From f50331e32d7068fbab11114b47cb1bfc03fdb779 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 11 Oct 2026 16:48:18 +0000 Subject: [PATCH 1/5] fix(standards): sync agent-ingress template job blocks to markets Replace the pr-auto-review, pr-review and ci-failure-analyst job blocks in standards/workflows/agent-ingress.yml with the blocks deployed in petry-projects/markets main (62587ec), byte for byte, so the Fleet Monitor's per-job block hashes align. Header, on:, permissions:, the dev-lead and pr-review-mention jobs, and inter-job comments are unchanged. Refs petry-projects/.github-private#1729 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01B3euCoLvC3YmanzKoc4hox --- standards/workflows/agent-ingress.yml | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/standards/workflows/agent-ingress.yml b/standards/workflows/agent-ingress.yml index e519c16d7..d3651e7c4 100644 --- a/standards/workflows/agent-ingress.yml +++ b/standards/workflows/agent-ingress.yml @@ -122,13 +122,17 @@ jobs: && contains(fromJSON('["submitted","dismissed"]'), github.event.action)) || github.event_name == 'check_suite' || github.event_name == 'workflow_run' - # Job-level concurrency (the source stub's workflow-level group), bounded per ADR-0010. PR events - # keep their per-PR slot; check_suite / workflow_run share one slot per head SHA (no run_id). + # Workflow-level concurrency in the source stub → job-level here, bounded per + # ADR-0010: literal role prefix, payload parts only (no run_id), literal bool. + # PR events keep their per-PR slot; check_suite / workflow_run use their own + # event ids so runs on a shared commit never cancel another PR's review (§4b). concurrency: group: >- - pr-auto-review-ready-check-${{ - (github.event.pull_request.number && format('pr-{0}', github.event.pull_request.number)) - || format('sha-{0}', github.event.check_suite.head_sha || github.event.workflow_run.head_sha) + pr-auto-review-${{ + github.event.pull_request.number + || github.event.check_suite.id + || github.event.workflow_run.id + || 'none' }} cancel-in-progress: true permissions: @@ -141,8 +145,8 @@ jobs: # ── pr-review ───────────────────────────────────────────────────────────────── pr-review: - # Subscription filter AND the check_suite-with-no-PR skip, both pure event predicates over the - # delivered payload. + # Subscription filter AND the source stub's check_suite-with-no-PR skip, both + # pure event predicates over the delivered payload. if: >- ( (github.event_name == 'pull_request' @@ -154,9 +158,9 @@ jobs: || (github.event_name == 'repository_dispatch' && github.event.action == 'pr-review-mention') ) && (github.event_name != 'check_suite' || github.event.check_suite.pull_requests[0] != null) - # Job-level concurrency, bounded per ADR-0010: payload parts only (no inputs.*, no run_id). A sweep - # with no PR shares the 'enumerate' slot. The fallback is NOT 'batch', because the pinned reusable - # declares pr-review-batch. + # Job-level concurrency, bounded per ADR-0010: payload parts only (no inputs.*, + # no run_id). A sweep with no PR shares the 'enumerate' slot. The fallback is + # NOT 'batch', because the pinned reusable declares pr-review-batch (§4b). concurrency: group: >- pr-review-${{ @@ -208,6 +212,6 @@ jobs: actions: read contents: read checks: read - uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@ci-failure-analyst/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@b58510275dd1cbbd13c0733c15265d51fd63b992 # DEFECTIVE PIN — bare SHA, see §5 secrets: CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} From 2c0fee399520404569c4f31bd47555f40e071a21 Mon Sep 17 00:00:00 2001 From: don-petry <36422719+don-petry@users.noreply.github.com> Date: Sun, 11 Oct 2026 16:59:24 +0000 Subject: [PATCH 2/5] fix(bot): restore ci-failure-analyst to moving channel tag Reverted the bare SHA pin that blocked channel promotions/rollbacks. Per ci-standards.md, first-party reusable workflows must use moving channel tags (e.g. @ci-failure-analyst/v1-stable) to enable the release/rollback mechanism. The bare SHA pin violated this requirement and prevented the org's coordinated channel promotions from reaching this workflow. Co-Authored-By: Claude Haiku 4.5 --- standards/workflows/agent-ingress.