@vypdev/copilot 3.5.2 → 3.5.4

package/build/cli/index.js

@@ -38159,6 +38159,27 @@ function runAtApplicationErrorBoundary(operation) {
 }
 
 
+/***/ }),
+
+/***/ 72594:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DeploymentMergeEffectError = void 0;
+const application_error_1 = __nccwpck_require__(75999);
+/** Semantic effect failure. Only a confirmed readiness rejection permits one new inspection. */
+class DeploymentMergeEffectError extends application_error_1.ApplicationError {
+    constructor(action, readinessChanged, code, message, cause) {
+        super(code, message, { cause });
+        this.action = action;
+        this.readinessChanged = readinessChanged;
+    }
+}
+exports.DeploymentMergeEffectError = DeploymentMergeEffectError;
+
+
 /***/ }),
 
 /***/ 38313:
@@ -51843,6 +51864,91 @@ function bindSddEvidenceReadPorts(ports) {
 }
 
 
+/***/ }),
+
+/***/ 84387:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DeploymentMergeEffects = void 0;
+const application_error_1 = __nccwpck_require__(75999);
+const deployment_merge_effect_error_1 = __nccwpck_require__(72594);
+const managed_pull_request_1 = __nccwpck_require__(95914);
+/** Applies current policy, with one bounded re-observation after a typed readiness rejection. */
+class DeploymentMergeEffects {
+    constructor(pullRequests) {
+        this.pullRequests = pullRequests;
+    }
+    async configure(operation, pullRequest, inspection, inspect, beforeApply) {
+        await beforeApply(inspection.decision.mode);
+        const action = selectAction(operation, inspection);
+        try {
+            await this.apply(action, pullRequest);
+            return inspection.decision.mode;
+        }
+        catch (error) {
+            if (!(error instanceof deployment_merge_effect_error_1.DeploymentMergeEffectError) || !error.readinessChanged || operation.prMode !== "auto")
+                throw error;
+            const current = await this.pullRequests.getPullRequest(pullRequest.number);
+            assertSamePullRequest(pullRequest, current);
+            if (current.merged)
+                return inspection.decision.mode;
+            if (current.state !== "open")
+                throw new application_error_1.ApplicationError("provider.conflict", "The managed PR was closed without merging.");
+            const refreshed = await inspect(current);
+            if (refreshed.kind === "blocked")
+                throw new application_error_1.ApplicationError("provider.conflict", refreshed.reason);
+            const nextAction = selectAction(operation, refreshed);
+            if (nextAction === action) {
+                if (action === "enable-auto-merge" && current.autoMergeEnabled)
+                    return refreshed.decision.mode;
+                throw error;
+            }
+            await beforeApply(refreshed.decision.mode);
+            await this.apply(nextAction, current);
+            return refreshed.decision.mode;
+        }
+    }
+    async apply(action, pullRequest) {
+        try {
+            if (action === "merge") {
+                await this.pullRequests.mergePullRequest(pullRequest.number, pullRequest.headSha);
+            }
+            else if (action === "enable-auto-merge" && !pullRequest.autoMergeEnabled) {
+                await this.pullRequests.enableAutoMerge(pullRequest.nodeId, pullRequest.headSha);
+            }
+            else if (action === "merge-queue" && !await this.pullRequests.isPullRequestQueued(pullRequest.nodeId)) {
+                await this.pullRequests.enqueuePullRequest(pullRequest.nodeId, pullRequest.headSha);
+            }
+        }
+        catch (cause) {
+            if (cause instanceof application_error_1.ApplicationError)
+                throw cause;
+            throw new application_error_1.ApplicationError("workflow.failed", `Automatic merge action ${action} failed with an unclassified provider rejection.`, { cause, retryable: true });
+        }
+    }
+}
+exports.DeploymentMergeEffects = DeploymentMergeEffects;
+function selectAction(operation, inspection) {
+    if (inspection.decision.mode !== "auto-merge")
+        return inspection.decision.mode;
+    return operation.prMode === "auto" && inspection.capabilities.immediatelyMergeable ? "merge" : "enable-auto-merge";
+}
+function assertSamePullRequest(expected, current) {
+    const marker = (0, managed_pull_request_1.parseManagedPullRequestMarker)(expected.body);
+    const currentMarker = (0, managed_pull_request_1.parseManagedPullRequestMarker)(current.body);
+    if (expected.number !== current.number || expected.nodeId !== current.nodeId
+        || expected.repositoryFullName !== current.repositoryFullName || expected.baseBranch !== current.baseBranch
+        || expected.headBranch !== current.headBranch || expected.headSha !== current.headSha
+        || !marker || !currentMarker || marker.operationId !== currentMarker.operationId
+        || marker.phase !== currentMarker.phase || marker.issue !== currentMarker.issue) {
+        throw new application_error_1.ApplicationError("provider.conflict", "The managed PR identity or frozen head changed during merge setup.", { retryable: false });
+    }
+}
+
+
 /***/ }),
 
