@plainconceptsplatform/workflows 1.6.41 → 1.6.47

package/loops/actions/housekeeping/action.yml

@@ -214,6 +214,47 @@ runs:
             retried += 1;
           }
 
+          // 1b. Release held children. The router holds a stack child while a `Blocked by #N` sibling is
+          // open and the landing of that sibling releases it. When the stack's root merged first, or the
+          // sibling landed on the default branch, no landing event ever comes: Pliny-Bot kept eight
+          // children held for a day behind issues that had been closed for hours. A sweep that finds
+          // every blocker closed sends the child back through the router, which no longer holds it.
+          // Once per issue: the router decides, and a child it holds again must not be dispatched on
+          // every sweep.
+          const RELEASE_MARKER = '<!-- housekeeping-release -->';
+          let released = 0;
+          for (const issue of issues) {
+            if (issue.pull_request) continue;
+            const labels = names(issue);
+            if (!labels.includes('implement')) continue;
+            if (['bot-working', 'stalled', 'review', 'pr-pending'].some((l) => labels.includes(l))) continue;
+            const thread = await github.paginate(github.rest.issues.listComments, {
+              ...context.repo, issue_number: issue.number, per_page: 100,
+            });
+            if (!thread.some((c) => (c.body ?? '').includes('<!-- stack-held -->'))) continue;
+            if (thread.some((c) => (c.body ?? '').includes(RELEASE_MARKER))) continue;
+            const blockers = [...new Set([...(issue.body ?? '').matchAll(/blocked by #(\d+)/gi)].map((m) => Number(m[1])))];
+            let stillOpen = 0;
+            for (const number of blockers) {
+              const blocker = await github.rest.issues.get({ ...context.repo, issue_number: number })
+                .then((r) => r.data).catch(() => null);
+              if (blocker && blocker.state === 'open') stillOpen += 1;
+            }
+            if (stillOpen > 0) continue;
+            await act(`#${issue.number}: releasing a held child, every blocker is closed`, async () => {
+              await github.rest.issues.createComment({
+                ...context.repo, issue_number: issue.number,
+                body: `${RELEASE_MARKER}\nEvery issue this one was blocked by is closed, so it is going back through the router.`,
+              });
+              await github.rest.actions.createWorkflowDispatch({
+                ...context.repo, workflow_id: 'work-router.yml',
+                ref: context.payload.repository.default_branch,
+                inputs: { operation: 'implement', 'issue-number': String(issue.number) },
+              });
+            });
+            released += 1;
+          }
+
           // 2. Strands. pr-pending says a pull request is open and waiting; when that pull request
           // closed without merging, nothing ever took the label off.
           for (const issue of issues) {

package/loops/actions/merge-train/merge-train.sh

@@ -161,6 +161,28 @@ SUMMARY="${GITHUB_STEP_SUMMARY:-/dev/null}"
 now_epoch=$(date -u +%s)
 iso_epoch() { date -u -d "$1" +%s 2>/dev/null || echo 0; }
 
+# The failing jobs of the CI run on a commit, read from the Actions API. The App behind the train's token
+# can dispatch workflows but may not read check runs (403 "Resource not accessible by integration"): the
+# check-runs calls then returned the same error text for the head and for the base, "what fails here" was
+# always a subset of "what fails on the base", and every red pull request was left waiting. Nothing is
+# printed, and the status is non-zero, when the run cannot be read, so the caller claims nothing.
+ci_runs_for_sha() {
+  local sha="$1" runs
+  # Every completed run on the commit, not only the CI workflow's: on the default branch the CI runs inside the
+  # deploy workflow. Extra failures on the base are harmless, the rule only asks that the pull request's own
+  # failures are among them.
+  runs=$(gh api "repos/$REPO/actions/runs?head_sha=$sha&per_page=100"     --jq '.workflow_runs[] | select(.status == "completed") | .id' 2>/dev/null) || return 1
+  [ -n "$runs" ] || return 1
+  printf '%s
+' "$runs"
+}
+
+ci_failed_jobs() {
+  local run="$1"
+  gh api "repos/$REPO/actions/runs/$run/jobs?per_page=100" \
+    --jq '.jobs[] | select(.conclusion == "failure") | [(.name | sub("^.* / "; "")), .completed_at] | @tsv' 2>/dev/null
+}
+
 summary() { printf '%s\n' "$*" >>"$SUMMARY"; }
 
