Skip to content

Allow merge-based update-branch flow in PR assistant guidance#600

Merged
strawgate merged 8 commits intomainfrom
fix/bundle-transfer-merge-conflicts
Mar 9, 2026
Merged

Allow merge-based update-branch flow in PR assistant guidance#600
strawgate merged 8 commits intomainfrom
fix/bundle-transfer-merge-conflicts

Conversation

@strawgate
Copy link
Collaborator

@strawgate strawgate commented Mar 8, 2026

Summary

  • Allow merge-based conflict resolution in shared ready_to_push_to_pr guidance while still blocking history-rewrite flows (git rebase, git reset --hard + cherry-pick).
  • Update push safety behavior so ready_to_push_to_pr keeps the ancestry/history-rewrite guard but no longer rejects merge commits, and anchor self-review diff/stat/log generation to the original PR head when available.
  • Align mention-in-pr instructions to call ready_to_push_to_pr before push_to_pull_request_branch, defer merge-conflict/update-branch mechanics to shared guidance, and rerun required repo checks if ready_to_push_to_pr results in additional edits.
  • Add the same rerun-required-checks-after-ready_to_push_to_pr guidance to gh-aw-mention-in-pr-no-sandbox.md.
  • Add shared PR targeting (target: '$\{\{ inputs.target-pr-number || "triggering" }}') to PR-related safe-output fragments (add_comment, create_pull_request_review_comment, submit_pull_request_review, resolve_pull_request_review_thread, push_to_pull_request_branch) and remove duplicated per-workflow targeting config from gh-aw-mention-in-pr-by-id.md.
  • Add target-pr-number workflow input to gh-aw-mention-in-pr-no-sandbox.md for explicit PR targeting on manual/dispatch runs.
  • Update agentics-maintenance dispatch operation sentinel from 'none' to '' for compiled workflow consistency.
  • Update Makefile compiler pinning so setup-gh-aw installs gh-aw from strawgate/gh-aw at e0993dfc79bafc3e268b143cd957374b70b33e77, then regenerate lockfiles.
  • Add docs for same-run detector/auditor -> gh-aw-create-pr-from-issue chaining and compiler output propagation (docs/upgrading.md, docs/workflows/detector-fixer-chaining.md).

Test plan

  • make compile
  • make lint-workflows
  • Verify mention-in-pr now calls ready_to_push_to_pr before push_to_pull_request_branch.
  • Verify merge commits after the original PR head are allowed by ready_to_push_to_pr while history rewrites are still blocked (see tests/test_safe_input_ready_to_make_pr.py).

The body of this PR is automatically managed by the Trigger Update PR Body workflow.

@github-actions github-actions bot added the medium_boom Medium PR blast radius; likely benefits from human review label Mar 8, 2026
@coderabbitai
Copy link

coderabbitai bot commented Mar 8, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

This PR updates many GitHub Actions workflows and fragments. Changes include: adding an optional workflow input target-pr-number and propagating it as target across safe-outputs configurations; switching merge-conflict guidance to a merge-based flow and relaxing some history-rewrite checks; removing Safe Inputs scaffolding from many workflows; injecting Git author/committer environment variables into multiple steps; bumping the GitHub MCP server image from v0.31.0 to v0.32.0; changing an operation workflow input default in agentics-maintenance from 'none' to ""; and renaming/updating one test's expectations.

