Skip to content

fix(review): defer automation while optional ci runs - #2414

Merged
JSONbored merged 1 commit into
mainfrom
codex/propose-fix-for-auto-merge-vulnerability
Jul 1, 2026
Merged

fix(review): defer automation while optional ci runs#2414
JSONbored merged 1 commit into
mainfrom
codex/propose-fix-for-auto-merge-vulnerability

Conversation

@JSONbored

Copy link
Copy Markdown
Owner

Motivation

  • Optional but visible pending CI checks were being treated as non-blocking after the stale-CI cap because the auto-maintain planner received only ciState (which can be "passed"), allowing approve/merge actions while optional checks still ran.
  • This contradicts the intended settle-before-decide policy that the planner must wait while any visible CI is still in progress.

Description

  • Thread ciAggregate.hasPending into the planner input as ciHasPending so the planner sees whether any visible CI is still unsettled and can act accordingly (src/queue/processors.ts).
  • Add ciHasPending to the AgentActionPlanInput type and update the planner to defer actions when ciHasPending === true in addition to ciState === "pending" (src/settings/agent-actions.ts).
  • Add a regression unit test that ensures the planner defers approve/merge/close/label actions when required contexts passed but optional visible CI remains pending (test/unit/agent-actions.test.ts).
  • Files changed: src/queue/processors.ts, src/settings/agent-actions.ts, test/unit/agent-actions.test.ts.

Testing

  • Ran npx vitest run test/unit/agent-actions.test.ts and the suite passed.
  • Ran npm run typecheck and the TypeScript check passed.
  • Started npm run test:coverage locally, but the full coverage run did not complete in the interactive session; the change includes a focused regression test covering the new branch.

Codex Task

@codecov

codecov Bot commented Jul 1, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.71%. Comparing base (17d70b2) to head (3c28f2c).
⚠️ Report is 24 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #2414   +/-   ##
=======================================
  Coverage   95.71%   95.71%           
=======================================
  Files         222      222           
  Lines       24661    24661           
  Branches     8949     8949           
=======================================
  Hits        23605    23605           
  Misses        433      433           
  Partials      623      623           
Files with missing lines Coverage Δ
src/queue/processors.ts 90.21% <ø> (ø)
src/settings/agent-actions.ts 92.52% <100.00%> (ø)
🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@loopover-orb

loopover-orb Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

Review updated: 2026-07-01 21:03:29 UTC

3 files · 1 AI reviewer · no blockers · readiness 86/100 · CI green · clean

⏸️ Suggested Action - Manual Review

  • Touches a guarded path — held for manual review

Review summary
This change threads the aggregate pending-CI signal into the auto-maintenance planner and makes the planner defer all actions whenever any visible CI is still unsettled. The core behavior is correct for the described failure mode: a passed required-check state no longer authorizes approve/merge/close/label actions while optional visible checks are still running. The regression test covers the important combination of ciState "passed" plus ciHasPending true.

Nits — 5 non-blocking
  • nit: src/settings/agent-actions.ts:105 keeps ciHasPending optional, which is compatible but makes future planner callers easier to wire incorrectly; consider making it required once all call sites are confirmed.
  • nit: test/unit/agent-actions.test.ts:426 only covers the true branch for ciHasPending; a focused false-branch assertion would make the new input contract clearer.
  • src/settings/agent-actions.ts:105: consider renaming ciHasPending to ciHasVisiblePending, or require the field, so the type carries the same meaning as the comment and ciAggregate.hasPending source.
  • test/unit/agent-actions.test.ts:426: add a paired case with ciState "passed" and ciHasPending false that still plans the expected enabled action, to lock the distinction between optional pending CI and fully settled CI.
  • Touches a guarded path — held for manual review — A maintainer must review and merge this change.
Signal Result Evidence
Code review ✅ No blockers 1 reviewer
Linked issue ⚠️ Missing No linked issue or no-issue rationale found.
Related work ✅ No active overlap found No same-issue or scoped active PR overlap found.
Change scope ✅ 20/20 Low review scope from cached public metadata (size label size:XS; no linked issue context).
Validation posture ✅ 25/25 PR body includes validation/test evidence.
Contributor workload ✅ 10/10 Author activity: 67 registered-repo PR(s), 57 merged, 589 issue(s).
Contributor context ✅ Confirmed Gittensor contributor JSONbored; Gittensor profile; 67 PR(s), 589 issue(s).
Gate result ⚠️ Not blocking Advisory; not blocking this PR.
Review context
  • Author: JSONbored
  • Role context: owner (maintainer lane)
  • Public audience mode: oss maintainer
  • Lane context: Repository registration is not available in the local Gittensory cache.
  • Public profile languages: not available
  • Official Gittensor activity: 67 PR(s), 589 issue(s).
  • PR-specific overlap: none found.
Contributor next steps
  • Treat this as maintainer-lane context rather than normal contributor-lane activity.
  • Explain no-issue PR.
  • Triage stale or unlinked PRs.
  • No action.
  • Link the issue being solved, or explicitly explain why this is a no-issue PR.
Signal definitions
  • Related work = same linked issue, overlapping active PRs, or title/path similarity.
  • Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
  • Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
  • Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
  • Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed


💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

  • Re-run Gittensory review

@loopover-orb loopover-orb Bot added gittensor gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. labels Jul 1, 2026
@JSONbored
JSONbored merged commit 296f75a into main Jul 1, 2026
12 checks passed
@JSONbored
JSONbored deleted the codex/propose-fix-for-auto-merge-vulnerability branch July 1, 2026 22:14
@github-project-automation github-project-automation Bot moved this from Todo to Done in gittensory - v1 roadmap Jul 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier.

Projects

No open projects
Status: Done

Development

Successfully merging this pull request may close these issues.

1 participant