Skip to content

File an issue when the scheduled zone-shell audit fails #1149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MaxGhenis merged 1 commit into from
Aug 10, 2026
Merged

File an issue when the scheduled zone-shell audit fails #1149

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions .github/workflows/app-zone-shell-audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ jobs:
audit:
name: Audit PolicyEngine shell on app-zone routes
runs-on: ubuntu-latest
permissions:
contents: read
issues: write
steps:
- uses: actions/checkout@v4

Expand All @@ -35,3 +38,21 @@ jobs:
env:
APP_ZONE_ALLOW_DESTINATION_FALLBACK: ${{ github.event_name == 'pull_request' && '1' || '0' }}
run: node .github/scripts/audit-app-zone-shell.mjs

- name: File or bump an issue when the scheduled audit fails
if: failure() && github.event_name == 'schedule'
env:
GH_TOKEN: ${{ github.token }}
run: |
title="Production zone-shell audit is failing"
run_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
existing=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \
--search "in:title \"$title\"" --json number --jq '.[0].number')
if [ -n "$existing" ]; then
gh issue comment "$existing" --repo "$GITHUB_REPOSITORY" \
--body "Still failing: $run_url"
else
gh issue create --repo "$GITHUB_REPOSITORY" --title "$title" --body "The scheduled app-zone shell audit failed: $run_url

A zone child stopped rendering the PolicyEngine site shell, or a route is down or erroring. Every embedded tool renders the shell itself (CLAUDE.md → Embedded sites → The shell rule); the child repo's own CI shell guard should catch this at PR time — fix the child and check why its guard did not."
fi
Loading