Possibly related PRs

Suggested labels

big_boom

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix/bundle-transfer-merge-conflicts
  • 🛠️ Update Documentation: Commit on current branch
  • 🛠️ Update Documentation: Create PR

Comment @coderabbitai help to get the list of available commands and usage tips.

coderabbitai[bot]

This comment was marked as resolved.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

♻️ Duplicate comments (1)
.github/workflows/gh-aw-pr-review-addresser.lock.yml (1)

1115-1163: ⚠️ Potential issue | 🟠 Major

Anchor the self-review inputs to headRefOid for merge-based updates.

pr_head_sha is loaded here, but the saved diff/stat/log still come from @{upstream}. After merging the base branch into the PR branch, that pulls base-only hunks and commits into /tmp/self-review, so the sub-agent reviews unrelated upstream work instead of just the conflict-resolution changes. Please switch the shared gh-aw-fragments/safe-output-push-to-pr.md source to diff/log from headRefOid (or otherwise filter merged-base-only changes) before recompiling. Based on learnings: files under .github/workflows with the .lock.yml extension are auto-generated by running gh aw compile from corresponding .md source files, so fixes belong in the source fragment rather than this lockfile.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/gh-aw-pr-review-addresser.lock.yml around lines 1115 -
1163, The diff/stat/log generation use @{upstream} even when pr_head_sha
(headRefOid) is available, causing merged base commits to be included; update
the logic that builds diff_text, stat_text and commits_text to prefer/anchor git
commands to the PR head (pr_head_sha) when pr_head_sha is non-empty (e.g., use
['git', 'diff', f'{pr_head_sha}..HEAD'] or ['git', 'diff', pr_head_sha, 'HEAD']
and similarly for --stat and git log ranges) instead of @{upstream}; make this
change in the source fragment gh-aw-fragments/safe-output-push-to-pr.md (not the
generated .lock.yml) so the compiled workflow uses pr_head_sha to produce
diffs/logs/stat that are limited to PR changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/gh-aw-fragments/safe-output-add-comment-pr-hide-older.md:
- Line 9: The fragment sets target using target: '${{ inputs.target-pr-number ||
"triggering" }}', which forces a hardcoded "triggering" fallback into all
importers and breaks workflow_run contexts; remove the fallback or require
callers to provide target-pr-number. To fix, update the fragment to use only
inputs.target-pr-number (e.g., target: '${{ inputs.target-pr-number }}') and
either add a required input declaration for target-pr-number in this fragment or
update each importer (.github/workflows/gh-aw-estc-pr-buildkite-detective.md and
.github/workflows/gh-aw-pr-actions-detective.md) to pass target-pr-number
explicitly; ensure any logic that relied on "triggering" is adjusted in the
comment-posting step that reads the target variable.

In @.github/workflows/gh-aw-mention-in-pr.lock.yml:
- Line 2309: The reply_to_pull_request_review_comment handler in the
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG lacks the target setting so replies can land
on the wrong PR; update the JSON entry for
"reply_to_pull_request_review_comment" inside GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG
to include "target":"${{ inputs.target-pr-number || \"triggering\" }}" (matching
the other PR-mutating handlers) so it respects explicit inputs.target-pr-number;
make this change in the source .md that generates the .lock.yml and recompile
with gh aw compile.

In @.github/workflows/gh-aw-pr-actions-fixer.lock.yml:
- Around line 611-617: The workflow is referencing the input name
target-pr-number but that input is not declared in the source workflow inputs,
causing the .lock.yml to fallback to "triggering"; add a new inputs.entry named
target-pr-number (matching the exact symbol target-pr-number) to the source
workflow's inputs block in gh-aw-pr-actions-fixer.md with an appropriate
description and default (or leave empty) and then regenerate the lock file so
.github/workflows/gh-aw-pr-actions-fixer.lock.yml is updated to use the declared
input in all places (including the safe-outputs JSON entries that reference ${ {
inputs.target-pr-number } }).

