Switch integration-batch PR readiness filtering to GitHub check runs

[Copilot]

Dry-run selection was skipping PRs that appeared green in the GitHub UI because the workflow relied on legacy combined commit status (/commits/{sha}/status) and required state=success. This updates integration-batch selection to use check runs, aligned with current GitHub checks behavior.

• Selection criteria: move from combined status to Checks API

  • Replaced status lookup with:
    • GET /repos/$REPO/commits/$head_sha/check-runs
  • Per PR head SHA:
    • skip if total_count == 0 → reason: no check runs found
    • skip if any check run has status != completed → reason: checks pending
    • skip if any completed check run has conclusion not in {success, skipped, neutral} → reason: checks not successful
    • otherwise include PR in merge set

• Workflow output/summary consistency

  • Kept JSON outputs compact for $GITHUB_OUTPUT.
  • Updated skipped-check rendering in integration PR body and job summary to display reason (instead of legacy state).

• Docs alignment

  • Updated docs/INTEGRATION.md selection rules to document check-runs-based gating.

checks_json="$(gh api -H "Accept: application/vnd.github+json" "/repos/$REPO/commits/$head_sha/check-runs")"
total_count="$(echo "$checks_json" | jq -r '.total_count')"
pending_count="$(echo "$checks_json" | jq '[.check_runs // [] | .[] | select(.status != "completed")] | length')"
bad_conclusion_count="$(echo "$checks_json" | jq '[.check_runs // [] | .[] | select(.status == "completed" and .conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral")] | length')"

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/rockcarver/frodo-cli/releases
  • Triggering command: /opt/hostedtoolcache/node/24.14.1/x64/bin/node /opt/hostedtoolcache/node/24.14.1/x64/bin/node --no-warnings --enable-source-maps --experimental-loader file:///home/REDACTED/work/frodo-cli/frodo-cli/dist/loader.cjs /home/REDACTED/work/frodo-cli/frodo-cli/dist/app.cjs shell t@users.noreply.github.com --depth 2 REDACTED config-manager pull saml -f test/e2e/fr-config-manager-pull-config/saml.json -D testDir22 git conf�� ame URL --file test/e2e/exports/all/allAlphaResourceTypes.resourcetype.authz.json --global (http block)
  • Triggering command: /opt/hostedtoolcache/node/24.14.1/x64/bin/node /opt/hostedtoolcache/node/24.14.1/x64/bin/node --no-warnings --enable-source-maps --experimental-loader file:///home/REDACTED/work/frodo-cli/frodo-cli/dist/loader.cjs /home/REDACTED/work/frodo-cli/frodo-cli/dist/app.cjs shell es/.bin/node gpg.program (http block)
  • Triggering command: /opt/hostedtoolcache/node/24.14.1/x64/bin/node /opt/hostedtoolcache/node/24.14.1/x64/bin/node --no-warnings --enable-source-maps --experimental-loader file:///home/REDACTED/work/frodo-cli/frodo-cli/dist/loader.cjs /home/REDACTED/work/frodo-cli/frodo-cli/dist/app.cjs shell in/node pull.rebase (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Update Integration Batch workflow selection criteria in rockcarver/frodo-cli.

Context: In dry-run, PRs that appear green/ready in GitHub UI were skipped because workflow used legacy combined commit status endpoint /repos/{owner}/{repo}/commits/{sha}/status and required .state == success.

Required change:

• In .github/workflows/integration-batch.yml, replace the "Filter to PRs with successful combined status" logic to use GitHub Checks API (check runs) instead.
• For each PR head SHA:
  • Fetch check runs via GET /repos/$REPO/commits/$head_sha/check-runs (use gh api).
  • If .total_count == 0: skip the PR (reason: no check runs found).
  • If any check run has .status != "completed": skip (reason: checks pending).
  • If any completed check run has .conclusion not in {success, skipped, neutral}: skip (reason: checks not successful).
  • Otherwise: include PR.
• Keep the rest of the workflow behavior unchanged.
• Ensure outputs remain valid JSON (compact) when writing to $GITHUB_OUTPUT.

Deliverable: Open a PR with these changes.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: @copilot Accepted Confirmation: Confirm agent session

Assistant: I can add it for you, but I can’t make repository changes from this chat right now.

What you’ll need to do:

1. Create a new branch in rockcarver/frodo-cli
2. Add the new workflow file at:
   • .github/workflows/integration-batch.yml (the YAML we finalized with dry-run)
3. Update the release pipeline + docs:
   • Modify .github/workflows/pipeline.yml so bump type is derived from the merged PR’s labels (release:patch|minor|major), defaulting to prerelease, and failing if:
     • the commit maps to 0 PRs (direct push) or >1 PRs
     • more than one release label is present
   • Update docs/PIPELINE.md to remove trigger phrase guidance and document the label-based behavior + failure-on-direct-push rule

If you want, paste the current docs/CONTRIBUTE.md here (or link it) and I’ll draft the exact edits for:

• the integration workflow usage (integration-batch, integrated, integration-failed)
• the new release labeling model
• any Node version / command corrections I spot

User: What does this mean exactly: "I can add it for you, but I can’t make repository changes from this chat right now."?

Where can you add it if you cannot make repository changes? Just trying to understand what you can and what you cannot do.

Assistant: I misspoke. In this chat I can make repository changes, but only by using the GitHub tools that create a PR / push commits. I can’t “reach into your local repo,” and I also can’t change anything without a repo/branch target and your confirmation—which you’ve already given by accepting the agent session.

What I can do here:

• Create commits in rockcarver/frodo-cli (via a PR) that:
  • add .github/workflows/integration-batch.yml
  • update .github/workflows/pipeline.yml to use PR labels (release:patch|minor|major) and fail on direct pushes / ambiguous PR mapping
  • update docs/PIPELINE.md
  • review/update docs/CONTRIBUTE.md and add something like docs/INTEGRATION.md

What I cannot do here:

• Directly click around in the GitHub UI for you (e.g., create labels via the UI)
• Apply org/repo settings like branch protections, Actions “workflow permissions”, required checks, etc. (I can tell you exactly where/how)
• Merge the PR myself unless you ask and I have permission (usually you merge)
• Modify your local environment

Also, the Copilot coding agent is already running on your request and will produce a PR you can review/merge. You can track it here:

data:
  - title: '[WIP] Automate integration batching and switch release pipeline to label-driven bumping'
    repository: rockcarver/frodo-cli
    url: https://github.com/copilot/tasks/pull/PR_kwDOH1LPHs7TuVXl?session_id=bffe9455-7b9b-4c6a-be31-736a197a8347
    state: queued

If you open that link, you should see the PR (or a task that becomes a PR) once it’s ready. If you want, I can also summarize the diff and call out anything that needs manual repo-setting changes (like adding the new labels).

User: OK, so if I understand you correctly, what I need to do is:

1. Create labels release:patch|minor|major
2. Review and merge the PR you created
3. Test the new integration-batch workflow

Assistant: Yes — that’s the right sequence, with two small additions.

What you need to do

1. Create labels in rockcarver/frodo-cli

   • release:patch
   • release:minor
   • release:major
   • (also for the integration workflow)
     • integration-batch
     • integrated
     • integration-failed

2. Review and merge the PR the agent creates

   • It should include:
     • .github/workflows/integration-batch.yml (with dry-run)
     • .github/workflows/pipeline.yml updated to use PR labels and **fail on direct pushes / ambigu...

This pull request was created from Copilot chat.

[vscheuber]

Looks good.