Do not fail the sweep when a head branch is reused by a newer pull request

Now that the sweep runs to completion it surfaces a condition that was
previously unreachable. When a contributor closes a pull request and then
reuses its head branch for a new one, the head branch no longer points at
the SHA the closed pull request recorded. `delete_branch` correctly refuses
to delete it -- deleting it would break the newer pull request -- but it
reported that refusal as a failure, so the whole run went red.

That state is permanent for as long as the newer pull request stays open, so
the workflow would have been red on every run indefinitely. That is the same
alert fatigue the previous fix set out to remove, just from a different
cause. `jdeniau-GHSA-xvcm-6775-5m9r` is a live example: pull request 9129 was
closed, one more commit was pushed to its head branch, and pull request 9226
was opened from it and is still open.

Reusing a branch this way is a normal contributor pattern here, not an
operational fault, and it needs no human intervention: once the newer pull
request is closed its own cleanup removes the branch, the older pull
request's head then reads as already absent, and the leftover staging branch
is collected on the next sweep. Treat it the way the other "nothing safe to
do here" states are already treated -- still open, fork-headed, deleted --
and skip it instead of failing.

`delete_branch` now returns 3 for this case specifically, so a genuine
deletion failure is still a failure and still stops the staging branch from
being deleted after it. Nothing that was previously deleted is deleted any
differently; only the reporting changes.

Record the skipped branches and write them to the job summary along with the
sweep counters, so they stay visible without being buried in a 1,600-line log
and without holding the run red.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: daca0885-6779-4adb-bb02-ff6920d73ab3

Author: taladrane

.github/workflows/delete_staging_and_head_branches_writer.yaml

@@ -165,8 +165,12 @@ jobs:
             fi
             if [[ -n "${expected_sha}" && "${current_sha}" != "${expected_sha}" ]]; then
               rm -f "${body_file}"
-              echo "::error::Head branch ${branch} now points to ${current_sha}, not ${expected_sha}; leaving it and the staging branch in place."
-              return 1
+              # The branch moved after the pull request closed, which normally means a newer
+              # pull request reused it. Deleting it would break that pull request, so report
+              # this as a skip rather than a failure: it resolves itself once the newer pull
+              # request is closed and cleaned up in turn.
+              echo "::warning::Head branch ${branch} now points to ${current_sha}, not ${expected_sha}; it is in use elsewhere, so it and the staging branch are left in place."
+              return 3
             fi
 
             if ! status="$(request_ref "${body_file}" DELETE "${encoded_branch}")"; then
@@ -192,9 +196,15 @@ jobs:
             return 1
           }
 
+          # Records a branch that was deliberately left in place, so the job summary can
+          # report it without the run having to fail.
+          record_skip() {
+            printf '%s\t%s\n' "$1" "$2" >> "${SKIPPED_FILE}"
+          }
+
           process_pr() {
             local advisory_file_pages base_ref base_repo expected_staging_branch head_ref head_repo head_sha
-            local fetch_status=0 pr_json pr_number="$1" state
+            local delete_status=0 fetch_status=0 pr_json pr_number="$1" state
             expected_staging_branch="${2:-}"
 
             if ! is_pr_number "${pr_number}"; then
@@ -274,7 +284,12 @@ jobs:
             fi
 
             if [[ "${head_ref}" == "${base_ref}" ]]; then
-              delete_branch "${base_ref}" "${head_sha}" || return 1
+              delete_branch "${base_ref}" "${head_sha}" || delete_status=$?
+              if (( delete_status == 3 )); then
+                record_skip "${pr_number}" "${base_ref}"
+                return 0
+              fi
+              (( delete_status == 0 )) || return 1
               return 0
             fi
 
@@ -284,7 +299,14 @@ jobs:
             fi
 
             # Never delete the staging branch when the head branch could not be removed.
-            delete_branch "${head_ref}" "${head_sha}" || return 1
+            delete_branch "${head_ref}" "${head_sha}" || delete_status=$?
+            if (( delete_status == 3 )); then
+              record_skip "${pr_number}" "${head_ref}"
+              return 0
+            fi
+            if (( delete_status != 0 )); then
+              return 1
+            fi
             delete_branch "${base_ref}"
           }
 