 /***/ 77658:
@@ -51867,6 +51973,7 @@ const deployment_message_catalog_1 = __nccwpck_require__(79364);
 const deployment_operation_1 = __nccwpck_require__(92730);
 const merge_queue_readiness_1 = __nccwpck_require__(12515);
 const result_1 = __nccwpck_require__(73817);
+const deployment_merge_effects_1 = __nccwpck_require__(84387);
 exports.DEPLOYMENT_ORCHESTRATION_TASK_ID = "DeploymentOrchestrationUseCase";
 class DeploymentOrchestrationRuntime {
     constructor(dependencies, stateBoundary) {
@@ -51941,12 +52048,19 @@ class DeploymentOrchestrationRuntime {
                 result: await this.block(context, operation, category, inspection.reason, true),
             };
         }
-        const managed = {
-            ...operation,
-            selectedPrMode: inspection.decision.mode,
-        };
-        await this.persist(context, managed);
-        await this.applyMergeBehavior(context, operation, pullRequest, inspection);
+        let managed = operation;
+        try {
+            await new deployment_merge_effects_1.DeploymentMergeEffects(this.dependencies.pullRequests).configure(operation, pullRequest, inspection, (current) => this.inspectMergeBehavior(context, operation, current.baseBranch, targetRole, current.headSha, current.number), async (mode) => {
+                managed = { ...operation, selectedPrMode: mode };
+                await this.persist(context, managed);
+            });
+        }
+        catch (cause) {
+            const diagnostic = (0, application_error_1.toApplicationError)(cause, "workflow.failed", "Automatic merge setup failed with an unclassified provider rejection.", { retryable: true });
+            const message = `GitHub could not configure automatic merge for PR #${pullRequest.number}. ${diagnostic.message} Check the PR and retry the stored ${category} phase.`;
+            const error = new application_error_1.ApplicationError(diagnostic.code, message, { cause, retryable: diagnostic.retryable });
+            return { kind: "blocked", result: await this.block(context, managed, category, message, error.retryable, error) };
+        }
         await this.publishDashboard(context, managed);
         return { kind: "configured", operation: managed };
     }
@@ -52000,27 +52114,6 @@ class DeploymentOrchestrationRuntime {
             // Preserve the original provider failure returned by the coordinator.
         }
     }
-    async applyMergeBehavior(context, operation, pullRequest, inspection) {
-        if (inspection.decision.mode === "auto-merge") {
-            await this.applyAutoMerge(context, operation, pullRequest, inspection.capabilities);
-            return;
-        }
-        if (inspection.decision.mode === "merge-queue") {
-            const queued = await this.dependencies.pullRequests.isPullRequestQueued(pullRequest.nodeId);
-            if (!queued) {
-                await this.dependencies.pullRequests.enqueuePullRequest(pullRequest.nodeId, pullRequest.headSha);
-            }
-        }
-    }
-    async applyAutoMerge(context, operation, pullRequest, capabilities) {
-        if (operation.prMode === "auto" && capabilities.immediatelyMergeable) {
-            await this.dependencies.pullRequests.mergePullRequest(pullRequest.number, pullRequest.headSha);
-            return;
-        }
-        if (!pullRequest.autoMergeEnabled) {
-            await this.dependencies.pullRequests.enableAutoMerge(pullRequest.nodeId);
-        }
-    }
     async unsupportedMergeBehavior(context, operation, targetRole, targetBranch, capabilities, decision) {
         const catalog = await this.presentationCatalog('issue', context, operation);
         if (capabilities.mergeQueueObservationProblems.length === 0) {
@@ -52876,22 +52969,19 @@ const application_error_1 = __nccwpck_require__(75999);
 const deployment_plan_policy_1 = __nccwpck_require__(8352);
 const deployment_operation_1 = __nccwpck_require__(92730);
 const deployment_orchestration_runtime_1 = __nccwpck_require__(77658);
+const deployment_continuation_guard_1 = __nccwpck_require__(1779);
 class ConfirmPublicationHandler {
     constructor(runtime, reconciliation) {
         this.runtime = runtime;
         this.reconciliation = reconciliation;
     }
     async invoke(context) {
-        const operation = await this.resumeRetryableBlock(context, (0, deployment_orchestration_runtime_1.requireDeploymentOperation)(context));
-        if (operation.phase === "reconciliation_pending" && operation.publicationVerified) {
-            return await this.reconciliation.plan(context, operation)
-                ?? (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${operation.tag} was already verified; reconciliation state was recovered.`);
-        }
-        if (operation.phase === "completed" && operation.publicationVerified) {
-            await this.runtime.publishDashboard(context, operation);
-            return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${operation.tag} was already verified; duplicate notification ignored.`);
-        }
-        assertPublicationPhase(operation);
+        const current = (0, deployment_orchestration_runtime_1.requireDeploymentOperation)(context);
+        const invalid = (0, deployment_continuation_guard_1.validateDeploymentContinuation)(current, context.singleAction.operationId, ["published", "publishing", "promoted", "reconciliation_pending", "completed"], context.singleAction.version);
+        if (invalid)
+            throw new application_error_1.ApplicationError("workflow.stale", invalid);
+        // Verify external receipts before clearing a block or retrying any merge/cleanup effect.
+        const operation = current;
         const productionSha = requireProductionSha(operation);
         const publication = await this.runtime.dependencies.publication.inspect({
             tag: operation.tag,
@@ -52908,8 +52998,18 @@ class ConfirmPublicationHandler {
         if (!reachable) {
             return await this.runtime.block(context, operation, "publication", "Published SHA is not reachable from the stored production branch.", false);
         }
+        const resumed = await this.resumeRetryableBlock(context, operation);
+        if (resumed.phase === "reconciliation_pending" && resumed.publicationVerified) {
+            return await this.reconciliation.plan(context, resumed)
+                ?? (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${resumed.tag} was already verified; reconciliation state was recovered.`);
+        }
+        if (resumed.phase === "completed" && resumed.publicationVerified) {
+            await this.runtime.publishDashboard(context, resumed);
+            return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${resumed.tag} was already verified; duplicate notification ignored.`);
+        }
+        assertPublicationPhase(resumed);
         const published = {
-            ...operation,
+            ...resumed,
             phase: "published",
             publicationVerified: true,
             publicationReceipt: publication.receipt,
@@ -53228,6 +53328,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ReconciliationHandler = void 0;
 const deployment_plan_policy_1 = __nccwpck_require__(8352);
 const deployment_operation_1 = __nccwpck_require__(92730);
+const managed_pull_request_1 = __nccwpck_require__(95914);
 const deployment_orchestration_runtime_1 = __nccwpck_require__(77658);
 class ReconciliationHandler {
     constructor(runtime) {
@@ -53264,10 +53365,12 @@ class ReconciliationHandler {
         return await this.complete(context, updated, ` after reconciliation PR #${pullRequest.number}`);
     }
     async plan(context, operation) {
-        const index = operation.reconciliationTargets.findIndex((target) => target.status === "pending" && target.pullRequest === undefined);
+        const index = operation.reconciliationTargets.findIndex((target) => target.status === "pending");
         if (index < 0)
             return await this.finishOrPresent(context, operation);
         let target = operation.reconciliationTargets[index];
+        if (target.pullRequest !== undefined)
+            return await this.resumePullRequest(context, operation, target);
         const targetRole = (0, deployment_orchestration_runtime_1.reconciliationTargetRole)(operation, target.targetBranch);
         const preflight = await this.runtime.inspectMergeBehavior(context, operation, target.targetBranch, targetRole, target.sourceSha);
         if (preflight.kind === "blocked") {
@@ -53324,6 +53427,26 @@ class ReconciliationHandler {
         await this.runtime.publishMilestone(context, completed, { kind: "orchestration-complete", tag: completed.tag });
         return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Deployment ${completed.tag} completed${completionContext}.`);
     }
+    async resumePullRequest(context, operation, target) {
+        const pullRequest = await this.runtime.dependencies.pullRequests.getPullRequest(target.pullRequest);
+        const identity = (0, managed_pull_request_1.parseManagedPullRequestMarker)(pullRequest.body);
+        const expectedHead = target.syncBranch ? target.syncSha : target.sourceSha;
+        if (!identity || identity.operationId !== operation.operationId || identity.phase !== "reconciliation"
+            || identity.issue !== context.singleAction.issue || pullRequest.number !== target.pullRequest
+            || pullRequest.repositoryFullName.toLowerCase() !== `${context.owner}/${context.repo}`.toLowerCase()
+            || pullRequest.baseBranch !== target.targetBranch
+            || pullRequest.headBranch !== (target.syncBranch ?? target.sourceBranch)
+            || !expectedHead || pullRequest.headSha !== expectedHead) {
+            return await this.runtime.block(context, operation, "reconciliation", "The recorded reconciliation PR no longer matches its durable identity and head SHA.", false);
+        }
+        if (pullRequest.merged)
+            return await this.accept(context, operation, pullRequest);
+        if (pullRequest.state === "closed") {
+            return await this.runtime.block(context, operation, "reconciliation", `Reconciliation PR #${pullRequest.number} was closed without merge.`, true);
+        }
+        const configured = await this.runtime.configureMergeBehavior(context, operation, pullRequest, "reconciliation", (0, deployment_orchestration_runtime_1.reconciliationTargetRole)(operation, target.targetBranch));
+        return configured.kind === "blocked" ? configured.result : undefined;
+    }
     async finishOrPresent(context, operation) {
         if (operation.reconciliationTargets.length > 0
             && operation.reconciliationTargets.every((target) => target.status === "completed")) {
@@ -79302,6 +79425,47 @@ function isNotFound(error) {
 }
 