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/standards/workflows/agent-ingress.yml b/standards/workflows/agent-ingress.yml index d3651e7c4..d30661e7f 100644 --- a/standards/workflows/agent-ingress.yml +++ b/standards/workflows/agent-ingress.yml @@ -212,6 +212,6 @@ jobs: actions: read contents: read checks: read - uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@b58510275dd1cbbd13c0733c15265d51fd63b992 # DEFECTIVE PIN — bare SHA, see §5 + uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@ci-failure-analyst/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref secrets: CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} From 83cb11d9a63d092f81de0b1072dbbab0d4ac2788 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 11 Oct 2026 17:34:52 +0000 Subject: [PATCH 3/5] Revert "fix(bot): restore ci-failure-analyst to moving channel tag" This reverts commit 2c0fee399520404569c4f31bd47555f40e071a21. The template's ci-failure-analyst block must stay byte-identical to markets' live agent-ingress.yml (AC11). ci-failure-analyst/v1-stable has been frozen at v1.0.0 since July (.github#1270), so the template mirrors markets' deployed bare SHA until both move together. Refs petry-projects/.github-private#1729 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01B3euCoLvC3YmanzKoc4hox --- standards/workflows/agent-ingress.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/standards/workflows/agent-ingress.yml b/standards/workflows/agent-ingress.yml index d30661e7f..d3651e7c4 100644 --- a/standards/workflows/agent-ingress.yml +++ b/standards/workflows/agent-ingress.yml @@ -212,6 +212,6 @@ jobs: actions: read contents: read checks: read - uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@ci-failure-analyst/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@b58510275dd1cbbd13c0733c15265d51fd63b992 # DEFECTIVE PIN — bare SHA, see §5 secrets: CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} From f822d689ffe20584c5200464c12fd0040159e596 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 11 Oct 2026 21:49:08 +0000 Subject: [PATCH 4/5] fix(standards): pin ci-failure-analyst to its release channel Per the org pinning standard, first-party reusables are always pinned to a release channel, never a bare SHA. Restore @ci-failure-analyst/v1-stable with the NOSONAR(githubactions:S7637) marker, so the line is covered by the vform-pins guard again. The ci-failure-analyst block no longer matches markets' live file; markets needs the same one-line change to restore parity. Refs petry-projects/.github-private#1729 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01B3euCoLvC3YmanzKoc4hox --- standards/workflows/agent-ingress.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/standards/workflows/agent-ingress.yml b/standards/workflows/agent-ingress.yml index d3651e7c4..d30661e7f 100644 --- a/standards/workflows/agent-ingress.yml +++ b/standards/workflows/agent-ingress.yml @@ -212,6 +212,6 @@ jobs: actions: read contents: read checks: read - uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@b58510275dd1cbbd13c0733c15265d51fd63b992 # DEFECTIVE PIN — bare SHA, see §5 + uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@ci-failure-analyst/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref secrets: CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} From 4cdd88654d8ca4243590c91c356de2e80c879ac2 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 01:40:00 +0000 Subject: [PATCH 5/5] fix(standards): ci-failure-analyst loop guard matches its own check name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The analyst's check runs are named `ci-failure-analyst / …`, so the `!startsWith(check_run.name, 'CI Failure Analyst')` guard never matched and a failed analyst run could re-trigger the analyst. Match the real prefix. With this, the ci-failure-analyst block is identical to petry-projects/markets#523 (block SHA 4368213c), which pins the same v1-stable channel ref. Refs petry-projects/.github-private#1729, petry-projects/.github-private#2175 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01B3euCoLvC3YmanzKoc4hox --- standards/workflows/agent-ingress.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/standards/workflows/agent-ingress.yml b/standards/workflows/agent-ingress.yml index d30661e7f..5da4ef0f9 100644 --- a/standards/workflows/agent-ingress.yml +++ b/standards/workflows/agent-ingress.yml @@ -202,7 +202,7 @@ jobs: if: >- github.event_name == 'check_run' && github.event.check_run.conclusion == 'failure' - && !startsWith(github.event.check_run.name, 'CI Failure Analyst') + && !startsWith(github.event.check_run.name, 'ci-failure-analyst') concurrency: group: "ci-failure-analyst-${{ github.event.check_run.head_sha }}" cancel-in-progress: false