Repository navigation
fix(ci): distinct commit status name for head SHA guard (SEL-454) - #3540
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 145db25e-d742-4ff9-abf5-50b1b11d57a0) |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes.
|
PR Blocker ChecklistHead SHA: Status: Ready
|
|
Review request for Grok: please review at head |
PetrefiedThunder
left a comment
There was a problem hiding this comment.
REVIEW: PASS grok 3885a52
Follow-up to my nit on #3515 (93b2cf5): the job's check run and its commit status shared the name "Head SHA Check Guard" and could show different states.
Fixed: all five createCommitStatus calls now use "Head SHA Check Guard / status", and the job check run keeps its name. Nothing else in the repo reads the old status context. The required contexts (CI Status Gate, PR Gate: Backend, Frontend and Workflow Contract) don't include either name, so it can't deadlock.
Nit: the earlier commit statuses named "Head SHA Check Guard" on old SHAs stay as they are. That's harmless.
CI at head: red, but the failures I checked are not from this PR. PR Gate: Workflow Contract fails on workflows already on main that are missing from scripts/workflow_inventory.txt (vercel-preview-guard, visual-preview, visual-production, visual-update-baselines); #3526 fails the same way, so it is pre-existing. CI Status Gate and Head SHA Check Guard fail because of it. Engine Review Pass is red because no non-author PASS exists at head yet. Commit Message Check, Secrets, Semgrep, tool pinning and Vercel are red on the other open PRs too. The branch is up to date with main. Local: YAML parses and actionlint is clean. It adds no sample or made-up data.
Disclosure: review written by Grok (headless Grok Build) and posted with C.Lee's approval on Oct 23, 2026 ("Yes, post all four").
Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com>
|
REVIEW: PASS codex 3885a52 This PR only renames the commit-status context in head-sha-check-guard.yml from 'Head SHA Check Guard' to 'Head SHA Check Guard / status', at all five createCommitStatus sites (moved, success, failure, pending). Before this, the status had the same name as the job's check run, so they could be confused. Branch protection on main requires CI Status Gate, PR Gate: Backend, PR Gate: Frontend and PR Gate: Workflow Contract, so nothing requires the old name, and nothing else in the repo matches on it. Note: this branch is behind main, and its red checks (Workflow Contract, Pinned supply chain, etc.) are the old-main failures fixed by #3552. Merge main in before landing, and that will need a fresh review on the new head. |
|
REVIEW: PASS codex d28807b This replaces my earlier comment on 3885a52: the head moved while I was posting. d28807b only merges origin/main (658bc7f, #3552) into the branch. Compared with main, the diff is still just the 5 renames to the 'Head SHA Check Guard / status' context, and my earlier findings still hold. The branch is now up to date with main. |
PetrefiedThunder
left a comment
There was a problem hiding this comment.
REVIEW: PASS muse d28807b
Full review. Diff is one file, .github/workflows/head-sha-check-guard.yml (+5/-5): all five createCommitStatus calls (failure x3, success, pending) change context from 'Head SHA Check Guard' to 'Head SHA Check Guard / status', so the commit status no longer collides with the workflow's own check-run name. No other references to the old context string in the repo (code search). main's required status checks (CI Status Gate, PR Gate: Backend/Frontend/Workflow Contract) don't reference this context, so the rename can't orphan a required check. No data added.
CI at review time: the renamed status already reports as 'Head SHA Check Guard / status' (pending on gates). Failing: Engine Review Pass (ran before this review) and the shared PR Blocker Checklist failure, both outside the diff; many gates still pending.
Branch updated with mainMain was merged into Because merge commits created with GITHUB_TOKEN do not trigger workflows, a push to this branch or a manual CI re-run is needed for checks to run on it. Last synced: 2026-10-24T02:11:25.027Z |
PetrefiedThunder
left a comment
There was a problem hiding this comment.
Delta review: since the last PASS, the only change is a clean sync merge of main with no manual conflict resolution.
REVIEW: PASS pi c2d45de
Signed-off-by: Christopher Sellers <1@christophersellers.com>
PetrefiedThunder
left a comment
There was a problem hiding this comment.
Reviewed diff of .github/workflows/head-sha-check-guard.yml. Renames the commit-status context to Head SHA Check Guard / status at all 5 createCommitStatus sites (head moved x2, success, failure, pending), so it no longer collides with the job check run name. There are no remaining references to the old status context in the workflow. The self-trigger guard keys on the workflow name, which is unchanged. The old context is not in main branch protection or rulesets, so nothing breaks. actionlint clean. Permissions and pinned actions are unchanged, and there is no new expression interpolation. No data changes.
Non-blocking: PRs that already carry the old Head SHA Check Guard status will keep it as a stale entry until they get new commits.
REVIEW: PASS pi 6d891ff
Follow-up to #3515 (merged). Grok's nit: the job check run and the commit status were both named Head SHA Check Guard and could show different states. The commit status context is now 'Head SHA Check Guard / status', so that context can be made required without ambiguity. Not added to required checks here.
No sample or made up data. Local: actionlint clean, node --check passes.
Note
Low Risk
CI-only rename of commit status context strings; guard behavior is unchanged aside from how the status appears in GitHub.
Overview
Renames the GitHub commit status context posted by the Head SHA Check Guard workflow from
Head SHA Check GuardtoHead SHA Check Guard / statuseverywherecreateCommitStatusruns (head moved, success, failure, and pending outcomes).This separates the commit status from the workflow job/check run name so branch protection or required checks can target the status context without colliding with the job’s own check name or showing conflicting states.
Reviewed by Cursor Bugbot for commit d28807b. Bugbot is set up for automated code reviews on this repo. Configure here.