 # Every write goes through this, so a dry run is honest: there is no second path that forgets.
@@ -433,18 +455,37 @@ for line in "${candidates[@]}"; do
   # the base is the pull request left alone.
   same_as_main=false
   if [ "$ci_status" = completed ] && [ "$ci_conclusion" = failure ] && [ "$park" = none ]; then
-    failed_here=$(gh api "repos/$REPO/commits/$head_sha/check-runs?per_page=100" \
-      --jq '[.check_runs[] | select(.conclusion == "failure") | (.name | sub("^.* / "; ""))] | unique | .[]' 2>/dev/null || true)
-    failed_base=$(gh api "repos/$REPO/commits/$base_ref/check-runs?per_page=100" \
-      --jq '[.check_runs[] | select(.conclusion == "failure") | (.name | sub("^.* / "; ""))] | unique | .[]' 2>/dev/null || true)
-    # How long the base has been red: the oldest failing check on its tip. The wait is bounded,
-    # because waiting for a base nobody fixes starves every pull request behind it. Pliny-Bot's
-    # main was red from 19:30 and the train waited until morning, ten hours, saying nothing.
-    red_since=$(gh api "repos/$REPO/commits/$base_ref/check-runs?per_page=100" \
-      --jq '[.check_runs[] | select(.conclusion == "failure") | .completed_at] | min // empty' 2>/dev/null || true)
+    failed_here=""
+    failed_base=""
+    red_since=""
+    base_sha=$(gh api "repos/$REPO/commits/$base_ref" --jq .sha 2>/dev/null || true)
+    here_jobs=$(ci_failed_jobs "${ci_run_id:-0}" || true)
+    failed_here=$(cut -f1 <<<"$here_jobs" | sort -u)
+    # A base tip with no completed CI run (a stack branch's tip is a merge commit nothing ran on) says
+    # nothing about the base: the pull request is judged on its own failures.
+    if [ -n "$base_sha" ] && base_runs=$(ci_runs_for_sha "$base_sha"); then
+      base_jobs=""
+      for base_run in $base_runs; do
+        base_jobs="$base_jobs$(ci_failed_jobs "$base_run" || true)"$'
+'
+      done
+      base_jobs=$(grep -v '^$' <<<"$base_jobs" || true)
+      failed_base=$(cut -f1 <<<"$base_jobs" | sort -u)
+      # How long the base has been red: the oldest failing job on its tip. The wait is bounded,
+      # because waiting for a base nobody fixes starves every pull request behind it. Pliny-Bot's
+      # main was red from 19:30 and the train waited until morning, ten hours, saying nothing.
+      red_since=$(cut -f2 <<<"$base_jobs" | sort | head -1)
+    fi
     red_for_hours=0
     if [ -n "$red_since" ]; then
-      red_for_hours=$(( (now_epoch - $(iso_epoch "$red_since")) / 3600 ))
+      # A date that does not parse reads as epoch 0, which made main "red for 497899h" and ended the
+      # wait at once (Pliny-Bot repaired five pull requests for failures main had too). No date, no claim.
+      red_epoch=$(iso_epoch "$red_since")
+      if [ "$red_epoch" -gt 0 ]; then
+        red_for_hours=$(( (now_epoch - red_epoch) / 3600 ))
+      else
+        echo "::warning::Could not read when $base_ref went red ('$red_since'); waiting for it as if it just did."
+      fi
     fi
     if [ -n "$failed_here" ] && [ -n "$failed_base" ] &&
       [ -z "$(comm -23 <(sort <<<"$failed_here") <(sort <<<"$failed_base"))" ]; then

