@goodtek/vibeops 3.4.0 → 3.4.1

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to VibeOps are documented here.
 
 ## Unreleased
 
+## 3.4.1 - 2026-11-08
+
+### Fixed
+
+- **Merge gate: a re-run supersedes the earlier run of the same check.** `statusCheckRollup` keeps every run of a check on the head commit, and any failure among them refused the merge — so a check that failed once (e.g. a transient host error) and then passed on a re-run still blocked `task merge`. The gate now keeps the latest item per check identity (CheckRun: workflow + name; StatusContext: context), latest = started last (`startedAt`, then `completedAt`; still running = newest). A later failure still beats an earlier pass, a newer pending run still waits, and when the order is unknown (an item without `startedAt`, or an exact tie) every run of that check is kept, so the gate stays fail-closed (D-016, TASK-059).
+
 ## 3.4.0 - 2026-11-07
 
 ### Added

package/README.md

@@ -254,7 +254,8 @@ Before calling `gh pr merge` / `glab mr merge`:
   - **passed:** `SUCCESS`, `NEUTRAL`, `SKIPPED`
   - **failed:** `FAILURE`, `CANCELLED`, `TIMED_OUT`, `ACTION_REQUIRED`, `STARTUP_FAILURE`, `STALE`, `ERROR`
   - **pending:** CheckRun `REQUESTED`, `QUEUED`, `IN_PROGRESS`, `WAITING`, `PENDING`; StatusContext `PENDING`, `EXPECTED`
-  - **anything missing or undocumented fails closed** (treated as failed). Several checks with the same name: any failure fails.
+  - **anything missing or undocumented fails closed** (treated as failed).
+  - **Re-runs: the latest run of each check counts.** The rollup keeps every run of a check on the head commit (a re-run adds one). The gate keeps the latest per check identity — CheckRun: workflow + name (`test` in two workflows are two checks); StatusContext: context — where latest = started last (`startedAt`, ties by `completedAt`, a still-running item is newest). So a failure followed by a passing re-run passes, a pass followed by a failing re-run fails, and a newer queued / running re-run waits. If the order is unknown — an item without `startedAt` or an exact tie — all runs of that check are kept and any failure among them fails.
 - **GitHub Actions — the PR's own CI, not leftovers:** the rollup lists every check on the head commit, including checks from other events (e.g. a finished `push` workflow on `develop` when a release PR `develop → main` is opened). Right after a PR is opened or pushed, GitHub has not created its `pull_request` run — or that run's jobs — yet, so such a rollup looked green and 3.1.x merged before CI started. The gate therefore also reads the GitHub Actions API for the head SHA:
   - **Expected workflows:** every `.github/workflows/*.yml|yaml` at the head commit whose `on:` triggers `pull_request` for this PR, using GitHub's filter rules — `branches` / `branches-ignore` against the base branch, `paths` / `paths-ignore` against the PR's changed files (first 300, like GitHub), and `types` (a custom list must contain both `opened` and `synchronize`). Disabled workflows are skipped; `pull_request_target`, `workflow_call` and other events are not awaited. Each expected workflow must have a `pull_request` run for the head SHA — until it appears the gate **waits** (`workflow … (pull_request) has not started for <sha> yet`), then refuses at `waitTimeoutSeconds`.
   - **All runs for the head SHA** (any event, latest run per workflow + event) must be `completed` with `success`, `neutral` or `skipped`. A queued / in-progress / waiting run waits; any other conclusion refuses immediately — including `startup_failure` (no jobs, so nothing in the rollup) and `action_required` (fork PR awaiting approval).

