The scan now reads exactly the manifests the release tooling rewrites, names
every directory and file it cannot read, and refuses an empty corpus; the
command takes the root it checks so the exit code is tested, and the workflow
reports a crashed check as a warning in report mode.
Each step is a spawn whose stdio reaches the job log, the first failure stops
the list, and the script decides from CHECK_MODE whether to annotate as an
error or a warning, so the workflow only calls it.
The missing-script branch now fails in block mode instead of passing, the shell
block parses, the version walk refuses a directory it cannot read or one that
holds no manifest, the install is watched before anything else can throw, and a
spec runs `bash -n` over every Policy shell block.
`Policy / Pre-Merge Check` now runs `scripts/pre-merge-check.ts` under plain
Node and knows nothing else about the merged tree. That script installs the
dependencies, checks that every released manifest carries the root version
while the install runs, and builds the Host and Client contracts, reporting
which step failed.
* fix(ci): keep the pre-merge check off the report-mode failures
* fix(ci): fail the pre-merge check in block mode without a base commit
* fix(ci): report every pre-merge failure the way its mode asks
The merge step now separates a base commit it cannot fetch from a merge it
cannot do, both failures print an annotation, and a spec pins the mode
wiring of the three Policy workflows.
* test(ci): type the Policy workflow assertions
---------
Co-authored-by: imccyu <[email protected]>
The App token cannot update a run the job token created and vice versa, so
selecting runs by `app.slug === 'github-actions'` missed every App run: each
phase created another run, a published App success was never revoked, and a
head with an older job-token run made the App patch fail. Select runs by the
publishing app slug instead, pass `vars.DSH_APPROVAL_APP_SLUG`, and set the
external_id marker on the setup-phase run too.
Cover the App-owned update and the job-run coexistence, and align the note with
the measured earliest-suite rule and the App slug variable.
* ci: run native Windows PR jobs in a separate workflow
GitHub re-runs failed jobs only after a whole run finishes, so slow Windows jobs blocked re-running failed Linux jobs. CI Windows now owns the native Windows jobs and the Windows x64 Python runtime target, with its own required 'windows checks passed' verdict.
Refs #6893
* ci: run Python PR jobs in a separate workflow
Python rarely fails while the Windows lanes run long, so the Python SDK suite and the Linux/Windows x64 runtime matrix move into CI Python. The three pull-request workflows can now be re-run without waiting for each other, and branch protection gains "python checks passed" beside the existing verdicts.
Refs #6893
* docs: record the three PR verdicts in the failover runbook
* test: pin the shared environment across the PR workflows
* test: read the python SDK lane from CI Python
* test(sdk): parse session JSONL frames in the keyless smoke
Node 24.19 returned only the first frame of a concatenated zstd log, so the single JSON.parse saw just the header; 24.22 returns every frame and the JSONL body broke the parse. Read frames explicitly and select the main session by its header so both versions agree.
Mint the check-run token from a dedicated approval App instead of a shared
automation App, so the identity that owns the decision check suite is specific to
this gate. The workflow reads `vars.DSH_APPROVAL_APP_CLIENT_ID` and
`secrets.DSH_APPROVAL_APP_PRIVATE_KEY`, and the token stays scoped to
`checks: write`.
The decision check run kept its job-token check suite out of the pull request's
merge box: GitHub associates check runs with a pull request through the check
suite of the workflow run, and a `pull_request_target` run is not associated.
Mint a token from the repository App scoped to `checks: write` and publish only
the check run with it, so the merge box lists the label; the commit status gate
keeps using the job token and is unaffected when the token or the write fails.
Pin the token step, its single secret reference, and the client split in the
workflow and approval tests, and record the measured association limit in the
Agent Note and review-ownership README.
The check run is a label, not the gate, so a failed write is logged and leaves
the commit status untouched; a replayed workflow token without the checks
permission therefore cannot break the gate. Mark the runs the publisher creates
with an external_id so a same-named job check run from a pull request is not
adopted, and revoke only the publisher's own success.
Record the unchanged status behavior against the archived decision, clarify the
measured context name, and state the pending-write residual in the note.
Only add the `weighted approval decision` check run: the required
`weighted approval` commit status keeps its `pending`, `success`, and `error`
states exactly as before, and branch rules keep requiring it. The check run
reports the same decision as a conclusion label and is not required, so it
never blocks a merge.
The Agent Note and README now state the status semantics as unchanged and the
measured reason a required check run is not available here.
The required check run introduced previously is not matched by this repository's
branch rules, so the gate could not be satisfied. Keep the required
`weighted approval` commit status as the gate and publish the
`weighted approval decision` check run as the label: action_required while the
policy is unmet, success when it holds, failure on setup or evaluation errors.
The status completes as success or failure instead of waiting as pending, so CI
watchers end.
Record the measured check-run limit, the revocation and recorded-conclusion
design, and the alternatives in the Agent Note; update the review-ownership
README, the workflow permissions, and the approval tests.
A required check accepts success, neutral, and skipped, and any workflow in the
pushed branch can name a job after the required check, so revoke every passing
conclusion instead of only the success this publisher writes. Take the
conclusion writer from main() so tests no longer append to the runner's
GITHUB_OUTPUT file.
Record the measured naming risk, the edit and re-run migration paths, and the
boundary of each cancellation measurement in the decision note and README.
The evaluation failure title was preserved by matching details_url, a field
GitHub may rewrite for check runs created with the workflow token, so the
setup-failure step could replace the specific title after all. Record the
conclusion the publish step wrote in a step output and run the setup-failure
step only when no conclusion was recorded; a published decision now survives
a later failure or cancellation without relying on an API field.
Record the measured timeout cancellation path and the re-run migration limit in
the decision note, and scope the pre-push guidance to ACTION_REQUIRED so a
failure conclusion is not read as an approval wait.
LogosVeritas