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -2821,6 +2821,48 @@ else
   FAIL=$((FAIL + 1))
   echo "FAIL: implement flags an issue stalled next to the pull request it just opened" >&2
 fi
+# A date the train cannot parse must not read as "main has been red since 1970".
+if grep -qF 'Could not read when $base_ref went red' "${HERE}/../merge-train/merge-train.sh"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the merge train treats an unparsable red-since date as an endless red main" >&2
+fi
+# Every merge gate agent used to share one group, so a merging gate waited behind repairs.
+if grep -qF 'gh-aw-opencode-agent-merge-gate-${{ inputs.pr-number }}' "${WORKFLOWS_DIR}/agent-merge-gate.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: merge gate agents share one repository-wide concurrency group" >&2
+fi
+# The gate resolves conflicts by taking hunks apart, not by keeping one side or both.
+if grep -qF 'A conflict is not always two additions.' "${WORKFLOWS_DIR}/agent-merge-gate.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the merge gate prompt must say a conflict is not always two additions" >&2
+fi
+# a held stack child whose blockers all closed is sent back through the router by the janitor.
+if grep -qF 'releasing a held child, every blocker is closed' "${HERE}/../housekeeping/action.yml"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the janitor does not release a held child whose blockers all closed" >&2
+fi
+# the train reads failing jobs from the Actions API, not from check runs its App cannot read.
+if grep -qF 'ci_failed_jobs()' "${HERE}/../merge-train/merge-train.sh" && ! grep -qF 'check-runs?per_page=100' "${HERE}/../merge-train/merge-train.sh"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the merge train compares failures through check runs its App cannot read" >&2
+fi
+# the gate measures check-diff against the branch the pull request merges into, not the default branch.
+if grep -qF "needs.subject.outputs.pr_base || github.event.repository.default_branch" "${WORKFLOWS_DIR}/agent-merge-gate.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the gate measures a stack child's comments and tests against the default branch" >&2
+fi
 # An empty AGENT_TIER_MODEL must remove an override a reused runner kept from an earlier job.
 if grep -qF 'rm -f .opencode/harness.user.json' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
   PASS=$((PASS + 1))

package/loops/workflows/agent-merge-gate.md

@@ -337,7 +337,11 @@ jobs:
       - name: Check the comments and tests it adds
         id: check
         env:
-          BASE: origin/${{ github.event.repository.default_branch || 'main' }}
+          # The branch the pull request merges into, not the default branch: for a stack child that is the
+          # feature branch. Against the default branch the base is the merge-base with it, which holds every
+          # sibling already landed in the stack, so Pliny-Bot #853 (2 tests of its own) was held for 28 against
+          # a budget of 26 that the parent's work had already spent.
+          BASE: origin/${{ needs.subject.outputs.pr_base || github.event.repository.default_branch || 'main' }}
         run: |
           set -uo pipefail
           if [ ! -f .opencode/scripts/check-diff.mjs ]; then
@@ -898,6 +902,13 @@ secrets:
 engine:
   id: opencode
   version: "1.2.14"
+  # One agent per pull request and kind, not one per repository. gh-aw's default group made every
+  # gate's agent job wait behind every other: Pliny-Bot's merging gate for #835 sat pending behind
+  # three repair agents for #846 to #848. The router already serialises what may merge (merge-belt)
+  # and keeps a pull request's repairs in a line of their own.
+  concurrency:
+    group: "gh-aw-opencode-agent-merge-gate-${{ inputs.pr-number }}-${{ inputs.ci-conclusion }}"
+    queue: max
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
@@ -1094,6 +1105,17 @@ timeout-minutes: 120
     use `--ours`, `--theirs`, or a blanket conflict-marker deletion without reviewing the
     intended behavior from both sides, and never rebase: the push is fast-forward only.
 
+    A conflict is not always two additions. When one side deleted what the other still edits (a
+    removed module, a retired block of translations), keeping the deleting side wholesale drops
+    everything the pull request put inside that block, and keeping both brings the deleted code
+    back. Take such a hunk apart: keep what the pull request added that still has a home, drop only
+    what the base retired. After resolving a locale file or any other keyed file, list the keys the
+    pull request added (its tip against its merge base) and confirm each still exists, then build
+    and run the tests that use them. Pliny-Bot #837 lost its approval card strings this way and
+    failed on a missing label. Two pull requests that each passed CI can also break the base
+    together, one deleting a namespace the other still uses; only a green run on the current base
+    says a merge is safe.
+
     Scope verification to the files the merge touched: pass changed file paths to
     lint/format tools instead of running them repository-wide (see step 6's scoped
     verification guidance).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.6.41",
+  "version": "1.6.47",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",