@plainconceptsplatform/workflows 1.6.42 → 1.6.48

package/loops/actions/housekeeping/action.yml

@@ -214,6 +214,47 @@ runs:
             retried += 1;
           }
 
+          // 1b. Release held children. The router holds a stack child while a `Blocked by #N` sibling is
+          // open and the landing of that sibling releases it. When the stack's root merged first, or the
+          // sibling landed on the default branch, no landing event ever comes: Pliny-Bot kept eight
+          // children held for a day behind issues that had been closed for hours. A sweep that finds
+          // every blocker closed sends the child back through the router, which no longer holds it.
+          // Once per issue: the router decides, and a child it holds again must not be dispatched on
+          // every sweep.
+          const RELEASE_MARKER = '<!-- housekeeping-release -->';
+          let released = 0;
+          for (const issue of issues) {
+            if (issue.pull_request) continue;
+            const labels = names(issue);
+            if (!labels.includes('implement')) continue;
+            if (['bot-working', 'stalled', 'review', 'pr-pending'].some((l) => labels.includes(l))) continue;
+            const thread = await github.paginate(github.rest.issues.listComments, {
+              ...context.repo, issue_number: issue.number, per_page: 100,
+            });
+            if (!thread.some((c) => (c.body ?? '').includes('<!-- stack-held -->'))) continue;
+            if (thread.some((c) => (c.body ?? '').includes(RELEASE_MARKER))) continue;
+            const blockers = [...new Set([...(issue.body ?? '').matchAll(/blocked by #(\d+)/gi)].map((m) => Number(m[1])))];
+            let stillOpen = 0;
+            for (const number of blockers) {
+              const blocker = await github.rest.issues.get({ ...context.repo, issue_number: number })
+                .then((r) => r.data).catch(() => null);
+              if (blocker && blocker.state === 'open') stillOpen += 1;
+            }
+            if (stillOpen > 0) continue;
+            await act(`#${issue.number}: releasing a held child, every blocker is closed`, async () => {
+              await github.rest.issues.createComment({
+                ...context.repo, issue_number: issue.number,
+                body: `${RELEASE_MARKER}\nEvery issue this one was blocked by is closed, so it is going back through the router.`,
+              });
+              await github.rest.actions.createWorkflowDispatch({
+                ...context.repo, workflow_id: 'work-router.yml',
+                ref: context.payload.repository.default_branch,
+                inputs: { operation: 'implement', 'issue-number': String(issue.number) },
+              });
+            });
+            released += 1;
+          }
+
           // 2. Strands. pr-pending says a pull request is open and waiting; when that pull request
           // closed without merging, nothing ever took the label off.
           for (const issue of issues) {

package/loops/actions/identify-gate-subject/action.yml

@@ -144,7 +144,11 @@ runs:
         if [ -n "$ci_run_id" ]; then
           run_sha="$(gh api "repos/$REPO/actions/runs/$ci_run_id" --jq '.head_sha' 2>/dev/null || true)"
           current_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
-          if [ -n "$run_sha" ] && [ "$run_sha" != "$current_sha" ]; then
+          # A conflicting pull request has no merge ref, so CI never runs on its head: the gate keeps
+          # the carried verdict and resolves the conflict. Pliny-Bot #862 was handed to the gate and
+          # declined every five minutes for an hour waiting for a run that could not start.
+          conflicting="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json mergeable --jq '.mergeable' 2>/dev/null || true)"
+          if [ -n "$run_sha" ] && [ "$run_sha" != "$current_sha" ] && [ "$conflicting" != CONFLICTING ]; then
             echo "::notice::CI run $ci_run_id judged ${run_sha:0:7}, but the head is ${current_sha:0:7}; reading the verdict again from the head."
             ci_conclusion=""
             ci_run_id=""
@@ -154,6 +158,8 @@ runs:
             fi
             ci_conclusion="$(jq -r '.conclusion // "pending"' <<<"$fresh")"
             ci_run_id="$(jq -r '.id' <<<"$fresh")"
+          elif [ "$conflicting" = CONFLICTING ]; then
+            echo "::notice::PR #$PR_NUMBER conflicts with its base, so CI cannot run on its head; the gate resolves the conflict."
           fi
         fi
 

