@goodtek/vibeops 3.1.8 → 3.1.9

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to VibeOps are documented here.
 
 ## Unreleased
 
+## 3.1.9 - 2026-10-17
+
+### Fixed
+
+- **The merge gate was blocked by GitHub's dynamic workflow runs.** A failed Dependabot run on the head commit (`event: dynamic`, `dynamic/dependabot/dependabot-updates`) refused a PR whose CI was green — and such runs cannot be re-run. Dynamic runs and `(dynamic)` check runs are now ignored; a `(dynamic)` check named in `requiredChecks` is still required (D-011, TASK-043).
+
 ## 3.1.8 - 2026-10-17
 
 ### Changed

package/README.md

@@ -218,6 +218,7 @@ Before calling `gh pr merge` / `glab mr merge`:
   - **Expected workflows:** every `.github/workflows/*.yml|yaml` at the head commit whose `on:` triggers `pull_request` for this PR, using GitHub's filter rules — `branches` / `branches-ignore` against the base branch, `paths` / `paths-ignore` against the PR's changed files (first 300, like GitHub), and `types` (a custom list must contain both `opened` and `synchronize`). Disabled workflows are skipped; `pull_request_target`, `workflow_call` and other events are not awaited. Each expected workflow must have a `pull_request` run for the head SHA — until it appears the gate **waits** (`workflow … (pull_request) has not started for <sha> yet`), then refuses at `waitTimeoutSeconds`.
   - **All runs for the head SHA** (any event, latest run per workflow + event) must be `completed` with `success`, `neutral` or `skipped`. A queued / in-progress / waiting run waits; any other conclusion refuses immediately — including `startup_failure` (no jobs, so nothing in the rollup) and `action_required` (fork PR awaiting approval).
   - The Actions API is required: if it cannot be read, the gate keeps waiting (back-off) and refuses at the timeout — it never merges blind.
+- **Dynamic workflows are not CI:** runs GitHub generates on the fly — `event: dynamic`, e.g. `dynamic/dependabot/dependabot-updates`, the jobs that open Dependabot PRs — and check runs suffixed `(dynamic)` are ignored. GitHub documents them as "generated for a specific run and … not stored in your repository's `.github/workflows` directory" ([Dependabot on GitHub Actions runners](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/about-dependabot-on-github-actions-runners)); a failed one says nothing about the commit and cannot be re-run. A `(dynamic)` check named in `requiredChecks` is still required.
 - **GitLab:** the MR head pipeline must be `success` or `skipped`. `failed`, `canceled`, `manual` and unknown statuses refuse; `created` / `pending` / `running` / `scheduled` / … wait.
 - **Host output is verified:** if `gh pr view` lacks or has empty `state`, `mergeable`, `headRefOid`, or `statusCheckRollup` is not a list (GitLab: `state`, `sha`, `merge_status`, `detailed_merge_status`, `head_pipeline`), the merge is refused.
 - **Failed check → refuse immediately** (exit code 1, checks named). **Pending → wait** up to `waitTimeoutSeconds`, then refuse. There is no override flag: fix CI (re-run `task ship`) and rerun `task merge`.

package/dist/lib/check-rollup.js

@@ -94,6 +94,15 @@ export function checkNameMatches(name, pattern) {
  * - any pending, or a required check not (yet) present → pending
  * - otherwise green (including "no checks at all" when nothing is required)
  */
+/**
+ * Check runs GitHub suffixes with " (dynamic)" belong to dynamic workflows (see
+ * `isDynamicRun` in github-actions-gate.ts), not to the commit's CI: dropped unless a required
+ * check pattern names them.
+ */
+export function withoutDynamicChecks(checks, requiredChecks = []) {
+    return checks.filter((c) => !(c.kind === "CheckRun" && c.name.endsWith(" (dynamic)")) ||
+        requiredChecks.some((p) => checkNameMatches(c.name, p)));
+}
 export function evaluateCheckGate(checks, requiredChecks = []) {
     const failed = checks.filter((c) => c.verdict === "failed");
     const pending = checks.filter((c) => c.verdict === "pending");

