feat: automated dry-run gate on every PR#11
Merged
nbrieussel merged 5 commits intomainfrom Apr 14, 2026
Merged
Conversation
|
Author
ValidationType de changement : nouveau workflow CI déclenché par Analyse du code :
Un TODO post-merge : aligner Verdict : |
Remove 80 lines of embedded github-script JS: upsert comment logic, known-bug detection, repo name extraction. Replace with two plain bash steps: run NOP with tee, grep for "There are changes for branch" and fail if found. Output is visible directly in Actions logs. Also drop pull-requests: write permission (no PR comment posted). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
nbrieussel
force-pushed
the
feat/pr-dry-run-gate
branch
from
aa0adf7 to
5e609d3
Compare
- "Run dry-run" keeps set -o pipefail: npm crash = job fails (desired) - "Report config changes" gets if: always() + continue-on-error: true: runs even after a crash, but finding diffs does not block the PR - warning annotation surfaces detected changes without blocking merge Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Without pipefail, tee's exit code (always 0) wins — npm crashing with the known check_suite NOP bug no longer fails the step. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
NOPCOMMAND lines contain the actual diff (existing vs expected state) and are logged just before "There are changes for branch". A single grep -E alternation surfaces both without added complexity. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…" line The change details (JSON diff + description) are logged on the 2 lines immediately after "There are changes for branch", not before it. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
.github/workflows/pr-dry-run.yml— a required-status-check-ready gate that runs safe-settings in NOP (dry-run) mode on every PR targetingmainand posts a summary comment.Gate logic
check_suitebugThe check only fails hard on a real unexpected error. Intentional diffs (e.g. a PR that modifies
settings.yml) remain visible via the PR comment for human review — they do not block.Implementation details
ubuntu-24.04, 30-minute timeout, skips fork PRs (no secrets available)github/safe-settings@2.1.17fresh (same pattern as the production sync workflow)npm ci(notnpm install) for reproducible installsactions/github-script@v7Cannot read properties of undefined (reading 'check_suite')is detected and treated as a warning, not an errorNext steps
Once merged, this workflow itself will trigger on subsequent PRs — this PR is the first one that would have been gated. To wire it as a required status check: go to branch protection for
main→ addSafe-settings dry-runas a required status check.Part of repo hygiene audit.