Repository navigation
ci(spec-sync): stop silent failures, skip re-push to existing bot branch, report results to issue - #12
Merged
Conversation
…nch; report to issue - Open/update draft PR: fail the step on non-zero git/gh exits ($PSNativeCommandUseErrorActionPreference). Previously a rejected push was swallowed and the run stayed green. - Do not re-push an existing spec-sync/update-<sha8> branch: checkout has no tracking ref, so --force-with-lease was always rejected as stale, and overwriting would drop reviewer fixups. Same SHA regenerates deterministically; the skip is noted in the PR body. - PR body: run URL, note that GITHUB_TOKEN PRs do not trigger ci.yml, "Closes #<tracking issue>". - New step: comment build/test/PR results (or the lack of a PR) on the tracking issue, even when the PR step fails. - New final step: fail the run when the regenerated client does not build or pass tests (previously only visible in the PR body). - ci.yml: pin permissions to contents: read. - Docs: design section 9 and CLAUDE.md describe the prerequisites/behaviour. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…env passing) - Do not reopen a spec-sync PR that was closed without merging for the same upstream SHA (avoids weekly re-creation); say so on the issue. - Report step: include the regenerate outcome, distinguish closed-PR / regeneration-failed / other no-PR causes; run on !cancelled(); pass step outputs through env instead of expanding them into the script. - Validate the upstream SHA format before emitting it. - Close-on-sync step: fail on gh errors like the other steps. - PR body: note that build/test results are from this run when the existing branch was not re-pushed. - ci.yml: persist-credentials: false on read-only checkouts. - Docs: design section 9 (closed-PR behaviour); gate record. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens
.github/workflows/spec-sync.ymlafter the first real drift (#10 / #11) exposed silent failures.Why
--force-with-leaseon a checkout with no tracking ref. If the bot branch already exists (the next weekly run before chore(spec-sync): update specs to fa5577c9 and regenerate #11 merges, or a re-run), the push is rejected as stale. pwsh ignores the non-zero exit, so the run stays green while the push fails.What
$PSNativeCommandUseErrorActionPreference). Only the probes whose non-zero exit is the answer are exempt.spec-sync/update-<sha8>branch. Regeneration for the same SHA gives the same output, and skipping the push keeps reviewer fixups. The PR body says the push was skipped.!cancelled()). The comment says why no PR was opened when there is none.GITHUB_TOKENPRs do not triggerci.yml, andCloses #<issue>.env:.ci.yml:permissions: contents: read, pluspersist-credentials: falseon checkout.Gate
security / test-arch / code: all PASS, no blocking. Record:
docs/reviews/2026-10-07-spec-sync-hardening-review.md. The non-blocking follow-ups are applied inaf5796c.Not run end-to-end yet. It will be verified on the next drift or via
workflow_dispatch.Related: #11 contains the
generate.ps1refDatefix. Merge #11 first. Merging this before the next scheduled run (Mon 05:23 UTC) is also recommended.🤖 Generated with Claude Code