---

Duplicate comments:
In @.github/workflows/gh-aw-pr-review-addresser.lock.yml:
- Around line 1115-1163: The diff/stat/log generation use @{upstream} even when
pr_head_sha (headRefOid) is available, causing merged base commits to be
included; update the logic that builds diff_text, stat_text and commits_text to
prefer/anchor git commands to the PR head (pr_head_sha) when pr_head_sha is
non-empty (e.g., use ['git', 'diff', f'{pr_head_sha}..HEAD'] or ['git', 'diff',
pr_head_sha, 'HEAD'] and similarly for --stat and git log ranges) instead of
@{upstream}; make this change in the source fragment
gh-aw-fragments/safe-output-push-to-pr.md (not the generated .lock.yml) so the
compiled workflow uses pr_head_sha to produce diffs/logs/stat that are limited
to PR changes.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 92ab706d-e806-481b-9de6-90caab2d215c

📥 Commits

Reviewing files that changed from the base of the PR and between d56f5f0 and f2f5837.

📒 Files selected for processing (25)
  • .github/workflows/agentics-maintenance.yml
  • .github/workflows/gh-aw-create-pr-from-issue.lock.yml
  • .github/workflows/gh-aw-create-pr-from-issue.md
  • .github/workflows/gh-aw-dependency-review.lock.yml
  • .github/workflows/gh-aw-estc-docs-pr-review.lock.yml
  • .github/workflows/gh-aw-estc-pr-buildkite-detective.lock.yml
  • .github/workflows/gh-aw-fragments/safe-output-add-comment-pr-hide-older.md
  • .github/workflows/gh-aw-fragments/safe-output-add-comment-pr.md
  • .github/workflows/gh-aw-fragments/safe-output-push-to-pr.md
  • .github/workflows/gh-aw-fragments/safe-output-resolve-thread.md
  • .github/workflows/gh-aw-fragments/safe-output-review-comment.md
  • .github/workflows/gh-aw-fragments/safe-output-submit-review.md
  • .github/workflows/gh-aw-mention-in-issue-by-id.lock.yml
  • .github/workflows/gh-aw-mention-in-issue-by-id.md
  • .github/workflows/gh-aw-mention-in-pr-by-id.lock.yml
  • .github/workflows/gh-aw-mention-in-pr-by-id.md
  • .github/workflows/gh-aw-mention-in-pr-no-sandbox.lock.yml
  • .github/workflows/gh-aw-mention-in-pr.lock.yml
  • .github/workflows/gh-aw-pr-actions-detective.lock.yml
  • .github/workflows/gh-aw-pr-actions-fixer.lock.yml
  • .github/workflows/gh-aw-pr-ci-detective.lock.yml
  • .github/workflows/gh-aw-pr-review-addresser.lock.yml
  • .github/workflows/gh-aw-pr-review.lock.yml
  • Makefile
  • tests/test_safe_input_ready_to_make_pr.py
💤 Files with no reviewable changes (1)
  • .github/workflows/gh-aw-mention-in-pr-by-id.md
✅ Files skipped from review due to trivial changes (1)
  • .github/workflows/gh-aw-fragments/safe-output-add-comment-pr.md
🚧 Files skipped from review as they are similar to previous changes (8)
  • .github/workflows/gh-aw-estc-pr-buildkite-detective.lock.yml
  • .github/workflows/gh-aw-pr-review.lock.yml
  • .github/workflows/gh-aw-pr-ci-detective.lock.yml
  • .github/workflows/gh-aw-mention-in-issue-by-id.lock.yml
  • .github/workflows/gh-aw-fragments/safe-output-push-to-pr.md
  • .github/workflows/gh-aw-estc-docs-pr-review.lock.yml
  • .github/workflows/gh-aw-create-pr-from-issue.lock.yml
  • .github/workflows/gh-aw-dependency-review.lock.yml

