fix(guard): allow Wave 0 deprecated-workflow removals through Health 45 guard - #2007
Merged
Conversation
Contributor
|
No description provided. |
stranske
marked this pull request as ready for review
May 4, 2026 20:43
Contributor
Automated Status SummaryHead SHA: fc36190
Coverage Overview
Updated automatically; will refresh on subsequent CI/Docker completions. Keepalive checklistScopeNo scope information available Tasks
Acceptance criteria
|
Contributor
|
No description provided. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c8381fb4f8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+37
to
+40
| '.github/workflows/agents-autofix-loop.yml', | ||
| '.github/workflows/agents-bot-comment-handler.yml', | ||
| '.github/workflows/agents-keepalive-loop.yml', | ||
| '.github/workflows/agents-verify-to-issue-v2.yml', |
There was a problem hiding this comment.
Adding these four paths to ALLOW_REMOVED_PATHS disables Health 45 protection for deleting or renaming them in the Workflows repo, because evaluateGuard treats allowlisted removals/renames as an immediate continue (no fatal violation, label, or CODEOWNER gate). Since these workflow files still exist under .github/workflows/, a PR can now remove critical automation like agents-autofix-loop.yml or agents-keepalive-loop.yml without the guard blocking it.
Useful? React with 👍 / 👎.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the agents guard allowlist so Wave 0 consumer-template cleanup PRs can delete several deprecated workflow files without being blocked by Health 45, and mirrors that change into the consumer template copy. The PR fits into the repo’s sync/guardrail layer by adjusting how protected agents-* workflow deletions are validated during template cleanup.
Changes:
- Extend
ALLOW_REMOVED_PATHSin the root guard script for four deprecated consumer-template workflow paths. - Apply the same allowlist expansion to the consumer-template guard script for downstream syncs.
- Expand the existing guard unit test to cover the newly allowlisted removal paths.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
templates/consumer-repo/.github/scripts/agents-guard.js |
Mirrors the new deletion allowlist into the consumer-template guard. |
.github/scripts/agents-guard.js |
Expands the root guard’s allowlisted removed workflow paths. |
.github/scripts/__tests__/agents-guard.test.js |
Adds removal-path test coverage for the new allowlist entries. |
Comment on lines
+35
to
+40
| // Wave 0 cleanup removes deprecated consumer-template workflows past the | ||
| // 2026-02-15 deprecation deadline so sync PRs can delete stale copies. | ||
| '.github/workflows/agents-autofix-loop.yml', | ||
| '.github/workflows/agents-bot-comment-handler.yml', | ||
| '.github/workflows/agents-keepalive-loop.yml', | ||
| '.github/workflows/agents-verify-to-issue-v2.yml', |
stranske
added a commit
that referenced
this pull request
May 5, 2026
…TECTION_TOKEN in health-44 Wave 1's state-fingerprint helper (#1998 + #2002 wireup) broke Health 44 enforce because the workflow's GITHUB_TOKEN can't access the actions/variables endpoint even with `actions: write` set — that endpoint requires a token with Variables permission (PAT, GitHub App, or fine-grained PAT). Resulting failure observed on every PR running Health 44 enforce since #2002 merged (incl. PR #2006, PR #2007 today): GET /repos/stranske/Workflows/actions/variables/STATE_FINGERPRINT_HEALTH_44_GATE_BRANCH_PROTECTION_* failed: 403 "Resource not accessible by integration" Two-part fix: 1) `scripts/state_fingerprint.py` — `RepoVariableStorage` now treats 401/403 from the variables API as "storage unavailable" rather than fatal. Read returns None (no prior fingerprint), write skips silently, and a warning goes to stderr so the operator sees the misconfiguration in workflow logs. The existing 404 (no prior) path is unchanged. Effect: any workflow that adopts `--storage repo-variable` but doesn't have the right token degrades gracefully (skips the optimization, runs anyway) instead of failing outright. Future Wave 1+ workflows using repo-variable storage benefit from this. 2) `.github/workflows/health-44-gate-branch-protection.yml` — uses `BRANCH_PROTECTION_TOKEN` (already used downstream by `enforce`) when present, falling back to `GITHUB_TOKEN`. Now the fingerprint optimization actually works when the secret is configured. Existing 6 tests in tests/scripts/test_state_fingerprint.py still pass. py_compile clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
