@plainconceptsplatform/workflows 1.6.10 → 1.6.11

package/loops/actions/identify-gate-subject/action.yml

@@ -132,6 +132,31 @@ runs:
         # both stalled on a human that way while CI was legitimately red and remediable.
         ci_conclusion="$CONCLUSION"
         ci_run_id="$CI_RUN_ID"
+
+        # A verdict from a CI run that judged an older head is not a verdict on this one. The
+        # router carries the run it saw, and the head can move before the gate starts: a repair
+        # pushed, a branch updated from main. Pliny-Bot #729 was blocked and sent to review on a
+        # red run of a commit that two later pushes had already fixed, and the gate's own report
+        # said so. When the run's commit is not the head, the carried verdict is dropped and read
+        # again from the head's own latest run; when that head has no finished run yet, there is
+        # nothing to judge, and the gate steps aside until CI finishes and the train hands the
+        # pull request back.
+        if [ -n "$ci_run_id" ]; then
+          run_sha="$(gh api "repos/$REPO/actions/runs/$ci_run_id" --jq '.head_sha' 2>/dev/null || true)"
+          current_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
+          if [ -n "$run_sha" ] && [ "$run_sha" != "$current_sha" ]; then
+            echo "::notice::CI run $ci_run_id judged ${run_sha:0:7}, but the head is ${current_sha:0:7}; reading the verdict again from the head."
+            ci_conclusion=""
+            ci_run_id=""
+            fresh="$(gh api "repos/$REPO/actions/runs?head_sha=$current_sha&per_page=100"               --jq '[.workflow_runs[] | select((.name | ascii_downcase) == "app: ci" or (.name | ascii_downcase) == "ci") | select(.status == "completed")] | sort_by(.created_at) | last')"
+            if [ -z "$fresh" ] || [ "$fresh" = "null" ]; then
+              none "CI has not finished on the current head of PR #$PR_NUMBER; the train hands it back when it has"
+            fi
+            ci_conclusion="$(jq -r '.conclusion // "pending"' <<<"$fresh")"
+            ci_run_id="$(jq -r '.id' <<<"$fresh")"
+          fi
+        fi
+
         if [ -z "$ci_conclusion" ] || [ -z "$ci_run_id" ]; then
           head_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
           # A run keeps the name it had when it ran, so a repository whose CI was renamed still

package/loops/actions/merge-train/merge-train.sh

@@ -38,6 +38,10 @@ set -euo pipefail
 #   CI_STATUS          none, or the latest CI run's status (queued, in_progress, completed, ...)
 #   CI_CONCLUSION      that run's conclusion when it completed
 #   CI_STUCK           true when that run has been pending longer than the train waits
+#   SAME_AS_MAIN       true when every check that failed on the head also fails on the base branch
+#                      tip: the failure is the base's, and repairing the pull request spends its
+#                      attempts on code that is not at fault (Pliny-Bot, 2026-10-17: a red main
+#                      cost every open pull request its repairs for seven hours)
 #   BEHIND_BY          commits on the base branch the head does not have
 #   TRUSTED_AUTHOR     true when a trusted bot opened it (only those runs are approved)
 train_move() {
@@ -70,7 +74,13 @@ train_move() {
               move=gate; reason="green and up to date"
             fi
             ;;
-          failure) move=gate; reason="CI failed" ;;
+          failure)
+            if [ "${SAME_AS_MAIN:-false}" = true ]; then
+              move="wait"; reason="CI failed, but only on checks that fail on the base branch too; waiting for the base to be fixed"
+            else
+              move=gate; reason="CI failed"
+            fi
+            ;;
           action_required)
             if [ "${TRUSTED_AUTHOR:-false}" = true ]; then
               move=approve; reason="CI is waiting for approval"
@@ -403,12 +413,28 @@ for line in "${candidates[@]}"; do
     fi
   fi
 