 
+/***/ }),
+
+/***/ 30873:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.githubDeploymentMergeError = githubDeploymentMergeError;
+const deployment_merge_effect_error_1 = __nccwpck_require__(72594);
+/** Never copy provider messages, request objects, headers, or arbitrary error types into public state. */
+function githubDeploymentMergeError(action, cause) {
+    const value = isRecord(cause) ? cause : {};
+    const status = typeof value.status === "number" && Number.isInteger(value.status)
+        && value.status >= 100 && value.status <= 599 ? value.status : undefined;
+    const rawErrors = Array.isArray(value.errors) ? value.errors : [];
+    const errors = rawErrors.filter(isRecord);
+    const types = errors.map((error) => error.type);
+    const denied = status === 401 || status === 403 || types.includes("FORBIDDEN") || types.includes("UNAUTHORIZED");
+    const limited = status === 429 || types.includes("RATE_LIMITED");
+    const unavailable = (status !== undefined && status >= 500) || types.includes("INTERNAL") || types.includes("SERVICE_UNAVAILABLE");
+    const cleanRejection = rawErrors.length === 1 && errors.length === 1 && errors[0].type === "UNPROCESSABLE"
+        && typeof errors[0].message === "string"
+        && ["Pull request is in clean status", "Pull request Pull request is in clean status",
+            "Pull request is in unstable status", "Pull request Pull request is in unstable status"].includes(errors[0].message);
+    const readinessChanged = !denied && !limited && !unavailable
+        && ((action === "merge" && status === 405) || (action === "enable-auto-merge" && (status === undefined || status === 200) && cleanRejection));
+    const code = denied ? "authorization.denied"
+        : limited ? "provider.rate-limited"
+            : unavailable ? "provider.unavailable"
+                : status === 404 || types.includes("NOT_FOUND") ? "provider.not-found"
+                    : status !== undefined || types.length > 0 ? "provider.conflict" : "workflow.failed";
+    const reason = readinessChanged ? "readiness-changed" : code;
+    const http = status === undefined ? "" : `; HTTP ${status}`;
+    return new deployment_merge_effect_error_1.DeploymentMergeEffectError(action, readinessChanged, code, `GitHub rejected ${action} (${reason}${http}).`, cause);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+
 /***/ }),
 
 /***/ 96483:
@@ -79312,6 +79476,8 @@ function isNotFound(error) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.GithubManagedPullRequestRepository = void 0;
 const managed_pull_request_1 = __nccwpck_require__(95914);
+const github_deployment_merge_error_1 = __nccwpck_require__(30873);
+const deployment_merge_effect_error_1 = __nccwpck_require__(72594);
 class GithubManagedPullRequestRepository {
     constructor(clientProvider) {
         this.clientProvider = clientProvider;
@@ -79355,12 +79521,21 @@ class GithubManagedPullRequestRepository {
         });
         return mapPullRequest(data, owner, repository);
     }
-    async enableAutoMerge(owner, repository, pullRequestNodeId, token) {
-        await this.clientProvider.getClient(token).graphql(`mutation EnableDeploymentAutoMerge($pullRequestId: ID!) {
-        enablePullRequestAutoMerge(input: {pullRequestId: $pullRequestId, mergeMethod: MERGE}) {
-          pullRequest { id }
+    async enableAutoMerge(_owner, _repository, pullRequestNodeId, expectedHeadSha, token) {
+        let response;
+        try {
+            response = await this.clientProvider.getClient(token).graphql(`mutation EnableDeploymentAutoMerge($pullRequestId: ID!, $expectedHeadOid: GitObjectID!) {
+          enablePullRequestAutoMerge(input: {pullRequestId: $pullRequestId, expectedHeadOid: $expectedHeadOid, mergeMethod: MERGE}) {
+            pullRequest { id }
+          }
+        }`, { pullRequestId: pullRequestNodeId, expectedHeadOid: expectedHeadSha });
+        }
+        catch (cause) {
+            throw (0, github_deployment_merge_error_1.githubDeploymentMergeError)("enable-auto-merge", cause);
+        }
+        if (response?.enablePullRequestAutoMerge?.pullRequest?.id !== pullRequestNodeId) {
+            throw new deployment_merge_effect_error_1.DeploymentMergeEffectError("enable-auto-merge", false, "provider.contract-invalid", "GitHub did not confirm native auto-merge for the expected PR.");
         }
-      }`, { pullRequestId: pullRequestNodeId, owner, repository });
     }
     async isPullRequestQueued(owner, repository, pullRequestNodeId, token) {
         const response = await this.clientProvider.getClient(token).graphql(`query DeploymentPullRequestQueue($pullRequestId: ID!) {
@@ -79384,15 +79559,18 @@ class GithubManagedPullRequestRepository {
         }
     }
     async mergePullRequest(owner, repository, pullRequest, expectedHeadSha, token) {
-        const { data } = await this.clientProvider.getClient(token).rest.pulls.merge({
-            owner,
-            repo: repository,
-            pull_number: pullRequest,
-            merge_method: "merge",
-            sha: expectedHeadSha,
-        });
-        if (!data.merged || !data.sha)
-            throw new Error(data.message ?? `Pull request #${pullRequest} was not merged.`);
+        let data;
+        try {
+            ({ data } = await this.clientProvider.getClient(token).rest.pulls.merge({
+                owner, repo: repository, pull_number: pullRequest, merge_method: "merge", sha: expectedHeadSha,
+            }));
+        }
+        catch (cause) {
+            throw (0, github_deployment_merge_error_1.githubDeploymentMergeError)("merge", cause);
+        }
+        if (!data?.merged || typeof data.sha !== "string" || !/^[a-f0-9]{40}$/i.test(data.sha)) {
+            throw new deployment_merge_effect_error_1.DeploymentMergeEffectError("merge", false, "provider.contract-invalid", "GitHub did not confirm a completed merge with a valid commit SHA.");
+        }
         return data.sha;
     }
 }
@@ -92436,7 +92614,7 @@ function bindManagedPullRequests(port, binding) {
         findManagedPullRequests: (query) => port.findManagedPullRequests({ ...query, owner: binding.owner, repository: binding.repository, token: binding.token }),
         createManagedPullRequest: (command) => port.createManagedPullRequest({ ...command, owner: binding.owner, repository: binding.repository, token: binding.token }),
         getPullRequest: (pullRequest) => port.getPullRequest(binding.owner, binding.repository, pullRequest, binding.token),
-        enableAutoMerge: (pullRequestNodeId) => port.enableAutoMerge(binding.owner, binding.repository, pullRequestNodeId, binding.token),
+        enableAutoMerge: (pullRequestNodeId, expectedHeadSha) => port.enableAutoMerge(binding.owner, binding.repository, pullRequestNodeId, expectedHeadSha, binding.token),
         isPullRequestQueued: (pullRequestNodeId) => port.isPullRequestQueued(binding.owner, binding.repository, pullRequestNodeId, binding.token),
         enqueuePullRequest: (pullRequestNodeId, expectedHeadSha) => port.enqueuePullRequest(binding.owner, binding.repository, pullRequestNodeId, expectedHeadSha, binding.token),
         mergePullRequest: (pullRequest, expectedHeadSha) => port.mergePullRequest(binding.owner, binding.repository, pullRequest, expectedHeadSha, binding.token),