package/loops/actions/merge-train/action.yml

@@ -50,6 +50,10 @@ inputs:
     description: Decide and report the move without making it.
     required: false
     default: 'false'
+  ci-depth-tiered:
+    description: "true when the repository's CI runs only light checks on a bot's push and the full CI when the train asks (repository variable CI_DEPTH_TIERED)."
+    required: false
+    default: 'false'
   ci-run-id:
     description: A CI run that handed its verdict over from inside itself, and so still reads as in progress.
     required: false
@@ -78,6 +82,7 @@ runs:
         MAIN_RED_WAIT_HOURS: ${{ inputs.main-red-wait-hours }}
         MAX_REPAIRS: ${{ inputs.max-repairs }}
         DRY_RUN: ${{ inputs.dry-run }}
+        CI_DEPTH_TIERED: ${{ inputs.ci-depth-tiered }}
         HINT_RUN_ID: ${{ inputs.ci-run-id }}
         HINT_CONCLUSION: ${{ inputs.ci-conclusion }}
       run: bash "${GITHUB_ACTION_PATH}/merge-train.sh"

package/loops/actions/merge-train/merge-train.sh

@@ -70,6 +70,8 @@ train_move() {
           success)
             if [ "${BEHIND_BY:-0}" -gt 0 ]; then
               move=update; reason="green but ${BEHIND_BY} commit(s) behind its base branch"
+            elif [ "${CI_SHALLOW:-false}" = true ]; then
+              move=deepen; reason="green on the light checks only; the full CI has not run on this head"
             else
               move=gate; reason="green and up to date"
             fi
@@ -161,6 +163,28 @@ SUMMARY="${GITHUB_STEP_SUMMARY:-/dev/null}"
 now_epoch=$(date -u +%s)
 iso_epoch() { date -u -d "$1" +%s 2>/dev/null || echo 0; }
 
+# The failing jobs of the CI run on a commit, read from the Actions API. The App behind the train's token
+# can dispatch workflows but may not read check runs (403 "Resource not accessible by integration"): the
+# check-runs calls then returned the same error text for the head and for the base, "what fails here" was
+# always a subset of "what fails on the base", and every red pull request was left waiting. Nothing is
+# printed, and the status is non-zero, when the run cannot be read, so the caller claims nothing.
+ci_runs_for_sha() {
+  local sha="$1" runs
+  # Every completed run on the commit, not only the CI workflow's: on the default branch the CI runs inside the
+  # deploy workflow. Extra failures on the base are harmless, the rule only asks that the pull request's own
+  # failures are among them.
+  runs=$(gh api "repos/$REPO/actions/runs?head_sha=$sha&per_page=100"     --jq '.workflow_runs[] | select(.status == "completed") | .id' 2>/dev/null) || return 1
+  [ -n "$runs" ] || return 1
+  printf '%s
+' "$runs"
+}
+
+ci_failed_jobs() {
+  local run="$1"
+  gh api "repos/$REPO/actions/runs/$run/jobs?per_page=100" \
+    --jq '.jobs[] | select(.conclusion == "failure") | [(.name | sub("^.* / "; "")), .completed_at] | @tsv' 2>/dev/null
+}
+
 summary() { printf '%s\n' "$*" >>"$SUMMARY"; }
 
 # Every write goes through this, so a dry run is honest: there is no second path that forgets.
@@ -177,6 +201,32 @@ act() {
   "$@"
 }
 
