
-
-      - name: Configure @node-core/utils
-        run: |
-          ncu-config set branch "${GITHUB_REF_NAME}"
-          ncu-config set upstream origin
-          ncu-config set username "$USERNAME"
-          ncu-config set token "$GITHUB_TOKEN"
-          ncu-config set jenkins_token "$JENKINS_TOKEN"
-          ncu-config set repo "${REPOSITORY}"
-          ncu-config set owner "${GITHUB_REPOSITORY_OWNER}"
-        env:
-          USERNAME: ${{ secrets.JENKINS_USER }}
-          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
-          JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
-
       - name: Start the Commit Queue
-        run: ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ needs.get_mergeable_prs.outputs.numbers }}
+        if: steps.get_mergeable_prs.outputs.numbers != ''
+        run: ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ steps.get_mergeable_prs.outputs.numbers }}
         env:
           GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}

doc/contributing/commit-queue.md

@@ -27,8 +27,8 @@ From a high-level, the Commit Queue works as follows:
    workflow uses a five-minute cron, but GitHub Actions scheduled workflows are
    not guaranteed to run exactly every five minutes. For each candidate, the
    queue will:
-   1. Run a metadata-only readiness check that uses `@node-core/utils` without
-      checking out the repository
+   1. In the landing job, install and configure `@node-core/utils`, then run a
+      metadata-only readiness check without checking out the repository
    2. If the metadata check exits with a deferrable readiness code, meaning
       the PR is only blocked on wait time, keep the `commit-queue` label and
       skip this PR until a later queue run
@@ -93,20 +93,20 @@ reasons:
    commit, meaning we wouldn't be able to use it for already opened PRs
    without rebasing them first.
 
-`@node-core/utils` is configured with a personal token and a Jenkins token from
-[@nodejs-github-bot](https://github.com/nodejs/github-bot). The workflow starts
-with a small selector step that uses GitHub CLI to fetch pull requests with the
-`commit-queue` label. It first fetches the same age-based and fast-track buckets
-the queue used before accepting early queue requests, then fetches the broader
-queue and de-duplicates the result. This keeps not-yet-ready PRs from crowding
-out PRs that the previous query would have selected if GitHub paginates or caps
-a query result.
-
-If there are candidate PRs, the selector installs `@node-core/utils`, downloads
-the target branch's README without checking out the repository, and runs
+The workflow starts with a small candidate job that uses GitHub CLI to fetch
+pull requests with the `commit-queue` label. It first fetches the same
+age-based and fast-track buckets the queue used before accepting early queue
+requests, then fetches the broader queue and de-duplicates the result. This
+keeps not-yet-ready PRs from crowding out PRs that the previous query would
+have selected if GitHub paginates or caps a query result.
+
+If there are candidate PRs, the landing job installs and configures
+`@node-core/utils` once with a personal token and a Jenkins token from
+[@nodejs-github-bot](https://github.com/nodejs/github-bot). It then downloads
+the target branch's README without checking out the repository and runs
 `git node metadata --readme --json` for each candidate. This uses the same
 `@node-core/utils` PR readiness checks as `git node land`, but does not clone,
-fetch, or merge the PR. The selector consumes the structured metadata result
+fetch, or merge the PR. The filter consumes the structured metadata result
 and its exit code instead of matching human-readable output:
 
 * exit code `0`: the PR is ready and is passed to
@@ -119,12 +119,13 @@ and its exit code instead of matching human-readable output:
 
 The `20`-`29` exit code range is reserved by `@node-core/utils` for deferrable
 metadata readiness states, and `40`-`49` is reserved for hard metadata failure
-states. Unknown selector failures fail the workflow before starting the landing
-job and leave PR labels unchanged so the queue can retry on a later scheduled
-run. PRs passed through with exit code `40`-`49` continue through
-`commit-queue.sh`. The script still applies its existing `request-ci` and
-pending-check deferrals before removing the queue label and reporting a hard
-failure.
+states. Unknown filter failures fail the workflow before starting the landing
+script and leave PR labels unchanged so the queue can retry on a later
+scheduled run. PRs passed through with exit code `40`-`49` continue through
+`commit-queue.sh`. The workflow checks out the repository only when at least
+one PR remains after filtering. The script still applies its existing
+`request-ci` and pending-check deferrals before removing the queue label and
+reporting a hard failure.
 
 > The personal token needs permission for public repositories and to read
 > profiles. It is used by `@node-core/utils` and by the landing job for
@@ -146,18 +147,18 @@ done here since `git node land` will fail if the last CI failed.
 The script removes the `commit-queue` label, then runs `git node land`,
 forwarding stdout and stderr to a file. PRs that are only blocked on wait time
 should have already been filtered by the metadata check. If a hard readiness
-failure appears between the selector job and `git node land`, the landing job
-adds a `commit-queue-failed` label to the PR, leaves a comment with the output
-of `git node land`, and then aborts the landing session. If the abort fails,
-the queue stops instead of continuing in an unknown state.
-
-Fast-tracked PRs use the metadata check before the landing job. If the
-fast-track request has not yet received enough collaborator thumbs-up, the queue
-keeps the `commit-queue` label and retries until either the fast-track request
-is approved or the PR becomes landable through the regular wait-time rules. The
-commit queue does not create the fast-track request comment; that is handled
-when the `fast-track` label is added. If that comment is missing, the queue
-reports the failure instead of keeping the PR queued.
+failure appears between the metadata filter and `git node land`, the landing
+job adds a `commit-queue-failed` label to the PR, leaves a comment with the
+output of `git node land`, and then aborts the landing session. If the abort
+fails, the queue stops instead of continuing in an unknown state.
+
+Fast-tracked PRs use the metadata check before checkout and the landing script.
+If the fast-track request has not yet received enough collaborator thumbs-up,
+the queue keeps the `commit-queue` label and retries until either the
+fast-track request is approved or the PR becomes landable through the regular
+wait-time rules. The commit queue does not create the fast-track request
+comment; that is handled when the `fast-track` label is added. If that comment
+is missing, the queue reports the failure instead of keeping the PR queued.
 
 If no errors happen during `git node land`, the script either pushes the direct
 rebase landing to `main` or uses GitHub's squash merge API for single-commit and