package/build/github_action/index.js

@@ -38816,6 +38816,27 @@ function runAtApplicationErrorBoundary(operation) {
 }
 
 
+/***/ }),
+
+/***/ 72594:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DeploymentMergeEffectError = void 0;
+const application_error_1 = __nccwpck_require__(75999);
+/** Semantic effect failure. Only a confirmed readiness rejection permits one new inspection. */
+class DeploymentMergeEffectError extends application_error_1.ApplicationError {
+    constructor(action, readinessChanged, code, message, cause) {
+        super(code, message, { cause });
+        this.action = action;
+        this.readinessChanged = readinessChanged;
+    }
+}
+exports.DeploymentMergeEffectError = DeploymentMergeEffectError;
+
+
 /***/ }),
 
 /***/ 61544:
@@ -50157,6 +50178,91 @@ function bindSddEvidenceReadPorts(ports) {
 }
 
 
+/***/ }),
+
+/***/ 84387:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DeploymentMergeEffects = void 0;
+const application_error_1 = __nccwpck_require__(75999);
+const deployment_merge_effect_error_1 = __nccwpck_require__(72594);
+const managed_pull_request_1 = __nccwpck_require__(95914);
+/** Applies current policy, with one bounded re-observation after a typed readiness rejection. */
+class DeploymentMergeEffects {
+    constructor(pullRequests) {
+        this.pullRequests = pullRequests;
+    }
+    async configure(operation, pullRequest, inspection, inspect, beforeApply) {
+        await beforeApply(inspection.decision.mode);
+        const action = selectAction(operation, inspection);
+        try {
+            await this.apply(action, pullRequest);
+            return inspection.decision.mode;
+        }
+        catch (error) {
+            if (!(error instanceof deployment_merge_effect_error_1.DeploymentMergeEffectError) || !error.readinessChanged || operation.prMode !== "auto")
+                throw error;
+            const current = await this.pullRequests.getPullRequest(pullRequest.number);
+            assertSamePullRequest(pullRequest, current);
+            if (current.merged)
+                return inspection.decision.mode;
+            if (current.state !== "open")
+                throw new application_error_1.ApplicationError("provider.conflict", "The managed PR was closed without merging.");
+            const refreshed = await inspect(current);
+            if (refreshed.kind === "blocked")
+                throw new application_error_1.ApplicationError("provider.conflict", refreshed.reason);
+            const nextAction = selectAction(operation, refreshed);
+            if (nextAction === action) {
+                if (action === "enable-auto-merge" && current.autoMergeEnabled)
+                    return refreshed.decision.mode;
+                throw error;
+            }
+            await beforeApply(refreshed.decision.mode);
+            await this.apply(nextAction, current);
+            return refreshed.decision.mode;
+        }
+    }
+    async apply(action, pullRequest) {
+        try {
+            if (action === "merge") {
+                await this.pullRequests.mergePullRequest(pullRequest.number, pullRequest.headSha);
+            }
+            else if (action === "enable-auto-merge" && !pullRequest.autoMergeEnabled) {
+                await this.pullRequests.enableAutoMerge(pullRequest.nodeId, pullRequest.headSha);
+            }
+            else if (action === "merge-queue" && !await this.pullRequests.isPullRequestQueued(pullRequest.nodeId)) {
+                await this.pullRequests.enqueuePullRequest(pullRequest.nodeId, pullRequest.headSha);
+            }
+        }
+        catch (cause) {
+            if (cause instanceof application_error_1.ApplicationError)
+                throw cause;
+            throw new application_error_1.ApplicationError("workflow.failed", `Automatic merge action ${action} failed with an unclassified provider rejection.`, { cause, retryable: true });
+        }
+    }
+}
+exports.DeploymentMergeEffects = DeploymentMergeEffects;
+function selectAction(operation, inspection) {
+    if (inspection.decision.mode !== "auto-merge")
+        return inspection.decision.mode;
+    return operation.prMode === "auto" && inspection.capabilities.immediatelyMergeable ? "merge" : "enable-auto-merge";
+}
+function assertSamePullRequest(expected, current) {
+    const marker = (0, managed_pull_request_1.parseManagedPullRequestMarker)(expected.body);
+    const currentMarker = (0, managed_pull_request_1.parseManagedPullRequestMarker)(current.body);
+    if (expected.number !== current.number || expected.nodeId !== current.nodeId
+        || expected.repositoryFullName !== current.repositoryFullName || expected.baseBranch !== current.baseBranch
+        || expected.headBranch !== current.headBranch || expected.headSha !== current.headSha
+        || !marker || !currentMarker || marker.operationId !== currentMarker.operationId
+        || marker.phase !== currentMarker.phase || marker.issue !== currentMarker.issue) {
+        throw new application_error_1.ApplicationError("provider.conflict", "The managed PR identity or frozen head changed during merge setup.", { retryable: false });
+    }
+}
+
+
 /***/ }),
 