package/dist/lib/github-actions-gate.js

@@ -171,6 +171,17 @@ export async function workflowExpectedForPullRequest(yamlText, ctx) {
     return { expected: true };
 }
 const RUN_PASS = new Set(["success", "neutral", "skipped"]);
+/**
+ * GitHub-generated runs that are not the commit's CI: "dynamic workflows are generated for a
+ * specific run and are not stored in your repository's `.github/workflows` directory" — e.g.
+ * the jobs that generate Dependabot pull requests, `dynamic/dependabot/dependabot-updates`
+ * (docs.github.com/code-security/dependabot/working-with-dependabot/about-dependabot-on-github-actions-runners).
+ * Their result says nothing about the head commit, and a failed one cannot be re-run, so the
+ * gate ignores them (required checks named in `.vibeops.json` are still judged by name).
+ */
+export function isDynamicRun(run) {
+    return run.event === "dynamic" || run.path.startsWith("dynamic/");
+}
 function runPath(run) {
     return run.path.split("@")[0];
 }
@@ -180,11 +191,13 @@ function describeRun(run, detail) {
 /**
  * Latest run per (workflow, event) must be completed and passing; every
  * expected workflow must have a `pull_request` run. Unknown statuses /
- * conclusions fail closed.
+ * conclusions fail closed. Dynamic runs ({@link isDynamicRun}) are ignored.
  */
 export function evaluateActionsRuns(runs, expectedPaths) {
     const latest = new Map();
     for (const run of runs) {
+        if (isDynamicRun(run))
+            continue;
         const key = `${runPath(run)}\u0000${run.event}`;
         const prev = latest.get(key);
         if (prev === undefined || run.id > prev.id)

package/dist/lib/pr-create.js

@@ -1,9 +1,9 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { mergeRequestLabel } from "./git-host.js";
-import { classifyRollup, evaluateCheckGate, formatCheckGateProblems, } from "./check-rollup.js";
+import { classifyRollup, evaluateCheckGate, withoutDynamicChecks, formatCheckGateProblems, } from "./check-rollup.js";
 import { isMergeRequestReadyToMerge, isPipelineActive, pipelineGateState, pipelineStatusFromHost, } from "./merge-request-readiness.js";
-import { evaluateActionsRuns, listExpectedPullRequestWorkflows, listWorkflowRunsForSha, parseGitHubPullUrl, } from "./github-actions-gate.js";
+import { evaluateActionsRuns, isDynamicRun, listExpectedPullRequestWorkflows, listWorkflowRunsForSha, parseGitHubPullUrl, } from "./github-actions-gate.js";
 import { dim, log } from "./logger.js";
 import { checkBaseInHead } from "./merge-base-freshness.js";
 import { MERGE_GATE_DEFAULTS, mergeGateTiming } from "./merge-config.js";
@@ -292,7 +292,10 @@ export async function readMergeRequestDetails(cwd, host, url, options) {
             throw new MergeRequestShapeError("gh", problems);
     }
     const checks = classifyRollup(parsed.statusCheckRollup);
-    const gate = evaluateCheckGate(checks);
+    // Dynamic workflows' check runs are not the commit's CI (see `withoutDynamicChecks`);
+    // required ones are still judged by name in the merge gate.
+    const ciChecks = withoutDynamicChecks(checks);
+    const gate = evaluateCheckGate(ciChecks);
     let pipelineStatus = "none";
     if (gate.state === "red") {
         pipelineStatus = "failed";
@@ -300,7 +303,7 @@ export async function readMergeRequestDetails(cwd, host, url, options) {
     else if (gate.state === "pending") {
         pipelineStatus = "running";
     }
-    else if (checks.length > 0) {
+    else if (ciChecks.length > 0) {
         pipelineStatus = "success";
     }
     const mergeable = parsed.mergeable?.trim().toUpperCase() ?? "";
@@ -340,11 +343,12 @@ export class MergeGateError extends Error {
 }
 function evaluateDetailsGate(details, requiredChecks) {
     if (details.checks !== null) {
-        const gate = evaluateCheckGate(details.checks, requiredChecks);
+        const checks = withoutDynamicChecks(details.checks, requiredChecks);
+        const gate = evaluateCheckGate(checks, requiredChecks);
         return {
             state: gate.state,
             problems: formatCheckGateProblems(gate),
-            noChecks: details.checks.length === 0,
+            noChecks: checks.length === 0,
         };
     }
     const state = pipelineGateState(details.pipelineStatus);
@@ -383,7 +387,7 @@ async function evaluateGitHubActions(cwd, url, details, expectedCache) {
         expected = await listExpectedPullRequestWorkflows(cwd, pr, sha, details.baseBranch);
         expectedCache.set(sha, expected);
     }
-    const runs = await listWorkflowRunsForSha(cwd, pr, sha);
+    const runs = (await listWorkflowRunsForSha(cwd, pr, sha)).filter((r) => !isDynamicRun(r));
     return {
         result: evaluateActionsRuns(runs, expected.map((w) => w.path)),
         runCount: runs.length,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodtek/vibeops",
-  "version": "3.1.8",
+  "version": "3.1.9",
   "description": "Minimal CLI rails for Cursor-based TASK-driven vibe coding.",
   "type": "module",
   "packageManager": "pnpm@9.15.9",
@@ -62,7 +62,7 @@
   "devDependencies": {
     "@eslint/js": "10.0.1",
     "@types/node": "^20.14.0",
-    "eslint": "10.11.0",
+    "eslint": "10.12.0",
     "tsx": "^4.23.15",
     "typescript": "^5.5.4",
     "typescript-eslint": "8.71.0"