+# Tiered CI: the label that asks a pull request's CI for the full depth. The CI's depth job reads the
+# pull request's labels at run time, so a re-run of the same pull_request run turns full: the event and
+# its context stay the pull request's, which the scope, mutation and coverage jobs rely on (a separate
+# workflow_dispatch run would lose it, and mutation runs on pull_request events only).
+CI_FULL_LABEL="ci-full"
+
+mark_full_ci() {
+  local pr="$1"
+  gh label create "$CI_FULL_LABEL" --repo "$REPO" --color 0E8A16 \
+    --description "The CI runs at full depth on this pull request (set by the merge train)" >/dev/null 2>&1 || true
+  gh api -X POST "repos/$REPO/issues/$pr/labels" -f "labels[]=$CI_FULL_LABEL" >/dev/null 2>&1
+}
+
+deepen_ci() {
+  local pr="$1" run="$2"
+  [ -n "$run" ] || return 1
+  mark_full_ci "$pr" || return 1
+  # A CI handover reaches the train from inside the run, and a run still going cannot be re-run.
+  local i
+  for i in 1 2 3 4 5 6 7 8 9 10 11 12; do
+    [ "$(gh api "repos/$REPO/actions/runs/$run" --jq .status 2>/dev/null)" = completed ] && break
+    sleep 10
+  done
+  gh run rerun "$run" --repo "$REPO" >/dev/null 2>&1
+}
+
 is_trusted_bot() {
   case " $TRUSTED_BOTS " in *" $1 "*) return 0 ;; esac
   return 1
@@ -413,6 +463,16 @@ for line in "${candidates[@]}"; do
       success | failure) ci_status=completed; ci_conclusion="$HINT_CONCLUSION" ;;
     esac
   fi
+  # Tiered CI (CI_DEPTH_TIERED): a bot's push runs the light checks and the full CI runs once, when the
+  # pull request is next in line. Pliny-Bot spent two thirds of its pull request CI on heads that were
+  # replaced before they merged. A green run without a successful "Full CI" job was light and says
+  # nothing about the tests. When the jobs cannot be read the run is taken as full, as before.
+  ci_shallow=false
+  if [ "${CI_DEPTH_TIERED:-false}" = true ] && [ "$ci_status" = completed ] && [ "$ci_conclusion" = success ] && [ -n "${ci_run_id:-}" ]; then
+    full_jobs=$(gh api "repos/$REPO/actions/runs/$ci_run_id/jobs?per_page=100" \
+      --jq '[.jobs[] | select((.name | test("(^|/ )Full CI$")) and .conclusion == "success")] | length' 2>/dev/null || echo "")
+    [ "$full_jobs" = 0 ] && ci_shallow=true
+  fi
   ci_stuck=false
   if [ "$ci_status" != none ] && [ "$ci_status" != completed ] && [ -n "${ci_created:-}" ]; then
     [ $((now_epoch - $(iso_epoch "$ci_created"))) -lt $((STUCK_HOURS * 3600)) ] || ci_stuck=true
@@ -433,15 +493,27 @@ for line in "${candidates[@]}"; do
   # the base is the pull request left alone.
   same_as_main=false
   if [ "$ci_status" = completed ] && [ "$ci_conclusion" = failure ] && [ "$park" = none ]; then
-    failed_here=$(gh api "repos/$REPO/commits/$head_sha/check-runs?per_page=100" \
-      --jq '[.check_runs[] | select(.conclusion == "failure") | (.name | sub("^.* / "; ""))] | unique | .[]' 2>/dev/null || true)
-    failed_base=$(gh api "repos/$REPO/commits/$base_ref/check-runs?per_page=100" \
-      --jq '[.check_runs[] | select(.conclusion == "failure") | (.name | sub("^.* / "; ""))] | unique | .[]' 2>/dev/null || true)
-    # How long the base has been red: the oldest failing check on its tip. The wait is bounded,
-    # because waiting for a base nobody fixes starves every pull request behind it. Pliny-Bot's
-    # main was red from 19:30 and the train waited until morning, ten hours, saying nothing.
-    red_since=$(gh api "repos/$REPO/commits/$base_ref/check-runs?per_page=100" \
-      --jq '[.check_runs[] | select(.conclusion == "failure") | .completed_at] | min // empty' 2>/dev/null || true)
+    failed_here=""
+    failed_base=""
+    red_since=""
+    base_sha=$(gh api "repos/$REPO/commits/$base_ref" --jq .sha 2>/dev/null || true)
+    here_jobs=$(ci_failed_jobs "${ci_run_id:-0}" || true)
+    failed_here=$(cut -f1 <<<"$here_jobs" | sort -u)
+    # A base tip with no completed CI run (a stack branch's tip is a merge commit nothing ran on) says
+    # nothing about the base: the pull request is judged on its own failures.
+    if [ -n "$base_sha" ] && base_runs=$(ci_runs_for_sha "$base_sha"); then
+      base_jobs=""
+      for base_run in $base_runs; do
+        base_jobs="$base_jobs$(ci_failed_jobs "$base_run" || true)"$'
+'
+      done
+      base_jobs=$(grep -v '^$' <<<"$base_jobs" || true)
+      failed_base=$(cut -f1 <<<"$base_jobs" | sort -u)
+      # How long the base has been red: the oldest failing job on its tip. The wait is bounded,
+      # because waiting for a base nobody fixes starves every pull request behind it. Pliny-Bot's
+      # main was red from 19:30 and the train waited until morning, ten hours, saying nothing.
+      red_since=$(cut -f2 <<<"$base_jobs" | sort | head -1)
+    fi
     red_for_hours=0
     if [ -n "$red_since" ]; then
       # A date that does not parse reads as epoch 0, which made main "red for 497899h" and ended the
@@ -469,7 +541,7 @@ for line in "${candidates[@]}"; do
   decision=$(HOLD="$hold" REVIEW_DECISION="$review_decision" PARK="$park" \
     ATTEMPTS="$attempts" MAX_ATTEMPTS="$MAX_ATTEMPTS" SILENT_GATE="$silent_gate" MERGEABLE="$mergeable" \
     CI_STATUS="$ci_status" CI_CONCLUSION="$ci_conclusion" CI_STUCK="$ci_stuck" SAME_AS_MAIN="$same_as_main" \
-    BEHIND_BY="${behind_by:-0}" TRUSTED_AUTHOR="$trusted_author" train_move)
+    BEHIND_BY="${behind_by:-0}" TRUSTED_AUTHOR="$trusted_author" CI_SHALLOW="$ci_shallow" train_move)
   move=$(sed -n 's/^move=//p' <<<"$decision")
   reason=$(sed -n 's/^reason=//p' <<<"$decision")
 