 /***/ 77658:
@@ -50181,6 +50287,7 @@ const deployment_message_catalog_1 = __nccwpck_require__(79364);
 const deployment_operation_1 = __nccwpck_require__(92730);
 const merge_queue_readiness_1 = __nccwpck_require__(12515);
 const result_1 = __nccwpck_require__(73817);
+const deployment_merge_effects_1 = __nccwpck_require__(84387);
 exports.DEPLOYMENT_ORCHESTRATION_TASK_ID = "DeploymentOrchestrationUseCase";
 class DeploymentOrchestrationRuntime {
     constructor(dependencies, stateBoundary) {
@@ -50255,12 +50362,19 @@ class DeploymentOrchestrationRuntime {
                 result: await this.block(context, operation, category, inspection.reason, true),
             };
         }
-        const managed = {
-            ...operation,
-            selectedPrMode: inspection.decision.mode,
-        };
-        await this.persist(context, managed);
-        await this.applyMergeBehavior(context, operation, pullRequest, inspection);
+        let managed = operation;
+        try {
+            await new deployment_merge_effects_1.DeploymentMergeEffects(this.dependencies.pullRequests).configure(operation, pullRequest, inspection, (current) => this.inspectMergeBehavior(context, operation, current.baseBranch, targetRole, current.headSha, current.number), async (mode) => {
+                managed = { ...operation, selectedPrMode: mode };
+                await this.persist(context, managed);
+            });
+        }
+        catch (cause) {
+            const diagnostic = (0, application_error_1.toApplicationError)(cause, "workflow.failed", "Automatic merge setup failed with an unclassified provider rejection.", { retryable: true });
+            const message = `GitHub could not configure automatic merge for PR #${pullRequest.number}. ${diagnostic.message} Check the PR and retry the stored ${category} phase.`;
+            const error = new application_error_1.ApplicationError(diagnostic.code, message, { cause, retryable: diagnostic.retryable });
+            return { kind: "blocked", result: await this.block(context, managed, category, message, error.retryable, error) };
+        }
         await this.publishDashboard(context, managed);
         return { kind: "configured", operation: managed };
     }
@@ -50314,27 +50428,6 @@ class DeploymentOrchestrationRuntime {
             // Preserve the original provider failure returned by the coordinator.
         }
     }
-    async applyMergeBehavior(context, operation, pullRequest, inspection) {
-        if (inspection.decision.mode === "auto-merge") {
-            await this.applyAutoMerge(context, operation, pullRequest, inspection.capabilities);
-            return;
-        }
-        if (inspection.decision.mode === "merge-queue") {
-            const queued = await this.dependencies.pullRequests.isPullRequestQueued(pullRequest.nodeId);
-            if (!queued) {
-                await this.dependencies.pullRequests.enqueuePullRequest(pullRequest.nodeId, pullRequest.headSha);
-            }
-        }
-    }
-    async applyAutoMerge(context, operation, pullRequest, capabilities) {
-        if (operation.prMode === "auto" && capabilities.immediatelyMergeable) {
-            await this.dependencies.pullRequests.mergePullRequest(pullRequest.number, pullRequest.headSha);
-            return;
-        }
-        if (!pullRequest.autoMergeEnabled) {
-            await this.dependencies.pullRequests.enableAutoMerge(pullRequest.nodeId);
-        }
-    }
     async unsupportedMergeBehavior(context, operation, targetRole, targetBranch, capabilities, decision) {
         const catalog = await this.presentationCatalog('issue', context, operation);
         if (capabilities.mergeQueueObservationProblems.length === 0) {
@@ -51190,22 +51283,19 @@ const application_error_1 = __nccwpck_require__(75999);
 const deployment_plan_policy_1 = __nccwpck_require__(8352);
 const deployment_operation_1 = __nccwpck_require__(92730);
 const deployment_orchestration_runtime_1 = __nccwpck_require__(77658);
+const deployment_continuation_guard_1 = __nccwpck_require__(1779);
 class ConfirmPublicationHandler {
     constructor(runtime, reconciliation) {
         this.runtime = runtime;
         this.reconciliation = reconciliation;
     }
     async invoke(context) {
-        const operation = await this.resumeRetryableBlock(context, (0, deployment_orchestration_runtime_1.requireDeploymentOperation)(context));
-        if (operation.phase === "reconciliation_pending" && operation.publicationVerified) {
-            return await this.reconciliation.plan(context, operation)
-                ?? (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${operation.tag} was already verified; reconciliation state was recovered.`);
-        }
-        if (operation.phase === "completed" && operation.publicationVerified) {
-            await this.runtime.publishDashboard(context, operation);
-            return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${operation.tag} was already verified; duplicate notification ignored.`);
-        }
-        assertPublicationPhase(operation);
+        const current = (0, deployment_orchestration_runtime_1.requireDeploymentOperation)(context);
+        const invalid = (0, deployment_continuation_guard_1.validateDeploymentContinuation)(current, context.singleAction.operationId, ["published", "publishing", "promoted", "reconciliation_pending", "completed"], context.singleAction.version);
+        if (invalid)
+            throw new application_error_1.ApplicationError("workflow.stale", invalid);
+        // Verify external receipts before clearing a block or retrying any merge/cleanup effect.
+        const operation = current;
         const productionSha = requireProductionSha(operation);
         const publication = await this.runtime.dependencies.publication.inspect({
             tag: operation.tag,
@@ -51222,8 +51312,18 @@ class ConfirmPublicationHandler {
         if (!reachable) {
             return await this.runtime.block(context, operation, "publication", "Published SHA is not reachable from the stored production branch.", false);
         }
+        const resumed = await this.resumeRetryableBlock(context, operation);
+        if (resumed.phase === "reconciliation_pending" && resumed.publicationVerified) {
+            return await this.reconciliation.plan(context, resumed)
+                ?? (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${resumed.tag} was already verified; reconciliation state was recovered.`);
+        }
+        if (resumed.phase === "completed" && resumed.publicationVerified) {
+            await this.runtime.publishDashboard(context, resumed);
+            return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${resumed.tag} was already verified; duplicate notification ignored.`);
+        }
+        assertPublicationPhase(resumed);
         const published = {
-            ...operation,
+            ...resumed,
             phase: "published",
             publicationVerified: true,
             publicationReceipt: publication.receipt,
@@ -51542,6 +51642,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ReconciliationHandler = void 0;
 const deployment_plan_policy_1 = __nccwpck_require__(8352);
 const deployment_operation_1 = __nccwpck_require__(92730);
+const managed_pull_request_1 = __nccwpck_require__(95914);
 const deployment_orchestration_runtime_1 = __nccwpck_require__(77658);
 class ReconciliationHandler {
     constructor(runtime) {
@@ -51578,10 +51679,12 @@ class ReconciliationHandler {
         return await this.complete(context, updated, ` after reconciliation PR #${pullRequest.number}`);
     }
     async plan(context, operation) {
-        const index = operation.reconciliationTargets.findIndex((target) => target.status === "pending" && target.pullRequest === undefined);
+        const index = operation.reconciliationTargets.findIndex((target) => target.status === "pending");
         if (index < 0)
             return await this.finishOrPresent(context, operation);
         let target = operation.reconciliationTargets[index];
+        if (target.pullRequest !== undefined)
+            return await this.resumePullRequest(context, operation, target);
         const targetRole = (0, deployment_orchestration_runtime_1.reconciliationTargetRole)(operation, target.targetBranch);
         const preflight = await this.runtime.inspectMergeBehavior(context, operation, target.targetBranch, targetRole, target.sourceSha);
         if (preflight.kind === "blocked") {
@@ -51638,6 +51741,26 @@ class ReconciliationHandler {
         await this.runtime.publishMilestone(context, completed, { kind: "orchestration-complete", tag: completed.tag });
         return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Deployment ${completed.tag} completed${completionContext}.`);
     }
+    async resumePullRequest(context, operation, target) {
+        const pullRequest = await this.runtime.dependencies.pullRequests.getPullRequest(target.pullRequest);
+        const identity = (0, managed_pull_request_1.parseManagedPullRequestMarker)(pullRequest.body);
+        const expectedHead = target.syncBranch ? target.syncSha : target.sourceSha;
+        if (!identity || identity.operationId !== operation.operationId || identity.phase !== "reconciliation"
+            || identity.issue !== context.singleAction.issue || pullRequest.number !== target.pullRequest
+            || pullRequest.repositoryFullName.toLowerCase() !== `${context.owner}/${context.repo}`.toLowerCase()
+            || pullRequest.baseBranch !== target.targetBranch
+            || pullRequest.headBranch !== (target.syncBranch ?? target.sourceBranch)
+            || !expectedHead || pullRequest.headSha !== expectedHead) {
+            return await this.runtime.block(context, operation, "reconciliation", "The recorded reconciliation PR no longer matches its durable identity and head SHA.", false);
+        }
+        if (pullRequest.merged)
+            return await this.accept(context, operation, pullRequest);
+        if (pullRequest.state === "closed") {
+            return await this.runtime.block(context, operation, "reconciliation", `Reconciliation PR #${pullRequest.number} was closed without merge.`, true);
+        }
+        const configured = await this.runtime.configureMergeBehavior(context, operation, pullRequest, "reconciliation", (0, deployment_orchestration_runtime_1.reconciliationTargetRole)(operation, target.targetBranch));
+        return configured.kind === "blocked" ? configured.result : undefined;
+    }
     async finishOrPresent(context, operation) {
         if (operation.reconciliationTargets.length > 0
             && operation.reconciliationTargets.every((target) => target.status === "completed")) {
@@ -71570,6 +71693,47 @@ function isNotFound(error) {
 }
 