…erge-conflicts

Made-with: Cursor

# Conflicts:
#	.github/workflows/gh-aw-create-pr-from-issue.lock.yml
#	.github/workflows/gh-aw-create-pr-from-issue.md
#	.github/workflows/gh-aw-dependency-review.lock.yml
#	.github/workflows/gh-aw-estc-docs-pr-review.lock.yml
#	.github/workflows/gh-aw-estc-pr-buildkite-detective.lock.yml
#	.github/workflows/gh-aw-mention-in-issue-by-id.lock.yml
#	.github/workflows/gh-aw-mention-in-pr-by-id.lock.yml
#	.github/workflows/gh-aw-mention-in-pr-no-sandbox.lock.yml
#	.github/workflows/gh-aw-mention-in-pr.lock.yml
#	.github/workflows/gh-aw-pr-actions-detective.lock.yml
#	.github/workflows/gh-aw-pr-actions-fixer.lock.yml
#	.github/workflows/gh-aw-pr-ci-detective.lock.yml
#	.github/workflows/gh-aw-pr-review-addresser.lock.yml
#	.github/workflows/gh-aw-pr-review.lock.yml
coderabbitai[bot]

This comment was marked as resolved.

Pin the compiler build to e0993dfc79bafc3e268b143cd957374b70b33e77, document same-run issue-to-PR chaining guidance, and regenerate workflow outputs/lockfiles using the locally built binary to avoid remote clone stalls.

Made-with: Cursor
Use PR head SHA as the preferred baseline for diff/stat/log context so merge-based conflict resolution does not flood self-review artifacts with upstream-only changes.

Made-with: Cursor
Initialize pr_head_sha before PR-context checks so readiness logic works when /tmp/pr-context/pr.json is absent and pytest no longer fails with NameError.

Made-with: Cursor
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
.github/workflows/gh-aw-fragments/safe-output-push-to-pr.md (1)

16-21: ⚠️ Potential issue | 🔴 Critical

Initialize pr_head_sha before the PR-context check.

pr_head_sha is assigned only at line 20 inside the if os.path.isfile(pr_json_path): block, but read at lines 36, 50, and 65 outside that block. When /tmp/pr-context/pr.json is absent, execution skips the block and raises UnboundLocalError on the first read, breaking the diff/stat/log fallback mechanism.

Proposed fix
      pr_json_path = '/tmp/pr-context/pr.json'
+     pr_head_sha = ''
      if os.path.isfile(pr_json_path):
          with open(pr_json_path) as f:
              pr_data = json.load(f)
          pr_head_sha = pr_data.get('headRefOid', '')
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/gh-aw-fragments/safe-output-push-to-pr.md around lines 16
- 21, pr_head_sha is only set inside the conditional that checks pr_json_path,
causing UnboundLocalError when the file is missing; initialize pr_head_sha
(e.g., to an empty string or None) before the if-block that reads pr_json_path
so later reads (the fallback logic referencing pr_head_sha) always have a
defined value and the diff/stat/log fallback can run safely.
♻️ Duplicate comments (1)
.github/workflows/gh-aw-mention-in-pr.lock.yml (1)

1938-1938: ⚠️ Potential issue | 🟠 Major

Add target to review-comment replies.

reply_to_pull_request_review_comment is still the only PR-mutating handler here without a target. In target-pr-number runs, replies will still default to the triggering PR unless the agent manually sets pull_request_number, so follow-up on addressed feedback can land on the wrong PR.

Minimal fix
-"reply_to_pull_request_review_comment":{"max":10}
+"reply_to_pull_request_review_comment":{"max":10,"target":"${{ inputs.target-pr-number || \"triggering\" }}"}

Based on learnings, .github/workflows/*.lock.yml files here are generated from the source .md, so this should be fixed in the source workflow markdown and then recompiled.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/gh-aw-mention-in-pr.lock.yml at line 1938, The handler
config GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG is missing a target for the
reply_to_pull_request_review_comment entry, so replies default to the triggering
PR; add "target":"${{ inputs.target-pr-number || \"triggering\" }}" to the
reply_to_pull_request_review_comment object in the config (mirror how target is
used in create_pull_request_review_comment and others) and then update the
source workflow markdown that generates this .github/workflows/*.lock.yml so the
compiled lock file is regenerated with the new target field.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/gh-aw-dependency-review.md:
- Around line 37-41: The workflow adds an input "target-pr-number" but still
uses the hard-coded github.event.pull_request.number in the visible PR context
and in Step 1's pull_request_read instructions; update the workflow to resolve
the PR number once (e.g., compute a single variable like pr_number =
inputs.target-pr-number || github.event.pull_request.number) and use that
variable everywhere the PR number is referenced (replace occurrences of
github.event.pull_request.number in the visible PR context, the
pull_request_read step, and any other PR-number references) so manual/dispatch
runs honor the provided target-pr-number consistently.

