mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 17:45:53 +01:00
Devin Foley
cbe91aab12
The lockfile-policy design lets manifest-only PRs merge green against a regenerated lockfile artifact, with refresh-lockfile.yml expected to land the real lockfile right after via an auto-merge PR. That last step was permanently stuck: the branch is pushed with the default GITHUB_TOKEN, which triggers no pull_request workflows, so the required checks never start, auto-merge never fires, and every frozen-lockfile install on master fails until a human notices and pokes the PR — which is exactly what happened after #12095/#12100 merged. Prefer a LOCKFILE_BOT_TOKEN secret (fine-grained PAT, contents + pull-requests write) on every credential surface so the push triggers checks and auto-merge completes unattended, and add a verification step that fails the refresh run loudly — with recovery instructions in the job summary — whenever the PR's required checks have not started. A wiring test pins both properties and the policy job runs it. Tested: node --test scripts/__tests__/refresh-lockfile-workflow.test.mjs (3 pass); both workflow files re-parsed as YAML.