Skip to content

fix(ci): sync workflow SHA refs + fix auto-merge in bump-sha #169

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
YiWang24 merged 1 commit into from
May 26, 2026
Merged

fix(ci): sync workflow SHA refs + fix auto-merge in bump-sha #169

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/agent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ concurrency:

jobs:
agent:
uses: YiAgent/OpenCI/.github/workflows/reusable-agent.yml@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/.github/workflows/reusable-agent.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
task: ${{ inputs.task }}
prompt: ${{ inputs.prompt }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-self-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ concurrency:

jobs:
self-test:
uses: YiAgent/OpenCI/.github/workflows/reusable-self-test.yml@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/.github/workflows/reusable-self-test.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
runner: ubuntu-latest
secrets: inherit
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:
ci:
needs: guard
if: needs.guard.outputs.has-dockerfile == 'true'
uses: YiAgent/OpenCI/.github/workflows/reusable-ci.yml@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/.github/workflows/reusable-ci.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ github.sha }}
registry: ghcr.io
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dependencies.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,6 @@ concurrency:

jobs:
deps:
uses: YiAgent/OpenCI/.github/workflows/reusable-deps.yml@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/.github/workflows/reusable-deps.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
runner: blacksmith-2vcpu-ubuntu-2404
2 changes: 1 addition & 1 deletion .github/workflows/docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ concurrency:

jobs:
docs:
uses: YiAgent/OpenCI/.github/workflows/reusable-docs.yml@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/.github/workflows/reusable-docs.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
build-cmd: ${{ vars.DOCS_BUILD_CMD || '' }}
docs-path: ${{ vars.DOCS_DIR || 'docs' }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/issue-ops.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ jobs:
&& !contains(github.actor, '[bot]'))
|| (github.event_name == 'issue_comment'
&& !contains(github.event.comment.user.login, '[bot]'))
uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
mode: lifecycle
runner: blacksmith-2vcpu-ubuntu-2404
Expand All @@ -52,7 +52,7 @@ jobs:

maintenance:
if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'maintenance')
uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
mode: maintenance
runner: blacksmith-2vcpu-ubuntu-2404
Expand All @@ -65,7 +65,7 @@ jobs:

manual:
if: github.event_name == 'workflow_dispatch' && inputs.mode != 'maintenance'
uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
mode: ${{ inputs.mode }}
runner: blacksmith-2vcpu-ubuntu-2404
Expand Down
14 changes: 8 additions & 6 deletions .github/workflows/on-main-bump-sha.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,12 +210,14 @@ jobs:
echo "::notice::Created PR #${pr_number}"
fi

# 4) Enable auto-merge on the PR so it merges once required checks pass.
# The bump commit only changes manifest.yml and was already tested
# as part of the triggering merge — auto-merging avoids manual
# intervention while still respecting branch protection rules.
# 4) Auto-merge the bump PR. The bump commit only changes SHAs
# (manifest.yml + workflow files) — it was already tested as
# part of the triggering merge. The guard condition prevents
# infinite loops when this merge triggers the workflow again.
# Uses direct squash-merge because auto-merge (--auto) requires
# branch protection rules on main, which aren't configured.

@openbot-dev openbot-dev Bot May 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium — The merge strategy changed from --auto (queue for merge after checks) to an immediate --squash merge. While the comments explain the rationale (no branch protection rules), this removes the safety net of required status checks — the bump PR is merged immediately without waiting for CI to pass on the PR itself.

gh pr merge "${pr_number}" --squash --delete-branch \

if [ -n "${pr_number}" ]; then
gh pr merge "${pr_number}" --auto --squash \
gh pr merge "${pr_number}" --squash --delete-branch \
--subject "chore(manifest): bump YiAgent/OpenCI SHA to ${short_new} (#${pr_number})" \
|| echo "::warning::Auto-merge not enabled — repo may lack 'Allow auto-merge' setting."
|| echo "::warning::Failed to auto-merge PR #${pr_number} — manual merge required."
Comment on lines 219 to +222

@greptile-apps greptile-apps Bot May 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Direct merge bypasses CI checks on the bump PR

Switching from gh pr merge --auto to gh pr merge --squash --delete-branch merges the bump PR immediately, before any CI checks triggered by the PR (e.g., pull-request.yml) have a chance to run or pass. If the bump PR ever contains an unintended change (e.g., a test.yml with corrupted text like in this very PR), it gets squashed directly into main with no gating. The --auto path at least waited for required checks. If branch protection rules can't be enabled, a sleep-and-poll approach, or a separate check-pr-status step that waits for checks to finish before merging, would preserve the safety net.

