mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 17:45:53 +01:00
Devin Foley
cbe91aab12
The lockfile-policy design lets manifest-only PRs merge green against a regenerated lockfile artifact, with refresh-lockfile.yml expected to land the real lockfile right after via an auto-merge PR. That last step was permanently stuck: the branch is pushed with the default GITHUB_TOKEN, which triggers no pull_request workflows, so the required checks never start, auto-merge never fires, and every frozen-lockfile install on master fails until a human notices and pokes the PR — which is exactly what happened after #12095/#12100 merged. Prefer a LOCKFILE_BOT_TOKEN secret (fine-grained PAT, contents + pull-requests write) on every credential surface so the push triggers checks and auto-merge completes unattended, and add a verification step that fails the refresh run loudly — with recovery instructions in the job summary — whenever the PR's required checks have not started. A wiring test pins both properties and the policy job runs it. Tested: node --test scripts/__tests__/refresh-lockfile-workflow.test.mjs (3 pass); both workflow files re-parsed as YAML.
45 lines
1.7 KiB
JavaScript
45 lines
1.7 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { readFileSync } from "node:fs";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import test from "node:test";
|
|
|
|
const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
|
|
const workflow = readFileSync(
|
|
path.join(repoRoot, ".github/workflows/refresh-lockfile.yml"),
|
|
"utf8"
|
|
);
|
|
|
|
test("lockfile refresh pushes and manages its PR with a workflow-triggering credential", () => {
|
|
// A push made with the default GITHUB_TOKEN triggers no pull_request
|
|
// workflows, so the lockfile PR's required checks never start and
|
|
// auto-merge waits forever while master's frozen installs keep failing.
|
|
// Every credential surface must prefer the bot PAT and fall back to the
|
|
// default token.
|
|
const coalesce = /\$\{\{ secrets\.LOCKFILE_BOT_TOKEN \|\| github\.token \}\}/g;
|
|
const occurrences = workflow.match(coalesce) ?? [];
|
|
assert.ok(
|
|
occurrences.length >= 4,
|
|
`expected the LOCKFILE_BOT_TOKEN fallback on checkout, PR upsert, auto-merge, and verification (found ${occurrences.length})`
|
|
);
|
|
assert.doesNotMatch(
|
|
workflow,
|
|
/GH_TOKEN: \$\{\{ github\.token \}\}/,
|
|
"no credential surface may use the bare default token"
|
|
);
|
|
});
|
|
|
|
test("a lockfile PR whose required checks never start fails the run loudly", () => {
|
|
assert.match(workflow, /Verify required checks started on the lockfile PR/);
|
|
assert.match(workflow, /check-runs/);
|
|
assert.match(
|
|
workflow,
|
|
/::error::Lockfile PR has no required checks running/,
|
|
"the stuck state must surface as a red run with recovery guidance"
|
|
);
|
|
});
|
|
|
|
test("auto-merge remains enabled so a green refresh lands without a human", () => {
|
|
assert.match(workflow, /gh pr merge --auto --squash --delete-branch/);
|
|
});
|