From c543d8ea2de22c788edbef15e2ade683a973ffb4 Mon Sep 17 00:00:00 2001 From: Patrick Ryan Date: Sun, 4 Oct 2026 00:12:46 -0500 Subject: [PATCH 1/2] merge-bot: require policy-ci green before fast-forward --- .github/workflows/merge-bot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/merge-bot.yml b/.github/workflows/merge-bot.yml index 6f91c2c..2fdfe42 100644 --- a/.github/workflows/merge-bot.yml +++ b/.github/workflows/merge-bot.yml @@ -143,7 +143,7 @@ jobs: # not success is a hard fail. Timeout fails closed. for i in $(seq 1 20); do ok=1 - for name in "CodeQL" "Analyze (actions)" "Analyze (python)"; do + for name in "CodeQL" "Analyze (actions)" "Analyze (python)" "policy-ci"; do c=$(gh api "repos/$GITHUB_REPOSITORY/commits/$HEAD_SHA/check-runs?per_page=100" \ --jq "[.check_runs[] | select(.name == \"$name\")] | sort_by(.started_at) | last | if . == null or .status != \"completed\" then \"none\" else .conclusion // \"none\" end") echo "attempt $i: $name: $c" From 8d60876b9d6bb638bbd5ba630633129e6e4c8af5 Mon Sep 17 00:00:00 2001 From: Patrick Ryan Date: Sun, 4 Oct 2026 01:20:23 -0500 Subject: [PATCH 2/2] release: gate accepts dispatch builds from main --- .github/workflows/release.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 34f9541..38d7d85 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -52,9 +52,9 @@ jobs: run: | set -euo pipefail id="$(gh run list --repo "$GITHUB_REPOSITORY" --workflow build-environment-image.yml \ - --commit "$GITHUB_SHA" --status success --event push \ - --json databaseId,headBranch \ - --jq '[.[] | select(.headBranch == "main")] | .[0].databaseId // empty')" + --commit "$GITHUB_SHA" --status success \ + --json databaseId,headBranch,event \ + --jq '[.[] | select(.headBranch == "main" and (.event == "push" or .event == "workflow_dispatch"))] | .[0].databaseId // empty')" if [ -z "$id" ]; then echo "::error::no successful build-environment-image run on main for $GITHUB_SHA. Tag the commit that built the image." exit 1