package/dist/lib/check-rollup.js

@@ -5,6 +5,11 @@
  * GitHub returns two item shapes:
  * - `CheckRun` (GitHub Actions, check apps): `status` + `conclusion`, no `state`.
  * - `StatusContext` (commit status API): `state`, no `status`/`conclusion`.
+ *
+ * The rollup keeps every run of a check: a re-run (new attempt or new workflow run on the
+ * same head SHA) adds an item next to the old one. {@link latestPerCheck} keeps the latest
+ * item per check identity, so a passed re-run supersedes an earlier failure and a later
+ * failure supersedes an earlier pass.
  */
 /** GitHub GraphQL `CheckStatusState` values other than COMPLETED. */
 const CHECK_RUN_IN_FLIGHT = new Set(["REQUESTED", "QUEUED", "IN_PROGRESS", "WAITING", "PENDING"]);
@@ -32,7 +37,23 @@ function isCheckRun(item) {
     // Unknown typename: infer from fields.
     return (item.status ?? null) !== null || (item.conclusion ?? null) !== null;
 }
+/** RFC 3339 → epoch ms; missing, unparseable or Go's zero time (`0001-01-01T00:00:00Z`) → `null`. */
+function timestamp(raw) {
+    if (raw === null || raw === undefined || raw.trim() === "")
+        return null;
+    const ms = Date.parse(raw);
+    return Number.isFinite(ms) && ms > 0 ? ms : null;
+}
 export function classifyRollupItem(item) {
+    const base = classifyVerdict(item);
+    return {
+        ...base,
+        workflow: base.kind === "CheckRun" ? (item.workflowName ?? "").trim() || null : null,
+        startedAt: timestamp(item.startedAt),
+        completedAt: timestamp(item.completedAt),
+    };
+}
+function classifyVerdict(item) {
     if (isCheckRun(item)) {
         const name = (item.name ?? "").trim() || "(unnamed check run)";
         const status = upper(item.status);
@@ -72,8 +93,62 @@ export function classifyRollupItem(item) {
     // Missing or undocumented state — fail closed.
     return { name, kind: "StatusContext", verdict: "failed", detail: state || "MISSING_STATE" };
 }
+/** Classified, latest item per check identity ({@link latestPerCheck}). */
 export function classifyRollup(items) {
-    return (items ?? []).map(classifyRollupItem);
+    return latestPerCheck((items ?? []).map(classifyRollupItem));
+}
+/**
+ * Check identity: CheckRun = workflow + name (two workflows may both have a `test` job);
+ * StatusContext = context. GitHub's `workflowName` carries no event, so runs of one workflow
+ * from different events share an identity here; the Actions part of the gate
+ * (`evaluateActionsRuns`) still judges the latest run per workflow + event.
+ */
+function checkIdentity(c) {
+    return c.kind === "CheckRun"
+        ? `CheckRun\u0000${c.workflow ?? ""}\u0000${c.name}`
+        : `StatusContext\u0000${c.name}`;
+}
+/**
+ * Keep the latest item per check identity, like GitHub's merge box, which shows the latest
+ * result of each check. "Latest" = the item that started last (`startedAt`; a re-run starts
+ * after the run it repeats), ties broken by `completedAt` (an in-flight item with no
+ * `completedAt` is newest). Its verdict stands: a newer pending item is pending, a newer
+ * failure fails even after an earlier pass.
+ *
+ * Fail closed when the order is unknown: if any item of an identity lacks `startedAt`
+ * (e.g. queued, or an older gh), or the latest items tie exactly, every item of that
+ * identity is kept — so any failure among them still fails and any pending still waits.
+ */
+export function latestPerCheck(checks) {
+    const groups = new Map();
+    for (const c of checks) {
+        const key = checkIdentity(c);
+        const group = groups.get(key);
+        if (group === undefined)
+            groups.set(key, [c]);
+        else
+            group.push(c);
+    }
+    const out = [];
+    for (const group of groups.values()) {
+        if (group.length === 1 || group.some((c) => (c.startedAt ?? null) === null)) {
+            out.push(...group);
+            continue;
+        }
+        const sorted = [...group].sort(compareRecency);
+        const newest = sorted[sorted.length - 1];
+        out.push(...sorted.filter((c) => compareRecency(c, newest) === 0));
+    }
+    return out;
+}
+/** Ascending recency: `startedAt`, then `completedAt` (missing = still running = newest). */
+function compareRecency(a, b) {
+    const started = (a.startedAt ?? 0) - (b.startedAt ?? 0);
+    if (started !== 0)
+        return started;
+    const ac = a.completedAt ?? Number.POSITIVE_INFINITY;
+    const bc = b.completedAt ?? Number.POSITIVE_INFINITY;
+    return ac === bc ? 0 : ac < bc ? -1 : 1;
 }
 /** Exact name, or a `*` glob (e.g. `lint*`, `* · linux`). */
 export function checkNameMatches(name, pattern) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodtek/vibeops",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "Minimal CLI rails for Cursor-based TASK-driven vibe coding.",
   "type": "module",
   "packageManager": "pnpm@9.15.9",