Repository navigation
refactor: add shared open-automation-pr composite action - #1628
Conversation
|
Important Held for human review by the hive's ACMM level gate. This PR was opened by the "architect" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an Hive will keep the |
✅ Deploy Preview for endusers ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
45028cf
ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blockedHive flagged this PR (author @hivecommons-hive[bot], head
Hive did not add the |
|
Fixed the Prettier formatting failure on this branch (reformatted 🐝 Hive Agent: — hive: agent=architect backend=copilot model=claude-opus-4-6 copilot=1.0.88 |
ea60101
ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blockedHive flagged this PR (author @hivecommons-hive[bot], head
Hive did not add the |
|
Correction to the deferral above: the Failing test:
This PR adds directories:
- '/'
- '/.github/actions/setup-node-deps'
- '/.github/actions/open-automation-pr'Verified locally at this head: without the line, the suite fails 1/11 (this assertion); with it, 11/11 pass ( 🐝 Hive Agent: — hive: agent=ci-maintainer backend=copilot model=kimi-k3 copilot=1.0.88 |
|
Fixed the failing 🐝 Hive Agent: — hive: agent=architect backend=copilot model=claude-opus-4-6 copilot=1.0.88 |
54a8086
ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blockedHive flagged this PR (author @hivecommons-hive[bot], head
Hive did not add the |
|
Priority: P2, partial. The composite action is only the first half of #1622; the four workflow call-site substitutions are still required before the duplication finding is resolved. |
|
Follow-up: this PR adds the shared composite action and Dependabot path, but it does not yet complete #1622. The four call sites remain in |
Centralize the peter-evans/create-pull-request@v8.1.1 step used by four automation workflows (architecture-submission, refresh-community-people, refresh-metrics, refresh-radar-reports) into a single composite action that fixes delete-branch, labels and signoff, matching the pattern already used by .github/actions/setup-node-deps. Each workflow still needs updating to call ./.github/actions/open-automation-pr instead of peter-evans/create-pull-request directly; that edit touches .github/workflows/** and is out of reach for this lane's contributor-tier token, so it is left for a human or an ISSUES_PRS_MERGE agent per issue #1622. Signed-off-by: architect <280983584+hivecommons-hive[bot]@users.noreply.github.com>
Signed-off-by: architect <280983584+hivecommons-hive[bot]@users.noreply.github.com>
Dependabot's github-actions ecosystem entry only discovers SHA-pinned actions under the repository root (.github/workflows) and explicitly listed composite action directories. The new .github/actions/open-automation-pr/action.yml composite action pins peter-evans/create-pull-request by SHA but was not added to that list, so its pin would never be refreshed. Add the directory entry so tests/dependabot-contract.test.mjs passes. Signed-off-by: architect <280983584+hivecommons-hive[bot]@users.noreply.github.com>
Replace the four direct peter-evans/create-pull-request steps in architecture-submission.yml, refresh-community-people.yml, refresh-metrics.yml and refresh-radar-reports.yml with ./.github/actions/open-automation-pr, keeping each workflow's branch, commit message, title and body unchanged. The fixed delete-branch, labels and signoff values now live in one place. Two test guards found their workflows by the direct `uses:` and would have gone blind on the swap: the generate/format/validate/test ordering contract (helpers-workflow-ordering.mjs) and the pull-request-branch race contract (ci-concurrency.test.mjs). Both now resolve a step through local composite actions with walkSteps(), so a workflow is detected whether it calls the action directly or via the wrapper, and the branch is still read from the step the workflow wrote. The fixture tests cover the wrapped, non-wrapping and unknown-action cases. Closes #1622 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
54a8086 to
78ff7d7
Compare
🔒 Hold-gate integrity: branch changed while hold-gated — fresh review requiredThis PR's branch moved while it sat hold-gated: the head recorded when the hold was applied was Commits not present in the hold-time snapshot (4):
Authors not in the hold-time author set: A human should review the FULL diff at the current head — a rebase or force-push renames every commit, so everything above needs eyes even if it looks familiar. Removing the hold label after that review is the fresh approval: the guard has re-pinned its snapshot to the current head, so a clean lift re-opens the merge lanes. |
78ff7d7
ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blockedHive flagged this PR (author @hivecommons-hive[bot], head
Hive did not add the |
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
There was a problem hiding this comment.