 
+/***/ }),
+
+/***/ 30873:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.githubDeploymentMergeError = githubDeploymentMergeError;
+const deployment_merge_effect_error_1 = __nccwpck_require__(72594);
+/** Never copy provider messages, request objects, headers, or arbitrary error types into public state. */
+function githubDeploymentMergeError(action, cause) {
+    const value = isRecord(cause) ? cause : {};
+    const status = typeof value.status === "number" && Number.isInteger(value.status)
+        && value.status >= 100 && value.status <= 599 ? value.status : undefined;
+    const rawErrors = Array.isArray(value.errors) ? value.errors : [];
+    const errors = rawErrors.filter(isRecord);
+    const types = errors.map((error) => error.type);
+    const denied = status === 401 || status === 403 || types.includes("FORBIDDEN") || types.includes("UNAUTHORIZED");
+    const limited = status === 429 || types.includes("RATE_LIMITED");
+    const unavailable = (status !== undefined && status >= 500) || types.includes("INTERNAL") || types.includes("SERVICE_UNAVAILABLE");
+    const cleanRejection = rawErrors.length === 1 && errors.length === 1 && errors[0].type === "UNPROCESSABLE"
+        && typeof errors[0].message === "string"
+        && ["Pull request is in clean status", "Pull request Pull request is in clean status",
+            "Pull request is in unstable status", "Pull request Pull request is in unstable status"].includes(errors[0].message);
+    const readinessChanged = !denied && !limited && !unavailable
+        && ((action === "merge" && status === 405) || (action === "enable-auto-merge" && (status === undefined || status === 200) && cleanRejection));
+    const code = denied ? "authorization.denied"
+        : limited ? "provider.rate-limited"
+            : unavailable ? "provider.unavailable"
+                : status === 404 || types.includes("NOT_FOUND") ? "provider.not-found"
+                    : status !== undefined || types.length > 0 ? "provider.conflict" : "workflow.failed";
+    const reason = readinessChanged ? "readiness-changed" : code;
+    const http = status === undefined ? "" : `; HTTP ${status}`;
+    return new deployment_merge_effect_error_1.DeploymentMergeEffectError(action, readinessChanged, code, `GitHub rejected ${action} (${reason}${http}).`, cause);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+
 /***/ }),
 