4 tasks
stranske
added a commit
that referenced
this pull request
May 5, 2026
…back (#2010) * fix(keepalive): handle no-checklist draft PRs with accurate disposition Phase 6 sync-PR review surfaced two related bugs in keepalive_orchestrator_gate_runner.js (Copilot review on stranske/* sync PRs): - routeDraftToHuman() emitted "0 unchecked checklist item(s)" when the PR had no checkboxes at all, suggesting the user just needed to check boxes that didn't exist. - The branching at line 404 fell through to the same "needs human" path for both genuine missing-acceptance-items cases and PRs that legitimately have no checklist at all. This change distinguishes the no-checklist case end-to-end: - Adds a noChecklist flag in the caller (computed once where checkboxCounts is built). - Threads noChecklist through routeDraftToHuman so the comment body and summary line accurately describe "no acceptance checklist found" vs "N unchecked items". - Adds a distinct reason key 'pr-draft-no-checklist' so weekly metrics can distinguish the two cases. Lockstep edit: canonical .github/scripts/ + templates/consumer-repo/ both updated identically. node --check passes on both. Out of scope here: the perceived "missing closing brace" Copilot flagged was already addressed by PR #1985 / #1986 on 2026-04-30 — the GraphQL mutation block in markDraftReadyForReview() has the correct three closing braces. The isConcreteAgentLabel() concern about agent:rate-limited / agent:retry routing as concrete agent labels is separate and needs broader review of the keepalive loop's label-routing semantics; deferred. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(state-fingerprint): graceful fallback on 401/403 + use BRANCH_PROTECTION_TOKEN in health-44 Wave 1's state-fingerprint helper (#1998 + #2002 wireup) broke Health 44 enforce because the workflow's GITHUB_TOKEN can't access the actions/variables endpoint even with `actions: write` set — that endpoint requires a token with Variables permission (PAT, GitHub App, or fine-grained PAT). Resulting failure observed on every PR running Health 44 enforce since #2002 merged (incl. PR #2006, PR #2007 today): GET /repos/stranske/Workflows/actions/variables/STATE_FINGERPRINT_HEALTH_44_GATE_BRANCH_PROTECTION_* failed: 403 "Resource not accessible by integration" Two-part fix: 1) `scripts/state_fingerprint.py` — `RepoVariableStorage` now treats 401/403 from the variables API as "storage unavailable" rather than fatal. Read returns None (no prior fingerprint), write skips silently, and a warning goes to stderr so the operator sees the misconfiguration in workflow logs. The existing 404 (no prior) path is unchanged. Effect: any workflow that adopts `--storage repo-variable` but doesn't have the right token degrades gracefully (skips the optimization, runs anyway) instead of failing outright. Future Wave 1+ workflows using repo-variable storage benefit from this. 2) `.github/workflows/health-44-gate-branch-protection.yml` — uses `BRANCH_PROTECTION_TOKEN` (already used downstream by `enforce`) when present, falling back to `GITHUB_TOKEN`. Now the fingerprint optimization actually works when the secret is configured. Existing 6 tests in tests/scripts/test_state_fingerprint.py still pass. py_compile clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: apply Black formatting to state_fingerprint.py 401/403 fallback --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
Workflow source neededPR #2007 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely. Please do one of:
Once a valid source is present, this warning will not be reposted. |
This was referenced May 5, 2026
chore: sync agents-guard.js to allow Wave 0 deprecated removals
stranske/Travel-Plan-Permission#1029
Closed
Closed
5 tasks
This was referenced Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Evidence
.github/workflows/agents-autofix-loop.yml was deleted.Validation
node --check .github/scripts/agents-guard.jsnode --check templates/consumer-repo/.github/scripts/agents-guard.jsnode --test .github/scripts/__tests__/agents-guard.test.jsscripts/validate_template_completeness.pyThis PR only expands the explicit deletion allowlist for deprecated template workflows removed by Wave 0 cleanup. It does not relax label or CODEOWNER checks for modified protected workflows.