@@ -393,17 +415,66 @@ jobs:
                 "${candidates_file}" "${pairs_file}" || join_status=$?
             fi
 
-            echo "Inspected $(wc -l < "${pairs_file}" | tr -d ' ') staging branches." >&2
+            INSPECTED_COUNT="$(wc -l < "${pairs_file}" | tr -d ' ')"
+            echo "Inspected ${INSPECTED_COUNT} staging branches." >&2
             rm -rf "${pairs_file}" "${candidates_file}" "${chunk_dir}"
             # The cleanup above must not mask a failed join, otherwise the sweep would
             # report success while having reconciled nothing.
             return "${join_status}"
           }
 
+          # Branches left in place are expected rather than exceptional, so they are
+          # reported in the run summary instead of being buried in the log.
+          write_job_summary() {
+            local branch pr skipped_count=0
+
+            [[ -n "${GITHUB_STEP_SUMMARY:-}" ]] || return 0
+            if [[ -s "${SKIPPED_FILE}" ]]; then
+              skipped_count="$(wc -l < "${SKIPPED_FILE}" | tr -d ' ')"
+            fi
+            # A per-pull-request run with nothing to report should not add an empty section.
+            if (( ! SWEEP && skipped_count == 0 )); then
+              return 0
+            fi
+
+            {
+              echo "### Staging branch cleanup"
+              echo
+              if (( SWEEP )); then
+                echo "| Metric | Count |"
+                echo "| --- | ---: |"
+                echo "| Staging branches inspected | ${INSPECTED_COUNT} |"
+                echo "| Pull requests reconciled | ${RECONCILE_COUNT} |"
+                echo "| Left in place (head branch in use) | ${skipped_count} |"
+                echo "| Pull request failures | ${PROCESS_FAILURES} |"
+                echo "| Triage batches failed | ${TRIAGE_FAILURES} |"
+                echo
+              fi
+
+              if (( skipped_count > 0 )); then
+                echo "<details><summary>Head branch reused by a newer pull request (${skipped_count})</summary>"
+                echo
+                echo "Deleting these branches would break the newer pull request that now uses them, so they were left alone. They are cleaned up automatically once that pull request is closed. No action is needed."
+                echo
+                while IFS=$'\t' read -r pr branch; do
+                  echo "- \`${branch}\` — left over from #${pr}"
+                done < "${SKIPPED_FILE}"
+                echo
+                echo "</details>"
+              fi
+            } >> "${GITHUB_STEP_SUMMARY}"
+          }
+
           TRIAGE_CHUNK_SIZE=50
           TRIAGE_FAILURES=0
           PROCESS_FAILURES=0
           MISSING_PR_IS_ERROR=0
+          INSPECTED_COUNT=0
+          RECONCILE_COUNT=0
+          SWEEP=0
+          SKIPPED_FILE="$(mktemp)"
+          # An EXIT trap keeps the summary accurate even when the run ends in failure.
+          trap 'write_job_summary || true; rm -f "${SKIPPED_FILE}"' EXIT
 
           if [[ "${GITHUB_EVENT_NAME}" == "workflow_run" ]]; then
             PR_NUMBER="${WORKFLOW_RUN_PR_NUMBER}"
@@ -416,9 +487,11 @@ jobs:
             MISSING_PR_IS_ERROR=1
             process_pr "${DISPATCH_PR_NUMBER}"
           else
+            SWEEP=1
             TARGETS_FILE="$(mktemp)"
             collect_reconciliation_targets > "${TARGETS_FILE}"
-            echo "Reconciling $(wc -l < "${TARGETS_FILE}" | tr -d ' ') staging branch(es)."
+            RECONCILE_COUNT="$(wc -l < "${TARGETS_FILE}" | tr -d ' ')"
+            echo "Reconciling ${RECONCILE_COUNT} staging branch(es)."
 
             # A single unreconcilable pull request must not stop the sweep, otherwise
             # every branch after it is never reconciled.