 /***/ 96483:
@@ -71580,6 +71744,8 @@ function isNotFound(error) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.GithubManagedPullRequestRepository = void 0;
 const managed_pull_request_1 = __nccwpck_require__(95914);
+const github_deployment_merge_error_1 = __nccwpck_require__(30873);
+const deployment_merge_effect_error_1 = __nccwpck_require__(72594);
 class GithubManagedPullRequestRepository {
     constructor(clientProvider) {
         this.clientProvider = clientProvider;
@@ -71623,12 +71789,21 @@ class GithubManagedPullRequestRepository {
         });
         return mapPullRequest(data, owner, repository);
     }
-    async enableAutoMerge(owner, repository, pullRequestNodeId, token) {
-        await this.clientProvider.getClient(token).graphql(`mutation EnableDeploymentAutoMerge($pullRequestId: ID!) {
-        enablePullRequestAutoMerge(input: {pullRequestId: $pullRequestId, mergeMethod: MERGE}) {
-          pullRequest { id }
+    async enableAutoMerge(_owner, _repository, pullRequestNodeId, expectedHeadSha, token) {
+        let response;
+        try {
+            response = await this.clientProvider.getClient(token).graphql(`mutation EnableDeploymentAutoMerge($pullRequestId: ID!, $expectedHeadOid: GitObjectID!) {
+          enablePullRequestAutoMerge(input: {pullRequestId: $pullRequestId, expectedHeadOid: $expectedHeadOid, mergeMethod: MERGE}) {
+            pullRequest { id }
+          }
+        }`, { pullRequestId: pullRequestNodeId, expectedHeadOid: expectedHeadSha });
+        }
+        catch (cause) {
+            throw (0, github_deployment_merge_error_1.githubDeploymentMergeError)("enable-auto-merge", cause);
+        }
+        if (response?.enablePullRequestAutoMerge?.pullRequest?.id !== pullRequestNodeId) {
+            throw new deployment_merge_effect_error_1.DeploymentMergeEffectError("enable-auto-merge", false, "provider.contract-invalid", "GitHub did not confirm native auto-merge for the expected PR.");
         }
-      }`, { pullRequestId: pullRequestNodeId, owner, repository });
     }
     async isPullRequestQueued(owner, repository, pullRequestNodeId, token) {
         const response = await this.clientProvider.getClient(token).graphql(`query DeploymentPullRequestQueue($pullRequestId: ID!) {
@@ -71652,15 +71827,18 @@ class GithubManagedPullRequestRepository {
         }
     }
     async mergePullRequest(owner, repository, pullRequest, expectedHeadSha, token) {
-        const { data } = await this.clientProvider.getClient(token).rest.pulls.merge({
-            owner,
-            repo: repository,
-            pull_number: pullRequest,
-            merge_method: "merge",
-            sha: expectedHeadSha,
-        });
-        if (!data.merged || !data.sha)
-            throw new Error(data.message ?? `Pull request #${pullRequest} was not merged.`);
+        let data;
+        try {
+            ({ data } = await this.clientProvider.getClient(token).rest.pulls.merge({
+                owner, repo: repository, pull_number: pullRequest, merge_method: "merge", sha: expectedHeadSha,
+            }));
+        }
+        catch (cause) {
+            throw (0, github_deployment_merge_error_1.githubDeploymentMergeError)("merge", cause);
+        }
+        if (!data?.merged || typeof data.sha !== "string" || !/^[a-f0-9]{40}$/i.test(data.sha)) {
+            throw new deployment_merge_effect_error_1.DeploymentMergeEffectError("merge", false, "provider.contract-invalid", "GitHub did not confirm a completed merge with a valid commit SHA.");
+        }
         return data.sha;
     }
 }
@@ -84870,7 +85048,7 @@ function bindManagedPullRequests(port, binding) {
         findManagedPullRequests: (query) => port.findManagedPullRequests({ ...query, owner: binding.owner, repository: binding.repository, token: binding.token }),
         createManagedPullRequest: (command) => port.createManagedPullRequest({ ...command, owner: binding.owner, repository: binding.repository, token: binding.token }),
         getPullRequest: (pullRequest) => port.getPullRequest(binding.owner, binding.repository, pullRequest, binding.token),
-        enableAutoMerge: (pullRequestNodeId) => port.enableAutoMerge(binding.owner, binding.repository, pullRequestNodeId, binding.token),
+        enableAutoMerge: (pullRequestNodeId, expectedHeadSha) => port.enableAutoMerge(binding.owner, binding.repository, pullRequestNodeId, expectedHeadSha, binding.token),
         isPullRequestQueued: (pullRequestNodeId) => port.isPullRequestQueued(binding.owner, binding.repository, pullRequestNodeId, binding.token),
         enqueuePullRequest: (pullRequestNodeId, expectedHeadSha) => port.enqueuePullRequest(binding.owner, binding.repository, pullRequestNodeId, expectedHeadSha, binding.token),
         mergePullRequest: (pullRequest, expectedHeadSha) => port.mergePullRequest(binding.owner, binding.repository, pullRequest, expectedHeadSha, binding.token),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vypdev/copilot",
-  "version": "3.5.2",
+  "version": "3.5.4",
   "packageManager": "pnpm@10.12.4",
   "pnpm": {
     "overrides": {

package/setup/workflows/hotfix_workflow.yml

@@ -8,7 +8,7 @@ on:
         required: true
         default: prepare
         type: choice
-        options: [prepare, publish]
+        options: [prepare, publish, resume]
       operation-id:
         description: 'Internal durable operation identifier'
         required: false
@@ -66,10 +66,10 @@ jobs:
               if (operationId) errors.push('Operation ID must be empty in prepare mode.');
               if (!title || title.length > 1000) errors.push('Title must contain 1-1000 characters.');
               if (!changelog || changelog.length > 50000) errors.push('Changelog must contain 1-50000 characters.');
-            } else if (mode === 'publish') {
+            } else if (mode === 'publish' || mode === 'resume') {
               if (!/^[A-Za-z0-9][A-Za-z0-9._-]{7,127}$/.test(operationId)) errors.push('Operation ID is invalid.');
-              if (title || changelog) errors.push('Title and changelog must be empty in publish mode.');
-            } else errors.push('Mode must be prepare or publish.');
+              if (title || changelog) errors.push('Title and changelog must be empty in publish or resume mode.');
+            } else errors.push('Mode must be prepare, publish, or resume.');
             if (errors.length) core.setFailed(errors.join(' '));
 
   prepare-version-files:
@@ -185,17 +185,66 @@ jobs:
           single-action-version: ${{ inputs.version }}
           token: ${{ secrets.PAT }}
 
