Skip to content

fix(agent-ingress): pin ci-failure-analyst to v1-stable; fix the analyst loop guard #523

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
don-petry merged 1 commit into from
Oct 12, 2026
Merged

fix(agent-ingress): pin ci-failure-analyst to v1-stable; fix the analyst loop guard #523

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 22 additions & 2 deletions .github/scripts/tests/agent-ingress-workflow.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ ROLES=(dev-lead pr-auto-review pr-review pr-review-mention ci-failure-analyst)
[[ "$output" == *"/pr-review-mention-reusable.yml@pr-review-mention/v2-stable" ]]
run yq '.jobs.ci-failure-analyst.uses' "$WORKFLOW"
[ "$status" -eq 0 ]
[[ "$output" == *"/ci-failure-analyst-reusable.yml@b58510275dd1cbbd13c0733c15265d51fd63b992" ]]
[[ "$output" == *"/ci-failure-analyst-reusable.yml@ci-failure-analyst/v1-stable" ]]
}

@test "dev-lead job keeps the base=main PR filter and declares no caller concurrency" {
Expand Down Expand Up @@ -149,7 +149,7 @@ ROLES=(dev-lead pr-auto-review pr-review pr-review-mention ci-failure-analyst)
run yq '.jobs.ci-failure-analyst.if' "$WORKFLOW"
[[ "$output" == *"github.event_name == 'check_run'"* ]]
[[ "$output" == *"github.event.check_run.conclusion == 'failure'"* ]]
[[ "$output" == *"!startsWith(github.event.check_run.name, 'CI Failure Analyst')"* ]]
[[ "$output" == *"!startsWith(github.event.check_run.name, 'ci-failure-analyst')"* ]]
}

@test "if: guards never read repo state (vars/secrets/needs/hashFiles)" {
Expand All @@ -168,3 +168,23 @@ ROLES=(dev-lead pr-auto-review pr-review pr-review-mention ci-failure-analyst)
[[ "$output" =~ @pr-review/v1-stable[[:space:]]+#[[:space:]]*NOSONAR\(githubactions:S7637\)[[:space:]]+first-party[[:space:]]+channel[[:space:]]+ref ]]
[[ "$output" != *"DEFECTIVE PIN"* ]]
}

@test "ci-failure-analyst loop guard matches the analyst's own check run name (#2175)" {
# A reusable-workflow job's check run is named '<caller job> / <reusable job>',
# so the analyst's own check is 'ci-failure-analyst / analyze'. The guard must
# match that prefix, or a failed analyst run re-triggers the analyst.
run yq '.jobs.ci-failure-analyst.if' "$WORKFLOW"
[ "$status" -eq 0 ]
local prefix
prefix="$(printf '%s' "$output" | sed -n "s/.*!startsWith(github.event.check_run.name, '\([^']*\)').*/\1/p")"
[ -n "$prefix" ]
Comment thread
don-petry marked this conversation as resolved.
# The reusable's job id is 'analyze' (ci-failure-analyst-reusable.yml).
[[ 'ci-failure-analyst / analyze' == "$prefix"* ]]
}

@test "ci-failure-analyst pins its channel, not a bare SHA (#2176)" {
run grep -E '/ci-failure-analyst-reusable\.yml@' "$WORKFLOW"
[ "$status" -eq 0 ]
[[ "$output" =~ @ci-failure-analyst/v1-stable[[:space:]]+#[[:space:]]*NOSONAR\(githubactions:S7637\)[[:space:]]+first-party[[:space:]]+channel[[:space:]]+ref ]]
[[ "$output" != *"DEFECTIVE PIN"* ]]
}
4 changes: 2 additions & 2 deletions .github/workflows/agent-ingress.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,7 +169,7 @@ jobs:
if: >-
github.event_name == 'check_run'
&& github.event.check_run.conclusion == 'failure'
&& !startsWith(github.event.check_run.name, 'CI Failure Analyst')
&& !startsWith(github.event.check_run.name, 'ci-failure-analyst')
concurrency:
group: "ci-failure-analyst-${{ github.event.check_run.head_sha }}"
cancel-in-progress: false
Expand All @@ -179,6 +179,6 @@ jobs:
actions: read
contents: read
checks: read
uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@b58510275dd1cbbd13c0733c15265d51fd63b992 # DEFECTIVE PIN — bare SHA, see §5
uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@ci-failure-analyst/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref
secrets:
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Loading