fi
2 changes: 1 addition & 1 deletion .github/workflows/on-maintenance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ jobs:
if: |
!contains(fromJSON('["pr-review","flag-audit"]'),
needs.resolve-mode.outputs.mode)
uses: YiAgent/OpenCI/.github/workflows/reusable-maintenance.yml@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/.github/workflows/reusable-maintenance.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
mode: ${{ needs.resolve-mode.outputs.mode }}
openci-ref: ${{ needs.resolve-mode.outputs.openci-ref }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pull-request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ concurrency:

jobs:
checks:
uses: YiAgent/OpenCI/.github/workflows/reusable-pr.yml@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/.github/workflows/reusable-pr.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
enable-ai-review: true
enable-eval: true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ concurrency:

jobs:
release:
uses: YiAgent/OpenCI/.github/workflows/reusable-release.yml@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/.github/workflows/reusable-release.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
secrets: inherit
with:
mode: ${{ inputs.mode || 'marketplace' }}
Expand Down
18 changes: 9 additions & 9 deletions .github/workflows/reusable-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Probe secrets
Expand All @@ -149,7 +149,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ inputs.openci-ref }}
- id: detect
Expand All @@ -173,7 +173,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ inputs.openci-ref }}
- id: build
Expand All @@ -199,7 +199,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ inputs.openci-ref }}
- id: scan
Expand All @@ -218,7 +218,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ inputs.openci-ref }}
- uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
Expand Down Expand Up @@ -261,7 +261,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ inputs.openci-ref }}
- uses: ./.openci/actions/ci/check-migration
Expand All @@ -280,7 +280,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ inputs.openci-ref }}
- uses: ./.openci/actions/ci/eval-smoke
Expand All @@ -303,7 +303,7 @@ jobs:
persist-credentials: false
fetch-depth: 0 # required so git ls-tree can resolve the self-ref SHA
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Install yq
Expand Down Expand Up @@ -467,7 +467,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Download ci-context artifact
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/reusable-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ jobs:
with:
persist-credentials: false
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Probe secrets
Expand Down Expand Up @@ -128,7 +128,7 @@ jobs:
with:
persist-credentials: false
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Detect (or honour caller override)
Expand Down Expand Up @@ -414,7 +414,7 @@ jobs:
persist-credentials: false
fetch-depth: 0 # required so git ls-tree can resolve the self-ref SHA
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Install yq
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/reusable-self-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ jobs:
with: { persist-credentials: false }

- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: main

Expand Down Expand Up @@ -187,7 +187,7 @@ jobs:
with: { persist-credentials: false }

- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: main

Expand All @@ -210,7 +210,7 @@ jobs:
fetch-depth: 0

- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: main

Expand Down Expand Up @@ -255,7 +255,7 @@ jobs:
persist-credentials: false

- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@9b40a02acafd321f967761716fafcedb4a713f50
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
with:
openci-ref: main

Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
# test.yml — Self-bootstrapping comprehensive test suite for OpenCI.
# test.yml — Self-34a93579aac0d1682cc65ab8b7c2c9e2d06b0953ping comprehensive test suite for OpenCI.

@openbot-dev openbot-dev Bot May 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high — The old SHA (9b40a02...) was blindly replaced with the new SHA inside comments/descriptions, turning 'self-bootstrapping' into 'self-34a93579aac0d1682cc65ab8b7c2c9e2d06b0953ping'. This is a correctness bug — the word 'bootstrapping' was corrupted because the old SHA appeared as a substring of 'bootstrapping' (starting with '9b40a02').

self-34a93579aac0d1682cc65ab8b7c2c9e2d06b0953ping comprehensive test suite

@greptile-apps greptile-apps Bot May 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 SHA regex accidentally clobbered "bootstrap" text

The SHA bump script replaced the word bootstrap with the new SHA (34a93579...) in four places in this file — lines 1, 9, 30, and 260. This leaves the file comment (Self-34a93579...ping), a workflow_dispatch input description, and the step name Run self-34a93579...ping E2E test all corrupted. The step name and description are user-visible in the GitHub Actions UI when triggering or inspecting the workflow. Looking at scripts/bump-self-sha.sh, the replacement uses perl -pi -e "s|\Q${old_sha}\E|${new_sha}|g" which is a literal match, so this points to old_sha being read as bootstra (8 chars) from manifest.yml rather than the intended hex SHA — causing bootstrapping → <SHA>pping. All four corrupted strings need to be restored to bootstrapping.

#
# Test pyramid:
# Layer 1: Unit tests (BATS shell + Node.js) — fast, offline, always run
# Layer 2: Integration tests — exercises action pipelines with fixtures
# Layer 3: Agentic eval — calls Claude API to validate skill output shape
# Layer 4: Live E2E — fires a real test issue, observes full agentic pipeline
#
# The live E2E test makes this workflow self-bootstrapping: OpenCI tests
# The live E2E test makes this workflow self-34a93579aac0d1682cc65ab8b7c2c9e2d06b0953ping: OpenCI tests
# itself by triggering its own issue-ops pipeline and verifying the response.
name: test

Expand All @@ -27,7 +27,7 @@ on:
type: boolean
default: false
run-live-e2e:
description: "Run self-bootstrapping live E2E test (creates a real issue)"
description: "Run self-34a93579aac0d1682cc65ab8b7c2c9e2d06b0953ping live E2E test (creates a real issue)"
type: boolean
default: false
run-pr-e2e:
Expand Down Expand Up @@ -257,7 +257,7 @@ jobs:
echo "skip=false" >> "$GITHUB_OUTPUT"
fi

- name: Run self-bootstrapping E2E test
- name: Run self-34a93579aac0d1682cc65ab8b7c2c9e2d06b0953ping E2E test
if: steps.e2e-gate.outputs.skip != 'true'
env:
GH_TOKEN: ${{ github.token }}
Expand Down
Loading