+  resume-reconciliation:
+    name: Resume published deployment
+    if: ${{ inputs.mode == 'resume' }}
+    runs-on: ubuntu-latest
+    needs: validate
+    timeout-minutes: 15
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Verify published operation before recovery
+        uses: actions/github-script@v9
+        env:
+          ISSUE: ${{ inputs.issue }}
+          OPERATION_ID: ${{ inputs.operation-id }}
+          VERSION: ${{ inputs.version }}
+        with:
+          script: |
+            const response = await github.rest.issues.get({ ...context.repo, issue_number: Number(process.env.ISSUE) });
+            if (response.data.pull_request) throw new Error('The launcher must be an issue.');
+            const body = response.data.body || '';
+            const start = '<!-- copilot-configuration-start';
+            const end = 'copilot-configuration-end -->';
+            const first = body.indexOf(start);
+            const last = body.indexOf(end, first + start.length);
+            if (first < 0 || last < 0 || body.indexOf(start, first + start.length) >= 0) throw new Error('A unique durable configuration is required.');
+            const payload = JSON.parse(body.slice(first + start.length, last));
+            const state = payload?.deploymentOrchestration;
+            const receipt = state?.publicationReceipt;
+            const phase = state?.phase === 'blocked' && state?.lastFailure?.retryable === true
+              ? state.lastFailure.previousPhase : state?.phase;
+            if (payload?.schemaVersion !== 3 || state?.stateVersion !== 1
+              || !Number.isSafeInteger(state?.revision) || state.revision < 1
+              || state.operationId !== process.env.OPERATION_ID || state.version !== process.env.VERSION
+              || !['reconciliation_pending', 'completed'].includes(phase) || state.publicationVerified !== true
+              || !/^[a-f0-9]{40}$/i.test(state.productionSha || '') || state.tag !== `v${process.env.VERSION}`
+              || receipt?.operationId !== state.operationId || receipt?.productionSha !== state.productionSha
+              || receipt?.tag !== state.tag) throw new Error('Recovery requires the matching, already verified publication and reconciliation state.');
+      - name: Resume reconciliation from verified receipts
+        uses: vypdev/copilot@v3
+        with:
+          single-action: published_deployment_action
+          single-action-issue: ${{ inputs.issue }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          single-action-operation-id: ${{ inputs.operation-id }}
+          single-action-version: ${{ inputs.version }}
+          merge-queue-check-attestations: ${{ vars.MERGE_QUEUE_CHECK_ATTESTATIONS || '[]' }}
+          token: ${{ secrets.PAT }}
+
   report-failure:
     name: Report orchestration failure
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: [validate, prepare-version-files, promote, publish]
+    needs: [validate, prepare-version-files, promote, publish, resume-reconciliation]
     if: ${{ failure() && needs.validate.result == 'success' }}
     permissions:
       issues: write
     steps:
       - name: Persist publication failure
-        if: ${{ inputs.mode == 'publish' }}
+        if: ${{ inputs.mode == 'publish' || inputs.mode == 'resume' }}
         uses: vypdev/copilot@v3
         with:
           single-action: failed_deployment_action

package/setup/workflows/release_workflow.yml

@@ -8,7 +8,7 @@ on:
         required: true
         default: prepare
         type: choice
-        options: [prepare, publish]
+        options: [prepare, publish, resume]
       operation-id:
         description: 'Internal durable operation identifier'
         required: false
@@ -66,10 +66,10 @@ jobs:
               if (operationId) errors.push('Operation ID must be empty in prepare mode.');
               if (!title || title.length > 1000) errors.push('Title must contain 1-1000 characters.');
               if (!changelog || changelog.length > 50000) errors.push('Changelog must contain 1-50000 characters.');
-            } else if (mode === 'publish') {
+            } else if (mode === 'publish' || mode === 'resume') {
               if (!/^[A-Za-z0-9][A-Za-z0-9._-]{7,127}$/.test(operationId)) errors.push('Operation ID is invalid.');
-              if (title || changelog) errors.push('Title and changelog must be empty in publish mode.');
-            } else errors.push('Mode must be prepare or publish.');
+              if (title || changelog) errors.push('Title and changelog must be empty in publish or resume mode.');
+            } else errors.push('Mode must be prepare, publish, or resume.');
             if (errors.length) core.setFailed(errors.join(' '));
 
   prepare-version-files:
@@ -185,17 +185,66 @@ jobs:
           single-action-version: ${{ inputs.version }}
           token: ${{ secrets.PAT }}
 
+  resume-reconciliation:
+    name: Resume published deployment
+    if: ${{ inputs.mode == 'resume' }}
+    runs-on: ubuntu-latest
+    needs: validate
+    timeout-minutes: 15
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Verify published operation before recovery
+        uses: actions/github-script@v9
+        env:
+          ISSUE: ${{ inputs.issue }}
+          OPERATION_ID: ${{ inputs.operation-id }}
+          VERSION: ${{ inputs.version }}
+        with:
+          script: |
+            const response = await github.rest.issues.get({ ...context.repo, issue_number: Number(process.env.ISSUE) });
+            if (response.data.pull_request) throw new Error('The launcher must be an issue.');
+            const body = response.data.body || '';
+            const start = '<!-- copilot-configuration-start';
+            const end = 'copilot-configuration-end -->';
+            const first = body.indexOf(start);
+            const last = body.indexOf(end, first + start.length);
+            if (first < 0 || last < 0 || body.indexOf(start, first + start.length) >= 0) throw new Error('A unique durable configuration is required.');
+            const payload = JSON.parse(body.slice(first + start.length, last));
+            const state = payload?.deploymentOrchestration;
+            const receipt = state?.publicationReceipt;
+            const phase = state?.phase === 'blocked' && state?.lastFailure?.retryable === true
+              ? state.lastFailure.previousPhase : state?.phase;
+            if (payload?.schemaVersion !== 3 || state?.stateVersion !== 1
+              || !Number.isSafeInteger(state?.revision) || state.revision < 1
+              || state.operationId !== process.env.OPERATION_ID || state.version !== process.env.VERSION
+              || !['reconciliation_pending', 'completed'].includes(phase) || state.publicationVerified !== true
+              || !/^[a-f0-9]{40}$/i.test(state.productionSha || '') || state.tag !== `v${process.env.VERSION}`
+              || receipt?.operationId !== state.operationId || receipt?.productionSha !== state.productionSha
+              || receipt?.tag !== state.tag) throw new Error('Recovery requires the matching, already verified publication and reconciliation state.');
+      - name: Resume reconciliation from verified receipts
+        uses: vypdev/copilot@v3
+        with:
+          single-action: published_deployment_action
+          single-action-issue: ${{ inputs.issue }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          single-action-operation-id: ${{ inputs.operation-id }}
+          single-action-version: ${{ inputs.version }}
+          merge-queue-check-attestations: ${{ vars.MERGE_QUEUE_CHECK_ATTESTATIONS || '[]' }}
+          token: ${{ secrets.PAT }}
+
   report-failure:
     name: Report orchestration failure
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: [validate, prepare-version-files, promote, publish]
+    needs: [validate, prepare-version-files, promote, publish, resume-reconciliation]
     if: ${{ failure() && needs.validate.result == 'success' }}
     permissions:
       issues: write
     steps:
       - name: Persist publication failure
-        if: ${{ inputs.mode == 'publish' }}
+        if: ${{ inputs.mode == 'publish' || inputs.mode == 'resume' }}
         uses: vypdev/copilot@v3
         with:
           single-action: failed_deployment_action