Read the full diff against the tree at merge-base and ran the affected test suites locally — this looks correct to me.
What I verified:
- Action extraction is faithful.
.github/actions/open-automation-pr/action.ymlpinspeter-evans/create-pull-request@5f6978f…(v8.1.1), the exact SHA every workflow used inline before, and moves only the fixed policy fields (delete-branch: true,labels: automated,signoff: true). All four call sites keep their ownbranch,commit-message,title,body; nothing was dropped or reworded in the swap. - The test guards stay live through the wrapper.
pullRequestBranches(tests/ci-concurrency.test.mjs:166) andcommitsGeneratedOutput(tests/helpers-workflow-ordering.mjs:121) now resolve steps throughopensPullRequest, which descends viawalkSteps. Their production callers (ci-concurrency.test.mjs:237,412; automation-workflow-ordering.test.mjs:201) pass no options, andwalkStepsdefaults toloadLocalActions()(tests/helpers-workflows.mjs:91-104), so the real repository wrapper is followed. The branch is still read from the workflow's own step (step?.with?.branchon the wrapper call), not the forwarded${{ inputs.branch }}— the fixture at ci-concurrency.test.mjs:857-897 pins exactly this. - Dependabot coverage for the new action directory is added (.github/dependabot.yml:31), matching the
setup-node-depsprecedent. - Tests:
node --teston ci-concurrency, workflow-ordering-helpers, automation-workflow-ordering and composite-action-supply-chain — 51/51 pass at head 78ff7d7.
One informational note, not a defect: LAUNCH.md:119-120 still narrates the create-pull-request steps and historical issue #568 in past tense; it remains accurate since the wrapper forwards the same action, so no change needed.
Body and diff agree (the claimed call-site swap and guard fixes are all present). Approval itself is a maintainer's signature — @mrbobbytables, this is ready for that decision once the queued CI completes.
— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88
1 participant
Refactor
Adds
.github/actions/open-automation-pr/action.yml, a composite action that wrapspeter-evans/create-pull-request@5f6978f...(v8.1.1) and fixesdelete-branch: true,labels: automated, andsignoff: true, and switches the four automation workflows (architecture-submission.yml,refresh-community-people.yml,refresh-metrics.yml,refresh-radar-reports.yml) to call it. Each workflow keeps its own branch, commit message, title and body; only the fixed policy fields move into the action. This matches the existing.github/actions/setup-node-depspattern.Call-site swap and test guards (maintainer follow-up on this branch)
The original hive commits could only add the action; the workflow edits were pushed by a maintainer on top. Doing the swap exposed that two test guards located "workflows that open a PR" by the direct
uses: peter-evans/create-pull-requestand would have gone blind once every workflow used the wrapper:tests/helpers-workflow-ordering.mjs(commitsGeneratedOutput), behind the generate -> format -> validate -> test ordering contract intests/automation-workflow-ordering.test.mjstests/ci-concurrency.test.mjs(pullRequestBranches), behind the pull-request-branch race contractBoth now resolve a step through local composite actions using the existing
walkSteps()loader, so a workflow is detected whether it calls the action directly or via the wrapper, and the branch is still read from the step the workflow wrote (the wrapper forwardsbranch:unchanged). Fixture tests cover the wrapped, non-wrapping and unknown-action cases. Their non-vacuity guards failed before this fix and pass after it.Also rebased onto current
main.Closes #1622
Filed by architect agent (ACMM L5 — hold-gated mode); completed and released for review by @mrbobbytables.