In @.github/workflows/gh-aw-estc-docs-pr-review.lock.yml:
- Around line 92-96: The workflow adds an input named target-pr-number but the
prompt construction still reads github.event.pull_request.number; update the
prompt generation steps that build the review prompt (the places currently using
github.event.pull_request.number) to instead use inputs.target-pr-number as a
fallback when github.event.pull_request.number is empty — e.g., set a variable
like pr_number: ${{ github.event.pull_request.number || inputs.target-pr-number
}} and use that variable wherever the prompt or agent reads PR state; after
changing the prompt interpolation for all occurrences (the three prompt blocks
noted), recompile the source .md into the .lock.yml using gh aw compile so the
lockfile reflects the new input plumbing.

In @.github/workflows/gh-aw-mention-in-pr-no-sandbox.md:
- Around line 48-52: The workflow declares the input target-pr-number but the
prompt still uses github.event.issue.number; update all places the prompt
anchors the PR (where the prompt templates currently reference `${{
github.event.issue.number }}`) to use the effective expression `${{
inputs.target-pr-number || github.event.issue.number }}` so manual/dispatch
triggers use the provided target-pr-number; search for occurrences in the prompt
blocks (e.g., the two places currently anchoring the prompt) and replace them
with the combined expression to ensure consistency between the declared input
(target-pr-number) and prompt context.

---

Outside diff comments:
In @.github/workflows/gh-aw-fragments/safe-output-push-to-pr.md:
- Around line 16-21: pr_head_sha is only set inside the conditional that checks
pr_json_path, causing UnboundLocalError when the file is missing; initialize
pr_head_sha (e.g., to an empty string or None) before the if-block that reads
pr_json_path so later reads (the fallback logic referencing pr_head_sha) always
have a defined value and the diff/stat/log fallback can run safely.

---

Duplicate comments:
In @.github/workflows/gh-aw-mention-in-pr.lock.yml:
- Line 1938: The handler config GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG is missing a
target for the reply_to_pull_request_review_comment entry, so replies default to
the triggering PR; add "target":"${{ inputs.target-pr-number || \"triggering\"
}}" to the reply_to_pull_request_review_comment object in the config (mirror how
target is used in create_pull_request_review_comment and others) and then update
the source workflow markdown that generates this .github/workflows/*.lock.yml so
the compiled lock file is regenerated with the new target field.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7618c7c7-87aa-45fc-b200-91ccd603aabc

📥 Commits

Reviewing files that changed from the base of the PR and between 0ff6959 and 540d7df.