@@ -510,11 +582,30 @@ for line in "${candidates[@]}"; do
       merge_blocked=true
       continue
       ;;
+    deepen)
+      if [ "$merge_blocked" = true ]; then
+        echo "  #$pr waits for the pull request ahead of it before its full CI runs."
+        continue
+      fi
+      if act "Running the full CI on #$pr, which is next in line." deepen_ci "$pr" "${ci_run_id:-}"; then
+        merge_blocked=true
+        continue
+      fi
+      # Never a gate on the light run: it could merge code no test has run on. The pull request is
+      # skipped this tick and the line moves on, so one that cannot be deepened does not stop the rest.
+      echo "::warning::Could not start the full CI on #$pr; it is skipped this tick."
+      continue
+      ;;
     update)
       if [ "$merge_blocked" = true ]; then
         echo "  #$pr waits for the pull request ahead of it before it is brought up to date."
         continue
       fi
+      # Next in line: with tiered CI the run this update starts is the one that decides, so it runs full.
+      if [ "${CI_DEPTH_TIERED:-false}" = true ]; then
+        act "Asking for the full CI on #$pr before it is brought up to date." mark_full_ci "$pr" ||
+          echo "::warning::Could not label #$pr for the full CI; its update runs the light checks."
+      fi
       # Merge, never rebase: the gate's pushes are fast-forward only, and so are a person's.
       if act "Merging $base_ref into #$pr so CI judges it against what it will land on." \
         update_branch "$pr" "$head_sha"; then

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -2828,6 +2828,64 @@ else
   FAIL=$((FAIL + 1))
   echo "FAIL: the merge train treats an unparsable red-since date as an endless red main" >&2
 fi
+# Every merge gate agent used to share one group, so a merging gate waited behind repairs.
+if grep -qF 'gh-aw-opencode-agent-merge-gate-${{ inputs.pr-number }}' "${WORKFLOWS_DIR}/agent-merge-gate.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: merge gate agents share one repository-wide concurrency group" >&2
+fi
+# The gate resolves conflicts by taking hunks apart, not by keeping one side or both.
+if grep -qF 'A conflict is not always two additions.' "${WORKFLOWS_DIR}/agent-merge-gate.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the merge gate prompt must say a conflict is not always two additions" >&2
+fi
+# a held stack child whose blockers all closed is sent back through the router by the janitor.
+if grep -qF 'releasing a held child, every blocker is closed' "${HERE}/../housekeeping/action.yml"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the janitor does not release a held child whose blockers all closed" >&2
+fi
+# the train reads failing jobs from the Actions API, not from check runs its App cannot read.
+if grep -qF 'ci_failed_jobs()' "${HERE}/../merge-train/merge-train.sh" && ! grep -qF 'check-runs?per_page=100' "${HERE}/../merge-train/merge-train.sh"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the merge train compares failures through check runs its App cannot read" >&2
+fi
+# the gate measures check-diff against the branch the pull request merges into, not the default branch.
+if grep -qF "needs.subject.outputs.pr_base || github.event.repository.default_branch" "${WORKFLOWS_DIR}/agent-merge-gate.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the gate measures a stack child's comments and tests against the default branch" >&2
+fi
+# Tiered CI: the train deepens a light green run instead of gating it, and never gates a light run.
+if grep -qF 'move=deepen' "${HERE}/../merge-train/merge-train.sh" &&
+  grep -qF 'deepen_ci "$pr" "${ci_run_id:-}"' "${HERE}/../merge-train/merge-train.sh" &&
+  grep -qF "ci-depth-tiered: \${{ vars.CI_DEPTH_TIERED || 'false' }}" "${WORKFLOWS_DIR}/work-router.yml"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the merge train does not ask for the full CI before gating a light run" >&2
+fi
+# The implement agent tests only what it changed; the repository's CI runs the full suite.
+if grep -qF 'Test only what you changed; CI tests the rest.' "${WORKFLOWS_DIR}/agent-implement.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: implement tests only what it changed is missing from the prompt" >&2
+fi
+# A conflicting pull request is gated on its carried verdict: CI cannot run on a head with no merge ref.
+if grep -qF '[ "$conflicting" != CONFLICTING ]' "${HERE}/../identify-gate-subject/action.yml"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the gate waits for CI on a conflicting pull request, which never gets a run" >&2
+fi
 # An empty AGENT_TIER_MODEL must remove an override a reused runner kept from an earlier job.
 if grep -qF 'rm -f .opencode/harness.user.json' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
   PASS=$((PASS + 1))

package/loops/workflows/agent-implement.md

@@ -839,6 +839,16 @@ timeout-minutes: 180
 
      Never open a pull request that does not pass them.
 
+     **Test only what you changed; CI tests the rest.** In this run, run the tests that cover the
+     code you touched and nothing wider: the test files you added or edited, and the tests next to
+     the code you changed (web: `pnpm exec vitest related --run <changed files>`; .NET:
+     `dotnet test <the test project> --filter <the test classes>`). Do not run integration,
+     end-to-end, mutation or coverage suites here, and do not run the whole test suite to be safe:
+     the repository's CI runs all of it on your pull request before anything merges, on a runner
+     that has the database and the browsers this sandbox lacks. The verification commands above are
+     the repository's quick check for that reason. A full suite in the agent is the slowest part of
+     a run and repeats what CI does anyway.
+
      **Run them once, on the final tree.** They are slow: Pliny-Bot's `pnpm verify` is about
      twenty minutes of work on this runner. `pc-plan-apply` runs them in its verify step, and
      that run is this one: do not run them again when nothing changed since. Order the end of

package/loops/workflows/agent-merge-gate.md

@@ -337,7 +337,11 @@ jobs:
       - name: Check the comments and tests it adds
         id: check
         env:
-          BASE: origin/${{ github.event.repository.default_branch || 'main' }}
+          # The branch the pull request merges into, not the default branch: for a stack child that is the
+          # feature branch. Against the default branch the base is the merge-base with it, which holds every
+          # sibling already landed in the stack, so Pliny-Bot #853 (2 tests of its own) was held for 28 against
+          # a budget of 26 that the parent's work had already spent.
+          BASE: origin/${{ needs.subject.outputs.pr_base || github.event.repository.default_branch || 'main' }}
         run: |
           set -uo pipefail
           if [ ! -f .opencode/scripts/check-diff.mjs ]; then
@@ -898,6 +902,13 @@ secrets:
 engine:
   id: opencode
   version: "1.2.14"
+  # One agent per pull request and kind, not one per repository. gh-aw's default group made every
+  # gate's agent job wait behind every other: Pliny-Bot's merging gate for #835 sat pending behind
+  # three repair agents for #846 to #848. The router already serialises what may merge (merge-belt)
+  # and keeps a pull request's repairs in a line of their own.
+  concurrency:
+    group: "gh-aw-opencode-agent-merge-gate-${{ inputs.pr-number }}-${{ inputs.ci-conclusion }}"
+    queue: max
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
@@ -1094,6 +1105,17 @@ timeout-minutes: 120
     use `--ours`, `--theirs`, or a blanket conflict-marker deletion without reviewing the
     intended behavior from both sides, and never rebase: the push is fast-forward only.
 
+    A conflict is not always two additions. When one side deleted what the other still edits (a
+    removed module, a retired block of translations), keeping the deleting side wholesale drops
+    everything the pull request put inside that block, and keeping both brings the deleted code
+    back. Take such a hunk apart: keep what the pull request added that still has a home, drop only
+    what the base retired. After resolving a locale file or any other keyed file, list the keys the
+    pull request added (its tip against its merge base) and confirm each still exists, then build
+    and run the tests that use them. Pliny-Bot #837 lost its approval card strings this way and
+    failed on a missing label. Two pull requests that each passed CI can also break the base
+    together, one deleting a namespace the other still uses; only a green run on the current base
+    says a merge is safe.
+
     Scope verification to the files the merge touched: pass changed file paths to
     lint/format tools instead of running them repository-wide (see step 6's scoped
     verification guidance).

package/loops/workflows/work-router.yml

@@ -938,6 +938,8 @@ jobs:
           dry-run: ${{ env.MERGE_TRAIN_DRY_RUN }}
           ci-run-id: ${{ needs.classify.outputs.ci-run-id }}
           ci-conclusion: ${{ needs.classify.outputs.ci-conclusion }}
+          # Repository variable, read by the repository's CI as well: one switch for both sides.
+          ci-depth-tiered: ${{ vars.CI_DEPTH_TIERED || 'false' }}
 
   # The decision the gate parked for: a person with write access approves a pull request the
   # gate handed to them (human-review or owner-review), and the bot merges the commit they

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.6.42",
+  "version": "1.6.48",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",