mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-09 16:02:36 +01:00
DottaandPaperclip
b6e9615aed
## Thinking Path > - Paperclip helps people manage AI agents and their work. > - Pull requests already run CI and automated code review. > - A completed check does not start a final advisory merge review. > - A private routine webhook can connect these two steps. > - The webhook credential must stay outside PR code and public logs. > - This pull request adds an optional notification from trusted branch code. > - The routine records a recommendation. A person keeps merge control. ## Linked Issues or Issue Description **What existing behavior does this improve?** It connects successful PR verification to an advisory Paperclip routine. **Subsystem affected** GitHub Actions and the existing routine webhook API. **Current behavior** A PR can finish verification without asking a routine for a final merge recommendation. **Proposed behavior** A trusted workflow reads the current PR and its complete check list. It sends the PR identity to a private webhook when required checks pass and other reported checks finish successfully, as skipped, or as neutral. The receiving routine runs the configured merge review skill and records its decision on its Paperclip task. **Reason and benefit** This gives maintainers an advisory decision after verification. It does not grant merge control to the routine. **Breaking changes** None. Missing secrets or delivery errors leave verification results unchanged. Searched open and closed PRs and issues for related work. No duplicate notification workflow was found. Related API work: #18058 and #18581. This change uses the routine API and does not alter chat credential setup. ## What Changed - Add a default-branch workflow for PR workflow completions, external checks, and commit statuses. - Use read permissions and a GitHub environment restricted to master for the private URL and bearer token. - Require successful `ci / verify`, `ci / e2e`, and additional branch-rule checks. Read every status page and refresh the PR before delivery. - Use a stable idempotency key for each PR, head, and base. Reject stale events and changed candidates. - Verify the two core check runs belong to the same real GitHub Actions suite for the unchanged PR caller and master-owned reusable CI. Reject forged names, renamed callers, and incomplete file listings. - Keep HTTP redirects disabled, bound request time, and print fixed delivery states only. - Add regression checks and document private setup, pause, rotation, and acceptance steps. - Grant commit-status read access. Add a separate PR API probe with the same read permissions and the real Actions token. The probe has no private environment or webhook secrets and sends no notification. ## Verification - Pass: `node --test .github/scripts/tests/notify-pr-merge-review.test.mjs` (21 tests after the security and token-permission fixes). - Pass: actionlint v1.7.12 on `.github/workflows/pr-merge-review.yml`. - Pass: live GitHub query of a current PR and its complete status list. This found a GraphQL field mismatch during development. The corrected query passed with 62 checks. - Pass: the configured bearer webhook returned `test_received` with `routineStarted=false` in setup mode. Readback confirmed an active routine and environment secrets restricted to the master branch. - Not run: `pnpm verify --explain` could not start because this checkout has no installed workspace dependencies. Required CI will supply broad coverage. - The first quality-gate run rejected a CI-only title because this change adds a script. The feature title passed the later gate. - The security review found that PR-controlled check names could forge eligibility. A focused regression failed before the fix and passed after suite, run, caller, and reusable-workflow checks were added. The corrected provenance query also passed against a completed historical CI run without sending a webhook. - Earlier CI atec2c2dcfailed in `workspace-recovery.test.ts` with a generated company-prefix collision, in `idle-domain-deadlines-postgres.test.ts` with a deadline snapshot mismatch and timeout, and in `CoordinatorTasks.test.tsx` with a route query mismatch. The browser shard also recorded a CSS preload test failure before cancellation. These failures remain recorded in [run 42245040952](https://github.com/paperclipai/paperclip/actions/runs/42245040952). This PR does not edit those production paths. Current master is merged and fresh CI is required; the earlier failures are not claimed resolved. - The repeated browser, general-server, and UI lanes passed at715cee88ce. The earlier failures remain historical; their causes are not all established. The Runner package lane was still running before the next fix. - A reviewer found missing `statuses: read`, which the broader local token did not expose. The permission regression failed before the fix and passed after it. The new read-only API probe will test the query with the actual Actions token. - Pass atc3c84394b7: the real Actions-token API probe, typecheck, build, browser aggregate, security scan, and Greptile 5/5. No unresolved review threads remain. - The only remaining CI failure is a 15 second timeout in the existing retained-native-session-cleanup-work backlog test (server shard 6/12). This file and its production implementation are unchanged from the previous candidate whose lane passed. The one scoped rerun passed at the same head, and the required verify aggregate now passes. The timeout remains in [run 42250393645, attempt 1](https://github.com/paperclipai/paperclip/actions/runs/42250393645/attempts/1); its cause is not established. This is recovery evidence, not a claimed root-cause fix. - A nonblocking review suggestion to defer branch-rule lookup until a PR is matched remains a minor efficiency follow-up. It is not a correctness or security finding. - Pending: a real notification and resulting routine task after this workflow reaches master. The setup test did not start a PR review. ## Risks - This workflow uses secrets. Keep the environment restricted to the master branch. It runs only trusted branch code and does not read PR artifacts, caches, or executable files. - GitHub event timing and check visibility can race. Delivery is best effort. A missed event can omit a review; it cannot change CI results or merge a PR. - Optional skipped and neutral checks permit an assessment. They do not prove that a check ran. Required checks must succeed. The routine must assess unavailable scanner coverage and other evidence gaps before its recommendation. - Add any new PR verification workflow name to the completion trigger list. - PRs that change the primary CI caller, `.github/workflows/pr.yml`, need a manual advisory review until their caller change reaches master. This prevents a PR from replacing verification with a forged result. - This PR changes CI configuration. CODEOWNERS review and normal merge rules still apply. ## Model Used OpenAI GPT-6 family through Codex. The exact deployment model ID and context window are not exposed to this run. Used reasoning, tool use, and code execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with available version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>