📒 Files selected for processing (79)
  • .github/workflows/agent-deep-dive.lock.yml
  • .github/workflows/agent-efficiency.lock.yml
  • .github/workflows/gh-aw-agent-suggestions.lock.yml
  • .github/workflows/gh-aw-autonomy-atomicity-analyzer.lock.yml
  • .github/workflows/gh-aw-branch-actions-detective.lock.yml
  • .github/workflows/gh-aw-breaking-change-detect.lock.yml
  • .github/workflows/gh-aw-breaking-change-detector.lock.yml
  • .github/workflows/gh-aw-bug-exterminator.lock.yml
  • .github/workflows/gh-aw-bug-hunter.lock.yml
  • .github/workflows/gh-aw-code-duplication-detector.lock.yml
  • .github/workflows/gh-aw-code-duplication-fixer.lock.yml
  • .github/workflows/gh-aw-code-quality-audit.lock.yml
  • .github/workflows/gh-aw-code-simplifier.lock.yml
  • .github/workflows/gh-aw-create-pr-from-issue.lock.yml
  • .github/workflows/gh-aw-deep-research.lock.yml
  • .github/workflows/gh-aw-dependency-review.lock.yml
  • .github/workflows/gh-aw-dependency-review.md
  • .github/workflows/gh-aw-docs-drift.lock.yml
  • .github/workflows/gh-aw-docs-patrol.lock.yml
  • .github/workflows/gh-aw-duplicate-issue-detector.lock.yml
  • .github/workflows/gh-aw-estc-actions-resource-not-accessible-detector.lock.yml
  • .github/workflows/gh-aw-estc-docs-patrol-external.lock.yml
  • .github/workflows/gh-aw-estc-docs-pr-review.lock.yml
  • .github/workflows/gh-aw-estc-docs-pr-review.md
  • .github/workflows/gh-aw-estc-downstream-health.lock.yml
  • .github/workflows/gh-aw-estc-newbie-contributor-patrol-external.lock.yml
  • .github/workflows/gh-aw-estc-pr-buildkite-detective.lock.yml
  • .github/workflows/gh-aw-estc-pr-buildkite-detective.md
  • .github/workflows/gh-aw-flaky-test-investigator.lock.yml
  • .github/workflows/gh-aw-fragments/safe-output-push-to-pr.md
  • .github/workflows/gh-aw-framework-best-practices.lock.yml
  • .github/workflows/gh-aw-information-architecture.lock.yml
  • .github/workflows/gh-aw-internal-gemini-cli-web-search.lock.yml
  • .github/workflows/gh-aw-internal-gemini-cli.lock.yml
  • .github/workflows/gh-aw-issue-fixer.lock.yml
  • .github/workflows/gh-aw-issue-triage.lock.yml
  • .github/workflows/gh-aw-mention-in-issue-by-id.lock.yml
  • .github/workflows/gh-aw-mention-in-issue-no-sandbox.lock.yml
  • .github/workflows/gh-aw-mention-in-issue.lock.yml
  • .github/workflows/gh-aw-mention-in-pr-by-id.lock.yml
  • .github/workflows/gh-aw-mention-in-pr-no-sandbox.lock.yml
  • .github/workflows/gh-aw-mention-in-pr-no-sandbox.md
  • .github/workflows/gh-aw-mention-in-pr.lock.yml
  • .github/workflows/gh-aw-mention-in-pr.md
  • .github/workflows/gh-aw-newbie-contributor-fixer.lock.yml
  • .github/workflows/gh-aw-newbie-contributor-patrol.lock.yml
  • .github/workflows/gh-aw-performance-profiler.lock.yml
  • .github/workflows/gh-aw-plan.lock.yml
  • .github/workflows/gh-aw-pr-actions-detective.lock.yml
  • .github/workflows/gh-aw-pr-actions-detective.md
  • .github/workflows/gh-aw-pr-actions-fixer.lock.yml
  • .github/workflows/gh-aw-pr-actions-fixer.md
  • .github/workflows/gh-aw-pr-ci-detective.lock.yml
  • .github/workflows/gh-aw-pr-labeler.lock.yml
  • .github/workflows/gh-aw-pr-review-addresser.lock.yml
  • .github/workflows/gh-aw-pr-review.lock.yml
  • .github/workflows/gh-aw-product-manager-impersonator.lock.yml
  • .github/workflows/gh-aw-project-summary.lock.yml
  • .github/workflows/gh-aw-refactor-opportunist.lock.yml
  • .github/workflows/gh-aw-release-update.lock.yml
  • .github/workflows/gh-aw-scheduled-audit.lock.yml
  • .github/workflows/gh-aw-scheduled-fix.lock.yml
  • .github/workflows/gh-aw-small-problem-fixer.lock.yml
  • .github/workflows/gh-aw-stale-issues-investigator.lock.yml
  • .github/workflows/gh-aw-stale-issues-remediator.lock.yml
  • .github/workflows/gh-aw-stale-issues.lock.yml
  • .github/workflows/gh-aw-test-coverage-detector.lock.yml
  • .github/workflows/gh-aw-test-improvement.lock.yml
  • .github/workflows/gh-aw-test-improver.lock.yml
  • .github/workflows/gh-aw-text-auditor.lock.yml
  • .github/workflows/gh-aw-text-beautifier.lock.yml
  • .github/workflows/gh-aw-update-pr-body.lock.yml
  • .github/workflows/gh-aw-ux-design-patrol.lock.yml
  • .github/workflows/internal-downstream-health.lock.yml
  • .github/workflows/upgrade-check.lock.yml
  • .github/workflows/workflow-patrol.lock.yml
  • Makefile
  • docs/upgrading.md
  • docs/workflows/detector-fixer-chaining.md
✅ Files skipped from review due to trivial changes (1)
  • .github/workflows/gh-aw-stale-issues-investigator.lock.yml
🚧 Files skipped from review as they are similar to previous changes (4)
  • .github/workflows/gh-aw-pr-actions-detective.lock.yml
  • .github/workflows/gh-aw-dependency-review.lock.yml
  • .github/workflows/gh-aw-pr-review.lock.yml
  • .github/workflows/gh-aw-pr-ci-detective.lock.yml