+  # What failed on the head, compared with what is failing on the base branch tip. Names are
+  # compared after the last " / ": a check that a reusable workflow runs is "CI / backend" on the
+  # base branch and "backend" on a pull request. Only when every failed check is also failing on
+  # the base is the pull request left alone.
+  same_as_main=false
+  if [ "$ci_status" = completed ] && [ "$ci_conclusion" = failure ] && [ "$park" = none ]; then
+    failed_here=$(gh api "repos/$REPO/commits/$head_sha/check-runs?per_page=100" \
+      --jq '[.check_runs[] | select(.conclusion == "failure") | (.name | sub("^.* / "; ""))] | unique | .[]' 2>/dev/null || true)
+    failed_base=$(gh api "repos/$REPO/commits/$base_ref/check-runs?per_page=100" \
+      --jq '[.check_runs[] | select(.conclusion == "failure") | (.name | sub("^.* / "; ""))] | unique | .[]' 2>/dev/null || true)
+    if [ -n "$failed_here" ] && [ -n "$failed_base" ] &&
+      [ -z "$(comm -23 <(sort <<<"$failed_here") <(sort <<<"$failed_base"))" ]; then
+      same_as_main=true
+    fi
+  fi
+
   trusted_author=false
   is_trusted_bot "$author" && trusted_author=true
 
   decision=$(HOLD="$hold" REVIEW_DECISION="$review_decision" PARK="$park" \
     ATTEMPTS="$attempts" MAX_ATTEMPTS="$MAX_ATTEMPTS" SILENT_GATE="$silent_gate" MERGEABLE="$mergeable" \
-    CI_STATUS="$ci_status" CI_CONCLUSION="$ci_conclusion" CI_STUCK="$ci_stuck" \
+    CI_STATUS="$ci_status" CI_CONCLUSION="$ci_conclusion" CI_STUCK="$ci_stuck" SAME_AS_MAIN="$same_as_main" \
     BEHIND_BY="${behind_by:-0}" TRUSTED_AUTHOR="$trusted_author" train_move)
   move=$(sed -n 's/^move=//p' <<<"$decision")
   reason=$(sed -n 's/^reason=//p' <<<"$decision")

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -1979,6 +1979,11 @@ if worker_installed merge-gate; then
     assert "running CI is waited on" wait "$(move MERGEABLE=MERGEABLE CI_STATUS=in_progress)"
     assert "CI stuck past the limit is passed by" skip "$(move MERGEABLE=MERGEABLE CI_STATUS=queued CI_STUCK=true)"
     assert "red CI goes to the gate" gate "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=failure)"
+    # A red base branch cost every open Pliny-Bot pull request its repairs for seven hours: the
+    # failures were main's, and the gate spent attempts on code that was not at fault.
+    assert "a failure that is main's too is waited out, not repaired" wait "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=failure SAME_AS_MAIN=true)"
+    assert "a failure that is not main's still goes to the gate" gate "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=failure SAME_AS_MAIN=false)"
+    assert "a conflict is still the gate's even when main is red" gate "$(move MERGEABLE=CONFLICTING CI_STATUS=completed CI_CONCLUSION=failure SAME_AS_MAIN=true)"
     assert "green but behind is brought up to date first" update "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=success BEHIND_BY=2)"
     assert "green and current goes to the gate" gate "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=success BEHIND_BY=0)"
     assert "no CI run is passed by" skip "$(move MERGEABLE=MERGEABLE CI_STATUS=none)"
@@ -2758,6 +2763,11 @@ if worker_installed merge-gate; then
       GATE_RUN_ID_OK=0
       echo "FAIL: identify-gate-subject resolves the CI run only when the conclusion is unknown; a router that passes both gets an empty run ID" >&2
     fi
+    # A verdict from a run that judged an older head is not a verdict on this one (Pliny-Bot #729).
+    grep -Fq '"$run_sha" != "$current_sha"' "$GATE_SUBJECT_ACTION" ||
+      { GATE_RUN_ID_OK=0; echo "FAIL: identify-gate-subject trusts the carried CI run even when it judged an older head" >&2; }
+    grep -Fq 'select(.status == "completed")' "$GATE_SUBJECT_ACTION" ||
+      { GATE_RUN_ID_OK=0; echo "FAIL: identify-gate-subject re-reads a stale verdict without requiring a finished run on the head" >&2; }
   fi
 # Repeating a report the validator refused reproduces it, and every repeat is a fresh agent run
 # holding the repo-wide merge-belt slot. The worker gives that failure a smaller budget than a

package/loops/workflows/agent-implement.md

@@ -594,6 +594,7 @@ jobs:
           body: |
             ${{ env.IMPLEMENT_MARKER }}
             ${{ env.INCOMPLETE_COMMENT }}
+            What ended: the agent job was **${{ needs.agent.result }}** after ${{ steps.decide.outputs.minutes }} minutes (-1 when that could not be read), and publishing its output was **${{ needs.safe_outputs.result }}**.
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
   agent:
     needs: [eligibility]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.6.10",
+  "version": "1.6.11",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",