…illed (#9772)
## What happened
On **2026-07-24, ~16:05–16:26 UTC** GitHub's API browned out — HTTP 502
on the
workflow-dispatch endpoint, HTTP 504 on GraphQL, HTTP 429 on codeload.
Four `radar-basic`
PRs fell out of the pipeline and stayed out, because the calls that hand
work to the next
workflow had no retry:
| PR | Library | State it was left in | Call that died |
|---|---|---|---|
| #9742 | seaborn | `ai-approved` q90 | `impl-merge` → `gh pr view` →
**504** |
| #9744 | pygal | `ai-rejected` q87 | repair dispatch → **504**;
`ai-attempt-1` also lost |
| #9749 | makie | `ai-rejected` q88 | repair dispatch → **502** |
| #9751 | highcharts | `ai-rejected` q88 | repair dispatch → **502** |
`impl-review`'s verdict step is the pipeline's **only hand-off point** —
every downstream
workflow starts from a call made there. So an unretried blip doesn't
merely fail a step; it
leaves a PR carrying a verdict label with nothing listening.
All four have since been recovered manually and merged; this PR stops it
recurring.
## Changes
**`impl-review.yml` — the verdict step**
- every API call retries 3× with linear backoff (same shape as the
existing `Extract PR info`
retry, added 2026-05-06 for this same class of failure)
- the repair is **dispatched before** the attempt label is added, and
the label can no longer
gate it. Losing the label costs one over-strict review; losing the
dispatch costs the whole PR
- if the dispatch still exhausts its retries, the step drops
`ai-rejected` on the way out:
`ai-rejected` + `ai-attempt-N` matches **no** watchdog case (Case 2
excludes any verdict
label, Case 4 excludes PRs that already have an attempt label), while
the label-less state is
exactly Case 2 — which re-dispatches the repair at the attempt number
the remaining label
still encodes
- the label read tracks success explicitly instead of inferring it from
empty output, and a
successful read with no verdict label now fails loudly instead of ending
the step green
**Two bugs found while verifying the above**
- **`ai-attempt-4` never existed as a label.** The attempt label encodes
the cascading
threshold (90 → 80 → 70 → 60 → 50), but the repo only has
`ai-attempt-1..3`, so on the 4th
repair the add failed every time and `|| true` swallowed it — #7268 and
#7039 both reached
"Repair Attempt 4/4" carrying only `ai-attempt-1..3`. Every 4th review
therefore re-applied
the ≥ 90 attempt-0 bar, and the attempts-exhausted branch (close PR,
remove stale
implementation) could never be reached. Labels are now created on
demand.
*This also means my first draft of this PR was a hard blocker:* with the
label add fatal, the
4th repair would never have been dispatched at all.
- **That newly-reachable branch rendered a literal `$SCORE/100`** —
quoted heredoc. Now
expands, with the markdown backticks escaped so they can't become
command substitution.
**`impl-merge.yml`**
- the 5× merge retry re-reads PR state first. A merge that succeeded
server-side but lost its
HTTP response used to fail four more times with "already merged" and
exit 1 — and because
every post-merge step is gated on `should_run == 'true'` (implicit
`success()`), that skipped
GCS promotion, the `impl:{lib}:done` label, closing the issue and the
Postgres sync. A merged
PR with none of its bookkeeping: exactly the silent partial completion
CLAUDE.md warns about
**`auto-update-pr-branches.yml` — Dependabot PRs could never merge while
the pipeline ran**
- the workflow called `update-branch` on Dependabot PRs. That push is
authored by
`github-actions[bot]`, so GitHub gates the resulting runs behind manual
approval
(`action_required`) — and because `main` advances every few minutes
during impl merges, each
branch was re-updated long before anyone could approve. **PR #9674
accumulated 174 runs in
22 h: 162 `action_required` against only 4 green** (the original
`dependabot[bot]` push)
- Dependabot branches are now skipped. They merge fine while behind —
the `main` ruleset is
**not** strict (`strict_required_status_checks_policy: false`); the
file's header claimed the
opposite and is corrected
- `/dependabot`'s playbook told operators to run that same harmful
`update-branch` by hand; it
now says the opposite and documents the `@dependabot recreate` remedy
## Verification
`.github/workflows/` has no verification loop (CLAUDE.md), so this was
reviewed by a 4-lens
adversarial pass with an independent refutation round (regression /
shell-under-`bash -e` / retry idempotency / the Dependabot
premise), and every claim was re-checked against the live repo before
acting. That pass is what
caught the `ai-attempt-4` blocker and the false Dependabot-rebase
premise in my first draft.
- YAML parses; `bash -n` clean on the extracted steps
- `gh_retry` semantics exercised under `bash -e`: succeeds first try /
recovers after 2
failures / multi-arg passthrough / hard failure aborts the step
- the corrected control flow tested for all three cases — normal,
**attempt 4 with a
permanently failing label add (dispatch must still fire)**, and dispatch
exhaustion
(`ai-rejected` dropped, exit 1)
- confirmed the CI runner's `gh` adds labels fine; only the
locally-installed gh 2.45.0 hits
the `projectCards` GraphQL deprecation, so hard-failing on `--add-label`
is safe in CI
- ruleset strictness, the `ai-attempt-*` label set, and the poisoned
Dependabot head commits
were all read from the live repo, not assumed
## Follow-up (not in this PR)
- #9674, #9648 and #8820 already have a `github-actions[bot]` merge
commit as their head. Once
this merges their head stops moving, so approving each gated run
**once** is enough — verified
that the required contexts do report as SUCCESS on a bot-authored head
after approval (#9674,
commit `59545076`). Doing it before this merges would just get re-gated
by the next push to
`main`. (`@dependabot recreate` is an equivalent alternative; it also
restores a clean
`dependabot[bot]` head but re-resolves the versions.)
- Whether `auto-update-pr-branches.yml` should exist at all now that the
ruleset is non-strict
is worth deciding separately — it affects every auto-merge PR, so it
isn't folded in here.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
quality:88
Implementation:
radar-basic- javascript/highchartsImplements the javascript/highcharts version of
radar-basic.File:
plots/radar-basic/implementations/javascript/highcharts.jsParent Issue: #744
🤖 impl-generate workflow