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
.github/workflows/gh-aw-fragments/safe-output-push-to-pr.md (1)

15-27: ⚠️ Potential issue | 🔴 Critical

Test expectations do not match the new code behavior—merge commits will not be rejected as the test expects.

The test at tests/test_safe_input_ready_to_make_pr.py::TestPushGuards::test_merge_commit_detected (lines 539–556) was not updated. It creates a merge commit and asserts that the guard returns an error with "Merge commit" in the message (lines 555–556), expecting merge commits to be rejected.

However, the code at lines 15–27 uses a git merge-base --is-ancestor check that allows merge commits: the PR head remains an ancestor after a merge, so the check passes without error. This will cause the test to fail when run against the new code.

Either update the test to expect success for merge commits, or revert the code to reject them.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/gh-aw-fragments/safe-output-push-to-pr.md around lines 15
- 27, The guard currently uses git merge-base --is-ancestor (anc) which allows
merge commits, causing the test expecting merge commits to be rejected to fail;
update the guard (around pr_head_sha, pr_json_path, and the run(...) call that
sets anc) to also detect and reject merge commits by running a rev-list check
(e.g. run git rev-list --merges pr_head_sha..HEAD) and, if that returns any
commits, emit the same error/exit path as the existing ancestor check so merge
commits are rejected as the test expects.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In @.github/workflows/gh-aw-fragments/safe-output-push-to-pr.md:
- Around line 15-27: The guard currently uses git merge-base --is-ancestor (anc)
which allows merge commits, causing the test expecting merge commits to be
rejected to fail; update the guard (around pr_head_sha, pr_json_path, and the
run(...) call that sets anc) to also detect and reject merge commits by running
a rev-list check (e.g. run git rev-list --merges pr_head_sha..HEAD) and, if that
returns any commits, emit the same error/exit path as the existing ancestor
check so merge commits are rejected as the test expects.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 42ba1afe-ea04-48d2-a3d1-b9b6d1d8b1d2

📥 Commits

Reviewing files that changed from the base of the PR and between 540d7df and 84d29bd.

📒 Files selected for processing (1)
  • .github/workflows/gh-aw-fragments/safe-output-push-to-pr.md

Plumb target-pr-number through prompt context and add reply_to_pull_request_review_comment targeting, then regenerate lockfiles so compiled workflow verification passes for manual/dispatch runs.

Made-with: Cursor
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

medium_boom Medium PR blast radius; likely benefits from human review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant